Skip to content
yararules.org
Menu

YARA rules tagged HUNTING

3 rules carry the tag “HUNTING”.

  • SIGNATURE_BASE_Brooxml_Hunting

    Detects Microsoft OOXML files with prepended data/manipulated header

    Suspicious / huntingSignature Base (Florian Roth / Nextron)· Proofpoint· 2024-11-27
  • SIGNATURE_BASE_SUSP_RAR_NTFS_ADS

    Detects RAR archive with NTFS alternate data stream

    Suspicious / huntingSignature Base (Florian Roth / Nextron)· Proofpoint· 2024-12-17
  • SIGNATURE_BASE_APT_IN_TA397_Wmrat

    track wmRAT based on socket usage, odd error handling, and reused strings

    APT / threat actorSignature Base (Florian Roth / Nextron)· Proofpoint· 2024-11-20