8dedf37c64
Add WordShellcodeDecoder_Generic detection rule
...
This rule detects binary loaders that decode shellcode using a word-based mapping scheme. It identifies patterns associated with tokenization and RC4 encryption techniques.
2026-06-08 12:03:48 +02:00
cefa789ea4
Add YARA rule for APC Tandem Primitive Injection detection
2026-05-20 11:58:54 +02:00
0da5c526f9
Add rule to detect NtCreateThreadEx read primitive
...
This rule detects tools that misuse NtCreateThreadEx and RtlQueryDepthSList to create a remote memory read primitive without using ReadProcessMemory, focusing on thread exit codes for data collection.
2026-05-18 12:02:52 +02:00
580e481c12
Add YARA rule for ntdll.dll hook scanning detection
...
This rule detects tools that scan ntdll.dll exports by comparing in-memory bytes against the on-disk PE to identify inline hooks placed by EDR/AV products.
2026-05-17 12:42:43 +02:00
1114ef2526
Add rule for detecting APC-based memory write abuse
2026-05-14 09:17:37 +02:00
3326db0e03
Remove reference from PDB symbol resolution YARA file
...
Removed reference link from metadata.
2026-05-12 09:46:45 +02:00
8ca71c7c87
Create PDB_Symbol_Resolution_Kernel_Offsets rule
...
Adds a YARA rule to detect binaries resolving kernel structure offsets via PDB symbol server queries.
2026-05-12 09:45:35 +02:00
2494aab411
Add ETWTI_Bypass_BYOVD rule for ETW detection
...
This rule detects binaries attempting to disable the ETW Threat Intelligence provider through kernel memory manipulation, focusing on BYOVD-based patching techniques.
2026-05-07 11:57:01 +02:00
49b5a4062c
Add WFP Callout Patching detection rule
...
This rule detects WFP Callout Patching techniques used to overwrite ClassifyFunction pointers, targeting usermode tooling that interacts with the WFP callout array.
2026-05-05 21:47:40 +02:00
bce8475724
Add detection rule for MiniFilter Callback Unlinking
...
This rule detects the MiniFilter Callback Unlinking technique, which involves usermode tooling that manipulates FltMgr internal structures to avoid EDR file telemetry. It includes various patterns and conditions to identify potential malicious activities related to this technique.
2026-04-29 10:50:20 +02:00
59ca4f6a10
Add YARA rule for detecting kernel callback manipulation
2026-04-23 10:02:01 +02:00
1e30a1f9fd
Add detection rule for PspCreateProcessNotifyRoutine enumeration
...
This rule detects binaries that attempt to enumerate PspCreateProcessNotifyRoutine kernel callbacks using BYOVD read primitives.
2026-04-21 11:21:31 +02:00
82d218f403
Add YARA rule for Worker Factory Injection detection
2026-04-14 11:52:56 +02:00
26208dc1e7
Add rule to detect Code Integrity status queries
2026-04-09 11:19:04 +02:00
136226babc
Add detection rule for BYOVD and Defender sabotage
...
This rule detects tools that combine BYOVD kernel-level process termination with Registry-based disabling of Windows Defender.
2026-04-07 09:20:41 +02:00
952b6d5eb2
Add YARA rule for COM Surrogate injection detection
...
This rule detects the COM Surrogate injection technique, which utilizes DLL Surrogates for process injection and parent PID masquerading. It includes relevant registry paths, API imports, and conditions for detection.
2026-04-06 12:24:24 +02:00
a39cfa1c65
Create BYOVD_Defender_Killer_Generic YARA rule
...
Adds a YARA rule to detect tools using BYOVD techniques targeting Windows Defender.
2026-04-01 10:09:51 +02:00
1eb7b3109b
Add rule to detect BYOVD Token Stealing LPE
...
This rule detects tools performing BYOVD Local Privilege Escalation by stealing the SYSTEM process token using specific Windows API functions and kernel-related indicators.
2026-03-31 10:34:15 +02:00
d13f198077
Add rule for detecting Windows Code Integrity bypass
...
This rule detects attempts to bypass Windows Code Integrity using BYOVD techniques by monitoring specific indicators and patterns.
2026-03-26 10:39:18 +01:00
61e7762cfe
Add rule for detecting persistence via Startup directory
...
This rule detects executables that attempt to achieve persistence by interacting with the Windows Startup directory.
2026-03-25 11:36:00 +01:00
ad03174075
Add BYOVD detection rule for kernel R/W primitives
...
This rule detects potential BYOVD usage with kernel R/W primitives targeting PPL bypass.
2026-03-18 16:35:35 +01:00
b21bf18948
Add Layered String Obfuscation detection rule
...
This rule detects compile-time layered string encryption with runtime morphing capabilities, utilizing specific patterns for entropy constants and decryption logic.
2026-03-10 08:50:09 +01:00
2814494fd3
Add YARA rule for detecting reflective DLL loading
2026-03-03 10:24:32 +01:00
0a52dc900a
Add YARA rule for detecting BYOVD process termination tools
2026-02-24 10:40:29 +01:00
10f4a6482c
Create rule for compile-time XOR string encryption detection
...
Added a rule to detect compile-time XOR string encryption patterns in binaries.
2026-02-23 11:51:32 +01:00
bbb60001f8
Add YARA rule for Speck CBC key wrapping detection
...
This rule detects the usage of the Speck block cipher in CBC mode with session key wrapping, which is common in custom shellcode loaders and encryptors. It includes various patterns for identifying Speck operations, CRC32 implementations, and debug artifacts.
2026-02-23 10:13:41 +01:00
546ec46ab3
Add rule to detect kernel driver loading attempts
...
This rule detects userland binaries attempting to load kernel drivers using various techniques, including Native API usage and service creation.
2026-02-11 11:57:31 +01:00
1be8392e86
Add PPL_Weaponization_Intent rule for detection
...
This rule detects binaries attempting to escalate to Protected Process Light (PPL) using Driver IOCTL based on specific conditions and API calls.
2026-02-10 09:38:32 +01:00
9e12d6c614
Add YARA rule for detecting QueueUserAPC2 injection
...
This rule detects potential remote process injection using QueueUserAPC2 with Special User APC flags by looking for specific API calls and flags in PE files.
2026-01-29 09:50:04 +01:00
dacf325151
Add rule to detect PPL protection level queries
2026-01-28 14:41:56 +01:00
a488a3957f
Create RPC_Over_TCP_Communication.yar
2026-01-15 11:10:17 +01:00
71e91956f2
Rename Windows_RPC_Remote_Call.yml to Windows_RPC_Remote_Call.yar
2026-01-14 11:28:42 +01:00
2b270947a3
Create Windows_RPC_Remote_Call.yml
2026-01-14 11:28:04 +01:00
be86905cd1
Add rule for detecting custom DLL loading via NTDLL
...
This rule detects custom DLL loading techniques through NTDLL functions, focusing on specific strings and conditions.
2026-01-12 10:17:29 +01:00
0eceaa73d8
Add rule for detecting Thread Name-Calling DLL injection
...
This rule detects DLL injection via the Thread Name-Calling technique, focusing on specific APIs and indicators.
2025-12-30 11:51:16 +01:00
c2e24cd11b
Create Thread_NameCalling_Shellcode_Copy_Technique.yar
2025-12-29 12:01:03 +01:00
d88fa0fe82
Add rule to detect suspicious PostThreadMessage usage
...
This rule detects binaries that utilize PostThreadMessage for IPC, which can indicate potential malicious behavior.
2025-12-24 10:46:02 +01:00
23d7a475ba
Add YARA rule for suspicious clipboard IPC behavior
...
This rule detects binaries that manipulate the Windows clipboard for IPC, which can be exploited by malware for covert data exchange.
2025-12-24 10:04:39 +01:00
c863dd6758
Create CMSTP_UAC_Bypass_General.yar
2025-12-23 11:30:23 +01:00
4235461c0b
Create Win_ProcInj_ThreadNameCalling_General.yar
2025-12-22 12:41:51 +01:00
d70af77b66
Create Suspicious_Special_User_APC_Injection_With_Handle_Enumeration_And_RWX_Scan.yar
2025-12-16 11:50:42 +01:00
1fc8fbdd79
Create WIN_APC_Injection_NtQueueApcThreadEx2_SpecialUserAPC.yar
2025-12-09 10:17:01 +01:00
a17c2cd9c2
Add rule to detect IPC techniques using thread descriptions
...
This rule detects the use of SetThreadDescription and GetThreadDescription for covert IPC, enhancing detection capabilities with OpenThread.
2025-12-03 10:18:01 +01:00
c6c3322fdf
Create Donut_Process_Migration.yar
2025-11-10 11:59:03 +01:00
620919aa82
Add detection rule for section-based process injection
...
This rule detects binaries referencing APIs/constants used for section-based process injection, focusing on defensive detection.
2025-11-10 09:47:27 +01:00
f005d939e9
Add rule for detecting LDAP/AD enumeration techniques
...
This rule detects various LDAP and Active Directory enumeration techniques, including DC discovery and LDAP bind operations. It includes multiple strings for core LDAP APIs and common AD attributes to minimize false positives.
2025-11-06 09:35:29 +01:00
f110a9479b
Create Win_HTTP_JSON_C2_Poller_Generic.yar
2025-11-05 10:17:48 +01:00
1d523513e5
Create Windows_NamedPipe_Interactive_Shell.yar
2025-10-29 21:45:05 +01:00
f331342c11
Create Named_Pipe_Command_Execution_Technique.yar
2025-10-23 21:48:54 +02:00
dac090444a
Create dns_txt_c2_tunnel.yar
2025-10-22 21:48:26 +02:00
S12cybersecurity