Signature Base (Florian Roth / Nextron)
- Dépôt
- https://github.com/Neo23x0/signature-base
- Commit
- 94a1c48d7ab499879287ff611dfe7f9c56376030
- Récupéré le
- 2026-09-27
- Licence
- Detection Rule License 1.1
- Publication
- Texte complet
- Justification
- Repository LICENSE is the Detection Rule License 1.1, which permits publishing and redistribution with author attribution, a link to the rule and a licence indication. A few rules carry their own licence in meta (CC BY 4.0, MIT, BSD-2) — all permissive; the rule-level licence is shown.
Télécharger le pack (.yar, 1077 règles)
Texte de licence (tel que récupéré par YARA Forge)
# Detection Rule License (DRL) 1.1
Permission is hereby granted, free of charge, to any person obtaining a copy
of this rule set and associated documentation files (the "Rules"), to deal
in the Rules without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Rules, and to permit persons to whom the Rules are furnished to do so,
subject to the following conditions:
If you share the Rules (including in modified form), you must retain the
following if it is supplied within the Rules:
1. identification of the authors(s) ("author" field) of the Rule and any
others designated to receive attribution, in any reasonable manner
requested by the Rule author (including by pseudonym if designated).
2. a URI or hyperlink to the Rule set or explicit Rule to the extent
reasonably practicable
3. indicate the Rules are licensed under this Detection Rule License, and
include the text of, or the URI or hyperlink to, this Detection Rule
License to the extent reasonably practicable
If you use the Rules (including in modified form) on data, messages based on
matches with the Rules must retain the following if it is supplied within the
Rules:
1. identification of the authors(s) ("author" field) of the Rule and any
others designated to receive attribution, in any reasonable manner
requested by the Rule author (including by pseudonym if designated).
THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE
RULES.Règles de Signature Base (Florian Roth / Nextron)
This rule detects the custom hashing algorithm of Lockbit4.0 unpacked
MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2024-02-16Detect the packer used by Lockbit4.0
MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2024-02-16Detect the implementation of RC4 Algorithm by Lockbit4.0
MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2024-02-13This Yara rule from ISH Tecnologia's Heimdall Security Research Team detects key components of Akira Ransomware
MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y-Icaro Cesar· 2025-04-11Detects a variant of the GoLang Validalpha malware based on a file path found in the samples
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25Detects unknown wiper malware
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16Rule looking for BEATDROP malware
APT / acteurSignature Base (Florian Roth / Nextron)· Mandiant· 2022-04-28CoralWave loader masquerading as Lenovo audio DLL. Drops Remcos RAT.
MalwareSignature Base (Florian Roth / Nextron)· xstp· 2026-01-01Detects malicious VEILEDSIGNAL backdoor
APT / acteurSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-20Detects LockBit ransomware samples for Linux and macOS
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-04-15Detects unknown wiper malware
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16Detects scheduled task pattern found in Hermetic Wiper malware related intrusions
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25Detects CaddyWiper malware
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-03-15Detects IsaacWiper malware
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-03-03Turla mimicking SysInternals Tools- peFeatures
APT / acteurSignature Base (Florian Roth / Nextron)· JAG-S· 2020-05-28Detects Meterpreter in-memory
Outil offensifSignature Base (Florian Roth / Nextron)· netbiosX, Florian Roth· 2020-06-29This rule is looking for specific strings related to SUPERNOVA. SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args).
APT / acteurSignature Base (Florian Roth / Nextron)· FireEye· 2020-12-14SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args). This rule is looking for specific strings and attributes related to SUPERNOVA.
APT / acteurSignature Base (Florian Roth / Nextron)· FireEye· 2020-12-14Detects Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom
MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2026-02-02Detects DLL used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom
MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2026-02-02Detects shellcode used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom
MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2026-02-02Detects Cobalt Strike beacon loader
MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2026-02-02Detects RegPhantom, a kernel-mode rootkit that allow attacker to inject arbitrary code from unprivileged user-mode into kernel-mode and execute it.
MalwareSignature Base (Florian Roth / Nextron)· Pezier Pierre-Henri (Nextron Systems)· 2026-03-19This rule detects intrinsic patterns of BabbleLoader.
MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2025-01-27Detects Katz stealer
MalwareSignature Base (Florian Roth / Nextron)· MalGamy (Nextron Systems)· 2025-05-16Detects .NET based Katz stealer loader
MalwareSignature Base (Florian Roth / Nextron)· Jonathan Peters (cod3nym)· 2025-05-21This rule detects intrinsic patterns of Amadey version 5.34
MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y· 2025-06-18This Yara rule from ISH Tecnologia's Heimdall Security Research Team, detects the main components of the Megazord Ransomware
MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y-Icaro Cesar· 2025-04-11This ISH Tecnologia Yara rule, detects the main components of the first version of RALord Ransomware
MalwareSignature Base (Florian Roth / Nextron)· 0x0d4y-Icaro Cesar· 2025-04-01Detects a variant of the Atharvan 3RAT malware family
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25Detects a variant of the GoLang Validalpha malware
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25Detects a variant of the Lilith RAT malware family
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov (modified by Florian Roth, Nextron Systems)· 2024-07-25Detects the Dtrack variant used by Andariel
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25Detects a variant of the EasyRAT malware family
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25Detects ICONIC stealer payload used in the 3CX incident
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31Detects malicious VEILEDSIGNAL backdoor
APT / acteurSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-29Detects malicious VEILEDSIGNAL backdoor
APT / acteurSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-29Detects malicious VEILEDSIGNAL backdoor
APT / acteurSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-29Detects a backdoor DLL, that was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966
MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2023-11-23Detects binaries signed with compromised certificates used by DuckTail stealer - identified in June 2023
MalwareSignature Base (Florian Roth / Nextron)· dr4k0nia· 2023-06-16Detects a DLL that steals authentication credentials - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966
MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2023-11-23Detection for Prestige Ransomware
MalwareSignature Base (Florian Roth / Nextron)· Silas Cutler, modfied by Florian Roth· 2023-01-04Detects a trojan (written in Python) that communicates with c2 - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966
MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2023-11-23Detects Shellcode loader as seen being used by Gopuram backdoor
MalwareSignature Base (Florian Roth / Nextron)· X__Junior (Nextron Systems)· 2023-04-03Detects a trojan DLL that installs other components - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966
MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2023-11-23Detects Turla Mosquito malware
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-10-25Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated
Outil offensifSignature Base (Florian Roth / Nextron)· CodeX· 2022-07-04Detects AppStorage ntstatus msexch samples
APT / acteurSignature Base (Florian Roth / Nextron)· CISA Code & Media Analysis· 2021-12-23Detects contents of the configuration file used by Exaramel (encrypted with key odhyrfjcnfkdtslt, sample e1ff72[...]
APT / acteurSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects contents of the configuration file used by Exaramel (plaintext)
APT / acteurSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...]
APT / acteurSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects the specific name of the configuration file in Exaramel malware as seen in sample e1ff72[...]
APT / acteurSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects path of the unix socket created to prevent concurrent executions in Exaramel malware
APT / acteurSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects Strings used by Exaramel malware
APT / acteurSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO (composed from 4 saparate rules by Florian R…· 2021-02-15Detects misc strings in Exaramel malware with typos
APT / acteurSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects the beginning of type _type struct for some of the most important structs in Exaramel malware
APT / acteurSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects names of the tasks received from the CC server in Exaramel malware
APT / acteurSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects opcodes found in Octowave loader DLLs and WAV steganography files
MalwareSignature Base (Florian Roth / Nextron)· Jai Minton (@CyberRaiju) - HuntressLabs· 2025-03-19Detects supporting file used by Octowave loader containing hardcoded values
MalwareSignature Base (Florian Roth / Nextron)· Jai Minton (@CyberRaiju) - HuntressLabs· 2025-03-19YARA rule to detect RSHELL of APT27
APT / acteurSignature Base (Florian Roth / Nextron)· Bundesamt fuer Verfassungsschutz, modified by Florian Roth· 2024-07-11Detects DTrack variant used by Andariel
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov (modified by Florian Roth, Nextron Systems)· 2024-07-25Detects a variant of the GoLang Validalpha malware
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25Detects the Tiger RAT variant used by Andariel
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov (modified by Florian Roth, Nextron Systems)· 2024-07-25Detects DTrack variant used by Andariel
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25Detects the Tiger RAT variant used by Andariel
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25Detects EarthWorm - a reverse socks proxy used by the threat group that deployed Pygmy Goat malware on Sophos XG firewall devices. The detection is based on the pool num generation x86 assembly.
MalwareSignature Base (Florian Roth / Nextron)· NCSC· 2024-10-22Detects Lockbit ransomware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-02-23Detects the LockBit ransom note file 'LockBit-DECRYPT.txt' which is a sign of a LockBit ransomware infection
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-02-23Detects suspicious command line combinations often found in post exploitation activities
Suspect / chasseSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-02-23Detects VEILEDSIGNAL malware
APT / acteurSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20Detects VEILEDSIGNAL malware
APT / acteurSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20Detects VEILEDSIGNAL malware
APT / acteurSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20Detects VEILEDSIGNAL malware
APT / acteurSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20Detects VEILEDSIGNAL malware
APT / acteurSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20Detects VEILEDSIGNAL malware
APT / acteurSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20Detects patterns found in Lockbit TA attacks exploiting Citrixbleed vulnerability CVE 2023-4966
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-11-22Detects GodRAT malware targeting Windows systems
MalwareSignature Base (Florian Roth / Nextron)· Arda Buyukkaya· 2025-08-23Detects Lazarus Gopuram malware
MalwareSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2023-04-04QakBot Export Selection
MalwareSignature Base (Florian Roth / Nextron)· kevoreilly· 2023-02-17Detects indicators found in DarkBit ransomware
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-02-13Detects Go based DarkBit ransomware (garbled code; could trigger on other obfuscated samples, too)
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-02-13Detects indicators found in LockBit ransomware
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-04-17Detects indicators found in LockBit ransomware log files
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-04-17Detects BiBi wiper samples for Windows and Linux
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-11-01Detects marker found in VEILEDSIGNAL backdoor
Suspect / chasseSignature Base (Florian Roth / Nextron)· X__Junior· 2023-04-20Detects reversed stage3 related to Ukrainian wiper malware
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16Yara rule to detect first Hyperbro Loader Stage, often called vftrace.dll. Detects decoding function.
APT / acteurSignature Base (Florian Roth / Nextron)· Bundesamt fuer Verfassungsschutz (modified by Florian Roth)· 2022-01-14Detects artefacts found in Hermetic Wiper malware related intrusions
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25Detects Hermetic Wiper malware
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-24Cobalt Strike's resources/beacon.dll Versions 3.8
Outil offensifSignature Base (Florian Roth / Nextron)· gssincla@google.com· 2022-11-18Detects Nighthawk RAT
Outil offensifSignature Base (Florian Roth / Nextron)· Frank Boldewin (@r3c0nst)· 2022-11-22Detects Brute Ratel C4 badger indicators
Outil offensifSignature Base (Florian Roth / Nextron)· Matthew @embee_research, Florian Roth· 2022-10-12Detect the Nighthawk dropped beacon
Outil offensifSignature Base (Florian Roth / Nextron)· Arkbird_SOLG· 2022-11-22HyperBro Stage 2 and compressed Stage 3 detection
MalwareSignature Base (Florian Roth / Nextron)· Moritz Oettle· 2022-02-07HyperBro Stage 3 registry keys for persistence
MalwareSignature Base (Florian Roth / Nextron)· Marko Dorfhuber· 2022-02-07Detects samples similar to reversed stage3 found in Ukrainian wiper incident named WhisperGate
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16mimikatz
Outil offensifSignature Base (Florian Roth / Nextron)· Benjamin DELPY (gentilkiwi)· 2022-11-16Detects malware used in the Kaseya supply chain attack
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-07-02Detects malware used in the Kaseya supply chain attack
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-07-02Detects Tiny Turla backdoor DLL
APT / acteurSignature Base (Florian Roth / Nextron)· Cisco Talos· 2021-09-21The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications.
APT / acteurSignature Base (Florian Roth / Nextron)· threatintel@volexity.com· 2021-04-23Detects RokRAT malware used by ScarCruft APT group
APT / acteurSignature Base (Florian Roth / Nextron)· S2WLAB_TALON_JACK2· 2021-07-09Python Loader used to execute the BLUELIGHT malware family.
APT / acteurSignature Base (Florian Roth / Nextron)· threatintel@volexity.com· 2021-06-22Detects HelloKitty Ransomware samples from UNC2447 campaign
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-01Detects HelloKitty Ransomware samples from UNC2447 campaign
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-01Detects SombRAT samples from UNC2447 campaign
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-01Detects APT28 SkinnyBoy droppers
MalwareSignature Base (Florian Roth / Nextron)· Cluster25· 2021-05-24Detects CobaltStrike MZ header ReflectiveLoader launcher
Outil offensifSignature Base (Florian Roth / Nextron)· yara@s3c.za.net· 2021-07-08Detects CobaltStrike sleep_mask decoder
Outil offensifSignature Base (Florian Roth / Nextron)· yara@s3c.za.net· 2021-07-19Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2
Outil offensifSignature Base (Florian Roth / Nextron)· Elastic· 2021-03-16Identifies strings used in Cobalt Strike Beacon DLL
Outil offensifSignature Base (Florian Roth / Nextron)· Elastic· 2021-03-16Identifies XOR'd strings used in Cobalt Strike Beacon DLL
Outil offensifSignature Base (Florian Roth / Nextron)· Elastic· 2021-03-16Detects .NET red/black-team tools via name
Outil offensifSignature Base (Florian Roth / Nextron)· Arnim Rupp· 2021-01-22Detects .NET red/black-team tools via name
Outil offensifSignature Base (Florian Roth / Nextron)· Arnim Rupp· 2021-01-22The CobaltStrike malware family.
Outil offensifSignature Base (Florian Roth / Nextron)· threatintel@volexity.com· 2021-05-25No description has been set in the source file - Signature Base
MalwareSignature Base (Florian Roth / Nextron)· press inquiries <info@bka.de>, technical contact <info@mh…· 2021-03-23No description has been set in the source file - Signature Base
MalwareSignature Base (Florian Roth / Nextron)· press inquiries <info@bka.de>, technical contact <info@mh…· 2021-03-232021 initial Bokbot / Icedid loader for fake GZIP payloads
MalwareSignature Base (Florian Roth / Nextron)· Thomas Barabosch, Telekom Security· 2021-04-12Signature for a crypter associated with Conti
MalwareSignature Base (Florian Roth / Nextron)· James Quinn, Binary Defense· 2021-03-17Detects Darkside Ransomware
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-10Detects Lorenz Ransomware samples
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-04Detection for early versions of DARKSIDE ransomware samples based on the encryption mode configuration values.
MalwareSignature Base (Florian Roth / Nextron)· FireEye· 2021-03-22Yara Rule for WSH rat .NET packer of February 2021
MalwareSignature Base (Florian Roth / Nextron)· Yoroi Malware ZLab· 2021-03-09Detects Strings left in TMP Files created by K3CHANG Backdoor Ketrican
APT / acteurSignature Base (Florian Roth / Nextron)· Markus Neis, Swisscom· 2020-06-18Detects variants of GoldenSpy Malware
APT / acteurSignature Base (Florian Roth / Nextron)· BKA· 2020-08-21Detects Ketrican malware
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-06-18Detects Lazarus VHD Ransomware
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-10-05Detects Lazarus VHD Ransomware
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-10-05Detects Turla Kazuar malware
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-05-28Detects SideWinder final payload
APT / acteurSignature Base (Florian Roth / Nextron)· AT&T Alien Labs· 2020-08-25Detects SLOTHFULMEDIA malware
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-10-01Detects ATM Malware Loup
MalwareSignature Base (Florian Roth / Nextron)· Frank Boldewin (@r3c0nst)· 2020-08-17Rule to find Kinsing malware
MalwareSignature Base (Florian Roth / Nextron)· Tony Lambert, Red Canary· 2020-06-09Detects Parallax Loader
MalwareSignature Base (Florian Roth / Nextron)· @VK_Intel· 2020-02-24Detects Parallax Injected Payload v1.01
MalwareSignature Base (Florian Roth / Nextron)· @VK_Intel· 2020-02-24Detects Maze ransomware payload dll unpacked
MalwareSignature Base (Florian Roth / Nextron)· @VK_Intel· 2020-04-18Detects Mimikatz SkeletonKey in Memory
Outil offensifSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-08-09Detects c# red/black-team tools via typelibguid
Outil offensifSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-13Detects VB.NET red/black-team tools via typelibguid
Outil offensifSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-30Detects c# red/black-team tools via typelibguid
Outil offensifSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-28Detects c# red/black-team tools via typelibguid
Outil offensifSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-13Detects c# red/black-team tools via typelibguid
Outil offensifSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-13Detects VB.NET red/black-team tools via typelibguid
Outil offensifSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-30Detects c# red/black-team tools via typelibguid
Outil offensifSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-28Detects c# red/black-team tools via typelibguid
Outil offensifSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-13Detects c# red/black-team tools via typelibguid
Outil offensifSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-13Detects c# red/black-team tools via typelibguid
Outil offensifSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-28matches the Winnti 'Cooper' loader version used for the RedMimicry breach emulation
Outil offensifSignature Base (Florian Roth / Nextron)· mirar@chaosmail.org· 2020-06-22BLINDINGCAN RAT loader named iconcash.db used by APT37
MalwareSignature Base (Florian Roth / Nextron)· Marc Stroebel· 2020-12-15Detects Parallax injected code
MalwareSignature Base (Florian Roth / Nextron)· @VK_Intel· 2020-05-05Detects Emotet malware
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-01-29Detects Prolock malware in encrypted and decrypted mode
MalwareSignature Base (Florian Roth / Nextron)· Frank Boldewin (@r3c0nst)· 2020-05-17Detects REvil ransomware
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-10-13Detects Winnti malware
APT / acteurSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06Detects Winnti malware
APT / acteurSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06Detects Winnti malware
APT / acteurSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06Detects Winnti malware
APT / acteurSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06Detects Winnti malware
APT / acteurSignature Base (Florian Roth / Nextron)· Unknown· 2019-12-06Detected the NET loader used by SideWinder group (August 2020)
APT / acteurSignature Base (Florian Roth / Nextron)· Arkbird_SOLG· 2020-08-24Detects VB.NET red/black-team tools via typelibguid
Outil offensifSignature Base (Florian Roth / Nextron)· Arnim Rupp (https://github.com/ruppde)· 2020-12-30Detects Ragnarlocker by strings (July 2020)
MalwareSignature Base (Florian Roth / Nextron)· Arkbird_SOLG· 2020-07-30Detects Nightmare-Eclipse/BlueHammer (FunnyApp), a Windows local privilege escalation PoC that abuses a Defender signature-update RPC and a junction/symlink race to leak the SAM hive and derive NTLM hashes - giving an unprivileged user full SYSTEM-level credential access.
Outil offensifSignature Base (Florian Roth / Nextron)· AzizFarghly (Nextron-Systems)· 2026-04-07Detects SEASPY malware related LUA script
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-06-16Detects BPFDoor malware
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-05-09Detects unknown Linux implants (uploads from KR and MO)
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-05-05Detects URL mentioned in report on compromised Github repositories in August 2022
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-08-03Detects Grace (aka FlawedGrace and GraceWire) RAT
MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2022-12-13Detects typical stealer output files as created by RedLine or Racoon stealer
Suspect / chasseSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-09-17Detects virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-08-25Detects suspicious office reference files including an obfuscated MHTML reference exploiting CVE-2021-40444
ExploitSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-09-18Detects Khepri C2 framework beacons
Outil offensifSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-09-08Detects strings found in POOLRAT malware
Suspect / chasseSignature Base (Florian Roth / Nextron)· Mandiant· 2023-04-20Detects unknown malicious loaders noticed in August 2021
Web shellSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-08-25Detects SQL dump file created by P.A.S. webshell
Web shellSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO· 2021-02-15Detects Speculoos Backdoor used by APT41
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-04-14Detects Default Mimikatz memssp module in-memory
Outil offensifSignature Base (Florian Roth / Nextron)· SBousseaden· 2020-08-26Detects LINE VIPER Cisco ASA malware code as part of AES encrypted tasking and exfiltration.
MalwareSignature Base (Florian Roth / Nextron)· NCSC· 2025-09-25Detects LINE VIPER Cisco ASA malware code as part of ICMP tasking shellcode payloads.
MalwareSignature Base (Florian Roth / Nextron)· NCSC· 2025-09-25Detects LINE VIPER Cisco ASA malware code as part of RSA encrypted random AES key generation.
MalwareSignature Base (Florian Roth / Nextron)· NCSC· 2025-09-25Detects LINE VIPER Cisco ASA malware code as part of a shellcode deobfuscation routine.
MalwareSignature Base (Florian Roth / Nextron)· NCSC· 2025-09-25Detects LINE VIPER Cisco ASA malware code as part of shellcode initial execution.
MalwareSignature Base (Florian Roth / Nextron)· NCSC (modifier by Florian Roth)· 2025-09-25Detects RayInitiator GRUB bootkit stage 1 code that searches for the 'Booting the kernel' string.
MalwareSignature Base (Florian Roth / Nextron)· NCSC· 2025-09-25Detects RayInitiator GRUB bootkit stage 2 code that identifies the Linux kernel syscall table.
MalwareSignature Base (Florian Roth / Nextron)· NCSC· 2025-09-25Detects RayInitiator GRUB bootkit stage 3 install phase code that searches for the 'client-cert-fail' string.
MalwareSignature Base (Florian Roth / Nextron)· NCSC· 2025-09-25Detects RayInitiator GRUB bootkit stage 3 deploy phase code that copies LINE VIPER shellcode stub and marks executable.
MalwareSignature Base (Florian Roth / Nextron)· NCSC· 2025-09-25Detects a final Java loader JAR file used in phishing campaigns
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2025-08-07Detects obfuscated JavaScript in NPM packages used in supply chain crypto stealer attacks in September 2025
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2025-09-09Detects kill switch used by the backdoored XZ library (xzutil) CVE-2024-3094.
ExploitSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-03-30Detects SEASPY malware used by UNC4841 in attacks against Barracuda ESG appliances exploiting CVE-2023-2868
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-06-16Detects forensic artifacts found in attacks on SysAid on-prem software exploiting CVE-2023-47246
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-11-09Detects POC code used in attacks against libssh vulnerability CVE-2023-2283
Outil offensifSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-06-08Detects CamaroDragon's HorseShell implant for routers
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-10-06Detects CamaroDragon's tool named sheel
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-10-06Detects Tutle loader used in attacks against SysAid CVE-2023-47246
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-11-09Detects ransomware exploiting and encrypting ESXi servers
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-02-04Detects script used in ransomware attacks exploiting and encrypting ESXi servers
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-02-06Detects WAR file found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-08-01Detects compiled ASPX web shells found being used in MOVEit Transfer exploitation
Web shellSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-06-01Detects ASPX web shells as being used in MOVEit Transfer exploitation
Web shellSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-06-01Detects SECRETSAUCE PHP webshells (found after an exploitation of Citrix NetScaler ADC CVE-2023-3519)
Web shellSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-07-24Detects BPFDoor implants used by Chinese actor Red Menshen
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-05-07Detects BPFDoor implants used by Chinese actor Red Menshen
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-05-08Detects Python backdoor found on ESXi servers
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth· 2022-12-14Detects LinaDoor Linux Rootkit
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2022-05-19Detects Venus Ransomware samples
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-11-16Detects BoomBox malware as described in APT29 NOBELIUM report
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth· 2021-05-27Detects link file characteristics as described in APT29 NOBELIUM report
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-27Detects NativeZone loader as described in APT29 NOBELIUM report
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-05-27Detects MalDocs used by FIN7 group
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-09-07Detects HAFNIUM ASPX files dropped on compromised servers
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-03-07Detects ASP webshells
Web shellSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-03-05Detects Chopper like ASPX Webshells
Web shellSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-03-31Webshells generated by an Mailbox export to PST and stored as aspx: 570221043.aspx 689193944.aspx luifdecggoqmansn.aspx
Web shellSignature Base (Florian Roth / Nextron)· Moritz Oettle· 2021-09-04Detects webshells dropped by DropHell malware
Web shellSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-11-01This rule looks for portions of the TEARDROP backdoor that are vital to how it functions. TEARDROP is a memory only dropper that can read files and registry keys, XOR decode an embedded payload, and load the payload into memory. TEARDROP persists as a Windows service and has been observed dropping Cobalt Strike BEACON into memory.
APT / acteurSignature Base (Florian Roth / Nextron)· FireEye· 2020-12-14The SUNBURST backdoor uses a domain generation algorithm (DGA) as part of C2 communications. This rule is looking for each branch of the code that checks for which HTTP method is being used. This is in one large conjunction, and all branches are then tied together via disjunction. The grouping is intentionally designed so that if any part of the DGA is re-used in another sample, this signature should match that re-used portion. SUNBURST is a backdoor that has the ability to spawn and kill processes, write and delete files, set and create registry keys, gather system information, and disable a set of forensic analysis tools and services.
APT / acteurSignature Base (Florian Roth / Nextron)· FireEye· 2020-12-14Detects java based payload used in a campaign against compromised hosting providers using Virtualizor software
APT / acteurSignature Base (Florian Roth / Nextron)· Jonathan Peters (cod3nym)· 2026-08-31Detects dirtyfrag, a local privilege escalation exploit for Linux.
ExploitSignature Base (Florian Roth / Nextron)· Pezier Pierre-Henri (Nextron Systems)· 2026-05-07Detects a shellcode observed in dirtyfrag, a local privilege escalation exploit for Linux.
ExploitSignature Base (Florian Roth / Nextron)· Pezier Pierre-Henri (Nextron Systems)· 2026-05-07Detects an .NET based tool used to dump saved passwords from Microsoft Edge browser processes
Outil offensifSignature Base (Florian Roth / Nextron)· Florian Roth· 2026-05-05Detects RedSun hacktool used for privilege escalation through Microsoft Defender.
Outil offensifSignature Base (Florian Roth / Nextron)· Jonathan Peters (cod3nym)· 2026-04-16Detects Nimbus Manticore (UNC1549) agent implant featuring data exfiltration and remote control.
MalwareSignature Base (Florian Roth / Nextron)· Jonathan Peters (Nextron Systems)· 2026-05-28Detects .NET based stager using AppDomain Hijacking observed to be used by Nimbus Manticore (UNC1549). The stager drops another payload and establishes persistence via scheduled task.
MalwareSignature Base (Florian Roth / Nextron)· Jonathan Peters (Nextron Systems)· 2026-05-20Detects a backdoor smuggled into signed DAEMON Tools binaries via supply-chain compromise, receives encrypted commands over HTTPS to execute arbitrary shell commands and drop files on victim hosts.
MalwareSignature Base (Florian Roth / Nextron)· MalGamy· 2026-05-05Detects Base64 variations of refusal magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents.
MalwareSignature Base (Florian Roth / Nextron)· Marius Benthin· 2026-01-29Detects reconaissance payload used in the DAEMON Tools supplychain compromise. The tools collects detailed information about the infected system like hardware, installed software, running processes etc. all data is exfilled to an attacker controlled server.
MalwareSignature Base (Florian Roth / Nextron)· MalGamy, Jonathan Peters (cod3nym)· 2026-05-05Detects malicious indicators used in LiteLLM supply chain attack
MalwareSignature Base (Florian Roth / Nextron)· Marius Benthin· 2026-03-28Detects minimalistic backdoor deployment where a shellcode loader downloads an encrypted payload and executes it in memory after RC4 decryption using a command-line provided key
MalwareSignature Base (Florian Roth / Nextron)· MalGamy· 2026-05-05Detects package.json which include the malicious plain-crypto-js package as dependency
MalwareSignature Base (Florian Roth / Nextron)· Marius Benthin· 2026-03-31Detects The Gentlemen ransomware Windows locker (Storm-2697), a self-propagating Go-based encryptor
MalwareSignature Base (Florian Roth / Nextron)· Aryu-RU· 2026-06-16Detects malicious indicators used in Telnyx supply chain attack
MalwareSignature Base (Florian Roth / Nextron)· Marius Benthin· 2026-03-28Detects HAFNIUM ASPX files dropped on compromised servers
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-03-07Detects Wiper used by the Iranian DruidFly group
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth· 2025-06-21Detects EDR-Freeze hacktool
Outil offensifSignature Base (Florian Roth / Nextron)· Florian Roth· 2025-09-30Detects the BACKORDER loader compiled in GO which download and executes a second stage payload from a remote server.
MalwareSignature Base (Florian Roth / Nextron)· Arda Buyukkaya (modified by Florian Roth)· 2025-01-23Detects a DLL used to decrypt App-Bound Encrypted (ABE) cookies, passwords and payment methods from Chromium-based browsers. Seen being used by Katz stealer
MalwareSignature Base (Florian Roth / Nextron)· MAlGamy· 2025-05-19Detects malicious component of node package named Etoroloro
MalwareSignature Base (Florian Roth / Nextron)· Pezier Pierre-Henri· 2025-12-12Detects malicious JavaScript worm bun_environment.js
MalwareSignature Base (Florian Roth / Nextron)· Marius Benthin· 2025-11-24Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2025-09-16Detects Plague backdoor ELF binaries, related to PAM authentication alteration.
MalwareSignature Base (Florian Roth / Nextron)· Pezier Pierre-Henri· 2025-07-25Detects .NET based tool abusing legitimate Windows utility cmstp.exe to bypass UAC (User-Admin-Controls)
MalwareSignature Base (Florian Roth / Nextron)· Jonathan Peters (cod3nym)· 2025-05-21Detects known malicious preinstall script in package.json
MalwareSignature Base (Florian Roth / Nextron)· Marius Benthin· 2025-11-24Detects possible final payload of phishing-delivered malware, where embedded shellcode is used to decrypt and execute the payload after user-supplied password input.
MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2025-02-14Detects unknown of phishing-delivered malware
MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2025-02-14Detects AES decryptor used by Sindoor dropper related to APT 36
MalwareSignature Base (Florian Roth / Nextron)· Pezier Pierre-Henri· 2025-08-29Detects Sindoor downloader related to APT 36
MalwareSignature Base (Florian Roth / Nextron)· Pezier Pierre-Henri· 2025-08-29Detects ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770
Web shellSignature Base (Florian Roth / Nextron)· Florian Roth· 2025-07-20Detects FalseFont backdoor, related to Peach Sandstorm APT
APT / acteurSignature Base (Florian Roth / Nextron)· X__Junior, Jonathan Peters· 2024-01-11Detects make file and script contents used by the backdoored XZ library (xzutil) CVE-2024-3094.
ExploitSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-03-30Detects samples of the Agni malware family
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25Detects the MagicRAT variant used by Andariel
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov (modified by Florian Roth, Nextron Systems)· 2024-07-25Detects a Linux backdoor named Fipps used by Andariel
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25Detects the Grease2 malware family used by Andariel
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov (modified by Florian Roth, Nextron Systems)· 2024-07-25Detects a scheduled task loader used by Andariel
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25Detects a variant of the SocksTroy malware family
MalwareSignature Base (Florian Roth / Nextron)· CISA.gov· 2024-07-25Detects xlogin backdoor samples
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-11-11Detects exploits used in relation with Perfctl malware campaigns
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-10-09Detects INC ransomware and it's variants like Lynx
MalwareSignature Base (Florian Roth / Nextron)· X__Junior· 2024-08-08Detects TriangleDB implant found being used in Operation Triangulation on iOS devices (maybe also used on macOS systems)
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-06-21Detects malicious DYLIB files related to 3CX compromise
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-30Detects malicious macOS application related to 3CX compromise (decrypted payload)
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-30Detects macOS malware used in the 3CX incident
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31Detects malicious DLLs related to 3CX compromise (decrypted payload)
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth , X__Junior (Nextron Systems)· 2023-03-29Detects decrypted payload loaded inside 3CXDesktopApp.exe which downloads info stealer
APT / acteurSignature Base (Florian Roth / Nextron)· MalGamy (Nextron Systems)· 2023-03-29Detects TAXHAUL (AKA TxRLoader) malware used in the 3CX compromise by UNC4736
APT / acteurSignature Base (Florian Roth / Nextron)· Mandiant· 2023-03-04Detects a C# POC to exploit CVE-2023-29357 on Microsoft SharePoint servers
Outil offensifSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-10-01Detects a Python POC to exploit CVE-2023-29357 on Microsoft SharePoint servers
Outil offensifSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-10-01Detects 3CXDesktopApp MacOS Backdoor component
MalwareSignature Base (Florian Roth / Nextron)· X__Junior (Nextron Systems)· 2023-03-30Detects 3CXDesktopApp MacOS UpdateAgent backdoor component
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-30Detects SALTWATER malware used in Barracuda ESG exploitations (CVE-2023-2868)
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-06-07Detects indicators of fake document/image utility software that acts as a downloader for additional malware
MalwareSignature Base (Florian Roth / Nextron)· Jonathan Peters· 2023-11-13Detects LogClear.class found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-08-01Detects the 64bit Loader DLL used by TwistedPanda
APT / acteurSignature Base (Florian Roth / Nextron)· Check Point Research· 2022-04-14Detects droppers used by TwistedPanda
APT / acteurSignature Base (Florian Roth / Nextron)· Check Point Research· 2022-04-14Detects loader used by TwistedPanda
APT / acteurSignature Base (Florian Roth / Nextron)· Check Point Research· 2022-04-14Detects the obfuscated variant of SPINNER payload used by TwistedPanda
APT / acteurSignature Base (Florian Roth / Nextron)· Check Point Research· 2022-04-14Detects an older variant of SPINNER payload used by TwistedPanda
APT / acteurSignature Base (Florian Roth / Nextron)· Check Point Research· 2022-04-14Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation
ExploitSignature Base (Florian Roth / Nextron)· Tobias Michalski, Christian Burkard· 2022-05-30Detects POCs that exploit privilege escalation vulnerability CVE-2022-46689 on macOS
ExploitSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-12-19Detects SLAPSTICK malware used by UNC2891
APT / acteurSignature Base (Florian Roth / Nextron)· Mandiant· 2022-03-17Detects Tiny Shell - an open-source UNIX backdoor
Outil offensifSignature Base (Florian Roth / Nextron)· Mandiant· 2022-03-17Detects Tiny Shell variant for SPARC - an open-source UNIX backdoor
Outil offensifSignature Base (Florian Roth / Nextron)· Mandiant· 2022-03-17Detection for initial shellcode loader used to deploy GOLDBACDOOR
MalwareSignature Base (Florian Roth / Nextron)· Silas Cutler (silas@Stairwell.com)· 2022-04-21Detection for injected shellcode that decodes GOLDBACKDOOR
GénériqueSignature Base (Florian Roth / Nextron)· Silas Cutler (silas@Stairwell.com)· 2022-04-21Detects NatBypass tool (also used by APT41)
Outil offensifSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-12-27Detects ClientUploader onedrv
APT / acteurSignature Base (Florian Roth / Nextron)· CISA Code & Media Analysis· 2021-12-23Detects suspicios ELF files with sections as described in malicious iLO Board analysis by AmnPardaz in December 2021
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-12-28Detects Chily or SunnyDay malware used by Vice Society
APT / acteurSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-01-12Detects forensic artefacts indicating successful exploitation of F5 BIG IP appliances as reported by NCCGroup
ExploitSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-03-20Detects Chopper like ASPX Webshells
Web shellSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-03-31Detects an archive file created by P.A.S. for download operation
Web shellSignature Base (Florian Roth / Nextron)· FR/ANSSI/SDO (modified by Florian Roth)· 2021-02-15Detects loaders used by Chinese groups
APT / acteurSignature Base (Florian Roth / Nextron)· Vitali Kremez· 2020-02-01Detects RoyalRoad weaponized RTF documents
GénériqueSignature Base (Florian Roth / Nextron)· nao_sec· 2020-01-15Detects RoyalRoad weaponized RTF documents
GénériqueSignature Base (Florian Roth / Nextron)· nao_sec· 2020-01-15Detects RoyalRoad weaponized RTF documents
GénériqueSignature Base (Florian Roth / Nextron)· nao_sec· 2020-01-15Detects RoyalRoad weaponized RTF documents
GénériqueSignature Base (Florian Roth / Nextron)· nao_sec· 2020-01-15Detects RoyalRoad weaponized RTF documents
GénériqueSignature Base (Florian Roth / Nextron)· nao_sec· 2020-01-15Detects RoyalRoad weaponized RTF documents
GénériqueSignature Base (Florian Roth / Nextron)· nao_sec· 2020-01-15Detects RoyalRoad weaponized RTF documents
GénériqueSignature Base (Florian Roth / Nextron)· nao_sec· 2020-01-15Detects an base64 encoded executable with reversed characters
Suspect / chasseSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-04-06