YARA rules tagged FILE

• SIGNATURE_BASE_Mal_Lockbit4_Hashing_Alg_Win_Feb24

  This rule detects the custom hashing algorithm of Lockbit4.0 unpacked

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2024-02-16
• SIGNATURE_BASE_Mal_Lockbit4_Packed_Feb24

  Detect the packer used by Lockbit4.0

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2024-02-16
• SIGNATURE_BASE_Mal_Lockbit4_Rc4_Win_Feb24

  Detect the implementation of RC4 Algorithm by Lockbit4.0

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2024-02-13
• SIGNATURE_BASE_MAL_WIN_Akira_Apr25

  This Yara rule from ISH Tecnologia's Heimdall Security Research Team detects key components of Akira Ransomware

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y-Icaro Cesar· 2025-04-11
• SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Blackstring

  Detects a variant of the GoLang Validalpha malware based on a file path found in the samples

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25
• SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2

  Detects unknown wiper malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
• SIGNATURE_BASE_M_APT_Downloader_BEATDROP

  Rule looking for BEATDROP malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2022-04-28
• SIGNATURE_BASE_MAL_Coralwave_Lenovospkvol_Remcosmicdrop

  CoralWave loader masquerading as Lenovo audio DLL. Drops Remcos RAT.

  MalwareSignature Base (Florian Roth / Nextron)· xstp· 2026-01-01
• SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23

  Detects malicious VEILEDSIGNAL backdoor

  APT / threat actorSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-20
• SIGNATURE_BASE_MAL_RANSOM_LNX_Macos_Lockbit_Apr23_1

  Detects LockBit ransomware samples for Linux and macOS

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-04-15
• SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1

  Detects unknown wiper malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
• SIGNATURE_BASE_MAL_WIPER_Caddywiper_Mar22_1

  Detects CaddyWiper malware

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-03-15
• SIGNATURE_BASE_MAL_WIPER_Isaacwiper_Mar22_1

  Detects IsaacWiper malware

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-03-03
• SIGNATURE_BASE_Apt_RU_Turla_Kazuar_Debugview_Pefeatures

  Turla mimicking SysInternals Tools- peFeatures

  APT / threat actorSignature Base (Florian Roth / Nextron)· JAG-S· 2020-05-28
• SIGNATURE_BASE_APT_Webshell_SUPERNOVA_2

  This rule is looking for specific strings related to SUPERNOVA. SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args).

  APT / threat actorSignature Base (Florian Roth / Nextron)· FireEye· 2020-12-14
• SIGNATURE_BASE_APT_Webshell_SUPERNOVA_1

  SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args). This rule is looking for specific strings and attributes related to SUPERNOVA.

  APT / threat actorSignature Base (Florian Roth / Nextron)· FireEye· 2020-12-14
• SIGNATURE_BASE_MAL_Chrysalis_Dllloader_Feb26

  Detects DLL used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2026-02-02
• SIGNATURE_BASE_MAL_Cobaltstrike_Beacon_Loader_Feb26

  Detects Cobalt Strike beacon loader

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2026-02-02
• SIGNATURE_BASE_MAL_Kernel_Regphantom_Mar26

  Detects RegPhantom, a kernel-mode rootkit that allow attacker to inject arbitrary code from unprivileged user-mode into kernel-mode and execute it.

  MalwareSignature Base (Florian Roth / Nextron)· Pezier Pierre-Henri (Nextron Systems)· 2026-03-19
• SIGNATURE_BASE_Mal_Babbleloader_Win_Jan24

  This rule detects intrinsic patterns of BabbleLoader.

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2025-01-27
• SIGNATURE_BASE_MAL_Katz_Stealer_May25

  Detects Katz stealer

  MalwareSignature Base (Florian Roth / Nextron)· MalGamy (Nextron Systems)· 2025-05-16
• SIGNATURE_BASE_MAL_Win_Amadey_Jun25

  This rule detects intrinsic patterns of Amadey version 5.34

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2025-06-18
• SIGNATURE_BASE_MAL_WIN_Megazord_Apr25

  This Yara rule from ISH Tecnologia's Heimdall Security Research Team, detects the main components of the Megazord Ransomware

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y-Icaro Cesar· 2025-04-11
• SIGNATURE_BASE_MAL_WIN_Ralordv1_Apr25

  This ISH Tecnologia Yara rule, detects the main components of the first version of RALord Ransomware

  MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y-Icaro Cesar· 2025-04-01
• SIGNATURE_BASE_MAL_APT_NK_Andariel_Atharvan_3RAT

  Detects a variant of the Atharvan 3RAT malware family

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25
• SIGNATURE_BASE_MAL_APT_NK_Andariel_Lilithrat_Variant

  Detects a variant of the Lilith RAT malware family

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov (modified by Florian Roth, Nextron Systems)· 2024-07-25
• SIGNATURE_BASE_MAL_APT_NK_Andariel_Nopineapple_Dtrack_Unpacked

  Detects the Dtrack variant used by Andariel

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25
• SIGNATURE_BASE_MAL_APT_NK_Trifaux_Easyrat_JUPITER

  Detects a variant of the EasyRAT malware family

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25
• SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1

  Detects ICONIC stealer payload used in the 3CX incident

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31
• SIGNATURE_BASE_MAL_Backdoor_DLL_Nov23_1

  Detects a backdoor DLL, that was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2023-11-23
• SIGNATURE_BASE_MAL_Compromised_Cert_Ducktail_Stealer_Jun23

  Detects binaries signed with compromised certificates used by DuckTail stealer - identified in June 2023

  MalwareSignature Base (Florian Roth / Nextron)· dr4k0nia· 2023-06-16
• SIGNATURE_BASE_MAL_DLL_Stealer_Nov23

  Detects a DLL that steals authentication credentials - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2023-11-23
• SIGNATURE_BASE_MAL_EXE_Prestigeransomware

  Detection for Prestige Ransomware

  MalwareSignature Base (Florian Roth / Nextron)· Silas Cutler, modfied by Florian Roth· 2023-01-04
• SIGNATURE_BASE_MAL_Python_Backdoor_Script_Nov23

  Detects a trojan (written in Python) that communicates with c2 - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2023-11-23
• SIGNATURE_BASE_MAL_Trojan_DLL_Nov23

  Detects a trojan DLL that installs other components - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966

  MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2023-11-23
• SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1

  Detects Turla Mosquito malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-10-25
• SIGNATURE_BASE_APT_MAL_CISA_10365227_01_APPSTORAGE_Dec21

  Detects AppStorage ntstatus msexch samples

  APT / threat actorSignature Base (Florian Roth / Nextron)· CISA Code & Media Analysis· 2021-12-23
• SIGNATURE_BASE_Octowave_Loader_03_2025

  Detects opcodes found in Octowave loader DLLs and WAV steganography files

  MalwareSignature Base (Florian Roth / Nextron)· Jai Minton (@CyberRaiju) - HuntressLabs· 2025-03-19
• SIGNATURE_BASE_Octowave_Loader_Supporting_File_03_2025

  Detects supporting file used by Octowave loader containing hardcoded values

  MalwareSignature Base (Florian Roth / Nextron)· Jai Minton (@CyberRaiju) - HuntressLabs· 2025-03-19
• CRAIU_Crime_Lockbit3_Ransomware

  Generic LockBit detection, also catches the version used in attacks in Indonesia.

  MalwareCostin Raiu yararules· Costin G. Raiu, TLPBLACK, craiu@noh.ro· 2024-07-03
• CRAIU_Crime_Noabot

  Noabot is a clone of Mirai

  MalwareCostin Raiu yararules· Costin G. Raiu, Art of Noh, craiu@noh.ro· 2024-01-11
• SIGNATURE_BASE_APT_MAL_APT27_Rshell_Jul24

  YARA rule to detect RSHELL of APT27

  APT / threat actorSignature Base (Florian Roth / Nextron)· Bundesamt fuer Verfassungsschutz, modified by Florian Roth· 2024-07-11
• SIGNATURE_BASE_MAL_APT_NK_Andariel_Dtrack_Unpacked

  Detects DTrack variant used by Andariel

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov (modified by Florian Roth, Nextron Systems)· 2024-07-25
• SIGNATURE_BASE_MAL_APT_NK_Andariel_Tigerrat_Crowdsourced_Rule

  Detects the Tiger RAT variant used by Andariel

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov (modified by Florian Roth, Nextron Systems)· 2024-07-25
• SIGNATURE_BASE_MAL_APT_NK_WIN_Dtrack_Auto

  Detects DTrack variant used by Andariel

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25
• SIGNATURE_BASE_MAL_APT_NK_WIN_Tiger_RAT_Auto

  Detects the Tiger RAT variant used by Andariel

  MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25
• SIGNATURE_BASE_MAL_Earthworm_Socks_Proxy_ID_Generation

  Detects EarthWorm - a reverse socks proxy used by the threat group that deployed Pygmy Goat malware on Sophos XG firewall devices. The detection is based on the pool num generation x86 assembly.

  MalwareSignature Base (Florian Roth / Nextron)· NCSC· 2024-10-22
• SIGNATURE_BASE_MAL_RANSOM_Lockbit_Indicators_Feb24

  Detects Lockbit ransomware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-02-23
• SIGNATURE_BASE_SUSP_Command_Line_Combos_Feb24_2

  Detects suspicious command line combinations often found in post exploitation activities

  Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-02-23
• SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_1

  Detects VEILEDSIGNAL malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
• SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2

  Detects VEILEDSIGNAL malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
• SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3

  Detects VEILEDSIGNAL malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
• SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4

  Detects VEILEDSIGNAL malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
• SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_5

  Detects VEILEDSIGNAL malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
• SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_6

  Detects VEILEDSIGNAL malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20
• SIGNATURE_BASE_MAL_CRIME_RAT_WIN_PE_Godrat_Aug25

  Detects GodRAT malware targeting Windows systems

  MalwareSignature Base (Florian Roth / Nextron)· Arda Buyukkaya· 2025-08-23
• SIGNATURE_BASE_MAL_Gopuram_Apr23

  Detects Lazarus Gopuram malware

  MalwareSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2023-04-04
• SIGNATURE_BASE_MAL_Qakbotloader_Export_Section_Feb23

  QakBot Export Selection

  MalwareSignature Base (Florian Roth / Nextron)· kevoreilly· 2023-02-17
• SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_1

  Detects indicators found in DarkBit ransomware

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-02-13
• SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_2

  Detects Go based DarkBit ransomware (garbled code; could trigger on other obfuscated samples, too)

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-02-13
• SIGNATURE_BASE_MAL_WIPER_Bibi_Oct23

  Detects BiBi wiper samples for Windows and Linux

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-11-01
• BLACKBERRY_Headertip

  Detects HeaderTip

  MalwareBlackBerry Research & Intelligence (via Open-Source-YARA-rules)· BlackBerry Threat Research Team· 2022-04-06
• BLACKBERRY_Windealer_Executable

  Detects WinDealer Executable

  MalwareBlackBerry Research & Intelligence (via Open-Source-YARA-rules)· BlackBerry Threat Research Team· 2022-06-14
• BLACKBERRY_Windealer_Library

  Detects WinDealer Loaded DLL

  MalwareBlackBerry Research & Intelligence (via Open-Source-YARA-rules)· BlackBerry Threat Research Team· 2022-06-14
• DITEKSHEN_MALWARE_Win_Lummastealer

  Detects Lumma Stealer

  MalwareditekSHen detection· ditekSHen· 2034-02-17
• SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Stage3_Jan22

  Detects reversed stage3 related to Ukrainian wiper malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
• SIGNATURE_BASE_APT_RU_APT27_Hyperbro_Vftrace_Loader_Jan22_1

  Yara rule to detect first Hyperbro Loader Stage, often called vftrace.dll. Detects decoding function.

  APT / threat actorSignature Base (Florian Roth / Nextron)· Bundesamt fuer Verfassungsschutz (modified by Florian Roth)· 2022-01-14
• SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1

  Detects Hermetic Wiper malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-24
• SIGNATURE_BASE_EXT_HKTL_Nighthawk_RAT

  Detects Nighthawk RAT

  Hack toolSignature Base (Florian Roth / Nextron)· Frank Boldewin (@r3c0nst)· 2022-11-22
• SIGNATURE_BASE_HKTL_Bruteratel_Badger_Indicators_Oct22_4

  Detects Brute Ratel C4 badger indicators

  Hack toolSignature Base (Florian Roth / Nextron)· Matthew @embee_research, Florian Roth· 2022-10-12
• SIGNATURE_BASE_HKTL_MAL_Nighthawk_Nov_2022_1

  Detect the Nighthawk dropped beacon

  Hack toolSignature Base (Florian Roth / Nextron)· Arkbird_SOLG· 2022-11-22
• SIGNATURE_BASE_Hvs_APT27_Hyperbro_Decrypted_Stage2

  HyperBro Stage 2 and compressed Stage 3 detection

  MalwareSignature Base (Florian Roth / Nextron)· Moritz Oettle· 2022-02-07
• SIGNATURE_BASE_MAL_OBFUSC_Unknown_Jan22_1

  Detects samples similar to reversed stage3 found in Ukrainian wiper incident named WhisperGate

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
• SIGNATURE_BASE_Mimikatz

  mimikatz

  Hack toolSignature Base (Florian Roth / Nextron)· Benjamin DELPY (gentilkiwi)· 2022-11-16
• SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_1

  Detects malware used in the Kaseya supply chain attack

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-07-02
• SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_2

  Detects malware used in the Kaseya supply chain attack

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-07-02
• SIGNATURE_BASE_APT_MAL_Tinyturla_Sep21_1

  Detects Tiny Turla backdoor DLL

  APT / threat actorSignature Base (Florian Roth / Nextron)· Cisco Talos· 2021-09-21
• SIGNATURE_BASE_APT_NK_Scarcruft_Evolved_ROKRAT

  Detects RokRAT malware used by ScarCruft APT group

  APT / threat actorSignature Base (Florian Roth / Nextron)· S2WLAB_TALON_JACK2· 2021-07-09
• SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_1

  Detects HelloKitty Ransomware samples from UNC2447 campaign

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-01
• SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_2

  Detects HelloKitty Ransomware samples from UNC2447 campaign

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-01
• SIGNATURE_BASE_APT_UNC2447_MAL_SOMBRAT_May21_1

  Detects SombRAT samples from UNC2447 campaign

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-01
• SIGNATURE_BASE_APT28_Skinnyboy_Dropper_1

  Detects APT28 SkinnyBoy droppers

  MalwareSignature Base (Florian Roth / Nextron)· Cluster25· 2021-05-24
• SIGNATURE_BASE_HKTL_NET_NAME_RAT_Njrat_0_7D_Modded_Source_Code

  Detects .NET red/black-team tools via name

  Hack toolSignature Base (Florian Roth / Nextron)· Arnim Rupp· 2021-01-22
• SIGNATURE_BASE_HKTL_NET_NAME_Revengerat_Stub_Cssharp

  Detects .NET red/black-team tools via name

  Hack toolSignature Base (Florian Roth / Nextron)· Arnim Rupp· 2021-01-22
• SIGNATURE_BASE_MAL_Emotet_BKA_Cleanup_Apr21

  No description has been set in the source file - Signature Base

  MalwareSignature Base (Florian Roth / Nextron)· press inquiries <info@bka.de>, technical contact <info@mh…· 2021-03-23
• SIGNATURE_BASE_MAL_Icedid_GZIP_LDR_202104

  2021 initial Bokbot / Icedid loader for fake GZIP payloads

  MalwareSignature Base (Florian Roth / Nextron)· Thomas Barabosch, Telekom Security· 2021-04-12
• SIGNATURE_BASE_MAL_RANSOM_Darkside_May21_1

  Detects Darkside Ransomware

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-10
• SIGNATURE_BASE_MAL_RANSOM_Lorenz_May21_1

  Detects Lorenz Ransomware samples

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-04
• SIGNATURE_BASE_MAL_Ransomware_Win_DARKSIDE_V1_1

  Detection for early versions of DARKSIDE ransomware samples based on the encryption mode configuration values.

  MalwareSignature Base (Florian Roth / Nextron)· FireEye· 2021-03-22
• SIGNATURE_BASE_MAL_Wshrat_Dotnet_Packer_Feb21

  Yara Rule for WSH rat .NET packer of February 2021

  MalwareSignature Base (Florian Roth / Nextron)· Yoroi Malware ZLab· 2021-03-09
• CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Implant

  Kwampirs implant xor and rsa keys

  APT / threat actorCostin Raiu yararules· FBI / cywatch@fbi.gov· 2020-01-14
• CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Installer

  Kwampirs installer xor keys and Unicode string length routine

  APT / threat actorCostin Raiu yararules· FBI / cywatch@fbi.gov· 2020-01-14
• CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Shamoon_Code

  Kwampirs and Shamoon common code

  APT / threat actorCostin Raiu yararules· FBI / cywatch@fbi.gov· 2020-01-14
• SIGNATURE_BASE_APT_KE3CHANG_TMPFILE

  Detects Strings left in TMP Files created by K3CHANG Backdoor Ketrican

  APT / threat actorSignature Base (Florian Roth / Nextron)· Markus Neis, Swisscom· 2020-06-18
• SIGNATURE_BASE_APT_MAL_BKA_Goldenspy_Aug20_1

  Detects variants of GoldenSpy Malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· BKA· 2020-08-21
• SIGNATURE_BASE_APT_MAL_Ke3Chang_Ketrican_Jun20_1

  Detects Ketrican malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-06-18
• SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1

  Detects Lazarus VHD Ransomware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-10-05
• SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2

  Detects Lazarus VHD Ransomware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-10-05
• SIGNATURE_BASE_APT_MAL_RU_Turla_Kazuar_May20_1

  Detects Turla Kazuar malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-05-28
• SIGNATURE_BASE_APT_MAL_Sidewinder_Implant

  Detects SideWinder final payload

  APT / threat actorSignature Base (Florian Roth / Nextron)· AT&T Alien Labs· 2020-08-25
• SIGNATURE_BASE_APT_MAL_SLOTHFULMEDIA_Oct20_1

  Detects SLOTHFULMEDIA malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-10-01
• SIGNATURE_BASE_ATM_Malware_Loup_1

  Detects ATM Malware Loup

  MalwareSignature Base (Florian Roth / Nextron)· Frank Boldewin (@r3c0nst)· 2020-08-17
• SIGNATURE_BASE_Crime_H2Miner_Kinsing

  Rule to find Kinsing malware

  MalwareSignature Base (Florian Roth / Nextron)· Tony Lambert, Red Canary· 2020-06-09
• SIGNATURE_BASE_Crime_Win32_Parallax_Loader_1

  Detects Parallax Loader

  MalwareSignature Base (Florian Roth / Nextron)· @VK_Intel· 2020-02-24
• SIGNATURE_BASE_Crime_Win32_Parallax_Payload_1

  Detects Parallax Injected Payload v1.01

  MalwareSignature Base (Florian Roth / Nextron)· @VK_Intel· 2020-02-24
• SIGNATURE_BASE_Crime_Win32_Ransom_Maze_Dll_1

  Detects Maze ransomware payload dll unpacked

  MalwareSignature Base (Florian Roth / Nextron)· @VK_Intel· 2020-04-18
• SIGNATURE_BASE_HKTL_NET_GUID_Backnet

  Detects c# red/black-team tools via typelibguid

  Hack toolSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-13
• SIGNATURE_BASE_HKTL_NET_GUID_Blacknet

  Detects VB.NET red/black-team tools via typelibguid

  Hack toolSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-30
• SIGNATURE_BASE_HKTL_NET_GUID_C_Sharp_R_A_T_Client

  Detects c# red/black-team tools via typelibguid

  Hack toolSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-28
• SIGNATURE_BASE_HKTL_NET_GUID_Clr_Meterpreter

  Detects c# red/black-team tools via typelibguid

  Hack toolSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-13
• SIGNATURE_BASE_HKTL_NET_GUID_Darkeye

  Detects c# red/black-team tools via typelibguid

  Hack toolSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-13
• SIGNATURE_BASE_HKTL_NET_GUID_Njrat

  Detects VB.NET red/black-team tools via typelibguid

  Hack toolSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-30
• SIGNATURE_BASE_HKTL_NET_GUID_Scout

  Detects c# red/black-team tools via typelibguid

  Hack toolSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-28
• SIGNATURE_BASE_HKTL_NET_GUID_Stormkitty

  Detects c# red/black-team tools via typelibguid

  Hack toolSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-13
• SIGNATURE_BASE_HKTL_NET_GUID_Toxiceye

  Detects c# red/black-team tools via typelibguid

  Hack toolSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-13
• SIGNATURE_BASE_HKTL_NET_GUID_Vanillarat

  Detects c# red/black-team tools via typelibguid

  Hack toolSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-28
• SIGNATURE_BASE_MAL_Crime_Win32_Rat_Parallax_Shell_Bin

  Detects Parallax injected code

  MalwareSignature Base (Florian Roth / Nextron)· @VK_Intel· 2020-05-05
• SIGNATURE_BASE_MAL_Emotet_Jan20_1

  Detects Emotet malware

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-01-29
• SIGNATURE_BASE_MAL_Prolock_Malware

  Detects Prolock malware in encrypted and decrypted mode

  MalwareSignature Base (Florian Roth / Nextron)· Frank Boldewin (@r3c0nst)· 2020-05-17
• SIGNATURE_BASE_MAL_RANSOM_Revil_Oct20_1

  Detects REvil ransomware

  MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-10-13
• SEKOIA_Apt_Gobrat_2

  Detects GobRat related files

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-10
• SEKOIA_Apt_Icepeony_Icecache

  Detects IceCache backdoor

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
• SEKOIA_Apt_Icepeony_Iceevent

  Detects IceEvent Backdoor

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
• SEKOIA_Apt_Kimsuky_Fpspy

  Detects FPSpy, a backdoor used by Kimsuky

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
• SEKOIA_Apt_Kimsuky_Klogexe

  Detects KLogExe, a keylogger used by Kimsuky

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
• SEKOIA_Apt_Kimsuky_Powershell

  Powershell scripts used by Kimsuky. If size < 3KB ok. If between 3 and 15, a check is needed

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
• SEKOIA_Apt_Kimsuky_Powershell_Dropper_Strings

  Detects a PowerShell dropper used by Kimsuky

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11
• SEKOIA_Apt_Kimsuky_Toddlershark_Obfuscated

  Detects obfuscated version of Kimsuky TODDLERSHARK vbs malware

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06
• SEKOIA_Apt_Kimsuky_Toddlershark_Strings

  Detects Kimsuky TODDLERSHARK vbs malware

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06
• SEKOIA_Apt_Kimsuky_Validator_Strings

  Detects Kimsuky validator

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11
• SEKOIA_Apt_Kimsuky_Vbs

  VBS files used by Kimsuky

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
• SEKOIA_Apt_Lazarus_Pondrat

  Detects PondRAT via mangled command names

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
• SEKOIA_Apt_Queueseed

  Detects strings of Queueseed/Kapeka malware

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-04-22
• SEKOIA_Backoor_Win_Tinyturla_Ng

  Detect the TinyTurla-NG backdoor used by Turla

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-04
• SEKOIA_Downloader_Win_Cobianrat

  Detect CobianRAT downloader

  MalwareSEKOIA.IO Community· Sekoia.io· 2024-08-23
• SEKOIA_Infostealer_Win_Acrstealer_Str

  Finds ACR Stealer standalone samples based on specific strings.

  MalwareSEKOIA.IO Community· Sekoia.io· 2024-04-22
• SEKOIA_Infostealer_Win_Daolpu_Str

  Finds Daolpu Stealer samples based on specific strings.

  MalwareSEKOIA.IO Community· Sekoia.io· 2024-07-23
• SEKOIA_Infostealer_Win_Stealc_Str_Oct24

  Finds Stealc standalone samples (or dumps) based on the strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2024-10-20
• SEKOIA_Koi_Koiloader

  Detects Koi Loader

  MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20
• SEKOIA_Koi_Netstealer

  Detects NET ofbuscated Stealer used loaded by KoiLoader

  MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20
• SEKOIA_Koiloader_Lnk

  LNK file leading to deploy KoiLoader

  MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20
• SEKOIA_Koiloader_Powershell_Reflective_Loading

  Powershell script loading service.exe (related to Koi Loader)

  MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20
• SEKOIA_Latrodectus_Exports

  detection based on the exports

  MalwareSEKOIA.IO Community· Sekoia.io· 2024-07-03
• SEKOIA_Rat_Win_Xeno_Rat

  Xeno RAT is an open-source RAT, used by Kimsuky in January 2024

  MalwareSEKOIA.IO Community· Sekoia.io· 2024-02-09
• SEKOIA_Stealer_Win_Mgbot_Credential_Stealer

  Detect MgBot credential stealer plugin

  MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20
• SEKOIA_Strongpity_Malware

  Detects obfuscation used by StrongPity

  MalwareSEKOIA.IO Community· Sekoia.io· 2024-02-26
• SEKOIA_Tool_Scanline_Strings

  Detects scanline (non-packed)

  Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-06
• SEKOIA_Tool_Win_Lightrail

  Detect the LIGHTRAIL tunneler used by UNC1549

  Hack toolSEKOIA.IO Community· Sekoia.io· 2024-02-29
• SIGNATURE_BASE_APT_Winnti_MAL_Dec19_1

  Detects Winnti malware

  APT / threat actorSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06
• VOLEXITY_Apt_Malware_Win_Deepdata_Module

  Detects modules used by DEEPDATA based on the required export names used by those modules.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2024-07-30
• SEKOIA_Apt_37_Chinotto

  Detects obfuscation and string of APT37 stealer

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-02-27
• SEKOIA_Apt_Agent_Racoon_Strings

  Detects Agent Racoon used by CL-STA-0002

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-12-05
• SEKOIA_Apt_Aridviper_Rustsysjoker

  Detects Rust Sysjoker variant via PDB path or key and Rust string

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-11-27
• SEKOIA_Apt_Badmagic_Commonmagic_Generic_1

  Detects CommonMagic related implants

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-15
• SEKOIA_Apt_Badmagic_Commonmagic_Generic_2

  Detects CommonMagic related implants

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-15
• SEKOIA_Apt_Badmagic_Commonmagic_Main

  Detects CommonMagic related implants

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-15
• SEKOIA_Apt_Badmagic_Commonmagic_Screenshot_Module

  Detects CommonMagic related implants

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-15
• SEKOIA_Apt_Badmagic_Commonmagic_Usbstealer

  Detects CommonMagic related implants

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-15
• SEKOIA_Apt_Badmagic_Ld_Dll_Loader_Pshscript

  Detects BadMagic DLL Loader powershell script

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-15
• SEKOIA_Apt_Boldmove_Strings

  Detects BOLDMOVE via strings

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-01-16
• SEKOIA_Apt_Darkpink_Sample

  Detects two parts of cmd.exe /c

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-06-05
• SEKOIA_Apt_Gamaredon_Ddrdoh_Vbs_Downloader

  Detects the core of the VBS Gamaredon's Telegram Downloader

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-01-25
• SEKOIA_Apt_Kimsuky_Malicious_Gotopwsh_Lnk

  Detects malicious LNK used by Kimsuky

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-09-11
• SEKOIA_Apt_Konni_Check_Bat

  Script used to performs check before executing Konni

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-11-27
• SEKOIA_Apt_Konni_Dropper

  Detects Konni dropper used when distributed via malicious document

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-11-27
• SEKOIA_Apt_Lazarus_Lambload_Timecheck

  Detects timeCheck routine in LambLoad

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-11-27
• SEKOIA_Apt_Oilrig_Clipog_Strings

  Detects OilRig's Clipog stealer

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-10-24
• SEKOIA_Apt_Shadowpad_First_Called_Function

  Detects entrypoint of shadowpad

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-01-30
• SEKOIA_Apt_Sidecopy_Actionrat_Packer_Strings

  Detects SideCopy's ActionRAT (packer?)

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-11
• SEKOIA_Apt_Sidecopy_Reverserat_Strings

  Detects SideCopy's ReverseRAT

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-11
• SEKOIA_Apt_Turla_Comlook

  Detects Class and Method names used inside ComLook

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-10-30
• SEKOIA_Apt_Turla_Kazuar_Variant_2023

  New variant of Kazuar observed in 2023

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-11-03
• SEKOIA_Backdoor_Win_Feedload

  No description has been set in the source file - SEKOIA

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-10-24
• SEKOIA_Backdoor_Win_Foresttiger

  Detect Lazarus' malware ForestTiger

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-10-24
• SEKOIA_Backdoor_Win_Rokrat

  Detect the RokRAT malware

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-07-11
• SEKOIA_Backdoor_Win_Rollsling

  Detect Lazarus' RollSling malware (aka LazarLoader)

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-10-24
• SEKOIA_Bot_Lin_Kinsing_Strings

  Catch Kinsing malware based on strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-11-24
• SEKOIA_Bot_Lin_Xorddos_Strings

  Catch XORDDoS strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-11-02
• SEKOIA_Crypter_Win_Dotrunpex

  Detect the dotRunpeX crypter based on strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-06-08
• SEKOIA_Dropper_Win_Konni_Cab

  Detect the CAB files used to drop the KONNI malware

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-09-26
• SEKOIA_Hacktool_Ntospy_Strings

  Detects Ntospy based on strings

  Hack toolSEKOIA.IO Community· Sekoia.io· 2023-12-05
• SEKOIA_Hacktool_Stowaway_Strings

  Detects Stowaway based on strings

  Hack toolSEKOIA.IO Community· Sekoia.io· 2023-11-15
• SEKOIA_Infostealer_Win_Enigma_Loader_Module

  Find loader module of Enigma Stealer based on specific strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-01-30
• SEKOIA_Infostealer_Win_Lumma_Strings_Aug23

  Finds Lumma samples based on the specific strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-09-14
• SEKOIA_Infostealer_Win_Phoenix

  Finds Phoenix Stealer samples based on specific strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-06-20
• SEKOIA_Infostealer_Win_Stormkitty

  Finds StormKitty samples (or their variants) based on specific strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-03-29
• SEKOIA_Infostealer_Win_Vidar_Strings_Nov23

  Finds Vidar samples based on the specific strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-11-10
• SEKOIA_Loader_Amadey_Clipper_Plugin

  Finds Amadey's clipper plugin based on characteristic strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-05-16
• SEKOIA_Loader_Amadey_Standalone_May23

  Finds standalone samples of Amadey based on characteristic strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-05-17
• SEKOIA_Loader_Amadey_Stealer_Plugin

  Finds Amadey's stealer plugin based on characteristic strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-05-16
• SEKOIA_Loader_Latrodectus_Dll

  Finds Latrodectus samples based on the specific strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-12-08
• SEKOIA_Loader_Win_Jinxloader_Strings

  Finds JinxLoader samples based on the specific strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-12-04
• SEKOIA_Loader_Win_Konni_Bat

  Detect the BAT files (named trap.bat or yup.bat) used by KONNI

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-09-26
• SEKOIA_Rat_Lin_Gobrat_2023

  This rule detect samples that are downloaded on the GobRAT C2 URL path /a, /b and /c.

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-06-09
• SEKOIA_Rat_Win_Konni_Rat

  Detect the KONNI RAT DLL files (x32 and x64)

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-09-26
• SEKOIA_Rat_Win_Ratel_Strings

  Detect RATel based on characteristic strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-04-24
• SEKOIA_Rat_Win_Remcos

  DEPRECATED : Find Remcos RAT samples based on specific strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-01-29
• SEKOIA_Spyware_And_Strongpity_Mobile_Backdoor

  Detect the mobile backdoor using the name used in the certificate

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-01-16
• SEKOIA_Tool_Petitpotato

  No description has been set in the source file - SEKOIA

  Hack toolSEKOIA.IO Community· Sekoia.io· 2023-08-23
• SEKOIA_Win_Malware_Agnianestealer

  Detect the Agniane stealer using strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-08-10
• SEKOIA_Win_Malware_Statc_Downloader

  Statc Downloader powershell script. Base64 powershell

  MalwareSEKOIA.IO Community· Sekoia.io· 2023-08-09
• SIGNATURE_BASE_APT_Sidewinder_NET_Loader_Aug_2020_1_1

  Detected the NET loader used by SideWinder group (August 2020)

  APT / threat actorSignature Base (Florian Roth / Nextron)· Arkbird_SOLG· 2020-08-24
• SIGNATURE_BASE_HKTL_NET_GUID_Lime_RAT

  Detects VB.NET red/black-team tools via typelibguid

  Hack toolSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-30
• SIGNATURE_BASE_MAL_Ransom_Ragnarlocker_July_2020_1

  Detects Ragnarlocker by strings (July 2020)

  MalwareSignature Base (Florian Roth / Nextron)· Arkbird_SOLG· 2020-07-30
• VOLEXITY_Apt_Malware_Py_Dustpan_Pyloader

  Detects Python script used by KPlayer to update, modified by attackers to download a malicious payload.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-07-21
• VOLEXITY_Apt_Malware_Win_Dustpan_Apihashes

  Detects DUSTPAN malware using API hashes used to resolve functions at runtime.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2023-08-17
• ESET_Cw_Windows_Redline_Panel_Distinctive_Strings

  Matches rare strings found in Redline panel

  MalwareESET malware-ioc· ESET Research· 2022-10-11
• ESET_Cw_Windows_Redline_Panel_Prompts

  Matches prompt messages in Redline panel

  MalwareESET malware-ioc· ESET Research· 2022-10-11
• ESET_Cw_Windows_Redline_Panel_Status_Message_Strings

  Matches error/success messages in Redline panel

  MalwareESET malware-ioc· ESET Research· 2022-10-11
• ESET_Cw_Windows_Redline_Panel_Tab_Headers

  Matches view headers in Redline Panel

  MalwareESET malware-ioc· ESET Research· 2022-10-11
• SEKOIA_Apt_Apt10_Hui_Loader

  Specific string for HUI Loader

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-04
• SEKOIA_Apt_Kimsuky_Malicious_Vba

  Detects malicious VBA used by Kimsuky

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-08-30
• SEKOIA_Apt_Kimsuky_Sharpext_Devtoolmodule_Strings

  Detects the DevTool module used by SharpExt

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29
• SEKOIA_Apt_Kimsuky_Sharpext_Jsexfil_Strings

  Detects the exfiltration JS code of SharpExt

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29
• SEKOIA_Apt_Kimsuky_Sharptongue_Strings

  Detects SharpTongue variants.

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29
• SEKOIA_Apt_Kimsuky_Sharptongue_Vbslauncher_Strings

  Detects VBS Launchers used by SharpTongue

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29
• SEKOIA_Apt_Kimsuky_Vbs_Powershell_Downloader

  Detects VBS/Powershell Downloader used by Kimsuky

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-08-30
• SEKOIA_Apt_Konni

  Rule based on structure offsets and file extension

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-09-12
• SEKOIA_Apt_Lazarus_Vhd_Ransomware_Downloader

  Detects VHD ransomware downloader

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-11-28
• SEKOIA_Apt_Lazarus_Vhd_Ransomware_Loader

  Detects VHD ransomware x64 loader

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-11-28
• SEKOIA_Apt_Muddywater_Moriagent

  Detects Muddy's Mori Agent implant

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-01-14
• SEKOIA_Apt_Sandworm_Caddywiper_Stacked_Strings

  Detects stacked strings used in the wiper.

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-04-06
• SEKOIA_Apt_Sandworm_Olympicdestroyer

  Detects OlympicDestroyer malware

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-04-15
• SEKOIA_Apt_Sofacy_Graphitemalware_Generic

  Detects APT28 graphite malware based on strings

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-09-27
• SEKOIA_Apt_Ta428_Tmanger_Strings

  Detects Tmanger malware

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-09-06
• SEKOIA_Apt_Unknown_Sessionmanageriis_Strings

  Detects the IIS SessionManager backdoor

  APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-04
• SEKOIA_Backdoor_Win_Headertip

  Detect HeaderTip backdoor used by the Chinese threat actor Scarab. This backdoor has its hardcoded C2 in strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-25
• SEKOIA_Bumblebee_Loader

  Detect the BUMBLEBEE loader

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-05-23
• SEKOIA_Crime_Sload_Vbs_Downloader_Strings_1

  Detects an sLoad downloader based on strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-08-02
• SEKOIA_Crimeware_Njrat_Strings

  Detects njRAT based on some strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-08-22
• SEKOIA_Hacktool_Earthworm_Strings

  Detects Mac/Win/Linux EarthWorm based on strings

  Hack toolSEKOIA.IO Community· Sekoia.io· 2022-02-08
• SEKOIA_Hacktool_Mimikatz_Obfuscated

  Detects Mimikatz on strings obfuscation

  Hack toolSEKOIA.IO Community· Sekoia.io· 2022-07-22
• SEKOIA_Implant_Win_Flagpro

  Detect the Flagpro malware used by Blacktech

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-22
• SEKOIA_Implant_Win_Havoc_Default_Strings

  Finds Havoc implants based on the embedded default strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-10-07
• SEKOIA_Infostealer_Win_Aurora_Str

  Finds Aurora botnet samples based on characteristic strings.

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-07-21
• SEKOIA_Infostealer_Win_Mars_Stealer_Variant_Llcppc1

  Detect Mars Stealer variand llcppc1

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-10
• SEKOIA_Infostealer_Win_Mars_Stealer_Xor_Routine

  Detect Mars Stealer based on a specific XOR routine

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-06
• SEKOIA_Infostealer_Win_Nosu

  Finds Nosu samples based on characteristic strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-12-15
• SEKOIA_Infostealer_Win_Raccoon_Str_Takemypainback

  Detect Raccoon based on specific strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-10-03
• SEKOIA_Infostealer_Win_Solarmarker_Dll

  Finds SolarMarker DLL based on characteristic strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-12-09
• SEKOIA_Infostealer_Win_Solarmarker_Powershell

  Finds SolarMarker PowerShell script based on characteristic strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-12-09
• SEKOIA_Infostealer_Win_Stormkitty_Exfil_Urls

  Detect the open-source StormKitty spyware by looking for the github path

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-20
• SEKOIA_Infostealer_Win_Vidar_Str_Jul22

  Detect the Vidar infostealer based on specific strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-07-26
• SEKOIA_Infostealer_Win_Vulturi

  Detect the Vulturi infostealer based on specific strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-14
• SEKOIA_Kimsuky_Konni_Dll

  Rule based on structure offset and file extension

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-09-12
• SEKOIA_Loader_Win_Bumblebee

  Detect BUMBLEBEE based on specific strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-08
• SEKOIA_Loader_Win_Gcleaner

  Detect the GCleaner loader using specific strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-10-11
• SEKOIA_Loader_Win_Svcready_Imports

  Finds samples of the SVCReady loader

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-06-08
• SEKOIA_Malware_Remcom_Strings

  Detects RemCom based on strings

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-08-30
• SEKOIA_Ransomware_Lin_Avoslocker_Strings

  Detect AvosLocker ransomware for Linux by using strings from its ransom note and the onion domains

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-02-21
• SEKOIA_Ransomware_Win_Blackcat

  Detect the BlackCat ransomware (Windows version)

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-01-19
• SEKOIA_Ransomware_Win_Lorenz

  Detect the Lorenz ransomware

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-02-10
• SEKOIA_Rootkit_Win_Purplefox_360_Tct

  Detects Purple Fox payloads used during end-2021 and 2022 campaigns based on characteristics shared by TrendMicro details.

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-28
• SEKOIA_Rootkit_Win_Purplefox_Svchost_Txt

  Detects Purple Fox payloads used during end-2021 and 2022 campaigns based on characteristics shared by TrendMicro details.

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-28
• SEKOIA_Tinyfluff_Nodejs

  Detect TinyFluff backdoor by OldGremlin

  MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-20
• SEKOIA_Tool_Htran_Strings

  Detects HTran based on strings

  Hack toolSEKOIA.IO Community· Sekoia.io· 2022-09-09
• SEKOIA_Tool_Juicypotato_Exploit_Strings

  Detects the JuicyPotato exploit based on strings

  Hack toolSEKOIA.IO Community· Sekoia.io· 2022-09-09
• SEKOIA_Tool_Powershell_Unicorn

  Detects Unicorn Powershell

  Hack toolSEKOIA.IO Community· Sekoia.io· 2022-08-23
• VOLEXITY_Apt_Delivery_Macro_Lazypine_Jeus_B

  Detects macros used by the LazyPine threat actor to distribute AppleJeus.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2022-11-03
• VOLEXITY_Apt_Delivery_Office_Macro_Lazypine_Jeus

  Detects malicious documents used by LazyPine in a campaign dropping the AppleJeus malware.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2022-11-02
• VOLEXITY_Apt_Malware_Win_Applejeus_B_Oct22

  Detects unpacked AppleJeus samples.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2022-11-03
• VOLEXITY_Apt_Malware_Win_Applejeus_D_Oct22

  Detected AppleJeus unpacked samples.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2022-11-10
• VOLEXITY_Apt_Malware_Win_Applejeus_Oct22

  Detects AppleJeus DLL samples.

  APT / threat actorVolexity threat-intel· threatintel@volexity.com· 2022-11-03
• ESET_Apt_Windows_Invisimole

  InvisiMole magic values, keys and strings

  APT / threat actorESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_Invisimole_CPL_Loader

  CPL loader

  APT / threat actorESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_Invisimole_DNS_Downloader

  InvisiMole DNS downloader

  APT / threat actorESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_Invisimole_Logs

  Detects log files with collected created by InvisiMole's RC2CL backdoor

  APT / threat actorESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_Invisimole_SFX_Dropper

  Detects trojanized InvisiMole files: patched RAR SFX droppers with added InvisiMole blobs (config encrypted XOR 2A at the end of a file)

  APT / threat actorESET malware-ioc· ESET Research· 2021-05-17
• ESET_Apt_Windows_TA410_Lookback_Decryption

  Matches encryption/decryption function used by LookBack.

  APT / threat actorESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Lookback_HTTP

  Matches LookBack's hardcoded HTTP request

  APT / threat actorESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Lookback_Loader

  Matches the modified function in LookBack libcurl loader.

  APT / threat actorESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Lookback_Magic

  Matches message header creation in LookBack.

  APT / threat actorESET malware-ioc· ESET Research· 2021-10-12
• ESET_Apt_Windows_TA410_Lookback_Strings

  Matches multiple strings and export names in TA410 LookBack.

  APT / threat actorESET malware-ioc· ESET Research· 2021-10-12
• MALPEDIA_Elf_Bashlite_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Elf_Hideandseek_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Elf_Mirai_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Elf_Nosedive_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Elf_Persirai_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Elf_Satori_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_3Cx_Backdoor_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_5T_Downloader_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_7Ev3N_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_8Base_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_8T_Dropper_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Abaddon_Pos_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Abcsync_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Absentloader_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Acbackdoor_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Acehash_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Acidbox_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Acr_Stealer_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Acridrain_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Acronym_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Action_Rat_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Adhubllka_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Adkoob_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Advisorsbot_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Adylkuzz_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Afrodita_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
• MALPEDIA_Win_Agendacrypt_Auto

  autogenerated rule brought to you by yara-signator

  MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04

View all (4408)