admin/Yara-Rules-rules
1
0
Fork 0
mirror of https://github.com/Yara-Rules/rules synced 2026-06-08 12:58:40 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
Yara-Rules-rules/malware
T
History
Jaume Martin b942980fcf Merge pull request #424 from joshlemon/patch-1 
Create RANSOM_Revix.yar
2022-04-12 19:53:15 +02:00
..
Operation_Blockbuster
Merge pull request #348 from DottoPing/patch-5
2020-01-08 12:41:20 +01:00
000_common_rules.yar
Make is__elf private
2018-11-02 17:00:02 +01:00
APT_APT1.yar
Update apt1
2017-01-21 13:22:18 +01:00
APT_APT10.yar
Update APT_APT10.yar
2017-07-01 20:33:53 -04:00
APT_APT15.yar
Create APT_APT15.yar
2018-03-17 11:02:20 -04:00
APT_APT17.yar
Update APT_APT17.yar
2017-01-21 13:35:54 +01:00
APT_APT29_Grizzly_Steppe.yar
Update APT_APT29_Grizzly_Steppe.yar
2017-01-21 13:46:56 +01:00
APT_APT3102.yar
Update APT_APT3102.yar
2017-01-21 14:57:24 +01:00
APT_APT9002.yar
Update APT_APT9002.yar
2017-01-21 15:13:40 +01:00
APT_Backspace.yar
Update APT_Backspace.yar
2017-01-21 15:17:17 +01:00
APT_Bestia.yar
Update and rename APT_bestia.yar to APT_Bestia.yar
2016-03-01 11:25:57 +01:00
APT_Blackenergy.yar
Update APT_Blackenergy.yar
2017-01-21 15:32:33 +01:00
APT_Bluetermite_Emdivi.yar
Update APT_Bluetermite_Emdivi.yar
2017-01-21 15:40:39 +01:00
APT_C16.yar
Update APT_C16.yar
2017-01-21 15:57:27 +01:00
APT_Carbanak.yar
Update APT_Carbanak.yar
2017-01-21 16:04:07 +01:00
APT_Careto.yar
Update APT_Careto.yar
2017-01-21 16:11:51 +01:00
APT_Casper.yar
Update APT_Casper.yar
2017-01-21 16:36:03 +01:00
APT_CheshireCat.yar
Update APT_CheshireCat.yar
2017-01-21 16:50:46 +01:00
APT_Cloudduke.yar
Update APT_Cloudduke.yar
2017-01-21 16:55:33 +01:00
APT_Cobalt.yar
Updated and renamed name file APT_FIN7
2019-09-11 13:48:49 +02:00
APT_Codoso.yar
Update APT_Codoso.yar
2017-01-21 17:13:14 +01:00
APT_CrashOverride.yar
Create APT_CrashOverride.yar
2017-06-12 18:48:57 +02:00
APT_DeepPanda_Anthem.yar
Update APT_DeepPanda_Anthem.yar
2017-01-21 17:20:09 +01:00
APT_DeputyDog.yar
Update APT_DeputyDog.yar
2017-01-21 17:28:21 +01:00
APT_Derusbi.yar
Update APT_Derusbi.yar
2017-01-21 17:42:38 +01:00
APT_DPRK_ROKRAT.yar
Create APT_DPRK_ROKRAT.yar
2018-03-06 02:04:01 -05:00
APT_Dubnium.yar
Update APT_Dubnium.yar
2017-01-21 17:50:36 +01:00
APT_Duqu2.yar
Update APT_Duqu2.yar
2017-01-23 10:54:22 +01:00
APT_Emissary.yar
Update APT_Emissary.yar
2017-01-21 18:55:34 +01:00
APT_EnergeticBear_backdoored_ssh.yar
Create APT_EnergeticBear_backdoored_ssh.yar
2018-04-24 23:44:09 -04:00
APT_eqgrp_apr17.yar
Bugfix - comment symbols swapped
2017-04-19 14:31:12 +02:00
APT_Equation.yar
Update APT_Equation.yar
2017-01-21 23:35:57 +01:00
APT_EQUATIONGRP.yar
Update APT_EQUATIONGRP.yar
2017-01-21 18:49:16 +01:00
APT_fancybear_dnc.yar
Update APT_fancybear_dnc.yar
2017-01-24 11:52:11 +01:00
APT_fancybear_downdelph.yar
added apt28 downdelph rules
2017-06-14 09:37:52 +02:00
APT_FiveEyes.yar
Update APT_FiveEyes.yar
2017-01-22 08:42:55 +01:00
APT_furtim.yar
Update APT_furtim.yar
2017-01-24 12:01:39 +01:00
APT_FVEY_ShadowBrokers_Jan17_Screen_Strings.yar
Update APT_FVEY_ShadowBrokers_Jan17_Screen_Strings.yar
2017-01-22 08:32:43 +01:00
APT_Grasshopper.yar
Fixing rulenames in malware/APT_Grasshopper.yar
2017-04-08 09:45:08 +02:00
APT_Greenbug.yar
Create APT_Greenbug.yar
2017-02-13 10:40:48 +01:00
APT_Grizzlybear_uscert.yar
Create APT_Grizzlybear_uscert.yar
2017-02-13 10:41:44 +01:00
APT_HackingTeam.yar
Update APT_HackingTeam.yar
2017-01-22 08:59:22 +01:00
APT_Hellsing.yar
Update APT_Hellsing.yar
2017-01-22 09:12:41 +01:00
APT_HiddenCobra.yar
Update APT_HiddenCobra.yar
2018-04-12 19:00:23 +02:00
APT_Hikit.yar
Update APT_Hikit.yar
2017-01-22 10:28:07 +01:00
APT_Industroyer.yar
Create APT_Industroyer.yar
2017-06-14 09:31:21 +02:00
APT_Irontiger.yar
Update APT_Irontiger.yar
2017-01-22 10:40:20 +01:00
APT_Kaba.yar
Update APT_Kaba.yar
2017-01-22 13:06:33 +01:00
APT_Ke3Chang_TidePool.yar
Update APT_Ke3Chang_TidePool.yar
2017-01-22 13:12:24 +01:00
APT_KeyBoy.yar
Update APT_KeyBoy.yar
2017-01-22 13:28:04 +01:00
APT_LotusBlossom.yar
Update APT_LotusBlossom.yar
2017-01-22 13:31:53 +01:00
APT_Minidionis.yar
Update APT_Minidionis.yar
2017-01-22 22:09:50 +01:00
APT_Mirage.yar
Update APT_Mirage.yar
2017-01-22 22:13:36 +01:00
APT_Molerats.yar
Update APT_Molerats.yar
2017-01-22 22:22:07 +01:00
APT_Mongall.yar
Update APT_Mongall.yar
2017-01-22 22:25:11 +01:00
APT_MoonlightMaze.yar
add .yar extension
2020-06-30 17:02:13 -04:00
APT_NGO.yar
Update APT_NGO.yar
2017-01-23 08:15:27 +01:00
APT_Oilrig.yar
Update APT_Oilrig.yar
2017-01-23 08:57:32 +01:00
APT_OpClandestineWolf.yar
Update APT_OpClandestineWolf.yar
2017-01-23 09:04:15 +01:00
APT_OPCleaver.yar
Update APT_OPCleaver.yar
2017-01-23 08:42:43 +01:00
APT_OpDustStorm.yar
Update APT_OpDustStorm.yar
2017-01-23 09:09:59 +01:00
APT_OpPotao.yar
Update APT_OpPotao.yar
2017-01-23 09:14:18 +01:00
APT_Passcv.yar
Update APT_Passcv.yar
2017-01-23 09:30:50 +01:00
APT_PCclient.yar
Update APT_PCclient.yar
2017-01-23 09:23:08 +01:00
APT_Pipcreat.yar
Update APT_Pipcreat.yar
2017-01-23 09:40:52 +01:00
APT_Platinum.yar
Update APT_Platinum.yar
2017-01-23 10:05:41 +01:00
APT_Poseidon_Group.yar
Update APT_Poseidon_Group.yar
2017-01-23 10:13:14 +01:00
APT_Prikormka.yar
Update APT_Prikormka.yar
2017-01-23 10:20:34 +01:00
APT_PutterPanda.yar
Update APT_PutterPanda.yar
2017-01-23 10:37:58 +01:00
APT_RedLeaves.yar
add .yar extension
2020-06-30 17:04:19 -04:00
APT_Regin.yar
Update APT_Regin.yar
2017-01-23 16:09:18 +01:00
APT_RemSec.yar
Rename APT_RemSec to APT_RemSec.yar
2017-12-19 19:07:53 -05:00
APT_Sauron_extras.yar
add .yar extension
2020-06-30 17:03:40 -04:00
APT_Sauron.yar
add .yar extension
2020-06-30 17:02:59 -04:00
APT_Scarab_Scieron.yar
Rename Scieron.yar to APT_Scarab_Scieron.yar
2016-07-20 14:24:05 +02:00
APT_Seaduke.yar
Update APT_Seaduke.yar
2017-01-23 17:27:20 +01:00
APT_Shamoon_StoneDrill.yar
Update APT_Shamoon_StoneDrill.yar
2017-03-07 08:44:53 +01:00
APT_Snowglobe_Babar.yar
Update APT_Snowglobe_Babar.yar
2017-01-23 17:30:17 +01:00
APT_Sofacy_Bundestag.yar
Update APT_Sofacy_Bundestag.yar
2017-01-23 17:45:56 +01:00
APT_Sofacy_Fysbis.yar
Update APT_Sofacy_Fysbis.yar
2017-01-23 17:50:54 +01:00
APT_Sofacy_Jun16.yar
Update APT_Sofacy_Jun16.yar
2017-01-23 17:59:29 +01:00
APT_Sphinx_Moth.yar
Update APT_Sphinx_Moth.yar
2017-01-23 18:04:17 +01:00
APT_Stuxnet.yar
trying to pass the CI pipeline
2020-12-23 23:09:32 -06:00
APT_Terracota.yar
Update APT_Terracota.yar
2017-01-23 18:13:39 +01:00
APT_ThreatGroup3390.yar
Update APT_ThreatGroup3390.yar
2017-01-23 18:18:15 +01:00
APT_TradeSecret.yar
Create APT_TradeSecret.yar
2017-04-21 08:38:50 +02:00
APT_Turla_Neuron.yar
Add Turla neuron2 from NCSC report
2018-02-06 02:34:38 +00:00
APT_Turla_RUAG.yar
Update APT_Turla_RUAG.yar
2017-01-23 18:35:45 +01:00
APT_Unit78020.yar
Update APT_Unit78020.yar
2017-01-23 19:13:44 +01:00
APT_UP007_SLServer.yar
Update APT_UP007_SLServer.yar
2017-01-23 18:53:45 +01:00
APT_Uppercut.yar
MenuPass Uppercut rule added
2018-09-17 14:12:00 -04:00
APT_Waterbug.yar
Update APT_Waterbug.yar
2017-01-23 19:15:53 +01:00
APT_WildNeutron.yar
Remove chickenkiller string
2017-07-18 16:27:02 -04:00
APT_Windigo_Onimiki.yar
Update APT_Windigo_Onimiki.yar
2017-01-24 11:28:46 +01:00
APT_Winnti.yar
Update APT_Winnti.yar
2017-01-24 11:34:57 +01:00
APT_WoolenGoldfish.yar
Update APT_WoolenGoldfish.yar
2017-01-24 11:48:33 +01:00
EXPERIMENTAL_Beef.yar
Update EXPERIMENTAL_Beef.yar
2017-01-24 12:22:28 +01:00
GEN_PowerShell.yar
Update GEN_PowerShell.yar
2017-01-24 12:35:05 +01:00
MalConfScan.yar
Renamed Njrat to Njrat2 in terms to avoid conflicts
2020-02-24 13:14:20 +01:00
MALW_adwind_RAT.yar
Missing underscore
2017-07-03 14:48:11 +02:00
MALW_AgentTesla_SMTP.yar
Adding yara rules for AgentTesla SMTP variant and fortis mawlare.
2018-03-09 12:58:36 -07:00
MALW_AgentTesla.yar
Update MALW_AgentTesla.yar
2018-01-16 08:19:42 +01:00
MALW_Alina.yar
Update MALW_Alina.yar
2017-01-24 12:44:52 +01:00
MALW_AlMashreq.yar
new rules for MedusaHTTP version from 2019 and AlMashreq agent.
2019-08-13 10:20:24 -06:00
MALW_Andromeda.yar
Update MALW_Andromeda.yar
2017-01-24 12:55:35 +01:00
MALW_Arkei.yar
Create MALW_Arkei.yar
2018-08-31 14:43:42 +02:00
MALW_Athena.yar
Update MALW_Athena.yar
2017-01-24 13:00:33 +01:00
MALW_ATM_HelloWorld.yar
Syntax error fixed
2019-05-07 09:15:09 +02:00
MALW_Atmos.yar
Update MALW_Atmos.yar
2017-01-24 13:11:29 +01:00
MALW_ATMPot.yar
Create MALW_ATMPot.yar
2019-03-17 23:06:59 +01:00
MALW_AZORULT.yar
Update MALW_AZORULT.yar
2018-01-13 20:58:37 +01:00
MALW_BackdoorSSH.yar
Update MALW_BackdoorSSH.yar
2017-01-24 13:13:45 +01:00
MALW_Backoff.yar
Update MALW_Backoff.yar
2017-01-24 13:15:22 +01:00
MALW_Bangat.yar
Update MALW_Bangat.yar
2017-01-24 13:24:40 +01:00
MALW_Batel.yar
Update MALW_Batel.yar
2017-01-24 13:29:50 +01:00
MALW_BlackRev.yar
Rename BlackRev.yar to MALW_BlackRev.yar
2016-07-20 13:23:58 +02:00
MALW_BlackWorm.yar
Update MALW_BlackWorm.yar
2017-01-24 13:31:59 +01:00
MALW_Boouset.yar
Update MALW_Boouset.yar
2017-01-24 13:34:28 +01:00
MALW_Bublik.yar
Update MALW_Bublik.yar
2017-01-24 13:36:05 +01:00
MALW_Buzus_Softpulse.yar
Update MALW_Buzus_Softpulse.yar
2017-01-24 13:39:58 +01:00
MALW_CAP_HookExKeylogger.yar
Update MALW_CAP_HookExKeylogger.yar
2017-01-24 13:49:10 +01:00
MALW_Chicken.yar
Update MALW_Chicken.yar
2017-01-24 13:57:22 +01:00
MALW_Citadel.yar
Update MALW_Citadel.yar
2017-01-24 14:24:18 +01:00
MALW_Cloaking.yar
Update MALW_Cloaking.yar
2017-01-24 14:26:51 +01:00
MALW_Cookies.yar
Update MALW_Cookies.yar
2017-01-24 14:32:50 +01:00
MALW_Corkow.yar
Adding malware/APT_Grasshopper.yar
2017-04-08 00:29:00 +02:00
MALW_Cxpid.yar
Update MALW_Cxpid.yar
2017-01-24 14:36:27 +01:00
MALW_Cythosia.yar
Update MALW_Cythosia.yar
2017-01-24 14:39:01 +01:00
MALW_DDoSTf.yar
Update MALW_DDoSTf.yar
2017-01-24 14:39:53 +01:00
MALW_Derkziel.yar
Update MALW_Derkziel.yar
2017-01-24 14:41:20 +01:00
MALW_Dexter.yar
Update MALW_Dexter.yar
2017-01-24 14:43:42 +01:00
MALW_DiamondFox.yar
Update MALW_DiamondFox.yar
2017-01-24 14:44:42 +01:00
MALW_DirtJumper.yar
Update MALW_DirtJumper.yar
2017-01-24 14:46:26 +01:00
MALW_Eicar.yar
add .yar extension
2020-06-30 17:07:30 -04:00
MALW_Elex.yar
Update MALW_Elex.yar
2017-01-24 14:51:44 +01:00
MALW_Elknot.yar
Rename MalW_Elknot.yar to MALW_Elknot.yar
2016-07-20 14:16:40 +02:00
MALW_Emotet.yar
Create MALW_Emotet.yar
2017-10-19 08:54:44 +02:00
MALW_Empire.yar
Create MALW_Empire.yar
2016-11-15 10:43:12 +01:00
MALW_Enfal.yar
Rename Enfal.yar to MALW_Enfal.yar
2016-07-20 13:44:36 +02:00
MALW_Exploit_UAC_Elevators.yar
Rename exploit_uac_elevators.yar to MALW_Exploit_UAC_Elevators.yar
2016-07-21 14:50:51 +02:00
MALW_Ezcob.yar
Rename Ezcob.yar to MALW_Ezcob.yar
2016-07-20 13:48:17 +02:00
MALW_F0xy.yar
Rename F0xy.yar to MALW_F0xy.yar
2016-07-20 13:49:04 +02:00
MALW_FakeM.yar
Rename FakeM.yar to MALW_FakeM.yar
2016-07-20 13:49:31 +02:00
MALW_FALLCHILL.yar
Rename MALW_FALLCHILL to MALW_FALLCHILL.yar
2017-11-23 10:45:17 +01:00
MALW_Fareit.yar
Rename Crime_Fareit.yar to MALW_Fareit.yar
2016-07-20 13:35:13 +02:00
MALW_Favorite.yar
Rename favorite.yar to MALW_Favorite.yar
2016-07-21 14:41:53 +02:00
MALW_FUDCrypt.yar
Update MALW_FUDCrypt.yar
2020-01-07 18:55:18 +01:00
MALW_Furtim.yar
Create MALW_Furtim.yar
2016-07-29 14:12:34 +02:00
MALW_Gafgyt.yar
Create MALW_Gafgyt.yar
2017-06-08 09:31:15 +02:00
MALW_Genome.yar
Rename Genome.yar to MALW_Genome.yar
2016-07-20 13:52:45 +02:00
MALW_Glasses.yar
Tighten Glasses rule
2021-11-17 21:22:17 -07:00
MALW_Gozi.yar
Rename Gozi_Family.yar to MALW_Gozi.yar
2016-07-20 13:55:00 +02:00
MALW_Grozlex.yar
Rename Grozlex.yar to MALW_Grozlex.yar
2016-07-20 14:00:57 +02:00
MALW_Hajime.yar
IOT malware Hajime
2017-05-08 16:55:51 +02:00
MALW_hancitor.yar
new rule for hancitor botnet malware
2018-09-18 11:16:41 -06:00
MALW_Hsdfihdf_banking.yar
Rename Hsdfihdf_banking_malware.yar to MALW_Hsdfihdf_banking.yar
2016-07-20 14:06:51 +02:00
MALW_Httpsd_ELF.yar
Update MALW_Httpsd_ELF.yar
2018-06-02 19:54:17 +02:00
MALW_IcedID.yar
Update MALW_IcedID.yar
2018-01-21 21:47:41 +09:00
MALW_Iexpl0ree.yar
Rename iexpl0ree.yar to MALW_Iexpl0ree.yar
2016-07-21 14:47:36 +02:00
MALW_IMuler.yar
Rename IMuler.yar to MALW_IMuler.yar
2016-07-20 14:07:08 +02:00
MALW_Install11.yar
Rename Install11.yar to MALW_Install11.yar
2016-07-20 14:07:24 +02:00
MALW_Intel_Virtualization.yar
Rename Intel_Virtualization.yar to MALW_Intel_Virtualization.yar
2016-07-20 14:08:20 +02:00
MALW_IotReaper.yar
Create MALW_IotReaper.yar
2017-11-01 18:34:11 +01:00
MALW_Jolob_Backdoor.yar
Create MALW_Jolob_Backdoor.yar
2016-09-30 08:49:20 +02:00
MALW_Kelihos.yar
Rename Kelihos.yar to MALW_Kelihos.yar
2016-07-20 14:10:53 +02:00
MALW_KeyBase.yar
Create MALW_KeyBase.yar
2019-03-08 20:30:23 +00:00
MALW_KINS.yar
Update and rename KINS.yar to MALW_KINS.yar
2016-07-20 14:10:16 +02:00
MALW_kirbi_mimikatz.yar
add .yar extension
2020-06-30 17:08:20 -04:00
MALW_Korlia.yar
Create MALW_Korlia.yar
2016-11-18 11:59:07 +01:00
MALW_Korplug.yar
Update MALW_Korplug.yar
2016-09-30 08:38:43 +02:00
MALW_Kovter.yar
Create MALW_Kovter.yar
2016-09-30 08:40:26 +02:00
MALW_kpot.yar
added sig for kpot stealer
2018-08-29 16:52:07 -06:00
MALW_Kraken.yar
Update and rename kraken_bot1.yar to MALW_Kraken.yar
2016-07-21 14:45:16 +02:00
MALW_Kwampirs.yar
Create MALW_Kwampirs.yar
2018-04-24 23:35:16 -04:00
MALW_Lateral_Movement.yar
Create MALW_Lateral_Movement.yar
2016-09-30 08:41:27 +02:00
MALW_Lenovo_Superfish.yar
Rename Lenovo_superfish.yar to MALW_Lenovo_Superfish.yar
2016-07-20 14:13:52 +02:00
MALW_LinuxBew.yar
Create MALW_LinuxBew.yar
2017-11-01 18:24:27 +01:00
MALW_LinuxHelios.yar
Create MALW_LinuxHelios.yar
2017-11-01 18:32:37 +01:00
MALW_LinuxMoose.yar
Rename LinuxMoose.yar to MALW_LinuxMoose.yar
2016-07-20 14:11:53 +02:00
MALW_LostDoor.yar
Rename LostDoor.yar to MALW_LostDoor.yar
2016-07-20 14:14:48 +02:00
MALW_LuaBot.yar
Update MALW_LuaBot.yar
2017-06-21 17:16:56 +02:00
MALW_LuckyCat.yar
Rename LuckyCat.yar to MALW_LuckyCat.yar
2016-07-20 14:15:05 +02:00
MALW_LURK0.yar
Rename LURK0.yar to MALW_LURK0.yar
2016-07-20 14:12:15 +02:00
MALW_MacControl.yar
Rename MacControl.yar to MALW_MacControl.yar
2016-07-20 14:17:12 +02:00
MALW_MacGyver.yar
Create MALW_MacGyver.yar
2021-05-11 18:14:14 +02:00
MALW_Madness.yar
Update and rename Madness.yar to MALW_Madness.yar
2016-07-20 14:17:58 +02:00
MALW_Magento_backend.yar
Create MALW_Magento_backend.yar
2017-01-10 18:06:41 +01:00
MALW_Magento_frontend.yar
Update MALW_Magento_frontend.yar
2017-01-10 18:09:22 +01:00
MALW_Magento_suspicious.yar
Fix #265 Included filesize condition in all rules
2017-07-11 12:24:26 +02:00
MALW_Mailers.yar
Rename Mailers.yar to MALW_Mailers.yar
2016-07-20 14:18:29 +02:00
MALW_marap.yar
added marap.yar signature
2018-08-20 08:24:24 -06:00
MALW_MedusaHTTP_2019.yar
new rules for MedusaHTTP version from 2019 and AlMashreq agent.
2019-08-13 10:20:24 -06:00
MALW_Miancha.yar
Rename Miancha.yar to MALW_Miancha.yar
2016-07-20 14:19:56 +02:00
MALW_MiniAsp3_mem.yar
Update and rename MiniAsp3_mem.yar to MALW_MiniAsp3_mem.yar
2016-07-20 14:20:28 +02:00
MALW_Mirai_Okiru_ELF.yar
Update MALW_Mirai_Okiru_ELF.yar
2018-06-02 19:19:35 +02:00
MALW_Mirai_Satori_ELF.yar
Update MALW_Mirai_Satori_ELF.yar
2018-06-02 19:19:58 +02:00
MALW_Mirai.yar
Update MALW_Mirai.yar
2017-05-08 22:56:19 +02:00
MALW_Miscelanea_Linux.yar
Move more generic rules to capabilities category.
2020-01-17 03:13:57 +00:00
MALW_Miscelanea.yar
Added rule Invoke_mimikittenz
2016-08-01 22:16:17 +02:00
MALW_Monero_Miner_installer.yar
Create MALW_Monero_Miner_installer.yar
2018-02-04 11:58:37 -05:00
MALW_MSILStealer.yar
Update MALW_MSILStealer.yar
2020-01-07 18:55:31 +01:00
MALW_Naikon.yar
Rename Naikon.yar to MALW_Naikon.yar
2016-07-21 14:31:49 +02:00
MALW_Naspyupdate.yar
Rename naspyupdate.yar to MALW_Naspyupdate.yar
2016-07-21 14:42:24 +02:00
MALW_NetTraveler.yar
Rename NetTraveler.yar to MALW_NetTraveler.yar
2016-07-21 14:34:41 +02:00
MALW_NionSpy.yar
Update and rename W32_NionSpy.yar to MALW_NionSpy.yar
2016-07-20 15:00:29 +02:00
MALW_Notepad.yar
Rename Notepad.yar to MALW_Notepad.yar
2016-07-21 15:18:02 +02:00
MALW_NSFree.yar
Rename NSFree.yar to MALW_NSFree.yar
2016-07-20 14:59:53 +02:00
MALW_Odinaff.yar
Create Malware Odinaff
2016-10-26 21:38:21 +02:00
MALW_Olyx.yar
Rename Olyx.yar to MALW_Olyx.yar
2016-07-21 15:19:14 +02:00
MALW_OSX_Leverage.yar
Rename Leverage.yar to MALW_OSX_Leverage.yar
2016-07-20 14:14:23 +02:00
MALW_PE_sections.yar
Fix suspicious_packer_section rule
2019-03-24 01:26:34 +00:00
MALW_PittyTiger.yar
Rename PittyTiger.yar to MALW_PittyTiger.yar
2016-07-21 15:18:55 +02:00
MALW_PolishBankRat.yar
rename malware rules missing .yar extension and add to index.
2020-06-27 22:21:32 -06:00
MALW_Ponmocup.yar
Update MALW_Ponmocup.yar
2016-07-21 15:03:21 +02:00
MALW_Pony.yar
Rename Pony.yar to MALW_Pony.yar
2016-07-21 15:18:24 +02:00
MALW_Predator.yar
Create MALW_Predator.yar
2018-10-16 16:52:13 +02:00
MALW_PubSab.yar
Rename PubSab.yar to MALW_PubSab.yar
2016-07-21 15:16:55 +02:00
MALW_PurpleWave.yar
Create MALW_PurpleWave.yar
2020-08-02 19:42:46 +02:00
MALW_Pyinstaller_OSX.yar
pyinstaller on macos
2022-04-01 17:12:35 +08:00
MALW_Pyinstaller.yar
Rename pyinstaller.yar to MALW_Pyinstaller.yar
2016-07-21 14:40:30 +02:00
MALW_PyPI.yar
Rename MALW_PyPI to MALW_PyPI.yar
2017-09-18 08:52:00 +02:00
MALW_Quarian.yar
Rename Quarian.yar to MALW_Quarian.yar
2016-07-21 15:15:39 +02:00
MALW_Rebirth_Vulcan_ELF.yar
Move is__elf to MISC_Utils.yar
2018-06-02 18:49:19 +02:00
MALW_Regsubdat.yar
Rename Regsubdat.yar to MALW_Regsubdat.yar
2016-07-20 13:55:19 +02:00
MALW_Rockloader.yar
Rename Rockloader.yar to MALW_Rockloader.yar
2016-07-21 15:01:08 +02:00
MALW_Rooter.yar
Rename Rooter.yar to MALW_Rooter.yar
2016-07-21 15:10:53 +02:00
MALW_Rovnix.yar
Update and rename rovnix_downloader_sinkhole_check.yar to MALW_Rovnix.yar
2016-07-21 14:39:32 +02:00
MALW_Safenet.yar
Rename Safenet.yar to MALW_Safenet.yar
2016-07-21 15:08:40 +02:00
MALW_Sakurel.yar
Create MALW_Sakurel.yar
2016-09-30 08:43:40 +02:00
MALW_Sayad.yar
Update and rename Sayad.yar to MALW_Sayad.yar
2016-07-21 15:07:16 +02:00
MALW_Scarhikn.yar
Rename Scarhikn.yar to MALW_Scarhikn.yar
2016-07-21 15:06:19 +02:00
MALW_Sendsafe.yar
Create MALW_Sendsafe.yar
2016-09-14 08:44:31 +02:00
MALW_Shamoon.yar
Update MALW_Shamoon.yar
2016-12-07 14:57:57 +01:00
MALW_shifu_shiz.yar
added marap.yar signature
2018-08-20 08:24:24 -06:00
MALW_Shifu.yar
Update MALW_Shifu.yar
2016-07-21 10:39:19 +02:00
MALW_sitrof_fortis_scar.yar
Adding yara rules for AgentTesla SMTP variant and fortis mawlare.
2018-03-09 12:58:36 -07:00
MALW_Skeleton.yar
Rename Skeleton.yar to MALW_Skeleton.yar
2016-07-20 14:26:37 +02:00
MALW_Spora.yar
Update MALW_Spora.yar
2017-03-23 10:45:15 +01:00
MALW_Sqlite.yar
Rename sqlite.yar to MALW_Sqlite.yar
2016-07-21 14:38:28 +02:00
MALW_Stealer.yar
Rename Stealer.yar to MALW_Stealer.yar
2016-07-21 15:05:44 +02:00
MALW_Surtr.yar
Marking Surtr referenced rules RSharedStrings, RemoteStrings, and GmRemoteStrings as private to limit false alerts.
2020-09-21 16:53:21 -06:00
MALW_T5000.yar
Rename T5000.yar to MALW_T5000.yar
2016-07-21 14:55:48 +02:00
MALW_Tedroo.yar
Rename tedroo.yar to MALW_Tedroo.yar
2016-07-21 14:36:31 +02:00
MALW_Tinba.yar
Update and rename Tinba_Banking_Trojan.yar to MALW_Tinba.yar
2016-07-21 15:04:41 +02:00
MALW_TinyShell_Backdoor_gen.yar
Move is__elf to MISC_Utils.yar
2018-06-02 18:50:37 +02:00
MALW_Torte_ELF.yar
Move is__elf to MISC_Utils.yar
2018-06-02 18:50:02 +02:00
MALW_TreasureHunt.yar
Rename TreasureHunt.yar to MALW_TreasureHunt.yar
2016-07-21 15:04:06 +02:00
MALW_TrickBot.yar
Create MALW_TrickBot.yar
2017-06-13 10:09:56 +02:00
MALW_TRITON_HATMAN.yar
solve Privete Global rules
2018-08-27 12:21:43 +02:00
MALW_TRITON_ICS_FRAMEWORK.yar
Create MALW_TRITON_ICS_FRAMEWORK.yar
2018-01-18 10:12:17 +01:00
MALW_Trumpbot.yar
Create MALW_Trumpbot.yar
2017-11-01 18:25:44 +01:00
MALW_Upatre.yar
Rename crime_upatre_oct15.yar to MALW_Upatre.yar
2016-07-21 14:52:26 +02:00
MALW_Urausy.yar
Update and rename Urausy.yar to MALW_Urausy.yar
2016-07-21 15:02:33 +02:00
MALW_Vidgrab.yar
Rename Vidgrab.yar to MALW_Vidgrab.yar
2016-07-21 15:02:09 +02:00
MALW_viotto_keylogger.yar
Create MALW_viotto_keylogger.yar
2016-10-21 15:28:54 +02:00
MALW_Virut_FileInfector_UNK_VERSION.yar
Create MALW_Virut_FileInfector_UNK_VERSION.yar
2017-08-04 20:11:38 +02:00
MALW_Volgmer.yar
Create MALW_Volgmer.yar
2017-11-15 08:55:44 +01:00
MALW_Wabot.yar
Rename Wabot.yar to MALW_Wabot.yar
2016-07-21 15:01:49 +02:00
MALW_Warp.yar
Rename Warp.yar to MALW_Warp.yar
2016-07-21 14:57:11 +02:00
MALW_Wimmie.yar
Rename Wimmie.yar to MALW_Wimmie.yar
2016-07-21 14:56:56 +02:00
MALW_xDedic_marketplace.yar
Update and rename xDedic_marketplace.yar to MALW_xDedic_marketplace.yar
2016-07-21 14:33:08 +02:00
MALW_XHide.yar
Create MALW_XHide.yar
2017-11-30 23:47:38 +01:00
MALW_XMRIG_Miner.yar
Rename MALW_XMRIG_Miner to MALW_XMRIG_Miner.yar
2017-12-01 08:36:34 +01:00
MALW_XOR_DDos.yar
Rename XOR_DDosv1.yar to MALW_XOR_DDos.yar
2016-07-21 14:53:44 +02:00
MALW_Yayih.yar
Rename Yayih.yar to MALW_Yayih.yar
2016-07-21 14:52:00 +02:00
MALW_Yordanyan_ActiveAgent.yar
Update MALW_Yordanyan_ActiveAgent.yar
2018-10-04 12:01:09 -06:00
MALW_Zegost.yar
Rename Zegost.yar to MALW_Zegost.yar
2016-07-21 14:53:10 +02:00
MALW_Zeus.yar
Update MALW_Zeus.yar
2017-11-13 11:44:08 +01:00
POS_Bernhard.yar
Rename POS_bernhardPos.yar to POS_Bernhard.yar
2016-07-21 15:17:42 +02:00
POS_BruteforcingBot.yar
Create POS_BruteforcingBot.yar
2016-09-30 08:46:04 +02:00
POS_Easterjack.yar
Create POS_Easterjack.yar
2015-11-26 09:19:40 +01:00
POS_FastPOS.yar
Rename POS_MALW_FastPOS.yar to POS_FastPOS.yar
2016-07-20 14:18:56 +02:00
POS_LogPOS.yar
Rename LogPOS.yar to POS_LogPOS.yar
2015-11-26 09:20:45 +01:00
POS_MalumPOS.yar
Rename MalumPOS.yar to POS_MalumPOS.yar
2015-11-26 09:20:59 +01:00
POS_Mozart.yar
Rename mozart.yar to POS_Mozart.yar
2016-07-21 14:42:41 +02:00
POS.yar
Rename POS to POS.yar
2015-05-26 13:18:42 +02:00
RANSOM_777.yar
Rename MW_Ransomware_777.yar to RANSOM_777.yar
2016-07-20 14:15:43 +02:00
RANSOM_.CRYPTXXX.yar
Create RANSOM_.CRYPTXXX.yar
2016-09-29 09:52:15 +02:00
RANSOM_acroware.yar
Fixing issues
2020-07-01 22:52:12 +02:00
RANSOM_Alpha.yar
Update RANSOM_Alpha.yar
2016-10-18 08:54:13 +02:00
RANSOM_BadRabbit.yar
Create RANSOM_BadRabbit.yar
2017-10-25 10:14:28 +02:00
RANSOM_Cerber.yar
New rule Cerber5
2017-01-03 16:12:01 +01:00
RANSOM_Comodosec.yar
Create RANSOM_Comodosec.yar
2017-01-10 17:50:30 +01:00
RANSOM_Crypren.yar
Rename Crypren_ransomware to RANSOM_Crypren.yar
2016-07-20 13:36:12 +02:00
RANSOM_Cryptolocker.yar
Rename Ransomware.yar to RANSOM_Cryptolocker.yar
2016-07-21 14:44:48 +02:00
RANSOM_CryptoNar.yar
Create RANSOM_CryptoNar.yar
2018-09-01 18:23:38 +02:00
RANSOM_DMALocker.yar
Update and rename Ransom_DMALocker.yar to RANSOM_DMALocker.yar
2016-07-21 14:54:16 +02:00
RANSOM_DoublePulsar_Petya.yar
Create RANSOM_DoublePulsar_Petya.yar
2017-07-01 18:14:17 -04:00
RANSOM_Erebus.yar
Create RANSOM_Erebus.yar
2017-06-25 15:09:03 +02:00
RANSOM_GoldenEye.yar
Create RANSOM_GoldenEye.yar
2016-12-15 17:38:31 +01:00
RANSOM_GPGQwerty.yar
Create RANSOM_GPGQwerty.yar
2018-03-21 14:34:27 -04:00
RANSOM_jeff_dev.yar
add .yar extension
2020-06-30 17:14:54 -04:00
RANSOM_locdoor.yar
add .yar extension
2020-06-30 17:15:37 -04:00
RANSOM_Locky.yar
Fixed some errors
2016-10-18 14:02:02 +02:00
RANSOM_Maze.yar
Create RANSOM_Maze.yar
2019-11-24 20:11:06 +01:00
RANSOM_MS17-010_Wannacrypt.yar
Update RANSOM_MS17-010_Wannacrypt.yar
2018-02-04 12:09:52 -05:00
RANSOM_PetrWrap.yar
Creating ransomware_PetrWrap.yar
2017-06-27 21:35:15 -04:00
RANSOM_Petya_MS17_010.yar
add .yar extension
2020-06-30 17:05:15 -04:00
RANSOM_Petya.yar
Update RANSOM_Petya.yar
2016-10-18 14:21:08 +02:00
RANSOM_Pico.yar
add .yar extension
2020-06-30 17:06:14 -04:00
RANSOM_Revix.yar
Create RANSOM_Revix.yar
2021-12-07 15:46:02 +11:00
RANSOM_SamSam.yar
Create RANSOM_SamSam.yar
2018-03-21 14:39:37 -04:00
RANSOM_Satana.yar
Create RANSOM_Satana.yar
2016-10-18 08:58:29 +02:00
RANSOM_screenlocker_5h311_1nj3c706.yar
add .yar extension
2020-06-30 17:17:00 -04:00
RANSOM_Shiva.yar
add .yar extension
2020-06-30 17:16:18 -04:00
RANSOM_shrug2.yar
add .yar extension
2020-06-30 17:17:31 -04:00
RANSOM_Sigma.yar
create RANSOM_Sigma.yar
2018-05-09 20:49:07 -06:00
RANSOM_Snake.yar
Snake Ransomware yara rule
2020-05-15 11:14:55 +05:45
RANSOM_Stampado.yar
import missing
2016-10-10 18:40:45 +02:00
RANSOM_termite.yar
add .yar extension
2020-06-30 17:17:55 -04:00
RANSOM_TeslaCrypt.yar
Rename Ransom_TeslaCrypt.yar to RANSOM_TeslaCrypt.yar
2016-07-21 14:55:03 +02:00
RANSOM_Tox.yar
Rename tox.yar to RANSOM_Tox.yar
2016-07-21 14:36:09 +02:00
RAT_Adwind.yar
Update and rename Adwind_JAR_PACKA.yar to RAT_Adwind.yar
2016-07-20 11:34:59 +02:00
RAT_Adzok.yar
Update and rename Adzok_RAT.yar to RAT_Adzok.yar
2016-07-20 09:11:39 +02:00
RAT_Asyncrat.yar
new yara rule for AsyncRAT
2020-05-14 10:48:24 +02:00
RAT_BlackShades.yar
Update and rename BlackShades.yar to RAT_BlackShades.yar
2016-07-20 13:24:47 +02:00
RAT_Bolonyokte.yar
Rename Bolonyokte.yar to RAT_Bolonyokte.yar
2016-07-20 13:26:03 +02:00
RAT_Bozok.yar
Update and rename Bozok.yar to RAT_Bozok.yar
2016-07-20 13:27:25 +02:00
RAT_Cerberus.yar
Update and rename Cerberus.yar to RAT_Cerberus.yar
2016-07-20 13:31:57 +02:00
RAT_Crimson.yar
Update and rename Crimson_RAT.yar to RAT_Crimson.yar
2016-07-20 09:23:16 +02:00
RAT_CrossRAT.yar
solve Privete Global rules
2018-08-27 12:21:43 +02:00
RAT_CyberGate.yar
Update RAT_CyberGate.yar
2016-07-20 13:40:31 +02:00
RAT_DarkComet.yar
Update RAT_DarkComet.yar
2016-09-30 08:36:20 +02:00
RAT_FlyingKitten.yar
Update and rename FlyingKitten.yar to RAT_FlyingKitten.yar
2016-07-20 13:55:39 +02:00
RAT_Gh0st.yar
Update and rename Gh0st.yar to RAT_Gh0st.yar
2016-07-20 13:57:12 +02:00
RAT_Gholee.yar
Rename Gholee.yar to RAT_Gholee.yar
2016-07-20 13:58:58 +02:00
RAT_Glass.yar
Update and rename GlassRAT.yar to RAT_Glass.yar
2016-07-20 09:24:32 +02:00
RAT_Havex.yar
Update RAT_Havex.yar
2016-07-20 14:05:04 +02:00
RAT_Hizor.yar
Rename APT_RAT_Hizor.yar to RAT_Hizor.yar
2016-07-20 11:54:43 +02:00
RAT_Indetectables.yar
Update and rename APT_RAT_indetectables.yar to RAT_Indetectables.yar
2016-07-20 11:48:06 +02:00
RAT_Inocnation.yar
Rename inocnation.yar to RAT_Inocnation.yar
2016-07-21 14:47:15 +02:00
RAT_jRAT.yar
Update and rename jRAT.yar to RAT_jRAT.yar
2016-07-20 09:27:19 +02:00
RAT_Meterpreter_Reverse_Tcp.yar
Rename Meterpreter_Reverse_Tcp.yar to RAT_Meterpreter_Reverse_Tcp.yar
2016-07-20 14:19:24 +02:00
RAT_Nanocore.yar
Update RAT_Nanocore.yar
2016-11-15 11:00:37 +01:00
RAT_NetwiredRC.yar
Update and rename netwiredRC.yar to RAT_NetwiredRC.yar
2016-07-21 14:41:32 +02:00
RAT_Njrat.yar
Update RAT_Njrat.yar
2016-11-28 13:53:31 +01:00
RAT_Orcus.yar
add .yar extension
2020-06-30 17:18:26 -04:00
RAT_PlugX.yar
Update RAT_PlugX.yar
2016-09-30 08:42:38 +02:00
RAT_PoetRATDoc.yar
Renamed poetRAT to avoid dupes + adjusted critera
2020-05-23 19:54:23 +02:00
RAT_PoetRATPython.yar
Renamed poetRAT to avoid dupes + adjusted critera
2020-05-23 19:54:23 +02:00
RAT_PoisonIvy.yar
Rename PoisonIvy.yar to RAT_PoisonIvy.yar
2016-07-21 15:20:06 +02:00
RAT_Ratdecoders.yar
change file type comment from exe to jar for JavaDropper : RAT
2020-09-11 16:39:34 -06:00
RAT_Sakula.yar
Update RAT_Sakula.yar
2016-07-20 09:26:17 +02:00
RAT_ShadowTech.yar
Rename ShadowTech.yar to RAT_ShadowTech.yar
2016-07-21 15:05:58 +02:00
RAT_Shim.yar
Rename APT_RAT_ShimRat.yar to RAT_Shim.yar
2016-07-20 11:54:27 +02:00
RAT_Terminator.yar
Update RAT_Terminator.yar
2016-07-20 09:26:58 +02:00
RAT_xRAT20.yar
Update and rename xRAT20.yar to RAT_xRAT20.yar
2016-07-20 09:27:56 +02:00
RAT_xRAT.yar
Update and rename xRAT.yar to RAT_xRAT.yar
2016-07-20 09:27:37 +02:00
RAT_Xtreme.yar
Update RAT_Xtreme.yar
2019-03-17 02:05:24 -05:00
RAT_ZoxPNG.yar
Rename ZoxPNG.yar to RAT_ZoxPNG.yar
2016-07-21 14:46:57 +02:00
TOOLKIT_Chinese_Hacktools.yar
Create TOOLKIT_Chinese_Hacktools.yar
2016-11-15 10:48:00 +01:00
TOOLKIT_Dubrute.yar
Update and rename dubrute.yar to TOOLKIT_Dubrute.yar
2016-07-21 14:51:24 +02:00
TOOLKIT_exe2hex_payload.yar
Update and rename generic_exe2hex_payload.yar to TOOLKIT_exe2hex_payload.yar
2016-07-21 14:48:48 +02:00
TOOLKIT_FinFisher_.yar
Rename FinSpy.yar to TOOLKIT_FinFisher_.yar
2016-07-20 13:53:45 +02:00
TOOLKIT_Gen_powerkatz.yar
Rename Gen_powerkatz.yar to TOOLKIT_Gen_powerkatz.yar
2016-07-20 13:56:35 +02:00
TOOLKIT_Mandibule.yar
Update TOOLKIT_Mandibule.yar
2018-06-02 21:18:11 +02:00
TOOLKIT_PassTheHash.yar
Removed whitespace between names
2016-07-30 13:16:45 +02:00
TOOLKIT_Powerstager.yar
Update and rename TOOLKIT_powerstager.yar to TOOLKIT_Powerstager.yar
2018-01-16 08:21:10 +01:00
TOOLKIT_Pwdump.yar
Removed whitespace between names
2016-07-30 13:16:45 +02:00
TOOLKIT_Redteam_Tools_by_GUID.yar
add TOOLKIT_Redteam_Tools_by_Name.yar, TOOLKIT_Redteam_Tools_by_GUID.yar, TOOLKIT_Solarwinds_credential_stealer.yar
2021-01-23 14:57:42 +01:00
TOOLKIT_Redteam_Tools_by_Name.yar
add TOOLKIT_Redteam_Tools_by_Name.yar, TOOLKIT_Redteam_Tools_by_GUID.yar, TOOLKIT_Solarwinds_credential_stealer.yar
2021-01-23 14:57:42 +01:00
TOOLKIT_Solarwinds_credential_stealer.yar
add TOOLKIT_Redteam_Tools_by_Name.yar, TOOLKIT_Redteam_Tools_by_GUID.yar, TOOLKIT_Solarwinds_credential_stealer.yar
2021-01-23 14:57:42 +01:00
TOOLKIT_THOR_HackTools.yar
Fixing issues
2020-07-01 22:52:12 +02:00
TOOLKIT_Wineggdrop.yar
Update and rename wineggdrop.yar to TOOLKIT_Wineggdrop.yar
2016-07-21 14:34:10 +02:00