YARA rules tagged MEMORY

Detects modules used by DEEPDATA based on the required export names used by those modules.

Detects Python script used by KPlayer to update, modified by attackers to download a malicious payload.

Detects unpacked AppleJeus samples.

Detects unpacked AppleJeus samples.

Detected AppleJeus unpacked samples.

Detects AppleJeus DLL samples.

Ruby loader seen loading the ROKRAT malware family.

The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications.

A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload.

Simple backdoor which collects information about the IIS server it is installed on. It appears to the attacker refers to this components as 'XValidate' - i.e. to validate infected machines.

The CobaltStrike malware family, variant D.

Detects the JSP implementation of the Godzilla Webshell.

Identify any blob containing a bogus user-agent used in different components of an attack attributed to UTA0533.

Detection for LONGTALE, a chrome extension malware.

Detects KNUCKLEBALL, a python based injector malware, using string patterns.

CLEANGULP: Detects decoded runtime strings associated with command-and-control, tasking, and persistence.

Detection for the SUPERSTOMP malware used by JungleBamboo.

Detection for ORANGETAIL, a custom Java webshell used by UTA0533.

Detection for the accept logic of ORANGETAIL, a custom Java webshell used by UTA0533.

Detect PLENET, a multiplatform malware compile with native AOT.

Detection for VerdantBamboo related malware based on paths from local machines observed in binaries.

Detects the BRICKSTORM backdoor using common strings.

Detection for the BRICKSTORM malware family.

Detection for AgentPSD, a python-based malware typically delivered within PyInstaller-built binaries.

Detection for RELOADEXT, a Google Chrome extension malware.

Detects GOMOJI malware using strings in the ELF.

Detects DISGOMOJI malware using strings in the ELF.

Detects DISGOMOJI using strings in the ELF.

Detects DISGOMOJI loader using strings in the ELF.

Detects DISGOMOJI modules using strings in the ELF.

Detect the RELOADEXT installer.

VBS backdoor which bares architectural similarity to the POWERSTAR malware family.

SOCKS5 proxy tool used to relay connections.

Detects a opensource malware available on github using strings in the binary. DISGOMOJI used by TransparentJasmine is based on this malware.

Detects a opensource malware available on github using strings in the binary. The DISGOMOJI malware family used by TransparentJasmine is based on this malware.

Detection for fake macOS VPN client used by CharmingCypress.

Detects POWERSTAR modules based on common HTTP functions used across modules.

Detects AVBurner based on a combination of API calls used, hard-coded strings and bytecode patterns.

Detects the July 2023 POCOSTICK variant. These strings are only visible in memory after several rounds of shellcode decryption.

Detection for the COMPLYSHELL webshell.

Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc.

Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc.

Detects the PUPYRAT malware family, a cross-platform RAT written in Python.

Detects PANTEGANA, a Golang backdoor used by a range of threat actors due to its public availability.

Detects the RealCMD webshell, one of the payloads for BEHINDER.

Detects CONVERGE - a file upload webshell observed in incident involving compromise of Confluence server via CVE-2022-26134.

Detects the reGeorg webshells' JSP version.

A malicious Chrome browser extension used by the SharpPine threat actor to steal Gmail data from a victim.

Detects POWERLESS malware.

The DECROK malware family, which uses the victim's hostname to decrypt and execute an embedded payload.

The SPORTSBALL webshell, observed in targeted Microsoft Exchange attacks in 2021. SPORTSBALL was later discovered to be a variant of HYPERSHELL, a publicly available webshell.

CPP loader for the Backwash malware.

Detects an AutoIT backdoor designed to run on IIS servers and to install a webshell.

A variation of the reGeorgtunnel open-source webshell.

Detects the base version of GIMMICK written in .NET.

Variant of the BACKWASH malware family with IIS worm functionality.

Detects the macOS port of the GIMMICK malware.

Looks for a common design pattern in webshells where a request attribute is passed as an argument to exec().

Hunting Russian Intelligence Snake Malware

Detect the UPSTYLE webshell.

Detects a reverse SSH utility available on GitHub. Attackers may use this tool or similar tools in post-exploitation activity.

This rule detects multiple variants of the GOVERSHELL malware family employed by UTA0388 via unique strings. The implant is side-loaded by a legitimate executable and uses various network protocol to communicate with the C2 server.