YARA rules tagged APT
5 rules carry the tag “APT”.
Detects RokRAT malware used by ScarCruft APT group
APT / threat actorSignature Base (Florian Roth / Nextron)· S2WLAB_TALON_JACK2· 2021-07-09Detects Strings left in TMP Files created by K3CHANG Backdoor Ketrican
APT / threat actorSignature Base (Florian Roth / Nextron)· Markus Neis, Swisscom· 2020-06-18Detects Ruby ShellCode XOR routine used by ScarCruft APT group
APT / threat actorSignature Base (Florian Roth / Nextron)· S2WLAB_TALON_JACK2· 2021-05-20Detects Chopper WebShell Injection Variant (not only Hafnium related)
APT / threat actorSignature Base (Florian Roth / Nextron)· Markus Neis,Swisscom· 2021-03-05Detects WebShell Injection
APT / threat actorSignature Base (Florian Roth / Nextron)· Markus Neis,Swisscom· 2021-03-05