diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..4f101a76
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,3 @@
+*.yar text eol=lf
+*.toml text eol=lf
+*.lua text eol=lf
diff --git a/.github/ISSUE_TEMPLATE/behavior_bug_issue.md b/.github/ISSUE_TEMPLATE/behavior_bug_issue.md
new file mode 100644
index 00000000..034fc997
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/behavior_bug_issue.md
@@ -0,0 +1,31 @@
+---
+name: Behavior - Report a bug within the endpoint rule
+about: Report a bug for the endpoint security artifact
+title: "[Bug] Name of behavior rule"
+labels: bug, behavior
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Desktop (please complete the following information):**
+ - OS:
+ - Version:
+
+**Additional context**
+Add any other context about the problem here.
diff --git a/.github/ISSUE_TEMPLATE/behavior_custom_issue.md b/.github/ISSUE_TEMPLATE/behavior_custom_issue.md
new file mode 100644
index 00000000..9e003dec
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/behavior_custom_issue.md
@@ -0,0 +1,34 @@
+---
+name: Behavior - Report a custom issue
+about: Custom Issue reported
+title: "[Custom]: Concise title"
+labels: custom, behavior
+assignees: ''
+
+---
+
+## Description
+
+Provide a detailed description of the issue.
+
+## Optional Info
+
+- **Screenshots**
+
+- **Example Data**
+
+  Any available data or timeline information here, pasted or attached:
+
+  ```json
+  {
+    "paste_dataz": "here"
+  }
+  ```
+
+- **Additional Requirements**
+  Any additional configuration required for the query to work (e.g. sysmon, config modification, etc.)
+
+
+## References
+- https://sample.link.com/
+
diff --git a/.github/ISSUE_TEMPLATE/yara_request_coverage.md b/.github/ISSUE_TEMPLATE/yara_request_coverage.md
new file mode 100644
index 00000000..8d32c438
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/yara_request_coverage.md
@@ -0,0 +1,29 @@
+---
+name: YARA - Request for coverage on malware family
+about: Suggestion for YARA coverage for malware family
+title: "[Request for Coverage] Malware Family Name"
+labels: yara, Request for Coverage
+assignees: ''
+
+---
+
+<!-- Before submitting an issue to request coverage, please make sure the rule doesn’t currently have coverage within our repository. We are interested to hear about new families or malware that doesn’t currently have coverage within our rules. Please note, there is an unlimited supply of malware out there, and our team has to prioritize what families to target, we are currently focused on global threats impacting multiple organizations and the general population. We may not be able to implement coverage for every request, but we will try hard to review each request and consider new coverage. --->
+
+## Request for Coverage Details
+Malware Family Name:
+
+## Description
+<!-- Provide a detailed description and context around the malware family that is being suggested for coverage. Any kind of reference to existing threat research is really helpful for our team. --->
+
+## Example Sample
+<!-- In order to create new coverage for a malware family, please share the sample link via [VirusTotal](https://www.virustotal.com/gui/home/search) or other community sharing sites such as [MalwareBazaar](https://bazaar.abuse.ch/browse/) or [MalShare](https://malshare.com/). -->
+
+## Optional Info
+
+If you are further along in the analysis process and have working YARA rule for a set of samples. Feel free to also send that over to help augment our team's analysis into writing a new rule.
+
+  ```json
+  {
+    "Insert YARA rule here"
+  }
+  ```
diff --git a/.github/ISSUE_TEMPLATE/yara_rule_tuning.md b/.github/ISSUE_TEMPLATE/yara_rule_tuning.md
new file mode 100644
index 00000000..f5ae8489
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/yara_rule_tuning.md
@@ -0,0 +1,22 @@
+---
+name: YARA - Report an existing rule for tuning
+about: Suggestion for logic changes to an existing YARA rule
+title: "[Rule Tuning] Name of YARA rule"
+labels: yara, Tuning
+assignees: ''
+
+---
+
+<!-- Before submitting an issue to tune a rule, be sure to review CONTRIBUTING.md --->
+
+<!-- Example Impacted Rule --->
+<!-- Rule Name: Windows_Trojan_CobaltStrike_59ed9124   --->
+
+## Impacted Rule:
+Rule Name with ID:
+
+## Description
+<!-- Provide a detailed description of the suggested changes including any important details or context why the rule needs to be fixed. Any kind of alert volume within the specific time period and the number of endpoints impacted is super helpful. For example, this YARA rule is hitting on a signed Windows executable (svchost.exe) and has been triggered 200 times in the last 7 days on 5 different endpoints. --->
+
+## Example Sample
+<!-- We are happy to look into false positives and rule tunings. In order to do this we need to validate the request with a sample and verify the data along with the rule. Please provide a link to the sample within [VirusTotal](https://www.virustotal.com/gui/home/search). If the sample cannot be shared publicly, engage with us on our community Slack or email us directly.  -->
diff --git a/.github/workflows/duplicate_issue.yml b/.github/workflows/duplicate_issue.yml
new file mode 100644
index 00000000..624d4269
--- /dev/null
+++ b/.github/workflows/duplicate_issue.yml
@@ -0,0 +1,34 @@
+on:
+  issues:
+    types: [opened]
+name: Duplicate Open Issue to Internal Repo
+
+jobs:
+  post_new_issue:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Duplicate issue to internal behavior repo
+        uses: octokit/request-action@v2.x
+        if: contains(github.event.issue.labels.*.name, 'behavior')
+        with:
+          route: POST /repos/{owner}/{repo}/issues
+          owner: elastic
+          repo: endpoint-rules
+          title: "${{ toJSON(format('{0} {1}', '[Openness Issue]', github.event.issue.title ))}}"
+          body: ${{toJSON(github.event.issue.body)}}
+          labels: ${{toJSON(github.event.issue.labels)}}
+        env:
+          GITHUB_TOKEN: ${{ secrets.PROTECTIONS_MACHINE_TOKEN }}
+
+      - name: Duplicate issue to internal yara repo
+        uses: octokit/request-action@v2.x
+        if: contains(github.event.issue.labels.*.name, 'yara')
+        with:
+          route: POST /repos/{owner}/{repo}/issues
+          owner: elastic
+          repo: protections-yara-rules
+          title: "${{ toJSON(format('{0} {1}', '[Openness Issue]', github.event.issue.title ))}}"
+          body: ${{toJSON(github.event.issue.body)}}
+          labels: ${{toJSON(github.event.issue.labels)}}
+        env:
+          GITHUB_TOKEN: ${{ secrets.PROTECTIONS_MACHINE_TOKEN }}
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 00000000..e43b0f98
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.DS_Store
diff --git a/LICENSE.txt b/LICENSE.txt
new file mode 100644
index 00000000..809108b8
--- /dev/null
+++ b/LICENSE.txt
@@ -0,0 +1,93 @@
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor’s trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that
+organization. **control** means ownership of substantially all the assets of an
+entity, or the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.
diff --git a/README.md b/README.md
index 32f60315..1a97cc62 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,27 @@
-# protections-artifacts
\ No newline at end of file
+<h1><img src="https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/blt786d938064f8c8be/5e0e7b96fb35e665aed32798/logo-endpoint-32-color.svg"/>  Protections Artifacts</h1>
+
+
+Elastic Security prevents ransomware and malware, detects advanced threats, and arms responders with vital context. It’s free and open, ready for every endpoint.
+
+Protections-Artifacts is the home of our detection logic (rules, yara, etc) for [Elastic Security for endpoint](https://www.elastic.co/security/endpoint-security). At Elastic, we believe that being open and transparent is critical for the success of us and our users. Check out our [blog post](https://www.elastic.co/security-labs/) if you are interested in additional background.
+
+# Directory
+
+Below you will find the artifacts we have opened in this repository:
+
+| Folder | Description |
+| ------ | ----------- |
+| [`behavior/`](behavior/) | EQL based malicious behavior rules |
+| [`yara/`](yara) | Yara rules for malware protection |
+
+# Questions? Problems? Suggestions?
+
+If you would like you to provide feedback or contribute to this repository, please familiarize yourself with the applicable artifact’s readme and [open an issue](https://github.com/elastic/protections-artifacts/issues/new/choose) using one of the provided templates. We cannot accept pull requests at this time because this repository is automatically generated.
+
+You can also reach us in our [Slack Workspace](https://www.elastic.co/blog/join-our-elastic-stack-workspace-on-slack) or in the [Security Discuss](https://discuss.elastic.co/c/security/) forum.
+
+# License
+
+Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one or more contributor license agreements. Licensed under the Elastic License 2.0; you may not use these artifacts except in compliance with the Elastic License 2.0
+
+Contributors must sign a [Contributor License Agreement](https://www.elastic.co/contributor-agreement) before contributing code to any Elastic repositories.
diff --git a/behavior/README.md b/behavior/README.md
new file mode 100644
index 00000000..6595659b
--- /dev/null
+++ b/behavior/README.md
@@ -0,0 +1,55 @@
+## Elastic Security Malicious Behavior Protection Rules
+
+Prebuilt high signal [EQL](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html) rules that runs on the endpoint to disrupt malicious behavior, this layer of prevention equips Elastic Agent to protect Linux, Windows, and macOS hosts from a broad range of attack techniques with a major focus on the following tactics :
+
+- [Initial Access](https://attack.mitre.org/tactics/TA0001/)
+- [Execution](https://attack.mitre.org/tactics/TA0002/)
+- [Privilege Escalation](https://attack.mitre.org/tactics/TA0004/)
+- [Defense Evasion](https://attack.mitre.org/tactics/TA0005/)
+- [Credential Access](https://attack.mitre.org/tactics/TA0006/)
+- [Impact](https://attack.mitre.org/tactics/TA0040/)
+
+Prevention is achieved by pairing post-execution analytics with response actions to kill a specific process or a full process tree tailored to stop the adversary at the initial stages of the attack. Each protection rule is mapped to the most relevant [MITRE ATT&CK](https://attack.mitre.org/) tactic,  technique and subtechnique.
+
+The true positive rate that we aim to maintain is at least 70%, thus we prioritize analytics logic precision to reduce detection scope via prevention.
+
+Another example of our commitment to openness in security is our existing public [Detection Rules](https://github.com/elastic/detection-rules) repository where we share [EQL](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html) rules that run on the SIEM side, and that have a broader detection logic which make them more suitable for detection and hunting.
+
+### Rules Summary per Tactic
+
+<!-- python -m endpoint_rules rule-stats-summary --release-version latest 1.0.2 -->
+Note: New Production Rules since last version ('latest', '1.0.2') by OS/MITRE Tactic.
+
+| Tactic               |   Windows |   Linux |   macOS |   Total by Tactic |
+|----------------------|-----------|---------|---------|-------------------|
+| Credential Access    |        16 |       0 |       4 |                20 |
+| Discovery            |         0 |       1 |       2 |                 3 |
+| Execution            |         8 |       0 |       0 |                 8 |
+| Defense Evasion      |        12 |       0 |       3 |                15 |
+| Impact               |         3 |       0 |       0 |                 3 |
+| Privilege Escalation |         4 |       1 |       1 |                 6 |
+| Initial Access       |         5 |       0 |       0 |                 5 |
+| Command and Control  |         3 |       0 |       0 |                 3 |
+| Lateral Movement     |         3 |       0 |       1 |                 4 |
+| Persistence          |         1 |       0 |       1 |                 2 |
+| Total by OS          |        55 |       2 |      12 |                69 |
+
+Note: Latest Total Production Rules by OS/MITRE Tactic.
+
+| Tactic               |   Windows |   Linux |   macOS |   Total by Tactic |
+|----------------------|-----------|---------|---------|-------------------|
+| Execution            |        22 |       4 |       8 |                34 |
+| Credential Access    |        21 |       0 |       4 |                25 |
+| Persistence          |        15 |       0 |       2 |                17 |
+| Discovery            |         2 |       1 |       2 |                 5 |
+| Privilege Escalation |        33 |       2 |       2 |                37 |
+| Defense Evasion      |        42 |       0 |       3 |                45 |
+| Impact               |        10 |       1 |       1 |                12 |
+| Initial Access       |        22 |       0 |       0 |                22 |
+| Lateral Movement     |         5 |       0 |       1 |                 6 |
+| Command and Control  |         8 |       0 |       1 |                 9 |
+| Total by OS          |       180 |       8 |      24 |               212 |
+
+
+### Licensing
+These rules are licensed under the Elastic License v2. All rules have been designed to be used in the context of the Elastic Endpoint within the Elastic Security application.
diff --git a/behavior/rules/command_and_control_connection_to_dynamic_dns_provider_by_a_signed_binary_proxy.toml b/behavior/rules/command_and_control_connection_to_dynamic_dns_provider_by_a_signed_binary_proxy.toml
new file mode 100644
index 00000000..841b2d42
--- /dev/null
+++ b/behavior/rules/command_and_control_connection_to_dynamic_dns_provider_by_a_signed_binary_proxy.toml
@@ -0,0 +1,94 @@
+[rule]
+description = """
+Identifies DNS queries to known Dynamic DNS Providers by a signed Microsoft binary execution proxy. Dynamic DNS
+providers are often misused to host malware Command and Control servers.
+"""
+id = "fb6939a2-1b54-428c-92a2-3a831585af2a"
+license = "Elastic License v2"
+name = "Connection to Dynamic DNS Provider by a Signed Binary Proxy"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+sequence by process.entity_id with maxspan=5m
+  [process where event.action == "start" and user.id : "S-1-5-21-*" and
+    (
+     process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
+                     "powershell.exe", "pwsh.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe",
+                     "installutil.exe","RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe") or
+     process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
+                           "?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe",
+                           "?:\\Windows\\Microsoft.NET\\*.exe")
+     )
+  ]
+  [dns where
+    dns.question.name :
+         (
+          "*.no-ip.com",
+          "*.no-ip.org",
+          "*.no-ip.biz",
+          "*.no-ip.info",
+          "*.noip.com",
+          "*.afraid.org",
+          "*.changeip.com",
+          "*.ddns.net",
+          "*.dyndns.org",
+          "*.hopto.org",
+          "*.zapto.org",
+          "*.servehttp.com",
+          "*.sytes.net",
+          "*.myftp.biz",
+          "*.myftp.org",
+          "*.ddnsfree.com",
+          "*.duckdns.org",
+          "*.000webhostapp.com",
+          "*.myddns.me",
+          "*.dlinkddns.com",
+          "*.chickenkiller.com",
+          "*.thddns.net",
+          "*.linkpc.net",
+          "*.gotdns.ch"
+         ) and
+
+     /* covered by rule Id 51894221-7657-4b56-9406-e080e19ad159 */
+    not dns.question.name : "checkip.dyndns.org"
+  ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+[[threat.technique.subtechnique]]
+id = "T1071.004"
+name = "DNS"
+reference = "https://attack.mitre.org/techniques/T1071/004/"
+
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/command_and_control_connection_to_dynamic_dns_provider_by_an_unsigned_binary.toml b/behavior/rules/command_and_control_connection_to_dynamic_dns_provider_by_an_unsigned_binary.toml
new file mode 100644
index 00000000..a9317470
--- /dev/null
+++ b/behavior/rules/command_and_control_connection_to_dynamic_dns_provider_by_an_unsigned_binary.toml
@@ -0,0 +1,75 @@
+[rule]
+description = """
+Identifies DNS queries to known Dynamic DNS Providers by an unsigned program. Dynamic DNS providers are often misused to
+host malware Command and Control servers.
+"""
+id = "75b80e66-90d0-4ab6-9e6b-976f7d690906"
+license = "Elastic License v2"
+name = "Connection to Dynamic DNS Provider by an Unsigned Binary"
+os_list = ["windows"]
+version = "1.0.6"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ /* execution of an unsigned PEfollowed by dns request to dynamic dns provider */
+  [process where event.action == "start" and user.id : "S-1-5-21-*" and
+   not process.code_signature.trusted == true and
+   process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*")]
+  [dns where
+    dns.question.name :
+         (
+          "*.no-ip.com",
+          "*.no-ip.org",
+          "*.no-ip.biz",
+          "*.no-ip.info",
+          "*.noip.com",
+          "*.afraid.org",
+          "*.changeip.com",
+          "*.ddns.net",
+          "*.dyndns.org",
+          "*.hopto.org",
+          "*.zapto.org",
+          "*.servehttp.com",
+          "*.sytes.net",
+          "*.myftp.biz",
+          "*.myftp.org",
+          "*.ddnsfree.com",
+          "*.duckdns.org",
+          "*.000webhostapp.com",
+          "*.myddns.me",
+          "*.dlinkddns.com",
+          "*.chickenkiller.com", 
+          "*.thddns.net", 
+          "*.linkpc.net", 
+          "*.gotdns.ch"
+         ) and
+
+    /* covered by rule Id dfe28e03-9b0b-47f5-9753-65ed2666663f */
+    not dns.question.name : "checkip.dyndns.org"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+[[threat.technique.subtechnique]]
+id = "T1071.004"
+name = "DNS"
+reference = "https://attack.mitre.org/techniques/T1071/004/"
+
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml b/behavior/rules/command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml
new file mode 100644
index 00000000..d59c33d3
--- /dev/null
+++ b/behavior/rules/command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml
@@ -0,0 +1,125 @@
+[rule]
+description = """
+Identifies DNS queries to common web services by a signed Microsoft binary execution proxy. Adversaries may implement
+command and control communications that use common web services in order to hide their activity.
+"""
+id = "c567240c-445b-4000-9612-b5531e21e050"
+license = "Elastic License v2"
+name = "Connection to WebService by a Signed Binary Proxy"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+sequence by process.entity_id with maxspan=5m
+  [process where event.action == "start" and user.id : "S-1-5-21-*" and
+    (
+     process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
+                     "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe","RegSvcs.exe",
+                     "msxsl.exe", "xwizard.exe", "csc.exe") or
+     process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
+                           "?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe",
+                           "?:\\Windows\\Microsoft.NET\\*.exe") or
+     (process.name : ("powershell.exe", "pwsh.exe") and process.args_count >= 2)
+     ) and
+     not (process.name : "rundll32.exe" and process.command_line : "*davclnt.dll,DavSetCookie*") and
+     not (process.parent.executable : ("?:\\Program Files\\Microsoft SQL Server\\MSSQL*.EXE", "?:\\Program Files\\WindowsApps\\Microsoft.*.exe") and
+          process.name : ("powershell.exe", "pwsh.exe")) and
+     not (process.name : "java.exe" and process.parent.executable : "?:\\Program Files\\OWASP\\Zed Attack Proxy\\ZAP.exe") and
+     not (process.name : "java.exe" and process.args_count >= 5)
+  ]
+  [dns where
+    dns.question.name :
+    (
+        "raw.githubusercontent.*",
+        "pastebin.*",
+        "paste.ee",
+        "ghostbin.com",
+        "drive.google.com",
+        "?.docs.live.net",
+        "api.dropboxapi.*",
+        "content.dropboxapi.*",
+        "dl.dropboxusercontent.*",
+        "api.onedrive.com",
+        "*.onedrive.org",
+        "onedrive.live.com",
+        "filebin.net",
+        "?.tcp.ngrok.io",
+        "ngrok.com",
+        "*.portmap.*",
+        "*serveo.net",
+        "*localtunnel.me",
+        "*pagekite.me",
+        "*localxpose.io",
+        "*notabug.org",
+        "rawcdn.githack.*",
+        "paste.nrecom.net",
+        "zerobin.net",
+        "controlc.com",
+        "requestbin.net",
+        "slack.com",
+        "api.slack.com",
+        "slack-redir.net",
+        "slack-files.com",
+        "cdn.discordapp.com",
+        "discordapp.com",
+        "discord.com",
+        "apis.azureedge.net",
+        "cdn.sql.gg",
+        "api.*",
+        "?.top4top.io",
+        "top4top.io",
+        "www.uplooder.net",
+        "*.cdnmegafiles.com",
+        "transfer.sh",
+        "updates.peer2profit.com",
+        "api.telegram.org",
+        "meacz.gq",
+        "rwrd.org",
+        "*.publicvm.com",
+        "*.blogspot.com"
+    )
+  ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+[[threat.technique.subtechnique]]
+id = "T1071.004"
+name = "DNS"
+reference = "https://attack.mitre.org/techniques/T1071/004/"
+
+
+[[threat.technique]]
+id = "T1102"
+name = "Web Service"
+reference = "https://attack.mitre.org/techniques/T1102/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/command_and_control_connection_to_webservice_by_an_unsigned_binary.toml b/behavior/rules/command_and_control_connection_to_webservice_by_an_unsigned_binary.toml
new file mode 100644
index 00000000..da0c04b3
--- /dev/null
+++ b/behavior/rules/command_and_control_connection_to_webservice_by_an_unsigned_binary.toml
@@ -0,0 +1,101 @@
+[rule]
+description = """
+Identifies DNS queries to common web services by an unsigned program. Adversaries may implement command and control
+communications that use common web services in order to hide their activity.
+"""
+id = "2c3efa34-fecd-4b3b-bdb6-30d547f2a1a4"
+license = "Elastic License v2"
+name = "Connection to WebService by an Unsigned Binary"
+os_list = ["windows"]
+version = "1.0.6"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ /* execution of an unsigned PE file followed by dns lookup to commonly abused trusted webservices */
+
+  [process where event.action == "start" and user.id : "S-1-5-21-*" and
+   not process.code_signature.trusted == true and
+   process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*")]
+  [dns where
+    dns.question.name :
+    (
+        "raw.githubusercontent.*",
+        "pastebin.*",
+        "paste.ee",
+        "ghostbin.com",
+        "drive.google.com",
+        "d.docs.live.net",
+        "api.dropboxapi.*",
+        "content.dropboxapi.*",
+        "dl.dropboxusercontent.*",
+        "api.onedrive.com",
+        "*.onedrive.org",
+        "onedrive.live.com",
+        "filebin.net",
+        "?.tcp.ngrok.io",
+        "ngrok.com",
+        "*.portmap.*",
+        "*serveo.net",
+        "*localtunnel.me",
+        "*pagekite.me",
+        "*localxpose.io",
+        "*notabug.org",
+        "rawcdn.githack.*",
+        "paste.nrecom.net",
+        "zerobin.net",
+        "controlc.com",
+        "requestbin.net",
+        "slack.com",
+        "api.slack.com",
+        "slack-redir.net",
+        "slack-files.com",
+        "cdn.discordapp.com",
+        "discordapp.com",
+        "discord.com",
+        "cdn.sql.gg",
+        "cdn.discordapp.com",
+        "www.uplooder.net",
+        "*.cdnmegafiles.com",
+        "transfer.sh",
+        "updates.peer2profit.com",
+        "api.telegram.org",
+        "bing.com",
+        "yahoo.com",
+        "meacz.gq",
+        "rwrd.org", 
+        "*.publicvm.com", 
+        "*.blogspot.com"
+    )
+  ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+[[threat.technique.subtechnique]]
+id = "T1071.004"
+name = "DNS"
+reference = "https://attack.mitre.org/techniques/T1071/004/"
+
+
+[[threat.technique]]
+id = "T1102"
+name = "Web Service"
+reference = "https://attack.mitre.org/techniques/T1102/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/command_and_control_execution_of_a_file_written_by_a_signed_binary_proxy.toml b/behavior/rules/command_and_control_execution_of_a_file_written_by_a_signed_binary_proxy.toml
new file mode 100644
index 00000000..a41ab3a1
--- /dev/null
+++ b/behavior/rules/command_and_control_execution_of_a_file_written_by_a_signed_binary_proxy.toml
@@ -0,0 +1,60 @@
+[rule]
+description = """
+Identifies the execution of a file written or modified by a signed Microsoft binary proxy utility such as MSHTA.exe,
+CertReq.exe or CertUtil.exe. Adversaries may bypass process and/or signature-based defenses by proxying execution of
+malicious content with signed binaries.
+"""
+id = "ccbc4a79-3bae-4623-aaef-e28a96bf538b"
+license = "Elastic License v2"
+name = "Execution of a File Written by a Signed Binary Proxy"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+sequence with maxspan=5m
+  [file where event.action != "deletion" and
+   process.name : ("MSHTA.EXE", "CertUtil.exe", "CertReq.exe") and
+   not file.path : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe")] by file.path
+  [process where event.action == "start" and
+   not process.parent.executable : ("?:\\Windows\\System32\\drvinst.exe") and
+   not (process.code_signature.subject_name: "Bentley Systems, Incorporated" and process.code_signature.trusted == true)
+   ] by process.executable
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.005"
+name = "Mshta"
+reference = "https://attack.mitre.org/techniques/T1218/005/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1105"
+name = "Ingress Tool Transfer"
+reference = "https://attack.mitre.org/techniques/T1105/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/command_and_control_netwire_rat_registry_modification.toml b/behavior/rules/command_and_control_netwire_rat_registry_modification.toml
new file mode 100644
index 00000000..099d1bf7
--- /dev/null
+++ b/behavior/rules/command_and_control_netwire_rat_registry_modification.toml
@@ -0,0 +1,46 @@
+[rule]
+description = """
+Identifies registry modification activity consistent with the NetWire Remote Access Trojan (RAT). NetWire is a publicly
+available, multi-platform RAT that is used by criminal and APT groups.
+"""
+id = "102f340f-1839-4bad-8493-824cc02c4e69"
+license = "Elastic License v2"
+name = "NetWire RAT Registry Modification"
+os_list = ["windows"]
+reference = ["https://attack.mitre.org/software/S0198/", "https://any.run/malware-trends/netwire"]
+version = "1.0.5"
+
+query = '''
+registry where
+   registry.path : (
+      "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\NetWire\\HostId",
+      "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\NetWire\\Install Date")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1112"
+name = "Modify Registry"
+reference = "https://attack.mitre.org/techniques/T1112/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+[[threat]]
+framework = "MITRE ATT&CK"
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/command_and_control_remcos_rat_registry_or_file_modification.toml b/behavior/rules/command_and_control_remcos_rat_registry_or_file_modification.toml
new file mode 100644
index 00000000..24f2412d
--- /dev/null
+++ b/behavior/rules/command_and_control_remcos_rat_registry_or_file_modification.toml
@@ -0,0 +1,50 @@
+[rule]
+description = """
+Identifies registry and file system activity consistent with the Remcos Remote Access Trojan (RAT). Remcos RAT is used
+by attackers to perform actions on infected machines remotely.
+"""
+id = "9769d372-4115-4ef8-8d7b-aaad05dad9ae"
+license = "Elastic License v2"
+name = "Remcos RAT Registry or File Modification"
+os_list = ["windows"]
+reference = ["https://attack.mitre.org/software/S0332/", "https://any.run/malware-trends/remcos"]
+version = "1.0.5"
+
+query = '''
+any where event.category : ("registry", "file") and
+  (
+    registry.path : (
+      "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Remcos",
+      "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Remcos-*\\licence",
+      "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Remcos-*\\exepath") or
+    file.path : "?:\\Users\\*\\AppData\\Roaming\\remcos\\logs.dat"
+   )
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1112"
+name = "Modify Registry"
+reference = "https://attack.mitre.org/techniques/T1112/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+[[threat]]
+framework = "MITRE ATT&CK"
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/command_and_control_shlayer_malware_infection.toml b/behavior/rules/command_and_control_shlayer_malware_infection.toml
new file mode 100644
index 00000000..4030e023
--- /dev/null
+++ b/behavior/rules/command_and_control_shlayer_malware_infection.toml
@@ -0,0 +1,47 @@
+[rule]
+description = """
+Identifies the execution of curl to download a payload for execution. This behavior is consistent with Shlayer malware.
+Shlayer is a macOS malware family associated with ad fraud activity. Shlayer masquerades typically as an installer for
+applications like Adobe Flash Player and executes numerous macOS commands to deobfuscate code and install adware with
+persistence mechanisms.
+"""
+id = "3dda1ac2-86ef-41f5-ad3b-d9396383e104"
+license = "Elastic License v2"
+name = "Shlayer Malware Infection"
+os_list = ["macos"]
+reference = [
+    "https://attack.mitre.org/software/S0402/",
+    "https://redcanary.com/threat-detection-report/threats/shlayer/",
+    "https://securelist.com/shlayer-for-macos/95724/",
+]
+version = "1.0.5"
+
+query = '''
+process where event.action == "exec" and process.name == "curl" and process.args : "-f0L"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1105"
+name = "Ingress Tool Transfer"
+reference = "https://attack.mitre.org/techniques/T1105/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/command_and_control_suspicious_netsupport_execution.toml b/behavior/rules/command_and_control_suspicious_netsupport_execution.toml
new file mode 100644
index 00000000..f1f215da
--- /dev/null
+++ b/behavior/rules/command_and_control_suspicious_netsupport_execution.toml
@@ -0,0 +1,41 @@
+[rule]
+description = """
+Identifies a suspicious execution of NetSupport remote access software from non-default paths, issuing a DNS query to a
+non-standard NetSupport domain.
+"""
+id = "ad53a366-161a-4fa7-a75a-cc00658a767f"
+license = "Elastic License v2"
+name = "Suspicious NetSupport Execution"
+os_list = ["windows"]
+reference = ["https://www.netsupportsoftware.com/"]
+version = "1.0.4"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [process where process.pe.original_file_name : "client32.exe" and
+  process.code_signature.subject_name : "NetSupport Ltd" and
+  not process.executable : ("?:\\Program Files\\NetSupport*.exe", "?:\\Program Files (x86)\\NetSupport*.exe") and
+  not process.parent.executable : ("?:\\Program Files\\NetSupport*.exe", "?:\\Program Files (x86)\\NetSupport*.exe")]
+ [dns where not dns.question.name : "*.netsupportsoftware.com"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1219"
+name = "Remote Access Software"
+reference = "https://attack.mitre.org/techniques/T1219/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_credential_access_via_known_utilities.toml b/behavior/rules/credential_access_credential_access_via_known_utilities.toml
new file mode 100644
index 00000000..ea1da902
--- /dev/null
+++ b/behavior/rules/credential_access_credential_access_via_known_utilities.toml
@@ -0,0 +1,79 @@
+[rule]
+description = """
+Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database
+(NTDS.dit) in preparation for credential access.
+"""
+id = "3c44fc50-2672-48b3-af77-ff43b895ac70"
+license = "Elastic License v2"
+name = "Credential Access via Known Utilities"
+os_list = ["windows"]
+reference = ["https://lolbas-project.github.io/"]
+version = "1.0.11"
+
+query = '''
+process where event.action == "start" and
+ process.parent.name != null and 
+ (
+  (process.pe.original_file_name == "procdump" and process.args : "-ma") or
+  (process.name : "ProcessDump.exe" and not process.parent.executable : "?:\\Program Files*\\Cisco Systems\\*.exe") or
+  (process.pe.original_file_name == "WriteMiniDump.exe" and not process.parent.executable : "?:\\Program Files*\\Steam\\*.exe") or
+  /* Issue #623 - added coverage for evasion via renamed comsvcs DLL */
+  (process.pe.original_file_name == "RUNDLL32.EXE" and process.command_line : ("*comsvcs*#24*", "*MiniDump*", "*#24 * full*")) or
+  (process.pe.original_file_name == "RdrLeakDiag.exe" and process.args : "/fullmemdmp") or
+  (process.pe.original_file_name == "SqlDumper.exe" and process.args : "0x01100*") or
+  (process.pe.original_file_name == "TTTracer.exe" and process.args : "-dumpFull" and process.args : "-attach") or
+  (process.pe.original_file_name == "ntdsutil.exe" and process.command_line : "*create*") or
+  (process.pe.original_file_name == "diskshadow.exe" and process.args : "/s") or
+  (process.pe.original_file_name == "esentutl.exe" and process.args : "/vss" and process.command_line : ("*ntds.dit*", "*\\SAM*", "*//SAM*")) or
+  (process.pe.original_file_name == "reg.exe" and process.args : ("save", "export") and
+   process.command_line : ("*HKLM*\\SAM *", "*hkey_local_machine*\\SAM *", "*HKLM\\security*",
+                          "*hkey_local_machine\\security*", "*HKLM\\system *", "*hkey_local_machine\\system *")) or
+  /* generic original filename and variable number of hashes */
+  (process.name : "createdump.exe" and process.args : "-u") or 
+  (process.pe.original_file_name == "FX_VER_INTERNALNAME_STR" and process.args : "-u" and process.args : "-f" and process.args_count >= 3) or 
+  /* taskmgr via GUI - Create dump file - excluding Explorer to avoid breaking legit use of taskmgr */
+  (process.pe.original_file_name == "Taskmgr.exe" and process.args == "/4" and not process.parent.executable : "?:\\Windows\\explorer.exe") or 
+  /* Avast Home Security signed binary */
+  (process.pe.original_file_name == "avDump.exe" and process.args : "–dump_file")
+  ) and not
+
+  /* Issue #528 */
+  (process.pe.original_file_name == "reg.exe" and
+   process.parent.executable : ("?:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\*\\ir_agent.exe",
+                                "?:\\Program Files (x86)\\Rapid7\\Insight Agent\\components\\insight_agent\\*\\ir_agent.exe")) and not
+  (process.pe.original_file_name == "diskshadow.exe" and process.parent.name : "powershell.exe" and process.parent.args : "?:\\OmniStackBackups\\backup*") and
+  not (process.name : "rundll32.exe" and
+       process.command_line : "*davclnt.dll,DavSetCookie*http*MiniDump*" and
+       process.parent.executable : "?:\\WINDOWS\\system32\\svchost.exe" and process.parent.args : "WebClient")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1003"
+name = "OS Credential Dumping"
+reference = "https://attack.mitre.org/techniques/T1003/"
+[[threat.technique.subtechnique]]
+id = "T1003.001"
+name = "LSASS Memory"
+reference = "https://attack.mitre.org/techniques/T1003/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1003.003"
+name = "NTDS"
+reference = "https://attack.mitre.org/techniques/T1003/003/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_dumping_account_hashes_via_built_in_commands.toml b/behavior/rules/credential_access_dumping_account_hashes_via_built_in_commands.toml
new file mode 100644
index 00000000..d26dd0e3
--- /dev/null
+++ b/behavior/rules/credential_access_dumping_account_hashes_via_built_in_commands.toml
@@ -0,0 +1,41 @@
+[rule]
+description = """
+Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump
+credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for
+lateral movement.
+"""
+id = "2ed766db-e0b0-4a07-8ec1-4e41dd406b64"
+license = "Elastic License v2"
+name = "Dumping Account Hashes via Built-In Commands"
+os_list = ["macos"]
+reference = [
+    "https://apple.stackexchange.com/questions/186893/os-x-10-9-where-are-password-hashes-stored",
+    "https://www.unix.com/man-page/osx/8/mkpassdb/",
+]
+version = "1.0.5"
+
+query = '''
+process where event.type == "start" and
+ process.name : ("defaults", "mkpassdb") and process.args : ("ShadowHashData", "-dump")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1003"
+name = "OS Credential Dumping"
+reference = "https://attack.mitre.org/techniques/T1003/"
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_lsa_dump_via_silentprocessexit.toml b/behavior/rules/credential_access_lsa_dump_via_silentprocessexit.toml
new file mode 100644
index 00000000..71862605
--- /dev/null
+++ b/behavior/rules/credential_access_lsa_dump_via_silentprocessexit.toml
@@ -0,0 +1,43 @@
+[rule]
+description = """
+Identifies the modification of the Image File Execution Options SilentProcessExit key that can be abused to dump LSASS
+memory via the Windows Error Reporting WerFault.exe. Adversaries may use this technique for credential access.
+"""
+id = "28969fe6-0ebe-4442-b40c-dbe9b4234f5e"
+license = "Elastic License v2"
+name = "LSA Dump via SilentProcessExit"
+os_list = ["windows"]
+reference = [
+    "https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/",
+]
+version = "1.0.8"
+
+query = '''
+registry where registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1003"
+name = "OS Credential Dumping"
+reference = "https://attack.mitre.org/techniques/T1003/"
+[[threat.technique.subtechnique]]
+id = "T1003.001"
+name = "LSASS Memory"
+reference = "https://attack.mitre.org/techniques/T1003/001/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_potential_access_to_kerberos_cached_credentials.toml b/behavior/rules/credential_access_potential_access_to_kerberos_cached_credentials.toml
new file mode 100644
index 00000000..9a5c6c60
--- /dev/null
+++ b/behavior/rules/credential_access_potential_access_to_kerberos_cached_credentials.toml
@@ -0,0 +1,42 @@
+[rule]
+description = "Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets."
+id = "dc8fa849-efb4-45d1-be1a-9472325ff746"
+license = "Elastic License v2"
+name = "Potential Access to Kerberos Cached Credentials"
+os_list = ["macos"]
+reference = [
+    "https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/kerberosdump.py",
+    "https://opensource.apple.com/source/Heimdal/Heimdal-323.12/kuser/kcc-commands.in.auto.html",
+]
+version = "1.0.4"
+
+query = '''
+process where event.type == "start" and
+ process.name : "kcc" and process.command_line : "*copy_cred_cache*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1558"
+name = "Steal or Forge Kerberos Tickets"
+reference = "https://attack.mitre.org/techniques/T1558/"
+[[threat.technique.subtechnique]]
+id = "T1558.003"
+name = "Kerberoasting"
+reference = "https://attack.mitre.org/techniques/T1558/003/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_potential_credential_access_via_mimikatz.toml b/behavior/rules/credential_access_potential_credential_access_via_mimikatz.toml
new file mode 100644
index 00000000..7ca2818a
--- /dev/null
+++ b/behavior/rules/credential_access_potential_credential_access_via_mimikatz.toml
@@ -0,0 +1,67 @@
+[rule]
+description = """
+Identifies the usage of Mimikatz using known malicious command line arguments. Mimikatz is a credential dumper capable
+of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for
+testing the security of networks.
+"""
+id = "86bf5d50-7f5d-44b4-977b-dff222379727"
+license = "Elastic License v2"
+name = "Potential Credential Access via Mimikatz"
+os_list = ["windows"]
+reference = ["https://adsecurity.org/?page_id=1821", "https://github.com/gentilkiwi/mimikatz"]
+version = "1.0.4"
+
+query = '''
+process where event.action == "start" and
+  process.args : (
+    "privilege::debug",
+    "sekurlsa::logonpasswords",
+    "sekurlsa::pth",
+    "lsadump::sam",
+    "lsadump::dcsync",
+    "vault::cred",
+    "vault::list",
+    "token::elevate",
+    "/user:krbtgt",
+    "kerberos::tgt",
+    "kerberos::ptt",
+    "kerberos::list",
+    "misc::memssp"
+  )
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1003"
+name = "OS Credential Dumping"
+reference = "https://attack.mitre.org/techniques/T1003/"
+[[threat.technique.subtechnique]]
+id = "T1003.001"
+name = "LSASS Memory"
+reference = "https://attack.mitre.org/techniques/T1003/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1003.002"
+name = "Security Account Manager"
+reference = "https://attack.mitre.org/techniques/T1003/002/"
+
+
+[[threat.technique]]
+id = "T1558"
+name = "Steal or Forge Kerberos Tickets"
+reference = "https://attack.mitre.org/techniques/T1558/"
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_potential_credential_access_via_rubeus.toml b/behavior/rules/credential_access_potential_credential_access_via_rubeus.toml
new file mode 100644
index 00000000..9b49faba
--- /dev/null
+++ b/behavior/rules/credential_access_potential_credential_access_via_rubeus.toml
@@ -0,0 +1,62 @@
+[rule]
+description = """
+Identifies the usage of Rubeus using known malicious command line arguments. Rubeus is a toolset used for a diverse set
+of Kerberos Abuses and Manipulations like renew, ask, extract, and forge Kerberos Tickets.
+"""
+id = "0783f666-75ad-4015-9dd5-d39baec8f6b0"
+license = "Elastic License v2"
+name = "Potential Credential Access via Rubeus"
+os_list = ["windows"]
+reference = [
+    "https://github.com/GhostPack/Rubeus",
+    "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_hack_rubeus.yml",
+]
+version = "1.0.5"
+
+query = '''
+process where event.action == "start" and
+  process.command_line : (
+    "* asreproast *",
+    "* dump /service:krbtgt*",
+    "* dump /luid:*",
+    "* kerberoast *",
+    "* createnetonly /program:*",
+    "* ptt /ticket:*",
+    "* /impersonateuser:*",
+    "* renew /ticket:*",
+    "* asktgt /user:*",
+    "* asktgs /ticket:*",
+    "* harvest /interval:*",
+    "* s4u /user:*",
+    "* s4u /ticket:*",
+    "* hash /password:*",
+    "* tgtdeleg",
+    "* tgtdeleg /target:*",
+    "* golden /des:*",
+    "* golden /rc4:*",
+    "* golden /aes128:*",
+    "* golden /aes256:*",
+    "* changpw /ticket:*"
+  )
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1558"
+name = "Steal or Forge Kerberos Tickets"
+reference = "https://attack.mitre.org/techniques/T1558/"
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_potential_credential_access_via_windows_credential_history.toml b/behavior/rules/credential_access_potential_credential_access_via_windows_credential_history.toml
new file mode 100644
index 00000000..d78f0440
--- /dev/null
+++ b/behavior/rules/credential_access_potential_credential_access_via_windows_credential_history.toml
@@ -0,0 +1,55 @@
+[rule]
+description = """
+Identifies an unusual process accessing Users Windows Credential History File. The CREDHIST file contains previous
+password related master key hashes used by Microsoft's DPAPI. Adversaries may acquire credentials from the Windows
+Credential Manager.
+"""
+id = "ce8a6302-7248-457a-8427-3d6bad14e2f0"
+license = "Elastic License v2"
+name = "Potential Credential Access via Windows Credential History"
+os_list = ["windows"]
+reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
+version = "1.0.4"
+
+query = '''
+file where event.action == "open" and
+   /* Credentials History */
+  file.path : "?:\\Users\\*\\AppData\\*\\Microsoft\\Protect\\CREDHIST" and
+  user.id : "S-1-5-21*" and process.executable : "?:\\*" and
+  /* third party programs and noisy native system processes */
+  not process.executable :
+          ("?:\\Program Files\\*",
+           "?:\\Program Files (x86)\\*",
+           "?:\\Windows\\System32\\lsass.exe",
+           "?:\\Windows\\System32\\svchost.exe",
+           "?:\\Windows\\System32\\Robocopy.exe",
+           "?:\\Windows\\ccmcache\\*.exe",
+           "?:\\Windows\\CCM\\*.exe",
+           "?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1555"
+name = "Credentials from Password Stores"
+reference = "https://attack.mitre.org/techniques/T1555/"
+[[threat.technique.subtechnique]]
+id = "T1555.004"
+name = "Windows Credential Manager"
+reference = "https://attack.mitre.org/techniques/T1555/004/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_potential_credentials_phishing_via_osascript.toml b/behavior/rules/credential_access_potential_credentials_phishing_via_osascript.toml
new file mode 100644
index 00000000..a0b06dab
--- /dev/null
+++ b/behavior/rules/credential_access_potential_credentials_phishing_via_osascript.toml
@@ -0,0 +1,47 @@
+[rule]
+description = """
+Identifies the use of osascript to execute scripts via standard input that may prompt a user with a rogue dialog for
+credentials.
+"""
+id = "318d3d9d-ba60-40e3-bc8c-3d3304209a3c"
+license = "Elastic License v2"
+name = "Potential Credentials Phishing via OSASCRIPT"
+os_list = ["macos"]
+reference = [
+    "https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/prompt.py",
+    "https://ss64.com/osx/osascript.html",
+]
+version = "1.0.5"
+
+query = '''
+process where event.action == "exec" and
+ process.name : "osascript" and process.command_line : "*osascript*display*dialog*password*" and
+ not (process.parent.executable : "/usr/bin/sudo" and process.command_line : "*Encryption Key Escrow*") and
+ not (process.command_line : "*-e with timeout of 3600 seconds*" and user.id == 0 and process.parent.executable : "/bin/bash")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1056"
+name = "Input Capture"
+reference = "https://attack.mitre.org/techniques/T1056/"
+[[threat.technique.subtechnique]]
+id = "T1056.002"
+name = "GUI Input Capture"
+reference = "https://attack.mitre.org/techniques/T1056/002/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_potential_discovery_of_dpapi_master_keys.toml b/behavior/rules/credential_access_potential_discovery_of_dpapi_master_keys.toml
new file mode 100644
index 00000000..5bb75910
--- /dev/null
+++ b/behavior/rules/credential_access_potential_discovery_of_dpapi_master_keys.toml
@@ -0,0 +1,68 @@
+[rule]
+description = """
+Identifies an unusual process accessing Data Protection API Master keys. Adversaries may attempt to discover and acquire
+credentials from the Windows Credential Manager.
+"""
+id = "84bbe951-5141-4eb3-b9cf-8dfeea62a94e"
+license = "Elastic License v2"
+name = "Potential Discovery of DPAPI Master Keys"
+os_list = ["windows"]
+reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
+version = "1.0.7"
+
+query = '''
+file where event.action == "open" and
+ file.path : ("?:\\USERS\\*\\APPDATA\\*\\MICROSOFT\\PROTECT\\S-1-5-21*\\*",
+              "?:\\WINDOWS\\SYSTEM32\\MICROSOFT\\PROTECT\\S-1-5-18\\USER\\*") and
+ process.executable != null and
+ user.id : "S-1-5-21-*" and
+ not process.executable :
+           ("?:\\Program Files\\*",
+            "?:\\Program Files (x86)\\*",
+            "?:\\Windows\\System32\\lsass.exe",
+            "?:\\Windows\\System32\\svchost.exe",
+            "?:\\Windows\\System32\\Robocopy.exe",
+            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+            "System",
+            "?:\\Windows\\ccmcache\\*.exe",
+            "?:\\WINDOWS\\CCM\\*.exe",
+            "?:\\Windows\\SysWOW64\\prevhost.exe",
+            "?:\\Windows\\System32\\prevhost.exe",
+            "?:\\Veritas\\NetBackup\\bin\\bpbkar32.exe",
+            "?:\\Windows\\System32\\taskhostw.exe",
+            "?:\\Windows\\System32\\taskhost.exe",
+            "?:\\Windows\\System32\\sdiagnhost.exe",
+            "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
+            "?:\\$WINDOWS.~BT\\Sources\\setuphost.exe",
+            "?:\\Windows\\explorer.exe",
+            "?:\\Windows\\System32\\sppsvc.exe",
+            "?:\\Windows\\System32\\backgroundTaskHost.exe") and
+ /* MSSQL service account */
+ not (process.name : "sqlservr.exe" and file.path : "?:\\Users\\svc_*")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1555"
+name = "Credentials from Password Stores"
+reference = "https://attack.mitre.org/techniques/T1555/"
+[[threat.technique.subtechnique]]
+id = "T1555.004"
+name = "Windows Credential Manager"
+reference = "https://attack.mitre.org/techniques/T1555/004/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/credential_access_potential_discovery_of_windows_credential_manager_store.toml b/behavior/rules/credential_access_potential_discovery_of_windows_credential_manager_store.toml
new file mode 100644
index 00000000..080e3a9f
--- /dev/null
+++ b/behavior/rules/credential_access_potential_discovery_of_windows_credential_manager_store.toml
@@ -0,0 +1,68 @@
+[rule]
+description = """
+Identifies an unusual process accessing User or System Windows Credential Manager Files. Adversaries may attempt to list
+and acquire credentials from the Windows Credential Manager.
+"""
+id = "cc60be0e-2c6c-4dc9-9902-e97103ff8df9"
+license = "Elastic License v2"
+name = "Potential Discovery of Windows Credential Manager Store"
+os_list = ["windows"]
+reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
+version = "1.0.6"
+
+query = '''
+file where event.action == "open" and
+ file.path : ("?:\\Users\\*\\AppData\\*\\Microsoft\\Credentials\\*",
+              "?:\\Windows\\System32\\config\\systemprofile\\AppData\\*\\Microsoft\\Credentials\\*") and
+ process.executable != null and
+ user.id : "S-1-5-21-*" and
+ not process.executable :
+           ("?:\\Program Files\\*",
+            "?:\\Program Files (x86)\\*",
+            "?:\\Windows\\System32\\lsass.exe",
+            "?:\\Windows\\System32\\svchost.exe",
+            "?:\\Windows\\System32\\Robocopy.exe",
+            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
+            "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*.exe",
+            "?:\\Program Files\\Windows Defender Advanced Threat Protection\\*.exe",
+            "?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\*.exe",
+            "System",
+            "?:\\Windows\\ccmcache\\*.exe",
+            "?:\\WINDOWS\\CCM\\*.exe",
+            "?:\\Windows\\SysWOW64\\prevhost.exe",
+            "?:\\Windows\\System32\\prevhost.exe",
+            "?:\\Veritas\\NetBackup\\bin\\bpbkar32.exe",
+            "?:\\Windows\\System32\\taskhostw.exe",
+            "?:\\Windows\\System32\\taskhost.exe",
+            "?:\\Windows\\System32\\sdiagnhost.exe",
+            "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
+            "?:\\Windows\\System32\\dllhost.exe",
+            "?:\\Windows\\explorer.exe",
+            "?:\\Windows\\System32\\MRT.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1555"
+name = "Credentials from Password Stores"
+reference = "https://attack.mitre.org/techniques/T1555/"
+[[threat.technique.subtechnique]]
+id = "T1555.004"
+name = "Windows Credential Manager"
+reference = "https://attack.mitre.org/techniques/T1555/004/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/credential_access_security_account_manager_(sam)_file_access.toml b/behavior/rules/credential_access_security_account_manager_(sam)_file_access.toml
new file mode 100644
index 00000000..222510b6
--- /dev/null
+++ b/behavior/rules/credential_access_security_account_manager_(sam)_file_access.toml
@@ -0,0 +1,69 @@
+[rule]
+description = """
+Identifies access to the Security Account Manager (SAM) database file, which adversaries can use to recover password
+hashes for local accounts.
+"""
+id = "dc27190a-688b-4f9b-88f0-1f13deccd67f"
+license = "Elastic License v2"
+name = "Security Account Manager (SAM) File Access"
+os_list = ["windows"]
+reference = [
+    "https://adsecurity.org/?page_id=1821",
+    "https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
+]
+version = "1.0.8"
+
+query = '''
+file where event.action == "open" and 
+ file.path : 
+      ("?:\\WINDOWS\\SYSTEM32\\CONFIG\\SAM", 
+       "\\??\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\WINDOWS\\SYSTEM32\\CONFIG\\SAM",  
+       "\\Device\\HarddiskVolume*\\WINDOWS\\SYSTEM32\\CONFIG\\SAM") and
+ user.id != null and process.executable : "?:\\*" and not process.pid == 4 and
+ not process.executable :
+             ("?:\\Windows\\System32\\svchost.exe",
+              "?:\\Program Files (x86)\\*",
+              "?:\\Program Files\\*",
+              "?:\\Windows\\System32\\wuauclt.exe",
+              "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
+              "?:\\Windows\\System32\\vmwp.exe",
+              "?:\\Windows\\System32\\Dism.exe",
+              "?:\\Windows\\System32\\wbengine.exe",
+              "?:\\Windows\\System32\\mmc.exe",
+              "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
+              "?:\\Windows\\System32\\sppsvc.exe",
+              "?:\\Windows\\System32\\backgroundTaskHost.exe",
+              "?:\\Windows\\System32\\lsass.exe",
+              "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
+              "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*.exe",
+              "?:\\Program Files\\Windows Defender Advanced Threat Protection\\*.exe",
+              "?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\*.exe") and
+ /* mounted OS install */
+ not file.path : "?:\\?*\\Windows\\System32\\*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1003"
+name = "OS Credential Dumping"
+reference = "https://attack.mitre.org/techniques/T1003/"
+[[threat.technique.subtechnique]]
+id = "T1003.002"
+name = "Security Account Manager"
+reference = "https://attack.mitre.org/techniques/T1003/002/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_security_account_manager_(sam)_registry_access.toml b/behavior/rules/credential_access_security_account_manager_(sam)_registry_access.toml
new file mode 100644
index 00000000..6ddcbd61
--- /dev/null
+++ b/behavior/rules/credential_access_security_account_manager_(sam)_registry_access.toml
@@ -0,0 +1,68 @@
+[rule]
+description = """
+Identifies attempts to read the Security Account Manager database through the registry, which adversaries can use to
+recover password hashes for local accounts.
+"""
+id = "b6e8c090-f0ec-4c4c-af00-55ac2a9f9b41"
+license = "Elastic License v2"
+name = "Security Account Manager (SAM) Registry Access"
+os_list = ["windows"]
+reference = [
+    "https://adsecurity.org/?page_id=1821",
+    "https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
+]
+version = "1.0.6"
+
+query = '''
+sequence by process.entity_id with maxspan=5m
+  [process where event.action == "start" and
+   not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
+   not (process.name : "cscript.exe" and process.command_line : "*Tanium*collectAdInfo.vbs*" and
+        process.Ext.token.integrity_level_name == "system") and
+   not (process.code_signature.subject_name : ("Check Point Software Technologies Ltd.", "AO Kaspersky Lab") and process.code_signature.trusted == true) and
+   not (process.executable : "?:\\Windows\\Provisioning\\Autopilot\\DiagonsticAnalysis.pif" and
+        process.args : "?:\\Windows\\Provisioning\\Microsoft-Desktop-Provisioning-Diagnostic.dat") and
+   not (process.parent.executable : "?:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\*\\ir_agent.exe" and process.name : "reg.exe") and
+   not (process.executable : "?:\\Windows\\System32\\backgroundTaskHost.exe" and
+        process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and process.parent.args : "DcomLaunch" and
+        process.args : "-ServerName:BackgroundTaskHost.WebAccountProvider")
+   ]
+  [registry where event.action == "query" and
+   registry.path : "HKLM\\SAM\\SAM\\Domains\\Account\\*" and
+
+    /*
+     encrypted password LM/NT bytes are stored in V regval
+     under Account\Users key, to reduce noise we exclude following exact reg paths
+    */
+
+    not registry.path : ("HKLM\\SAM\\SAM\\Domains\\Account\\Users",
+                         "HKLM\\SAM\\SAM\\Domains\\Account\\Users\\Names",
+                         "HKLM\\SAM\\SAM\\Domains\\Account",
+                         "HKLM\\SAM\\SAM\\Domains\\Account\\Aliases\\*")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1003"
+name = "OS Credential Dumping"
+reference = "https://attack.mitre.org/techniques/T1003/"
+[[threat.technique.subtechnique]]
+id = "T1003.002"
+name = "Security Account Manager"
+reference = "https://attack.mitre.org/techniques/T1003/002/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_sensitive_file_access_cloud_credentials.toml b/behavior/rules/credential_access_sensitive_file_access_cloud_credentials.toml
new file mode 100644
index 00000000..27757a01
--- /dev/null
+++ b/behavior/rules/credential_access_sensitive_file_access_cloud_credentials.toml
@@ -0,0 +1,73 @@
+[rule]
+description = """
+Identifies an unusual process accessing common cloud providers credential files. Adversaries may search local file
+systems and remote file shares for files containing insecurely stored credentials.
+"""
+id = "39f60a36-8c5a-4703-8576-ad3e8c800a0f"
+license = "Elastic License v2"
+name = "Sensitive File Access - Cloud Credentials"
+os_list = ["windows"]
+reference = ["https://github.com/GhostPack/Seatbelt"]
+version = "1.0.5"
+
+query = '''
+sequence by process.entity_id with maxspan=5m
+   [process where event.action == "start" and
+    user.id : "S-1-5-21*" and process.executable != null and
+    not process.executable :
+          (
+            /* third party programs common install path - requires local admin */
+            "?:\\Program Files\\*",
+            "?:\\Program Files (x86)\\*",
+
+            /*
+              dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
+              explorer.exe for directory and file discovery.
+              SearchProtocolHost.exe is for file searches and indexing.
+             */
+            "?:\\Windows\\explorer.exe",
+            "?:\\Windows\\System32\\dllhost.exe",
+            "?:\\Windows\\System32\\SearchProtocolHost.exe",
+
+            /* Windows Defender */
+            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe")]
+   [file where event.type == "access" and
+    /* non system accounts */
+    user.id : "S-1-5-21*" and
+
+    /* AWS/Google/Azure/Git cloud credential files */
+    file.path : ("?:\\users\\*\\AppData\\*\\gcloud\\credentials.db",
+                 "?:\\users\\*\\AppData\\*\\gcloud\\legacy_credentials",
+                 "?:\\users\\*\\AppData\\*\\gcloud\\access_tokens.db",
+                 "?:\\users\\*\\.azure\\accessTokens.json",
+                 "?:\\users\\*\\.azure\\azureProfile.json",
+                 "?:\\users\\*\\.aws\\credentials",
+                 "?:\\Users\\*\\.config\\git\\credentials")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1552"
+name = "Unsecured Credentials"
+reference = "https://attack.mitre.org/techniques/T1552/"
+[[threat.technique.subtechnique]]
+id = "T1552.001"
+name = "Credentials In Files"
+reference = "https://attack.mitre.org/techniques/T1552/001/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_sensitive_file_access_remote_desktop_connection_manager.toml b/behavior/rules/credential_access_sensitive_file_access_remote_desktop_connection_manager.toml
new file mode 100644
index 00000000..32f821b9
--- /dev/null
+++ b/behavior/rules/credential_access_sensitive_file_access_remote_desktop_connection_manager.toml
@@ -0,0 +1,66 @@
+[rule]
+description = """
+Identifies an unusual process accessing Remote Desktop Connection Manager settings file. Adversaries may search and
+steal credentials from administration utilities configuration files.
+"""
+id = "934232e5-66d3-4e80-a4ee-a9f1b7d2a7bc"
+license = "Elastic License v2"
+name = "Sensitive File Access - Remote Desktop Connection Manager"
+os_list = ["windows"]
+reference = [
+    "http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/",
+    "https://smsagent.blog/2017/01/26/decrypting-remote-desktop-connection-manager-passwords-with-powershell/",
+]
+version = "1.0.6"
+
+query = '''
+file where event.type == "access" and
+    /* domain user RID */
+    user.id : "S-1-5-21*" and
+    file.path : "?:\\Users\\*\\AppData\\Local\\*\\Remote Desktop Connection Manager\\RDCMan.settings" and
+    not process.executable : "?:\\Program Files (x86)\\Microsoft\\Remote Desktop Connection Manager\\RDCMan.exe" and
+    not (process.name : "RDCMan.exe" and process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true)
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1552"
+name = "Unsecured Credentials"
+reference = "https://attack.mitre.org/techniques/T1552/"
+[[threat.technique.subtechnique]]
+id = "T1552.001"
+name = "Credentials In Files"
+reference = "https://attack.mitre.org/techniques/T1552/001/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1021"
+name = "Remote Services"
+reference = "https://attack.mitre.org/techniques/T1021/"
+[[threat.technique.subtechnique]]
+id = "T1021.001"
+name = "Remote Desktop Protocol"
+reference = "https://attack.mitre.org/techniques/T1021/001/"
+
+
+
+[threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+
+[internal]
+min_endpoint_version = "8.0.0"
diff --git a/behavior/rules/credential_access_sensitive_file_access_ssh_saved_keys.toml b/behavior/rules/credential_access_sensitive_file_access_ssh_saved_keys.toml
new file mode 100644
index 00000000..042df488
--- /dev/null
+++ b/behavior/rules/credential_access_sensitive_file_access_ssh_saved_keys.toml
@@ -0,0 +1,85 @@
+[rule]
+description = """
+Identifies an unusual process accessing common SSH clients saved SSH keys. Adversaries may search local file systems and
+remote file shares for files containing insecurely stored credentials.
+"""
+id = "1487d726-2bd2-4a9e-a9d2-db8aef1d6239"
+license = "Elastic License v2"
+name = "Sensitive File Access - SSH Saved Keys"
+os_list = ["windows"]
+reference = ["https://github.com/GhostPack/Seatbelt", "https://github.com/AlessandroZ/LaZagne"]
+version = "1.0.7"
+
+query = '''
+any where event.category in ("registry", "file") and
+ event.action in ("query", "open") and
+ user.id : "S-1-5-21*" and process.executable : "?:\\*" and
+ (file.path : "?:\\Users\\*\\.ssh\\known_hosts" or
+  registry.path : "HKEY_USERS\\S-1-5-21*\\Software\\SimonTatham\\PuTTY\\SshHostKeys\\*") and
+  not process.executable :
+      ("?:\\Program Files\\*",
+	   "?:\\Program Files (x86)\\*", 
+	   "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe", 
+	   "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe", 
+	   "?:\\Windows\\System32\\OpenSSH\\*.exe", 
+	   "?:\\Windows\\System32\\smartscreen.exe", 
+	   "?:\\WINDOWS\\system32\\reg.exe", 
+	   "?:\\Windows\\regedit.exe", 
+	   "?:\\Windows\\System32\\notepad.exe", 
+	   "?:\\Windows\\System32\\Robocopy.exe", 
+	   "?:\\Windows\\System32\\cmd.exe",
+	   "?:\\Windows\\explorer.exe",
+	   "?:\\Windows\\System32\\svchost.exe",
+	   "?:\\$WINDOWS.~BT\\Sources\\setuphost.exe",
+	   "?:\\Users\\*\\AppData\\Local\\Programs\\Git\\mingw64\\bin\\git.exe",
+	   "?:\\Users\\*\\AppData\\Local\\DBeaver\\dbeaver.exe") and
+
+  /* many of the following exclusions are not signed nor have an original file name  */
+  not process.name : ("pscp.exe", "psftp.exe", "_ssh.exe", "plink.exe", "PuTTYNG.exe", "putty*.exe", "busybox.exe",
+                      "ssh.exe", "WinSCP.exe", "bash.exe", "MoTTY.exe", "eclipse.exe", "code.exe", "datagrip*.exe",
+                      "MobaXterm_Personal*.exe", "RoyalTS_PuTTY*.exe", "MAP.EXE", "rssputty.exe", "phpstorm64.exe",
+                      "Fork.exe", "fzsftp.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1552"
+name = "Unsecured Credentials"
+reference = "https://attack.mitre.org/techniques/T1552/"
+[[threat.technique.subtechnique]]
+id = "T1552.001"
+name = "Credentials In Files"
+reference = "https://attack.mitre.org/techniques/T1552/001/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1021"
+name = "Remote Services"
+reference = "https://attack.mitre.org/techniques/T1021/"
+[[threat.technique.subtechnique]]
+id = "T1021.004"
+name = "SSH"
+reference = "https://attack.mitre.org/techniques/T1021/004/"
+
+
+
+[threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_sensitive_file_access_system_admin_utilities.toml b/behavior/rules/credential_access_sensitive_file_access_system_admin_utilities.toml
new file mode 100644
index 00000000..be6919b0
--- /dev/null
+++ b/behavior/rules/credential_access_sensitive_file_access_system_admin_utilities.toml
@@ -0,0 +1,90 @@
+[rule]
+description = """
+Identifies an unusual process accessing common third party system utilities sensitive files and registries. Adversaries
+may search local file systems and remote file shares for files containing insecurely stored credentials.
+"""
+id = "949c72ee-a283-4673-afe0-7fa72bddc2f6"
+license = "Elastic License v2"
+name = "Sensitive File Access - System Admin Utilities"
+os_list = ["windows"]
+reference = ["https://github.com/GhostPack/Seatbelt", "https://github.com/AlessandroZ/LaZagne"]
+version = "1.0.6"
+
+query = '''
+sequence by process.entity_id with maxspan=5m
+   [process where event.action == "start" and
+    user.id : "S-1-5-21*" and process.executable : "?:\\*" and
+    not process.executable :
+          (
+            /* third party programs common install path - requires local admin */
+            "?:\\Program Files\\*",
+            "?:\\Program Files (x86)\\*",
+            /*
+              dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
+              explorer.exe for directory and file discovery.
+              SearchProtocolHost.exe is for file searches and indexing.
+             */
+            "?:\\Windows\\explorer.exe",
+            "?:\\Windows\\System32\\dllhost.exe",
+            "?:\\Windows\\System32\\SearchProtocolHost.exe",
+            "?:\\Windows\\regedit.exe",
+            "?:\\Windows\\system32\\reg.exe",
+            "?:\\Windows\\System32\\notepad.exe",
+            "?:\\Windows\\System32\\Robocopy.exe",
+            "?:\\Windows\\System32\\cmd.exe",
+            /* Windows Defender */
+            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe",
+
+            /* lot of legit access from mounted sysadmin file shares */
+            "\\Device\\Mup\\*.exe") and
+    not (process.code_signature.subject_name :
+                      ("Martin Prikryl",
+                       "OpenVPN Technologies, Inc.",
+                       "TeamViewer Germany GmbH",
+                       "Open Source Developer, Dominik Reichl",
+                       "Tim Kosse",
+                       "TEFINCOM S.A.",
+                       "nordvpn s.a.") and
+          process.code_signature.trusted == true)
+   ]
+   [any where event.category in ("registry", "file") and
+    event.action in ("query", "open") and
+    (
+     file.path : ("?:\\Users\\*\\AppData\\Roaming\\KeePass\\KeePass.config.xml",
+                  "?:\\Users\\*\\AppData\\*\\NordVPN\\NordVPN.exe*\\user.config",
+                  "?:\\Users\\*\\AppData\\*\\FileZilla\\recentservers.xml",
+                  "?:\\Users\\*\\AppData\\*\\FileZilla\\sitemanager.xml") or
+     registry.path : ("HKEY_USERS\\S-1-5-21*\\software\\Martin Prikryl\\WinSCP *\\Sessions\\*\\Password*",
+                      "HKEY_USERS\\S-1-5-21*\\SOFTWARE\\WOW6432Node\\TeamViewer\\ProxyPassword",
+                      "HKEY_USERS\\S-1-5-21*\\Software\\OpenVPN-GUI\\Configs\\*auth-data*")
+     ) and
+      /* unsigned KeePass */
+     not (process.name : "KeePass.exe" and file.name : "KeePass.config.xml")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1552"
+name = "Unsecured Credentials"
+reference = "https://attack.mitre.org/techniques/T1552/"
+[[threat.technique.subtechnique]]
+id = "T1552.001"
+name = "Credentials In Files"
+reference = "https://attack.mitre.org/techniques/T1552/001/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_sensitive_file_access_unattended_panther.toml b/behavior/rules/credential_access_sensitive_file_access_unattended_panther.toml
new file mode 100644
index 00000000..4ca00930
--- /dev/null
+++ b/behavior/rules/credential_access_sensitive_file_access_unattended_panther.toml
@@ -0,0 +1,81 @@
+[rule]
+description = """
+Identifies an unusual process accessing Windows Panther Installation files. Adversaries may search local file systems
+and remote file shares for files containing insecurely stored credentials.
+"""
+id = "52e4ad92-e09b-4331-b827-cd0f2cbaf576"
+license = "Elastic License v2"
+name = "Sensitive File Access - Unattended Panther"
+os_list = ["windows"]
+reference = [
+    "https://steflan-security.com/windows-privilege-escalation-credential-harvesting/",
+    "https://github.com/pha5matis/Pentesting-Guide/blob/master/privilege_escalation_windows.md",
+]
+version = "1.0.6"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+   [process where event.action == "start" and
+    user.id : "S-1-5-21*" and process.executable != null and
+    not process.executable :
+          (
+            /* third party programs common install path - requires local admin */
+            "?:\\Program Files\\*",
+            "?:\\Program Files (x86)\\*",
+
+            /*
+              dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
+              explorer.exe for directory and file discovery.
+              SearchProtocolHost.exe is for file searches and indexing.
+             */
+            "?:\\Windows\\explorer.exe",
+            "?:\\Windows\\System32\\dllhost.exe",
+            "?:\\Windows\\System32\\SearchProtocolHost.exe",
+
+            /* Windows Defender */
+            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
+            "?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\*.exe",
+            "?:\\Program Files\\Windows Defender Advanced Threat Protection\\*.exe",
+
+            "?:\\Windows\\System32\\notepad.exe",
+            "?:\\Windows\\System32\\Robocopy.exe",
+            "?:\\Windows\\System32\\cmd.exe",
+            "?:\\Windows\\System32\\xcopy.exe",
+            "?:\\Windows\\System32\\SystemSettingsAdminFlows.exe",
+            "?:\\Windows\\System32\\smartscreen.exe")]
+   [file where event.type == "access" and
+    /* non system accounts */
+    user.id : "S-1-5-21*" and
+    file.path : ("?:\\Windows\\Panther\\Unattend.xml",
+                 "?:\\Windows\\Panther\\Unattended.xml",
+                 "?:\\Windows\\Panther\\Unattend\\Unattended.xml",
+                 "?:\\Windows\\Panther\\Unattend\\Unattend.xml",
+                 "?:\\Windows\\System32\\Sysprep\\unattend.xml",
+                 "?:\\Windows\\System32\\Sysprep\\Panther\\unattend.xml")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1552"
+name = "Unsecured Credentials"
+reference = "https://attack.mitre.org/techniques/T1552/"
+[[threat.technique.subtechnique]]
+id = "T1552.001"
+name = "Credentials In Files"
+reference = "https://attack.mitre.org/techniques/T1552/001/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_suspicious_access_to_active_directory_database_file.toml b/behavior/rules/credential_access_suspicious_access_to_active_directory_database_file.toml
new file mode 100644
index 00000000..edd34281
--- /dev/null
+++ b/behavior/rules/credential_access_suspicious_access_to_active_directory_database_file.toml
@@ -0,0 +1,62 @@
+[rule]
+description = """
+Identifies access to the Active Directory Domain Database file (ntds.dit). This file contains sensitive information
+including hashed domain credentials.
+"""
+id = "d66765b8-010b-4a40-ab62-1d8f13a44878"
+license = "Elastic License v2"
+name = "Suspicious Access to Active Directory Database File"
+os_list = ["windows"]
+reference = [
+    "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration",
+]
+version = "1.0.7"
+
+query = '''
+file where event.action == "open" and process.pid != 4 and 
+ file.path : "*\\Windows\\NTDS\\ntds.dit" and process.executable : "?:\\*" and
+ /* covered by RuleId 3c44fc50-2672-48b3-af77-ff43b895ac70 */
+ not process.executable :
+             ("?:\\Windows\\System32\\ntdsutil.exe",
+              "?:\\Windows\\System32\\esentutl.exe",
+              "?:\\Windows\\system32\\lsass.exe",
+              "?:\\Windows\\System32\\wbengine.exe",
+              "?:\\Program Files\\Bitdefender\\Endpoint Security\\epsecurityservice.exe",
+              "?:\\Program Files\\Common Files\\McAfee\\SystemCore\\mcshield.exe",
+              "?:\\Program Files\\Common Files\\McAfee\\AVSolution\\mcshield.exe",
+              "?:\\Program Files (x86)\\VIPRE Business Agent\\SBAMSvc.exe",
+              "?:\\Program Files\\Seqrite\\Seqrite\\SCANNER.EXE",
+              "?:\\Program Files\\Seqrite\\Seqrite Endpoint Security\\SCANNER.EXE",
+              "?:\\Program Files\\Seqrite\\Seqrite\\sapissvc.exe", 
+              "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe", 
+              "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*.exe", 
+              "?:\\Program Files\\Windows Defender Advanced Threat Protection\\*.exe",
+              "?:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Windows Server\\*.exe",
+              "?:\\Program Files (x86)\\Sophos\\Sophos Anti-Virus\\SavService.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1003"
+name = "OS Credential Dumping"
+reference = "https://attack.mitre.org/techniques/T1003/"
+[[threat.technique.subtechnique]]
+id = "T1003.003"
+name = "NTDS"
+reference = "https://attack.mitre.org/techniques/T1003/003/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_suspicious_access_to_lsa_secrets_registry.toml b/behavior/rules/credential_access_suspicious_access_to_lsa_secrets_registry.toml
new file mode 100644
index 00000000..ee9a66c8
--- /dev/null
+++ b/behavior/rules/credential_access_suspicious_access_to_lsa_secrets_registry.toml
@@ -0,0 +1,63 @@
+[rule]
+description = """
+Identifies access to the LSA Secrets policy registry hive by an unusual process. Adversaries with SYSTEM access to a
+host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential
+materials, such as credentials for service accounts.
+"""
+id = "c5ee8453-bc89-42e7-a414-1ba4bec85119"
+license = "Elastic License v2"
+name = "Suspicious Access to LSA Secrets Registry"
+os_list = ["windows"]
+reference = [
+    "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets",
+    "https://github.com/gtworek/PSBits/tree/master/LSASecretDumper",
+]
+version = "1.0.6"
+
+query = '''
+registry where
+ registry.path : ("HKLM\\SECURITY\\Policy\\Secrets\\*", "HKLM\\SECURITY\\CACHE*") and process.executable != null and
+ user.id : "S-1-5-18" and
+ not process.executable : ("?:\\Windows\\System32\\lsass.exe",
+                           "\\Device\\HarddiskVolume?\\Windows\\System32\\lsass.exe",
+                           "\\Device\\HarddiskVolume??\\Windows\\System32\\lsass.exe",
+                           "?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\ToolsIQ.exe",
+                           "?:\\Program Files\\Citrix\\PvsVm\\Service\\PvsVmAgent.exe",
+                           "?:\\Windows\\Provisioning\\Autopilot\\DiagonsticAnalysis.pif",
+                           "?:\\Program Files\\RepairTech\\LiveAgent\\SyncroLive.Agent.Runner.exe") and
+ not (process.executable : "?:\\Windows\\System32\\dsregcmd.exe" and registry.path : "HKLM\\SECURITY\\Policy\\Secrets\\DSREGCMD\\MutexName") and
+ not (process.executable : "?:\\Windows\\LTSvc\\LTSVC.exe" and registry.path : "HKLM\\SECURITY\\Cache\\NL$1") and 
+ not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and 
+      registry.path : "HKLM\\SECURITY\\Policy\\Secrets\\$MACHINE.ACC\\CupdTime\\")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1003"
+name = "OS Credential Dumping"
+reference = "https://attack.mitre.org/techniques/T1003/"
+[[threat.technique.subtechnique]]
+id = "T1003.004"
+name = "LSA Secrets"
+reference = "https://attack.mitre.org/techniques/T1003/004/"
+
+[[threat.technique.subtechnique]]
+id = "T1003.005"
+name = "Cached Domain Credentials"
+reference = "https://attack.mitre.org/techniques/T1003/005/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_suspicious_access_to_web_browser_credential_stores.toml b/behavior/rules/credential_access_suspicious_access_to_web_browser_credential_stores.toml
new file mode 100644
index 00000000..8e4742ca
--- /dev/null
+++ b/behavior/rules/credential_access_suspicious_access_to_web_browser_credential_stores.toml
@@ -0,0 +1,65 @@
+[rule]
+description = """
+Identifies access to more than one web browser's credential store data by the same process. Adversaries may steal
+credentials from web browsers by reading files specific to the target browser.
+"""
+id = "03758167-3eed-465f-9174-b284d599036d"
+license = "Elastic License v2"
+name = "Suspicious Access to Web Browser Credential Stores"
+os_list = ["windows"]
+version = "1.0.9"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+  [file where event.action == "open" and
+    user.id : "S-1-5-21*" and not process.pid == 4 and process.code_signature.trusted != true and
+    file.path :
+       (  /* chromium based browsers (chrome, edge, brave etc.) */
+        "?:\\Users\\*\\AppData\\Local\\*\\User Data\\Default\\Login Data",
+
+         /* some infostealers access only the cookies file and don't touch pwd file logins.json */
+        "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*default*\\logins.json",
+        "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*default*\\cookies.sqlite") and
+	 not process.executable :
+	           ("?:\\Program Files\\*.exe",
+			    "?:\\Program Files (x86)\\*.exe",
+				"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+				"?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe",
+				"*\\Program Files*\\Windows Defender\\MsMpEng.exe")]
+   [file where event.action == "open" and
+    file.path :
+       ("?:\\Users\\*\\AppData\\Local\\*\\User Data\\Default\\Login Data",
+        "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*default*\\logins.json",
+        "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*default*\\cookies.sqlite")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1539"
+name = "Steal Web Session Cookie"
+reference = "https://attack.mitre.org/techniques/T1539/"
+
+[[threat.technique]]
+id = "T1555"
+name = "Credentials from Password Stores"
+reference = "https://attack.mitre.org/techniques/T1555/"
+[[threat.technique.subtechnique]]
+id = "T1555.003"
+name = "Credentials from Web Browsers"
+reference = "https://attack.mitre.org/techniques/T1555/003/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "8.0.0"
diff --git a/behavior/rules/credential_access_suspicious_access_to_windows_vault_files.toml b/behavior/rules/credential_access_suspicious_access_to_windows_vault_files.toml
new file mode 100644
index 00000000..76d4cf40
--- /dev/null
+++ b/behavior/rules/credential_access_suspicious_access_to_windows_vault_files.toml
@@ -0,0 +1,56 @@
+[rule]
+description = """
+Identifies an unusual process accessing Windows Vault files. Credential Lockers store credentials in encrypted .vcrd
+files and the encryption key can be found in a file named Policy.vpol. Adversaries may acquire credentials from Vault
+files.
+"""
+id = "831c1cda-8d8c-4c21-a84e-c428469e7d93"
+license = "Elastic License v2"
+name = "Suspicious Access to Windows Vault Files"
+os_list = ["windows"]
+reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
+version = "1.0.4"
+
+query = '''
+file where event.action == "open" and
+   /* Credentials History */
+  (file.path : ("?:\\Users\\*\\AppData\\*\\Microsoft\\Vault\\*\\*", "?:\\ProgramData\\Microsoft\\Vault\\*") and
+    file.extension : ("vpol", "vcrd")) and
+  user.id : "S-1-5-21*" and process.executable : "?:\\*" and
+  /* third party programs and noisy native system processes */
+  not process.executable :
+          ("?:\\Program Files\\*",
+           "?:\\Program Files (x86)\\*",
+           "?:\\Windows\\System32\\lsass.exe",
+           "?:\\Windows\\System32\\svchost.exe",
+           "?:\\Windows\\System32\\Robocopy.exe",
+           "?:\\Windows\\ccmcache\\*.exe",
+           "?:\\Windows\\CCM\\*.exe",
+           "?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1555"
+name = "Credentials from Password Stores"
+reference = "https://attack.mitre.org/techniques/T1555/"
+[[threat.technique.subtechnique]]
+id = "T1555.004"
+name = "Windows Credential Manager"
+reference = "https://attack.mitre.org/techniques/T1555/004/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_system_bootkey_registry_access.toml b/behavior/rules/credential_access_system_bootkey_registry_access.toml
new file mode 100644
index 00000000..1b1aaa62
--- /dev/null
+++ b/behavior/rules/credential_access_system_bootkey_registry_access.toml
@@ -0,0 +1,66 @@
+[rule]
+description = """
+Identifies attempts to read the registry values used to calculate the System BootKey, which adversaries can use to
+recover passwords and other secrets from the registry.
+"""
+id = "ae7812a1-1329-47b4-9d76-8c7359cda4e4"
+license = "Elastic License v2"
+name = "System BootKey Registry Access"
+os_list = ["windows"]
+reference = [
+    "http://moyix.blogspot.com/2008/02/syskey-and-sam.html",
+    "https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump",
+]
+version = "1.0.5"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+  [registry where event.action == "query" and
+   /* Bootkey/Syskey - GBG, JD, Skew1 */
+   registry.path : ("HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Skew1*",
+                    "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JD*",
+                    "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JDLSA\\GBG*") and
+   not (process.executable : ("?:\\Windows\\System32\\lsass.exe", "?:\\Windows\\System32\\svchost.exe") and
+        user.id in ("S-1-5-18", "S-1-5-19"))
+   ]
+   [registry where event.action == "query" and
+    registry.path : ("HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Skew1*",
+                     "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JD*",
+                     "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\JDLSA\\GBG*")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1003"
+name = "OS Credential Dumping"
+reference = "https://attack.mitre.org/techniques/T1003/"
+[[threat.technique.subtechnique]]
+id = "T1003.002"
+name = "Security Account Manager"
+reference = "https://attack.mitre.org/techniques/T1003/002/"
+
+[[threat.technique.subtechnique]]
+id = "T1003.004"
+name = "LSA Secrets"
+reference = "https://attack.mitre.org/techniques/T1003/004/"
+
+[[threat.technique.subtechnique]]
+id = "T1003.005"
+name = "Cached Domain Credentials"
+reference = "https://attack.mitre.org/techniques/T1003/005/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_web_browser_credential_access_via_unsigned_process.toml b/behavior/rules/credential_access_web_browser_credential_access_via_unsigned_process.toml
new file mode 100644
index 00000000..41b61791
--- /dev/null
+++ b/behavior/rules/credential_access_web_browser_credential_access_via_unsigned_process.toml
@@ -0,0 +1,55 @@
+[rule]
+description = """
+Identifies an unsigned process accessing the password store of commonly used web browsers. Adversaries may steal
+credentials from web browsers by reading files specific to the target browser.
+"""
+id = "9ed4ee4a-bc91-4d38-b6dd-11467b774460"
+license = "Elastic License v2"
+name = "Web Browser Credential Access via Unsigned Process"
+os_list = ["windows"]
+version = "1.0.7"
+
+query = '''
+sequence by user.name with maxspan=2m
+  /* PE file creation followed by its execution followed by browser credential stores access */
+  
+  [file where event.action != "deletion" and
+   (file.Ext.header_bytes : "4d5a*" or file.extension : ("exe", "scr", "pif", "com"))] by file.path
+  [file where event.type == "access" and
+    /* domain user RID */
+    user.id : "S-1-5-21*" and
+    not process.code_signature.trusted == true and
+    not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
+    file.name : ("Login Data", "logins.json", "cert?.db", "key?.db", "signons.sqlite", "cookies.sqlite")] by process.executable
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1539"
+name = "Steal Web Session Cookie"
+reference = "https://attack.mitre.org/techniques/T1539/"
+
+[[threat.technique]]
+id = "T1555"
+name = "Credentials from Password Stores"
+reference = "https://attack.mitre.org/techniques/T1555/"
+[[threat.technique.subtechnique]]
+id = "T1555.003"
+name = "Credentials from Web Browsers"
+reference = "https://attack.mitre.org/techniques/T1555/003/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "8.0.0"
diff --git a/behavior/rules/credential_access_web_browser_credential_access_via_unusual_process.toml b/behavior/rules/credential_access_web_browser_credential_access_via_unusual_process.toml
new file mode 100644
index 00000000..98c80f11
--- /dev/null
+++ b/behavior/rules/credential_access_web_browser_credential_access_via_unusual_process.toml
@@ -0,0 +1,87 @@
+[rule]
+description = """
+Identifies an unexpected process accessing the password store of commonly used web browsers. Adversaries may steal
+credentials from web browsers by reading files specific to the target browser.
+"""
+id = "f488cd1b-2407-4ec8-8705-7adf99ccbd33"
+license = "Elastic License v2"
+name = "Web Browser Credential Access via Unusual Process"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+file where event.type == "access" and
+ process.executable != null and
+ file.name : ("Login Data", "logins.json", "signons.sqlite", "cookies.sqlite") and
+ file.path : ("?:\\Users\\*", "\\??\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\Users\\*") and not
+
+ /* browsers have variable install path %programfiles% and Users home folder */
+ process.name : ("chrome.exe", "firefox.exe", "firefoxportable.exe", "brave.exe", "browser.exe", "dragon.exe", "iexplore.exe",
+                "msedge.exe", "maxthon.exe", "microsoftedge.exe", "microsoftedgecp.exe", "microsoftedgesh.exe", "opera.exe",
+				"vivaldi.exe", "palemoon.exe", "seamonkey.exe", "safari.exe", "waterfox.exe", "OneDrive.exe", "BCompare.exe",
+				"thunderbird.exe", "certutil.exe", "chromium.exe", "UpdateBrowserForApp.exe", "MsMpEng.exe", "MpCopyAccelerator.exe",
+				"CCleaner64.exe", "ESETOnlineScanner.exe", "detecttvsu.exe") and not
+ process.executable :
+          (
+            /* third party programs common install path - requires local admin */
+            "*\\Program Files\\*",
+            "*\\Program Files (x86)\\*",
+
+            /*
+              dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
+              explorer.exe for directory and file discovery.
+              SearchProtocolHost.exe is for file searches and indexing.
+              browserexport is a legit utility that can be used to migrate browser data (but not decrypt pwd).
+             */
+            "*\\Windows\\explorer.exe",
+            "*\\Windows\\System32\\dllhost.exe",
+            "*\\Windows\\System32\\Robocopy.exe",
+            "*\\Windows\\System32\\browserexport.exe",
+            "*\\Windows\\System32\\SearchProtocolHost.exe"
+	      ) and
+   /* System virtual process */
+  not process.pid == 4 and
+
+  /* svchost instances running as non privileged user sid */
+  not (process.executable : "*\\Windows\\System32\\svchost.exe" and process.parent.pid < 1000) and
+
+  /* excluding privileged services and third party programs */
+  not (user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+       process.executable : ("?:\\Windows\\System32\\*.exe", "?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe")) and
+
+  not (process.name : "gener8.exe" and file.path : "?:\\USERS\\*\\APPDATA\\LOCAL\\GENER8\\USER DATA\\DEFAULT\\LOGIN DATA") and
+  not (process.name : "ccs.exe" and file.path : "?:\\USERS\\*\\APPDATA\\LOCAL\\ENTERPRISEBANKSECUREBROWSER\\USER DATA\\DEFAULT\\LOGIN DATA") and 
+  not (process.name : "epic.exe" and file.path : "?:\\USERS\\*\\APPDATA\\LOCAL\\EPIC PRIVACY BROWSER\\USER DATA\\DEFAULT\\LOGIN DATA") and
+  not (process.name : "ccss?st.exe" and file.path : "?:\\USERS\\*\\APPDATA\\LOCAL\\ESERVISSECUREBROWSER\\USER DATA\\DEFAULT\\LOGIN DATA")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1539"
+name = "Steal Web Session Cookie"
+reference = "https://attack.mitre.org/techniques/T1539/"
+
+[[threat.technique]]
+id = "T1555"
+name = "Credentials from Password Stores"
+reference = "https://attack.mitre.org/techniques/T1555/"
+[[threat.technique.subtechnique]]
+id = "T1555.003"
+name = "Credentials from Web Browsers"
+reference = "https://attack.mitre.org/techniques/T1555/003/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/credential_access_web_browsers_password_access_via_command_line.toml b/behavior/rules/credential_access_web_browsers_password_access_via_command_line.toml
new file mode 100644
index 00000000..3050819b
--- /dev/null
+++ b/behavior/rules/credential_access_web_browsers_password_access_via_command_line.toml
@@ -0,0 +1,51 @@
+[rule]
+description = """
+Adversaries may collect keychain storage data from a system to in order to acquire credentials. Keychains are the
+built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi
+and website passwords, secure notes, certificates, and Kerberos.
+"""
+id = "77d71ede-3025-4c71-bb99-ada7c344bf89"
+license = "Elastic License v2"
+name = "Web Browsers Password Access via Command Line"
+os_list = ["macos"]
+reference = [
+    "https://www.netmeister.org/blog/keychain-passwords.html",
+    "https://github.com/priyankchheda/chrome_password_grabber/blob/master/chrome.py",
+    "https://ss64.com/osx/security.html",
+    "https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/",
+]
+version = "1.0.4"
+
+query = '''
+process where event.action == "exec" and
+ process.name : "security" and
+ process.args : "-wa" and process.args : ("find-generic-password", "find-internet-password") and
+ process.command_line : ("*Chrome*", "*Chromium*", "*Opera*", "*Safari*", "*Brave*", "*Microsoft Edge*", "*Firefox*") and
+ not process.parent.executable : "/Applications/Keeper Password Manager.app/Contents/Frameworks/Keeper Password Manager Helper*/Contents/MacOS/Keeper Password Manager Helper*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1555"
+name = "Credentials from Password Stores"
+reference = "https://attack.mitre.org/techniques/T1555/"
+[[threat.technique.subtechnique]]
+id = "T1555.003"
+name = "Credentials from Web Browsers"
+reference = "https://attack.mitre.org/techniques/T1555/003/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_binary_masquerading_via_untrusted_path.toml b/behavior/rules/defense_evasion_binary_masquerading_via_untrusted_path.toml
new file mode 100644
index 00000000..ca6f2ecc
--- /dev/null
+++ b/behavior/rules/defense_evasion_binary_masquerading_via_untrusted_path.toml
@@ -0,0 +1,162 @@
+[rule]
+description = """
+Identifies binaries that have been identically named to Windows built-in programs and being run from untrusted or
+commonly abused paths. Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate
+or benign.
+"""
+id = "35dedf0c-8db6-4d70-b2dc-a133b808211f"
+license = "Elastic License v2"
+name = "Binary Masquerading via Untrusted Path"
+os_list = ["windows"]
+version = "1.0.11"
+
+query = '''
+process where event.action == "start" and
+  process.name : (
+    "at.exe",
+    "atbroker.exe",
+    "arp.exe",
+    "bcdedit.exe",
+    "bitsadmin.exe",
+    "certutil.exe",
+    "cmstp.exe",
+    "conhost.exe",
+    "control.exe",
+    "cscript.exe",
+    "csrss.exe",
+    "csi.exe",
+    "dsget.exe",
+    "dfsvc.exe",
+    "dllhost.exe",
+    "dsquery.exe",
+    "eventvwr.exe",
+    "fsutil.exe",
+    "ieexec.exe",
+    "installutil.exe",
+    "ipconfig.exe",
+    "lsass.exe",
+    "Microsoft.Workflow.Compiler.exe",
+    "mmc.exe",
+    "msbuild.exe",
+    "msdt.exe",
+    "mshta.exe",
+    "msiexec.exe",
+    "net.exe",
+    "net1.exe",
+    "netsh.exe",
+    "netstat.exe",
+    "odbcconf.exe",
+    "ping.exe",
+    "powershell.exe",
+    "qprocess.exe",
+    "quser.exe",
+    "qwinsta.exe",
+    "reg.exe",
+    "regasm.exe",
+    "regsvcs.exe",
+    "regsvr32.exe",
+    "runas.exe",
+    "rundll32.exe",
+    "schtasks.exe",
+    "sdclt.exe",
+    "services.exe",
+    "spoolsv.exe",
+    "svchost.exe",
+    "taskhost.exe",
+    "taskhostw.exe",
+    "tasklist.exe",
+    "userinit.exe",
+    "vaultcmd.exe",
+    "vssadmin.exe",
+    "wininit.exe",
+    "winlogon.exe",
+    "whoami.exe",
+    "wmic.exe",
+    "wevtutil.exe",
+    "wscript.exe",
+    "gprslt.exe",
+    "nbtstat.exe",
+    "systeminfo.exe",
+    "VsJITDebugger.exe",
+    "extexport.exe",
+    "extexport.exe") and
+    
+  not process.executable : (
+    "?:\\Windows\\System32\\*.exe",
+    "?:\\Windows\\SysWOW64\\*.exe",
+    "?:\\Windows\\Microsoft.NET\\*.exe",
+    "?:\\Program Files (x86)\\*.exe",
+    "?:\\Program Files\\*.exe",
+
+    /* Issue # 295 */
+    "?:\\Users\\*\\AppData\\Local\\Programs\\Git\\usr\\bin\\hostname.exe",
+    "?:\\*\\usr\\bin\\hostname.exe",
+    "?:\\ProgramData\\West Wind Technologies\\Uninstall\\*\\regsvr32.exe",
+    "?:\\ProgramData\\chocolatey\\*.exe",
+    "?:\\cygwin*\\bin\\*.exe",
+
+    /* PR #685 */
+    "\\Device\\HarddiskVolume*\\Windows\\System32\\*.exe",
+    "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\*.exe",
+    "\\Device\\HarddiskVolume*\\Windows\\Microsoft.NET\\*.exe",
+    "\\Device\\HarddiskVolume*\\Program Files (x86)\\*.exe",
+    "\\Device\\HarddiskVolume*\\Program Files\\*.exe"
+    ) and
+
+  not (process.name : "certutil.exe" and process.parent.executable : "?:\\Program Files (x86)\\Netskope\\STAgent\\stAgentUI.exe" and process.code_signature.subject_name: "netSkope Inc") and
+  not (process.executable : "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\*.exe" and process.code_signature.subject_name : "Lenovo") and
+
+  /* Issue #582 */
+  not (process.name : "certutil.exe" and process.parent.name : "cmd.exe" and process.args : "-A" and
+       process.parent.args : "?:\\Users\\*\\Firefox-Add_certs*\\firefox_add-certs-windows\\add-certs.cmd") and
+  not (process.name : "certutil.exe" and process.parent.executable : "?:\\Program Files (x86)\\DYMO\\DYMO Connect\\DYMO.WebApi.Win.Host.exe") and
+  /* Sfax Download Service */
+  not (process.name : "InstallUtil.exe" and process.parent.name : "Engine.exe" and
+       process.parent.args : "/OriginExe=*\\SfaxInstaller\\Sfax Windows Service.exe") and
+  not (process.pe.original_file_name == "RegAsm.exe" and
+       process.executable : "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoBatteryGaugePackage\\*\\RegAsm.exe") and
+  not (process.name : "regsvr32.exe" and process.parent.executable : ("?:\\ERPU\\Browser\\AutoUpgrade.exe", "?:\\ERPU\\Browser\\NeoWeb.exe")) and
+  not (process.name : "certutil.exe" and process.parent.name : "TOTALCMD*.EXE" and process.args_count <= 2) and
+  not (process.executable : "?:\\Campus\\System\\DLL\\CADability\\RegAsm.exe" and process.parent.executable : "?:\\Campus\\System\\DLL\\CADability\\RegCADability.exe") and
+  not (process.name : "certutil.exe" and process.args : "-d" and process.args : "-n") and
+  not (process.name : "services.exe" and process.args : "-i*" and process.parent.name : "monitor.exe") and
+  not (process.name : "RegAsm.exe" and process.args : ("directdeposit.vb.tlb", "?:\\Program Files (x86)\\*.dll", "?:\\Program Files\\*.dll")) and
+  not process.executable : "D:\\Reform V*\\Reform_PDC_Server_v*\\Plugins\\Monitoring\\CScript.exe" and
+  not (process.name : "rundll32.exe" and process.code_signature.subject_name == "Teramind Inc." and process.code_signature.trusted == true) and
+  not (process.name : "regsvr32.exe" and
+       process.args : ("?:\\Sage\\Sage300 Programs\\GL69A\\FRCOM690.DLL",
+                       "?:\\Program Files (x86)\\*.dll",
+                       "?:\\Program Files\\*.dll",
+                       "?:\\WINDOWS\\system32\\*.dll")) and
+  not process.executable : ("?:\\Microsoft Visual Studio\\*\\Msbuild.exe", "?:\\adv\\app\\RegAsm.exe", "?:\\Windows\\WinSxS\\wow64_microsoft-windows*management-console_*\\mmc.exe") and
+  not (process.executable : "?:\\Engeman\\RegAsm.exe" and process.parent.executable : "?:\\Engeman\\Engeman.exe") and
+  not process.command_line : ("installutil  /unattended Sage.CNA.WindowsService.exe ",
+                              "installutil  /u Sage.CNA.WindowsService.exe ",
+                              "InstallUtil  /i ComPlus.HelpDesk.AppServer.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1036"
+name = "Masquerading"
+reference = "https://attack.mitre.org/techniques/T1036/"
+[[threat.technique.subtechnique]]
+id = "T1036.004"
+name = "Masquerade Task or Service"
+reference = "https://attack.mitre.org/techniques/T1036/004/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_binary_proxy_execution_via_rundll32.toml b/behavior/rules/defense_evasion_binary_proxy_execution_via_rundll32.toml
new file mode 100644
index 00000000..9eea18f4
--- /dev/null
+++ b/behavior/rules/defense_evasion_binary_proxy_execution_via_rundll32.toml
@@ -0,0 +1,74 @@
+[rule]
+description = """
+Identifies the execution of a malicious application via rundll32.exe. Adversaries may abuse rundll32.exe to proxy
+execution of malicious code and bypass application whitelisting configuration.
+"""
+id = "f60455df-5054-49ff-9ff7-1dc4e37b6ea7"
+license = "Elastic License v2"
+name = "Binary Proxy Execution via Rundll32"
+os_list = ["windows"]
+reference = [
+    "https://lolbas-project.github.io/lolbas/Libraries/Shell32/",
+    "https://lolbas-project.github.io/lolbas/Libraries/Zipfldr/",
+    "https://lolbas-project.github.io/lolbas/Libraries/Pcwutl/",
+    "https://lolbas-project.github.io/lolbas/Libraries/Advpack/",
+    "https://lolbas-project.github.io/lolbas/Libraries/Ieadvpack/",
+    "https://lolbas-project.github.io/lolbas/Libraries/Url/",
+]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=1m
+  [process where event.action == "start" and
+   process.pe.original_file_name == "RUNDLL32.EXE" and
+   process.command_line :
+          ("*advpack*RegisterOCX*",
+           "*advpack*#12*",
+           "*zipfldr*RouteTheCall*",
+           "*pcwutl*LaunchApplication*",
+           "*pcwutl*#1*",
+           "*url.dll*FileProtocolHandler*file://*",
+           "*url.dll*FileProtocolHandler*.exe*",
+           "*shell32.dll*ShellExec_RunDLL*",
+           "*advpack*LaunchINFSection*") and
+   /* Issue #265 */
+   not (process.command_line : "*url.dll*FileProtocolHandler*" and
+        process.command_line : ("*http://*", "*zoommtg://*", "*://*&*&*")) and
+
+   /* Legit LaunchApplication instances via msdt */
+   not (process.command_line : "*pcwutl.dll,LaunchApplication*" and
+        process.parent.name :  "msdt.exe" and
+        process.working_directory : "?:\\Windows\\system32\\")] by process.entity_id
+  [process where event.action == "start" and
+   not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
+   not (process.name : "wscript.exe" and process.args : "Cathexis Archive Viewer.vbs") and
+   not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
+   not process.Ext.token.integrity_level_name == "system"
+   ] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_control_panel_process_with_unusual_arguments.toml b/behavior/rules/defense_evasion_control_panel_process_with_unusual_arguments.toml
new file mode 100644
index 00000000..6acd904e
--- /dev/null
+++ b/behavior/rules/defense_evasion_control_panel_process_with_unusual_arguments.toml
@@ -0,0 +1,60 @@
+[rule]
+description = """
+Identifies instances of the Control Panel application running with suspicious keywords or paths in the process command
+line value. Adversaries may abuse Control.exe to proxy execution of malicious code.
+"""
+id = "a4862afb-1292-4f65-a15f-8d6a8019b5e2"
+license = "Elastic License v2"
+name = "Control Panel Process with Unusual Arguments"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+process where event.action == "start" and
+ process.executable : ("?:\\Windows\\SysWOW64\\control.exe", "?:\\Windows\\System32\\control.exe") and
+ process.command_line :
+          ("*.jpg*",
+           "*.png*",
+           "*.gif*",
+           "*.bmp*",
+           "*.jpeg*",
+           "*.TIFF*",
+           "*.inf*",
+           "*.dat*",
+           "*.cpl:../*",
+           "*..\\..\\*",
+           "*/AppData/Local/*",
+           "*:\\Users\\Public\\*",
+           "*\\AppData\\Local\\*") and
+
+ /* excluding FPs where /name arg is used to specify a control by name */
+ not (process.args : "/name" and process.args_count >= 2) and
+ /* excluding system IL to minimize risk of killing system critical execution */
+ not process.Ext.token.integrity_level_name == "system"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.002"
+name = "Control Panel"
+reference = "https://attack.mitre.org/techniques/T1218/002/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_crashdump_disabled_via_registry_modification.toml b/behavior/rules/defense_evasion_crashdump_disabled_via_registry_modification.toml
new file mode 100644
index 00000000..8309ef44
--- /dev/null
+++ b/behavior/rules/defense_evasion_crashdump_disabled_via_registry_modification.toml
@@ -0,0 +1,41 @@
+[rule]
+description = """
+Identifies attempt to disable memory crashdump via registry modification. Malware using kernel mode component may
+perform this action to limit exposure in the case of an unexpected system crash.
+"""
+id = "77ca3fcc-f607-45e0-837e-e4173e4ffc2a"
+license = "Elastic License v2"
+name = "CrashDump Disabled via Registry Modification"
+os_list = ["windows"]
+reference = [
+    "https://elastic.github.io/security-research/intelligence/2022/03/01.hermeticwiper-targets-ukraine/article/",
+    "https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options",
+]
+version = "1.0.5"
+
+query = '''
+registry where registry.value : "CrashDumpEnabled" and registry.data.strings : "0" and
+ not (user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and 
+      process.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\msiexec.exe"))
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1112"
+name = "Modify Registry"
+reference = "https://attack.mitre.org/techniques/T1112/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_execution_via_internet_explorer_exporter.toml b/behavior/rules/defense_evasion_execution_via_internet_explorer_exporter.toml
new file mode 100644
index 00000000..d746e3de
--- /dev/null
+++ b/behavior/rules/defense_evasion_execution_via_internet_explorer_exporter.toml
@@ -0,0 +1,42 @@
+[rule]
+description = """
+Identifies the execution of the built-in Windows program, ExtExport, which can be used for execution via side-loading a
+malicious DLL with one of the following names: mozcrt19.dll, mozsqlite3.dll, or sqlite.dll.
+"""
+id = "e13a65b7-f46f-4c7f-85cf-7e59170071fa"
+license = "Elastic License v2"
+name = "Execution via Internet Explorer Exporter"
+os_list = ["windows"]
+reference = ["https://lolbas-project.github.io/lolbas/Binaries/Extexport/"]
+version = "1.0.7"
+
+query = '''
+sequence by user.id with maxspan=5m
+ [file where event.action != "deletion" and
+  file.name : ("sqlite3.dll", "mozcrt19.dll", "mozsqlite3.dll") and
+  not file.path : ("?:\\Program Files (x86)\\*.dll", "?:\\Program Files\\*.dll")]
+ [process where event.action == "start" and process.pe.original_file_name : "extexport.exe" and
+  not process.executable : ("?:\\Program Files (x86)\\Internet Explorer\\ExtExport.exe",
+                            "?:\\Program Files\\Internet Explorer\\ExtExport.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_execution_via_renamed_signed_binary_proxy.toml b/behavior/rules/defense_evasion_execution_via_renamed_signed_binary_proxy.toml
new file mode 100644
index 00000000..192ab2b1
--- /dev/null
+++ b/behavior/rules/defense_evasion_execution_via_renamed_signed_binary_proxy.toml
@@ -0,0 +1,81 @@
+[rule]
+description = """
+Identifies built-in Windows programs that have been renamed and can be used for execution, downloads, and/or evasion.
+Attackers may abuse this tactic to evade filename based detection of built-in tools.
+"""
+id = "b0207677-5041-470b-981d-13ab956cf5b4"
+license = "Elastic License v2"
+name = "Execution via Renamed Signed Binary Proxy"
+os_list = ["windows"]
+reference = ["https://lolbas-project.github.io"]
+version = "1.0.8"
+
+query = '''
+process where event.action == "start" and
+ process.name != null and
+     (
+       (process.pe.original_file_name == "cscript.exe" and not process.name : "cscript.exe") or
+       (process.pe.original_file_name == "wscript.exe" and not process.name : "wscript.exe") or
+       (process.pe.original_file_name == "PowerShell.EXE" and not process.name : "PowerShell.EXE") or
+       (process.pe.original_file_name == "Cmd.Exe" and not process.name : ("Cmd.Exe", "command.com")) or
+       (process.pe.original_file_name == "MSHTA.EXE" and not process.name : "MSHTA.EXE") or
+       (process.pe.original_file_name == "RUNDLL32.EXE" and not process.name : "RUNDLL32.EXE") or
+       (process.pe.original_file_name == "REGSVR32.EXE" and not process.name : "REGSVR32.EXE") or
+       (process.pe.original_file_name == "MSBuild.exe" and not process.name : "MSBuild.exe") or
+       (process.pe.original_file_name == "InstallUtil.exe" and not process.name : "InstallUtil.exe") or
+       (process.pe.original_file_name == "RegAsm.exe" and not process.name : "RegAsm.exe") or
+       (process.pe.original_file_name == "RegSvcs.exe" and not process.name : "RegSvcs.exe") or
+       (process.pe.original_file_name == "msxsl.exe" and not process.name : "msxsl.exe") or
+       (process.pe.original_file_name == "Microsoft.Workflow.Compiler.exe" and
+        not process.name : "Microsoft.Workflow.Compiler.exe") or
+       (process.pe.original_file_name == "msiexec.exe" and not process.name : "msiexec.exe" and
+        not process.executable : "?:\\Windows\\Installer\\MSI*.tmp") or
+       (process.pe.original_file_name == "CMSTP.EXE" and not process.name : "CMSTP.EXE") or
+       (process.pe.original_file_name == "bitsadmin.exe" and not process.name : "bitsadmin.exe") or
+       (process.pe.original_file_name == "CertUtil.exe" and not process.name : "CertUtil.exe") or
+       (process.pe.original_file_name == "wmic.exe" and not process.name : "wmic.exe") or
+       (process.pe.original_file_name == "schtasks.exe" and not process.name : "schtasks.exe") or
+       (process.pe.original_file_name == "wuauclt.exe" and not process.name : "wuauclt.exe") or
+       (process.pe.original_file_name == "Bginfo.exe" and not process.name : "Bginfo*.exe") or
+       (process.pe.original_file_name == "VsJITDebugger.exe" and not process.name : "VsJITDebugger.exe") or
+       (process.pe.original_file_name == "xwizard.exe" and not process.name : "xwizard.exe") or
+       (process.pe.original_file_name == "extexport.exe" and not process.name : "extexport.exe") or 
+       (process.pe.original_file_name == "CertReq.exe" and not process.name : "CertReq.exe")
+     ) and
+ /* some third party programs tend to include renamed binaries, still often run from trusted paths */
+ not process.executable :
+        (
+          "?:\\Windows\\System32\\*.exe",
+          "?:\\Windows\\SysWOW64\\*.exe",
+          "?:\\Program Files (x86)\\*.exe",
+          "?:\\Program Files\\*.exe",
+          "\\Device\\HarddiskVolume*\\Windows\\System32\\*.exe",
+          "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\*.exe",
+          "\\Device\\HarddiskVolume*\\Windows\\Microsoft.NET\\*.exe",
+          "\\Device\\HarddiskVolume*\\Program Files (x86)\\*.exe",
+          "\\Device\\HarddiskVolume*\\Program Files\\*.exe"
+        ) and
+  not (process.pe.original_file_name in ("RegAsm.exe", "REGSVR32.EXE") and process.executable : "?:\\Windows\\Installer\\MSI*.tmp" and
+       process.parent.executable : "?:\\WINDOWS\\system32\\msiexec.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_managed_.net_code_execution_via_windows_script_interpreter.toml b/behavior/rules/defense_evasion_managed_.net_code_execution_via_windows_script_interpreter.toml
new file mode 100644
index 00000000..a023c041
--- /dev/null
+++ b/behavior/rules/defense_evasion_managed_.net_code_execution_via_windows_script_interpreter.toml
@@ -0,0 +1,87 @@
+[rule]
+description = """
+Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious
+code execution via Windows scripts.
+"""
+id = "5a898048-d98c-44c6-b7ba-f63a31eb3571"
+license = "Elastic License v2"
+name = "Managed .NET Code Execution via Windows Script Interpreter"
+os_list = ["windows"]
+reference = [
+    "https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html",
+    "https://github.com/med0x2e/GadgetToJScript",
+    "https://github.com/mdsecactivebreach/SharpShooter",
+]
+version = "1.0.4"
+
+query = '''
+sequence by process.entity_id with maxspan=2m
+ [process where event.type == "start" and
+  process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe") and
+
+  /* Only FPs observed so far, similar FPs can be handled via user custom applied exclusions */
+  not (process.name : "mshta.exe" and process.parent.name : "Explorer.exe" and
+       process.working_directory : "H:\\Code\\SignatureGen\\") and
+  not (process.name : "wscript.exe" and process.parent.name : "wscript.exe" and
+       process.parent.args : "/ChangedHostBitness" and process.parent.args : "/ALL")]
+ [file where event.action == "creation" and
+  file.path : "?:\\Users\\*\\Microsoft\\CLR_*\\UsageLogs\\*.exe.log" and
+  /*
+   CLR Usage Logs are created only for the first time
+   the program executes .NET which should reduce noise compared to clr.dll imageload
+  */
+  file.name : ("wscript.exe.log",
+               "cscript.exe.log",
+               "mshta.exe.log",
+               "wmic.exe.log",
+               "cmstp.exe.log",
+               "msxsl.exe.log")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1055"
+name = "Process Injection"
+reference = "https://attack.mitre.org/techniques/T1055/"
+
+[[threat.technique]]
+id = "T1220"
+name = "XSL Script Processing"
+reference = "https://attack.mitre.org/techniques/T1220/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_modification_of_safari_settings_via_defaults_command.toml b/behavior/rules/defense_evasion_modification_of_safari_settings_via_defaults_command.toml
new file mode 100644
index 00000000..f9de9bfd
--- /dev/null
+++ b/behavior/rules/defense_evasion_modification_of_safari_settings_via_defaults_command.toml
@@ -0,0 +1,43 @@
+[rule]
+description = """
+Identifies changes to the Safari configuration using the built-in defaults command. Adversaries may attempt to enable or
+disable certain Safari settings, such as enabling JavaScript from Apple Events to ease the user's browser's hijacking.
+"""
+id = "396e1138-243c-4215-a8ed-be303204710d"
+license = "Elastic License v2"
+name = "Modification of Safari Settings via Defaults Command"
+os_list = ["macos"]
+reference = ["https://objectivebythesea.com/v2/talks/OBTS_v2_Zohar.pdf"]
+version = "1.0.5"
+
+query = '''
+process where event.type == "start" and
+  process.name : "defaults" and process.args : "write" and
+  process.command_line : "*com.apple.Safari*" and process.command_line : ("*IncludeDevelopMenu*", "*JavaScript*")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1562"
+name = "Impair Defenses"
+reference = "https://attack.mitre.org/techniques/T1562/"
+[[threat.technique.subtechnique]]
+id = "T1562.001"
+name = "Disable or Modify Tools"
+reference = "https://attack.mitre.org/techniques/T1562/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_msbuild_with_unusual_arguments.toml b/behavior/rules/defense_evasion_msbuild_with_unusual_arguments.toml
new file mode 100644
index 00000000..e36f1c31
--- /dev/null
+++ b/behavior/rules/defense_evasion_msbuild_with_unusual_arguments.toml
@@ -0,0 +1,59 @@
+[rule]
+description = """
+Identifies the execution of the built-in MSBuild utility with a suspicious count of command line arguments (less than
+three). Adversaries may use MSBuild to proxy the execution of malicious code via a trusted Windows utility.
+"""
+id = "6518cdaf-e6cd-4cf9-a51e-043117c3dbeb"
+license = "Elastic License v2"
+name = "MSBuild with Unusual Arguments"
+os_list = ["windows"]
+reference = ["https://lolbas-project.github.io/lolbas/Binaries/Msbuild/"]
+version = "1.0.5"
+
+query = '''
+process where event.action == "start" and
+ process.pe.original_file_name == "MSBuild.exe" and process.args_count == 2 and
+  /* FP - expected developers msbuild installation directories */
+
+ not process.executable : ("?:\\Program Files (x86)\\Microsoft Visual Studio\\*",
+                           "?:\\Program Files\\Microsoft Visual Studio\\*") and
+ not process.command_line : ("* /*", "* .\\*", "*.proj*", "*.sln*") and
+  /* FP - Third Party Programs except MS Office */
+
+ not (process.parent.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and
+       not process.parent.name : 
+                          ("winword.exe",
+                           "excel.exe",
+                           "outlook.exe",
+                           "powerpnt.exe",
+                           "eqnedt32.exe",
+                           "fltldr.exe",
+                           "mspub.exe",
+                           "msaccess.exe"))
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1127"
+name = "Trusted Developer Utilities Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1127/"
+[[threat.technique.subtechnique]]
+id = "T1127.001"
+name = "MSBuild"
+reference = "https://attack.mitre.org/techniques/T1127/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_network_connection_via_process_with_unusual_arguments.toml b/behavior/rules/defense_evasion_network_connection_via_process_with_unusual_arguments.toml
new file mode 100644
index 00000000..4c442e24
--- /dev/null
+++ b/behavior/rules/defense_evasion_network_connection_via_process_with_unusual_arguments.toml
@@ -0,0 +1,79 @@
+[rule]
+description = """
+Identifies suspicious network connections from Windows processes that typically have more than one command line
+argument. This may be indicative of a masquerading attempt to evade detections that monitor for suspicious parent-child
+process relationships.
+"""
+id = "95601d8b-b969-4189-9744-090140ae29e6"
+license = "Elastic License v2"
+name = "Network Connection via Process with Unusual Arguments"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+sequence by process.entity_id with maxspan=5m
+  [process where event.action == "start" and process.args_count == 1 and
+   process.name :
+     ("AddInProcess.exe",
+      "AddInProcess32.exe",
+      "AddInUtil.exe",
+      "AppLaunch.exe",
+      "aspnet_compiler.exe",
+      "aspnet_regbrowsers.exe",
+      "aspnet_regiis.exe",
+      "aspnet_regsql.exe",
+      "aspnet_state.exe",
+      "aspnet_wp.exe",
+      "CasPol.exe",
+      "ComSvcConfig.exe",
+      "csc.exe",
+      "cvtres.exe",
+      "DataSvcUtil.exe",
+      "EdmGen.exe",
+      "ilasm.exe",
+      "InstallUtil.exe",
+      "jsc.exe",
+      "Microsoft.Workflow.Compiler.exe",
+      "MSBuild.exe",
+      "mscorsvw.exe",
+      "ngen.exe",
+      "ngentask.exe",
+      "RegAsm.exe",
+      "RegSvcs.exe",
+      "ServiceModelReg.exe",
+      "vbc.exe",
+      "WsatConfig.exe",
+      "dllhost.exe",
+      "regsvr32.exe",
+      "GPUpdate.exe",
+      "SearchProtocolHost.exe",
+      /* Issue #639 - added msiexec */
+      "msiexec.exe")]
+  [network where event.action == "connection_attempted"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1036"
+name = "Masquerading"
+reference = "https://attack.mitre.org/techniques/T1036/"
+
+[[threat.technique]]
+id = "T1055"
+name = "Process Injection"
+reference = "https://attack.mitre.org/techniques/T1055/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_operating_system_security_updates_disabled.toml b/behavior/rules/defense_evasion_operating_system_security_updates_disabled.toml
new file mode 100644
index 00000000..58730276
--- /dev/null
+++ b/behavior/rules/defense_evasion_operating_system_security_updates_disabled.toml
@@ -0,0 +1,44 @@
+[rule]
+description = """
+Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in
+an attempt to disable security updates.
+"""
+id = "741ad90d-e8d0-4d29-b91b-3d68108cb789"
+license = "Elastic License v2"
+name = "Operating System Security Updates Disabled"
+os_list = ["macos"]
+reference = ["https://blog.checkpoint.com/2017/07/13/osxdok-refuses-go-away-money/"]
+version = "1.0.4"
+
+query = '''
+process where event.type == "start" and
+ process.name == "defaults" and
+ process.args : "write" and process.args : "-bool" and
+ process.command_line : "*com.apple.SoftwareUpdate*" and process.args : "CriticalUpdateInstall" and process.args : "NO"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1562"
+name = "Impair Defenses"
+reference = "https://attack.mitre.org/techniques/T1562/"
+[[threat.technique.subtechnique]]
+id = "T1562.001"
+name = "Disable or Modify Tools"
+reference = "https://attack.mitre.org/techniques/T1562/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_parent_process_pid_spoofing.toml b/behavior/rules/defense_evasion_parent_process_pid_spoofing.toml
new file mode 100644
index 00000000..686539c4
--- /dev/null
+++ b/behavior/rules/defense_evasion_parent_process_pid_spoofing.toml
@@ -0,0 +1,115 @@
+[rule]
+description = """
+Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID)
+of a new process to evade process-monitoring defenses or to elevate privileges.
+"""
+id = "816ba7e7-519a-4f85-be2a-bacd6ccde57f"
+license = "Elastic License v2"
+name = "Parent Process PID Spoofing"
+os_list = ["windows"]
+reference = ["https://blog.didierstevens.com/2017/03/20/"]
+version = "1.0.8"
+
+query = '''
+sequence with maxspan=5m
+ [process where event.action == "start" and
+  process.parent.executable != null and
+  /* FP - AppInfo */
+  not (process.executable : "?:\\windows\\system32\\svchost.exe" and
+       user.id == "S-1-5-18" and process.command_line : "* -k netsvcs*") and
+
+  /* FP - Windows Errors Reporting */
+  not (process.executable : "?:\\windows\\system32\\svchost.exe" and
+       user.id == "S-1-5-18" and process.command_line : "*WerSvcGroup*") and
+
+   /* FP - Secondary Logon */
+  not (process.executable : "?:\\windows\\system32\\svchost.exe" and
+       user.id == "S-1-5-18" and process.command_line : "*seclogon*") and
+
+   /* FP - Application Brokers */
+  not (process.executable : ("?:\\Windows\\System32\\RuntimeBroker.exe",
+                             "?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe")) and
+
+   /* FP - Third Party Programs except MS Office */
+  not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and
+       process.code_signature.trusted == true and
+       not process.name : ("winword.exe",
+                           "excel.exe",
+                           "outlook.exe",
+                           "powerpnt.exe",
+                           "eqnedt32.exe",
+                           "fltldr.exe",
+                           "mspub.exe",
+                           "msaccess.exe")) and
+
+   /* FP Issue #488 - WerFaultSecure ProtectedCrash  */
+  not (
+       process.executable : ("?:\\Windows\\System32\\WerFaultSecure.exe", "?:\\WINDOWS\\SysWOW64\\WerFaultSecure.exe") and
+       user.id == "S-1-5-18" and process.parent.command_line != null and
+       ((process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and process.parent.command_line : "*WerSvcGroup*") or
+         process.parent.executable : "?:\\Windows\\System32\\dxgiadaptercache.exe")
+       ) and
+
+   /* FP Issue #488 - File Picker UI Host is real parent of Authentication Broker AuthHost.exe */
+  not (process.executable : "?:\\Windows\\System32\\PickerHost.Exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and
+
+   /* FP Issue #488 - Roblox Game Client */
+  not (process.pe.original_file_name : "RobloxApp.exe" and
+        process.code_signature.subject_name == "Roblox Corporation" and process.code_signature.trusted == true) and
+
+   /* FP OpenWith handles unknown file handlers via GUI popup */
+  not (process.executable : ("?:\\WINDOWS\\system32\\OpenWith.exe", "?:\\WINDOWS\\syswow64\\OpenWith.exe") and process.args: "-Embedding" and
+       process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and process.parent.args : "DcomLaunch") and
+
+  not (process.pe.original_file_name : "notification_helper.exe" and process.code_signature.subject_name == "Microsoft Corporation" and
+       process.code_signature.trusted == true) and
+
+  not (process.pe.original_file_name : "pmlauncher.exe" and process.code_signature.subject_name == "BeyondTrust Software, Inc" and
+       process.code_signature.trusted == true) and
+
+  not (process.executable : "?:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_*\\MicrosoftEdge.exe" and
+       process.Ext.token.integrity_level_name == "low" and process.parent.executable : "?:\\Windows\\system32\\svchost.exe" and process.parent.args : "DcomLaunch") and
+
+  not (process.pe.original_file_name == "MBSetup.exe" and process.code_signature.subject_name == "Malwarebytes Inc" and
+       process.code_signature.trusted == true) and
+
+  not (process.executable : "?:\\Windows\\System32\\backgroundTaskHost.exe" and process.Ext.token.integrity_level_name == "low" and process.parent.name : "svchost.exe")
+  ] by process.entity_id
+ [process where event.action == "start" and process.parent.Ext.real.pid > 0 and 
+  /* FP Issue #488 - Auth Host Broker for WindowsApps */
+  not process.executable :  "?:\\Windows\\system32\\AuthHost.exe" and
+  not (process.parent.executable : "?:\\Windows\\System32\\sihost.exe" and
+        process.pe.original_file_name : ("chrome.exe", "msedge.exe") and process.args_count >= 2 and
+        process.code_signature.subject_name : ("Google LLC", "Microsoft Corporation"))] by process.parent.Ext.real.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1134"
+name = "Access Token Manipulation"
+reference = "https://attack.mitre.org/techniques/T1134/"
+[[threat.technique.subtechnique]]
+id = "T1134.004"
+name = "Parent PID Spoofing"
+reference = "https://attack.mitre.org/techniques/T1134/004/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_potential_defense_evasion_via_filter_manager_control_program.toml b/behavior/rules/defense_evasion_potential_defense_evasion_via_filter_manager_control_program.toml
new file mode 100644
index 00000000..0c743e5a
--- /dev/null
+++ b/behavior/rules/defense_evasion_potential_defense_evasion_via_filter_manager_control_program.toml
@@ -0,0 +1,40 @@
+[rule]
+description = "Identifies attempt to unload a security driver via the Filter Manager Control Program."
+id = "5b39f347-077c-4a1e-8d3c-6f7789ca09e8"
+license = "Elastic License v2"
+name = "Potential Defense Evasion via Filter Manager Control Program"
+os_list = ["windows"]
+reference = ["https://lolbas-project.github.io/lolbas/Binaries/FltMC/"]
+version = "1.0.5"
+
+query = '''
+process where event.action == "start" and
+ process.pe.original_file_name == "fltMC.exe" and
+ process.args : "unload" and process.command_line : ("*security*", "*sysmon*", "*esensor*", "*Elastic*")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1562"
+name = "Impair Defenses"
+reference = "https://attack.mitre.org/techniques/T1562/"
+[[threat.technique.subtechnique]]
+id = "T1562.001"
+name = "Disable or Modify Tools"
+reference = "https://attack.mitre.org/techniques/T1562/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_potential_masquerading_as_svchost.toml b/behavior/rules/defense_evasion_potential_masquerading_as_svchost.toml
new file mode 100644
index 00000000..2158d11a
--- /dev/null
+++ b/behavior/rules/defense_evasion_potential_masquerading_as_svchost.toml
@@ -0,0 +1,72 @@
+[rule]
+description = """
+Identifies the creation of a svchost process with an unusual parent. This may indicate an attempt to masquerade a
+malicious process.
+"""
+id = "5b00c9ba-9546-47cc-8f9f-1c1a3e95f65c"
+license = "Elastic License v2"
+name = "Potential Masquerading as SVCHOST"
+os_list = ["windows"]
+version = "1.0.6"
+
+query = '''
+process where event.action == "start" and
+  process.name : "svchost.exe" and
+  process.parent.executable != null and
+  not process.parent.executable : (
+    "?:\\Windows\\System32\\services.exe",
+    "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+    "?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe",
+    "?:\\Program Files*\\Windows Defender\\MsMpEng.exe",
+    "?:\\Windows\\*\\rpcnet*.exe",
+    "?:\\Windows\\System32\\MRT.exe",
+    "?:\\Windows\\System32\\MRT-*.exe",
+    "?:\\Program Files*\\Unity Client\\Unity.exe",
+    "?:\\Windows\\System32\\wermgr.exe",
+
+	"\\Device\\HarddiskVolume?\\Windows\\System32\\services.exe",
+	"\\Device\\HarddiskVolume?\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+	"\\Device\\HarddiskVolume?\\Program Files\\Microsoft Security Client\\MsMpEng.exe",
+	"\\Device\\HarddiskVolume?\\Program Files*\\Windows Defender\\MsMpEng.exe",
+	"\\Device\\HarddiskVolume?\\Windows\\*\\rpcnet*.exe",
+	"\\Device\\HarddiskVolume?\\Windows\\system32\\MRT.exe",
+	"\\Device\\HarddiskVolume?\\Program Files*\\Unity Client\\Unity.exe",
+	"\\Device\\HarddiskVolume?\\Windows\\System32\\wermgr.exe"
+	) and
+  not (process.parent.executable : "?:\\Windows\\system32\\svchost.exe" and process.executable : "?:\\Windows\\syswow64\\svchost.exe") and
+  not (process.parent.executable :
+                   ("?:\\Windows\\System32\\svchost.exe",
+                    "?:\\Program Files\\COMODO\\COMODO Internet Security\\cmdvirth.exe",
+                    "?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\acrocef*\\RdrCEF.exe") and
+       process.Ext.token.integrity_level_name == "system") and
+  not (process.pe.original_file_name == "AsDVDLock.exe" and
+       process.executable : "?:\\Program Files (x86)\\ASUS\\ASUS Manager\\USB Lock\\svchost.exe") and
+  not (process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and
+       process.parent.args : "ClipboardSvcGroup" and process.executable : "?:\\Windows\\System32\\svchost.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1036"
+name = "Masquerading"
+reference = "https://attack.mitre.org/techniques/T1036/"
+[[threat.technique.subtechnique]]
+id = "T1036.004"
+name = "Masquerade Task or Service"
+reference = "https://attack.mitre.org/techniques/T1036/004/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_potential_parent_process_pid_spoofing_via_malseclogon.toml b/behavior/rules/defense_evasion_potential_parent_process_pid_spoofing_via_malseclogon.toml
new file mode 100644
index 00000000..f52b13a6
--- /dev/null
+++ b/behavior/rules/defense_evasion_potential_parent_process_pid_spoofing_via_malseclogon.toml
@@ -0,0 +1,78 @@
+[rule]
+description = """
+Identifies potential parent process spoofing via abusing the seclogon service. Adversaries may spoof the parent process
+identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.
+"""
+id = "3bd31cbf-b581-41b7-b021-020cc64cfd9d"
+license = "Elastic License v2"
+name = "Potential Parent Process PID Spoofing via MalSecLogon"
+os_list = ["windows"]
+reference = ["https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html"]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=1m
+  [process where event.action == "start" and process.name : "svchost.exe" and process.args : "seclogon"] by process.entity_id
+  [process where event.action == "start" and
+   process.parent.Ext.real.pid > 0 and not process.Ext.token.integrity_level_name == "system" and
+
+   /* dirs hosting interesting processes to spoof as parent process like Explorer.exe */
+   process.parent.executable : ("?:\\Windows\\System32\\*.exe", "?:\\Windows\\SysWOW64\\*.exe") and
+
+    /* common secLogon Clients running from trusted directories */
+    not (process.parent.executable : "?:\\WINDOWS\\Explorer.EXE" and process.name : "rundll32.exe" and process.command_line : "*SHELL32.dll,RunAsNewUser_RunDLL*") and
+
+    not (process.parent.executable : ("?:\\Windows\\System32\\runas.exe", "?:\\WINDOWS\\system32\\ShellRunas.exe") and process.parent.args_count >= 2) and
+
+    not (process.parent.executable : "?:\\WINDOWS\\System32\\svchost.exe" and process.parent.args : "WdiServiceHost" and
+         process.name : "rundll32.exe" and process.command_line : "*winethc.dll*ForceProxyDetectionOnNextRun*") and
+
+    not (process.parent.executable : "?:\\Windows\\Sys*\\OneDriveSetup.exe" and process.parent.args : ("/thfirstsetup", "/uninstall") and
+         process.pe.original_file_name in ("OneDrive.exe", "OneDriveSetup.exe") and
+         process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) and
+
+    not (process.parent.executable : "?:\\Windows\\Sys*\\MsiExec.exe" and process.parent.args : "-Embedding") and
+
+    not (process.parent.executable : "?:\\Windows\\System32\\consent.exe" and process.executable : "?:\\WINDOWS\\system32\\UserAccountControlSettings.exe") and
+
+    /* RunAs execution via windows scripts */
+    not process.parent.name : ("cscript.exe", "powershell.exe", "wscript.exe") and
+
+    not process.parent.executable : ("?:\\windows\\system32\\ServerManager.exe", "?:\\Windows\\System32\\LogonUI.exe", "?:\\Windows\\System32\\dgagent\\dsagent.exe") and
+
+    not (process.parent.executable : "?:\\Windows\\System32\\DriverStore\\FileRepository\\*\\AircommandEngine.exe" and
+         process.executable : "?:\\Windows\\System32\\DriverStore\\FileRepository\\*\\AircommandEngine.exe") and
+
+    not (process.parent.executable : "?:\\Windows\\System32\\mmc.exe" and process.executable : "?:\\Windows\\system32\\gpupdate.exe") and
+
+    not (process.pe.original_file_name == "OffCATcmd.exe" and process.code_signature.subject_name == "Microsoft Corporation" and
+         process.code_signature.trusted == true and process.parent.executable : "?:\\Windows\\System32\\sdiagnhost.exe") and 
+	 
+    not (process.parent.name : "rundll32.exe" and process.parent.args : "?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc")] by process.parent.Ext.real.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1134"
+name = "Access Token Manipulation"
+reference = "https://attack.mitre.org/techniques/T1134/"
+[[threat.technique.subtechnique]]
+id = "T1134.004"
+name = "Parent PID Spoofing"
+reference = "https://attack.mitre.org/techniques/T1134/004/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_potential_privacy_control_bypass_via_localhost_secure_copy.toml b/behavior/rules/defense_evasion_potential_privacy_control_bypass_via_localhost_secure_copy.toml
new file mode 100644
index 00000000..f7633c71
--- /dev/null
+++ b/behavior/rules/defense_evasion_potential_privacy_control_bypass_via_localhost_secure_copy.toml
@@ -0,0 +1,54 @@
+[rule]
+description = """
+Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusing the auto addition of the Secure Shell
+Daemon (sshd) to the authorized application list for Full Disk Access. This may indicate attempts to bypass macOS
+privacy controls to access sensitive files.
+"""
+id = "55df8e91-fd3c-4cc1-b36f-f01ded8c6da3"
+license = "Elastic License v2"
+name = "Potential Privacy Control Bypass via Localhost Secure Copy"
+os_list = ["macos"]
+reference = [
+    "https://blog.trendmicro.com/trendlabs-security-intelligence/xcsset-mac-malware-infects-xcode-projects-performs-uxss-attack-on-safari-other-browsers-leverages-zero-day-exploits/",
+]
+version = "1.0.4"
+
+query = '''
+process where event.type == "start" and
+ process.name == "scp" and
+ process.args : "StrictHostKeyChecking=no" and
+ process.command_line : ("*scp *localhost:/*", "*scp *127.0.0.?:/*") and not process.command_line : "*vagrant@*127.0.0.1*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_potential_self_deletion_of_a_running_executable.toml b/behavior/rules/defense_evasion_potential_self_deletion_of_a_running_executable.toml
new file mode 100644
index 00000000..ec843719
--- /dev/null
+++ b/behavior/rules/defense_evasion_potential_self_deletion_of_a_running_executable.toml
@@ -0,0 +1,47 @@
+[rule]
+description = """
+Identifies the execution of a file followed by the rename of its primary file stream. This may indicate an attempt to
+delete the currently running process executable file on disk, bypassing the file lock restriction. Adversaries may
+delete files left behind by the actions of their intrusion activity.
+"""
+id = "24082642-49a7-4072-952b-10c244b24f8e"
+license = "Elastic License v2"
+name = "Potential Self Deletion of a Running Executable"
+os_list = ["windows"]
+reference = ["https://github.com/LloydLabs/delete-self-poc"]
+version = "1.0.5"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+    [process where event.action == "start" and
+     process.executable : ("?:\\Users\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*", "?:\\Python*")] by process.name
+    [file where event.action == "rename" and
+     /* Rename the primary file stream */
+     file.name : "*:*" and not file.Ext.original.name : "*:*"  and file.size == 0] by file.Ext.original.name
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1070"
+name = "Indicator Removal on Host"
+reference = "https://attack.mitre.org/techniques/T1070/"
+[[threat.technique.subtechnique]]
+id = "T1070.004"
+name = "File Deletion"
+reference = "https://attack.mitre.org/techniques/T1070/004/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_process_executable_image_tampering_attempt.toml b/behavior/rules/defense_evasion_process_executable_image_tampering_attempt.toml
new file mode 100644
index 00000000..7d4e3f7e
--- /dev/null
+++ b/behavior/rules/defense_evasion_process_executable_image_tampering_attempt.toml
@@ -0,0 +1,47 @@
+[rule]
+description = """
+Identifies attempts to tamper with the executable file of a process. Attackers may attempt to tamper with the executable
+file of a process in order to run or inject malicious code via techniques such as Process Ghosting or Process
+Doppelgänging. Attackers may use these techniques in attempts to evade process-based defenses and in some cases, to
+elevate privileges. Process Ghosting is a technique where an attacker can write a malicious file to disk in such a way
+that it is difficult for security tools to scan or delete - and where the deleted malicious file is subsequently
+executed as though it were a regular file on disk. Process Doppelgänging is a technique that exploits Transactional NTFS
+to execute arbitrary code in the address space of a separate running process, without committing the code to disk.
+"""
+id = "905f4c30-a8c5-40a5-80e3-a50c6714632f"
+license = "Elastic License v2"
+name = "Process Executable Image Tampering Attempt"
+os_list = ["windows"]
+reference = ["https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and 
+  process.Ext.defense_evasions : "Process Tampering: Image is locked for access"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1055"
+name = "Process Injection"
+reference = "https://attack.mitre.org/techniques/T1055/"
+[[threat.technique.subtechnique]]
+id = "T1055.013"
+name = "Process Doppelgänging"
+reference = "https://attack.mitre.org/techniques/T1055/013/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_protected_process_light_bypass_via_dll_tampering.toml b/behavior/rules/defense_evasion_protected_process_light_bypass_via_dll_tampering.toml
new file mode 100644
index 00000000..43864eb1
--- /dev/null
+++ b/behavior/rules/defense_evasion_protected_process_light_bypass_via_dll_tampering.toml
@@ -0,0 +1,61 @@
+[rule]
+description = """
+Identifies attempts to tamper with a DLL associated with a Protected Process Light (PPL) process. The purpose of PPL is
+to protect critical system processes against modification, access, or tampering via open process functions. An attacker
+may attempt to tamper with the DLL associated with a PPL process in order to bypass PPL protection and inject malicious
+code into the protected process, elevating their privileges. This privilege escalation can enable them to evade or
+disable security software, and access sensitive information such as credentials.
+"""
+id = "905f4c30-a8c5-40a5-80e3-a50c5613432f"
+license = "Elastic License v2"
+name = "Protected Process Light Bypass via DLL Tampering"
+os_list = ["windows"]
+reference = ["https://googleprojectzero.blogspot.com/2018/08/windows-exploitation-tricks-exploiting.html"]
+version = "1.0.8"
+
+query = '''
+sequence by process.entity_id with maxspan=3s
+ [process where event.action == "start" and process.Ext.protection != null and
+  process.Ext.protection != "PsProtectedSignerAntimalware-Light" and
+  not (process.executable : "?:\\Windows\\System32\\svchost.exe" and process.args == "WaaSMedicSvc" and
+       process.parent.executable : "?:\\Windows\\System32\\services.exe")]
+ [library where dll.Ext.defense_evasions : "Process Tampering: Code integrity violation" and
+  not (dll.code_signature.trusted == true and
+       dll.code_signature.subject_name :
+                 ("ESET, spol. s r.o.",
+                  "Acronis International GmbH",
+                  "Kaseya Corporation",
+                  "Veeam Software Group GmbH",
+                  "Trend Micro, Inc.",
+                  "Sophos Ltd",
+                  "DeviceLock, Inc")) and
+  not process.executable : "?:\\Program Files (x86)\\Common Files\\BattlEye\\BEService.exe" and
+  /* potential services child processes */
+  not (process.executable : "?:\\Windows\\System32\\services.exe" and dll.name : "*.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1211"
+name = "Exploitation for Defense Evasion"
+reference = "https://attack.mitre.org/techniques/T1211/"
+
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/defense_evasion_regsvr32_scriptlet_execution.toml b/behavior/rules/defense_evasion_regsvr32_scriptlet_execution.toml
new file mode 100644
index 00000000..e654e415
--- /dev/null
+++ b/behavior/rules/defense_evasion_regsvr32_scriptlet_execution.toml
@@ -0,0 +1,62 @@
+[rule]
+description = """
+Identifies the native Windows tool, regsvr32.exe, executing a scriptlet file. This can allow an attacker to bypass
+whitelisting and run arbitrary scripts.
+"""
+id = "0524c24c-e45e-4220-b21a-abdba0c46c4d"
+license = "Elastic License v2"
+name = "Regsvr32 Scriptlet Execution"
+os_list = ["windows"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and
+ (process.pe.original_file_name : "regsvr32.exe" or process.name : "regsvr32.exe") and
+  (
+    (process.command_line : "*scrobj*" and process.command_line : ("* /i:*", "* -i:*", "*.sct*")) or
+      /* attackers may rename scrobj.dll */
+      (
+        process.command_line : "* /u*" and
+        process.command_line :
+          (
+            "* /i:C:\\*",
+            "* /i:\"C:\\*",
+            "* -i:C:\\*",
+            "* -i:\"C:\\*",
+            "* /i:*http*",
+            "* -i:*http*"
+          )
+      )
+  ) and
+  /* Issue #326 */
+  not (process.Ext.token.integrity_level_name == "system" and not process.command_line : "*scrobj.dll*") and
+  not process.command_line : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*") and
+  not (process.parent.executable : ("?:\\Windows\\SysWOW64\\msiexec.exe", "?:\\Windows\\system32\\msiexec.exe") and
+      not process.command_line : "*scrobj.dll*")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.010"
+name = "Regsvr32"
+reference = "https://attack.mitre.org/techniques/T1218/010/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_regsvr32_with_unusual_arguments.toml b/behavior/rules/defense_evasion_regsvr32_with_unusual_arguments.toml
new file mode 100644
index 00000000..8a166091
--- /dev/null
+++ b/behavior/rules/defense_evasion_regsvr32_with_unusual_arguments.toml
@@ -0,0 +1,75 @@
+[rule]
+description = """
+Identifies unusual instances of Regsvr32 with suspicious keywords or paths in the process command line value.
+Adversaries may abuse regsvr32.exe to proxy execution of malicious code.
+"""
+id = "5db08297-bf72-49f4-b426-f405c2b01326"
+license = "Elastic License v2"
+name = "Regsvr32 with Unusual Arguments"
+os_list = ["windows"]
+version = "1.0.9"
+
+query = '''
+process where event.action == "start" and process.name : "regsvr32.exe" and
+ process.command_line :
+          ("*.jpg*",
+           "*.png*",
+           "*.gif*",
+           "*.bmp*",
+           "*.jpeg*",
+           "*.TIFF*",
+           "*.tmp*",
+           "*.dat*",
+           "*.pdf*",
+           "*.doc*",
+           "*.xls*",
+           "*.ppt*",
+           "*.txt*",
+           "* ?:/*/*",
+           "* ..\\*",
+           "*DumpStack.log*",
+           "*:\\Users\\Public\\*",
+           "*:\\Users\\*\\Documents\\*",
+           "*:\\Users\\*\\Pictures\\*",
+           "*:\\Users\\*\\Music\\*",
+           "*:\\Users\\*\\Pictures\\*",
+           "*:\\Windows\\Tasks\\*",
+           "*:\\Windows\\System32\\tasks\\*") and not
+ process.command_line : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*") and 
+ 
+ /*  path traversal */
+ not (process.command_line : "* ..\\*" and process.command_line :"* ..\\*\\*") and
+ not process.parent.executable : "?:\\Program Files (x86)\\Tencent\\QQPCMgr\\*\\QQPCTray.exe" and
+ not process.command_line :
+             ("*\\Program Files (x86)\\Tencent\\QQPCMgr\\*.dat*",
+              "*QQPCMgr*TSWebMon64.dat*",
+              "*BarTender Suite\\Codejock.DockingPane.x64.v15.3.1.ocx*") and
+ not process.parent.executable : "?:\\Eaglesoft\\Shared Files\\OcxReg.exe" and
+ not process.args : ("?:\\windows\\system32\\ChartFX.ClientServer.Data.dll", "?:\\Windows\\SysWOW64\\ChartFX.ClientServer.Data.dll")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.010"
+name = "Regsvr32"
+reference = "https://attack.mitre.org/techniques/T1218/010/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_remote_file_execution_via_msiexec.toml b/behavior/rules/defense_evasion_remote_file_execution_via_msiexec.toml
new file mode 100644
index 00000000..34aa28e5
--- /dev/null
+++ b/behavior/rules/defense_evasion_remote_file_execution_via_msiexec.toml
@@ -0,0 +1,50 @@
+[rule]
+description = """
+Identifies the execution of the built-in Windows Installer, MSIEXEC, with a url in the command line. Adversaries may
+abuse msiexec.exe to launch local or network accessible MSI files.
+"""
+id = "8ba98e28-d83e-451e-8df7-f0964f7e69b6"
+license = "Elastic License v2"
+name = "Remote File Execution via MSIEXEC"
+os_list = ["windows"]
+reference = [
+    "https://lolbas-project.github.io/lolbas/Binaries/Msiexec/",
+    "https://www.guardicore.com/labs/purple-fox-rootkit-now-propagates-as-a-worm/",
+]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and process.args_count <= 4 and
+ process.pe.original_file_name : "msiexec.exe" and process.args : "http*" and
+  process.args : ("/i", "-i") and
+  process.args : ("/q", "/quiet", "/qn", "-q", "-quiet", "-qn") and
+  not descendant of
+       [process where event.action == "start" and process.name : "*setup*" and process.code_signature.trusted == true] and
+  not process.Ext.token.integrity_level_name == "system"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.007"
+name = "Msiexec"
+reference = "https://attack.mitre.org/techniques/T1218/007/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_remote_msi_package_installation_via_msiexec.toml b/behavior/rules/defense_evasion_remote_msi_package_installation_via_msiexec.toml
new file mode 100644
index 00000000..ea8490da
--- /dev/null
+++ b/behavior/rules/defense_evasion_remote_msi_package_installation_via_msiexec.toml
@@ -0,0 +1,49 @@
+[rule]
+description = """
+Identifies the execution of the built-in Windows Installer, MSIEXEC, to install a remote package. Adversaries may abuse
+msiexec.exe to launch local or network accessible MSI files.
+"""
+id = "706bf4ca-45b7-4eb1-acae-b1228124594a"
+license = "Elastic License v2"
+name = "Remote MSI Package Installation via MSIEXEC"
+os_list = ["windows"]
+reference = [
+    "https://lolbas-project.github.io/lolbas/Binaries/Msiexec/",
+    "https://www.guardicore.com/labs/purple-fox-rootkit-now-propagates-as-a-worm/",
+]
+version = "1.0.5"
+
+query = '''
+sequence with maxspan=1m
+  [registry where process.name : "msiexec.exe" and
+    registry.value : "InstallSource" and registry.data.strings : "http*"] by process.entity_id
+  [process where event.action == "start" and
+    process.parent.name : "msiexec.exe" and process.parent.args : "/V" and user.id : "S-1-5-21*" and 
+    not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and process.code_signature.trusted == true)] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.007"
+name = "Msiexec"
+reference = "https://attack.mitre.org/techniques/T1218/007/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_renamed_autoit_scripts_interpreter.toml b/behavior/rules/defense_evasion_renamed_autoit_scripts_interpreter.toml
new file mode 100644
index 00000000..c63d7a88
--- /dev/null
+++ b/behavior/rules/defense_evasion_renamed_autoit_scripts_interpreter.toml
@@ -0,0 +1,41 @@
+[rule]
+description = """
+Identifies suspicious AutoIT process execution events. Attackers may rename an AutoIT executable file in an attempt to
+avoid signature-based detection.
+"""
+id = "99f2327e-871f-4b8a-ae75-d1c4697aefe4"
+license = "Elastic License v2"
+name = "Renamed AutoIt Scripts Interpreter"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+process where event.action == "start" and
+  process.pe.original_file_name : "AutoIt*.exe" and not process.name : "AutoIt*.exe"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1036"
+name = "Masquerading"
+reference = "https://attack.mitre.org/techniques/T1036/"
+[[threat.technique.subtechnique]]
+id = "T1036.003"
+name = "Rename System Utilities"
+reference = "https://attack.mitre.org/techniques/T1036/003/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_renamed_third_party_administrator_tools.toml b/behavior/rules/defense_evasion_renamed_third_party_administrator_tools.toml
new file mode 100644
index 00000000..f91b5a8c
--- /dev/null
+++ b/behavior/rules/defense_evasion_renamed_third_party_administrator_tools.toml
@@ -0,0 +1,48 @@
+[rule]
+description = "Identifies third party administrative tools commonly used by adversaries but running with unexpected file names."
+id = "b707de5c-8e4d-4d2c-be22-b09a7e82b73f"
+license = "Elastic License v2"
+name = "Renamed Third Party Administrator Tools"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+process where event.action == "start" and
+  (
+   (process.pe.original_file_name : "procdump" and 
+    process.code_signature.subject_name == "Microsoft Corporation" and not process.name : "*procdump*.exe") or
+   (process.pe.original_file_name : "psexec.c" and process.code_signature.subject_name == "Microsoft Corporation" and not process.name : "*psexec*.exe") or
+   (process.pe.original_file_name : "sdelete.exe" and process.code_signature.subject_name == "Microsoft Corporation" and not process.name : "*sdelete*")
+  ) and
+  not process.executable :
+    ("?:\\Windows\\System32\\*.exe", 
+	 "?:\\Windows\\SysWOW64\\*.exe", 
+	 "?:\\Program Files (x86)\\*.exe", 
+	 "?:\\Program Files\\*.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1036"
+name = "Masquerading"
+reference = "https://attack.mitre.org/techniques/T1036/"
+[[threat.technique.subtechnique]]
+id = "T1036.003"
+name = "Rename System Utilities"
+reference = "https://attack.mitre.org/techniques/T1036/003/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_renamed_windows_automaton_script_interpreter.toml b/behavior/rules/defense_evasion_renamed_windows_automaton_script_interpreter.toml
new file mode 100644
index 00000000..ac7f2f1e
--- /dev/null
+++ b/behavior/rules/defense_evasion_renamed_windows_automaton_script_interpreter.toml
@@ -0,0 +1,77 @@
+[rule]
+description = """
+Identifies suspicious execution of commonly abused third party Windows automation script interpreters. Attackers may
+rename AutoHotKey, Rebol or KIXTART executable files or execute scripts from suspicious paths in an attempt to avoid
+signature-based detection.
+"""
+id = "92d720dd-93b2-49e0-b68a-d5d6acbe4910"
+license = "Elastic License v2"
+name = "Renamed Windows Automaton Script Interpreter"
+os_list = ["windows"]
+reference = ["https://blog.morphisec.com/explosive-new-mirrorblast-campaign-targets-financial-companies"]
+version = "1.0.5"
+
+query = '''
+process where event.action == "start" and
+  (
+     /* renamed */
+   (process.pe.original_file_name : "AutoHotkey.exe" and not process.name : "AutoHotkey*.exe") or 
+   (process.pe.original_file_name : "KIX32.EXE" and not process.name : "KIX*.EXE") or 
+   (process.name : "rebol-view*.exe" and process.parent.name : "msiexec.exe") or 
+   (process.name : ("AutoHotkey*.exe", "KIX32.EXE", "rebol-view*.exe") and 
+     
+	 /* execution from common suspicious paths */
+     process.args : ("?:\\Users\\Public\\*", 
+                     "?:\\ProgramData\\*", 
+                     "?:\\Users\\*\\AppData\\*", 
+                     "?:\\Windows\\Temp\\*",
+                     "?:\\Windows\\Tasks\\*")) or 
+    
+	/* legit rebol script interpreter has no original file name thus adding this hash abused by mirrorblast*/
+    process.hash.sha256 : "215e28f9660472b6271a9902573c9d190e4d7ccca33fcf8d6054941d52a3ab85" or 
+	
+	/* unusual script extension */
+	(process.name : ("rebol-view*.exe", "AutoHotkey*.exe", "KIX*.EXE") and process.args_count == 2 and 
+	 not process.command_line : ("*.ahk*", "*.rb*", "*.kix*", "*.scr*", "*.bms"))
+   
+   ) and  
+   
+   /* FP - chocolatey installs and runs Autohotkey from programdata */
+   not (process.pe.original_file_name == "AutoHotkey.exe" and
+         process.executable : ("?:\\ProgramData\\chocolatey\\*", 
+                               "?:\\Program Files\\AutoHotkey\\AutoHotkey*.exe",
+                               "?:\\Program Files (x86)\\AutoHotkey\\AutoHotkey*.exe")) and
+   not (process.executable : "?:\\ProgramData\\chocolatey\\lib\\autohotkey.install\\tools\\AutoHotkey_*setup.exe" and 
+        process.parent.executable : "?:\\ProgramData\\chocolatey\\choco.exe") and
+   not (process.pe.original_file_name == "KIX32.EXE" and process.command_line : "*\\NETLOGON\\*") and
+   not (process.pe.original_file_name == "KIX32.EXE" and process.parent.command_line : "*\\netlogon\\*") and
+   not (process.pe.original_file_name == "KIX32.EXE" and process.executable : ("C:\\kworking\\Bin\\RMMKSE.EXE", "C:\\kworking\\Bin\\RMMSSE.EXE")) and
+   not (process.pe.original_file_name == "AutoHotkey.exe" and process.executable : "C:\\TCPU73\\Programm\\ClockTC\\ClockTC.exe" and
+        process.parent.executable : "C:\\TCPU73\\TOTALCMD.EXE")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1036"
+name = "Masquerading"
+reference = "https://attack.mitre.org/techniques/T1036/"
+[[threat.technique.subtechnique]]
+id = "T1036.003"
+name = "Rename System Utilities"
+reference = "https://attack.mitre.org/techniques/T1036/003/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_rundll32_regsvr32_loads_a_dll_downloaded_via_bits.toml b/behavior/rules/defense_evasion_rundll32_regsvr32_loads_a_dll_downloaded_via_bits.toml
new file mode 100644
index 00000000..4b2ba373
--- /dev/null
+++ b/behavior/rules/defense_evasion_rundll32_regsvr32_loads_a_dll_downloaded_via_bits.toml
@@ -0,0 +1,61 @@
+[rule]
+description = """
+Identifies when RunDLL32 or Regsvr32 loads an executable downloaded via Microsoft BITS Jobs. An adversary may leverage
+this technique to avoid suspicious processes making network connections and executing a malicious DLL.
+"""
+id = "74c1fd79-5961-4f1d-8ff8-b810b7c88545"
+license = "Elastic License v2"
+name = "RunDLL32/Regsvr32 Loads a DLL Downloaded via BITS"
+os_list = ["windows"]
+reference = [
+    "https://blog.menasec.net/2021/05/hunting-for-suspicious-usage-of.html",
+    "https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-2",
+]
+version = "1.0.6"
+
+query = '''
+sequence with maxspan=5m
+   [file where event.action : "rename" and
+    /* Executable File downloaded via BITS */
+    (file.extension : ("dll", "cpl", "ocx") or file.Ext.header_bytes : "4d5a*") and process.name : "svchost.exe" and
+    file.Ext.original.name : "BIT*.tmp"] by file.path
+   [library where process.name : ("rundll32.exe", "regsvr32.exe") and 
+    not dll.code_signature.trusted == true and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and 
+    not dll.path : ("?:\\Program Files (x86)\\*.dll", "?:\\Program Files\\*.dll")] by dll.path
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1197"
+name = "BITS Jobs"
+reference = "https://attack.mitre.org/techniques/T1197/"
+
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.010"
+name = "Regsvr32"
+reference = "https://attack.mitre.org/techniques/T1218/010/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/defense_evasion_rundll32_with_unusual_arguments.toml b/behavior/rules/defense_evasion_rundll32_with_unusual_arguments.toml
new file mode 100644
index 00000000..c34d2028
--- /dev/null
+++ b/behavior/rules/defense_evasion_rundll32_with_unusual_arguments.toml
@@ -0,0 +1,115 @@
+[rule]
+description = """
+Identifies unusual instances of RunDLL32 with suspicious keywords or paths in the process command line value.
+Adversaries may abuse rundll32.exe to proxy execution of malicious code.
+"""
+id = "cfaf983e-1129-464c-b0aa-270f42e20d3d"
+license = "Elastic License v2"
+name = "RunDLL32 with Unusual Arguments"
+os_list = ["windows"]
+version = "1.0.9"
+
+query = '''
+process where event.action == "start" and process.name : "rundll32.exe" and
+  (
+   /* suspicious extensions and paths */
+
+   (process.command_line : "*\\AppData\\Local\\Temp\\*,*" and not process.command_line : "*.dll*") or
+    process.command_line :
+          ("*.jpg*,*",
+           "*.png*,*",
+           "*.gif*,*",
+           "*.bmp*,*",
+           "*.jpeg*,*",
+           "*.TIFF*,*",
+           "*.tmp*,*",
+           "*.dat*,*",
+           "*.txt*,*",
+           "* ?:/*/*",
+           "* ..\\*",
+           "*:\\Users\\Public\\*,*",
+           "*:\\Users\\*\\Documents\\*,*",
+           "*:\\Users\\*\\Pictures\\*,*",
+           "*:\\Users\\*\\Music\\*,*",
+           "*:\\Windows\\Tasks\\*,*",
+           "*:\\Windows\\System32\\tasks\\*,*",
+           "*:\\Documents and Settings\\*,*",
+
+           /* Issue #371 */
+           "*.bin,*",
+           "*.log,*",
+           "*.nki,*",
+           "*\\M?-*.dll,_run@*",
+           "*%TEMP%\\*.cpl*",
+           "*\\Users\\*\\Downloads\\*.cpl*",
+           "*\\appdata\\roaming\\microsoft\\templates\\*,*") or
+    process.command_line like "*rUNdlL32.eXe*" or
+
+    /* fake Control_RunDLL export */
+    (process.command_line : "*Control_RunDLL*" and not process.command_line : "*shell32.dll*Control_RunDLL*") or
+
+    /* delayed execution */
+    (process.parent.name : "cmd.exe" and process.parent.args : ("timeout", "ping", "choice") and process.parent.args : ("/nobreak", "/n", "/t")) or
+
+    /* execution from temp with suspicious parent process tree */
+    (process.command_line : "*\\AppData\\Local\\Temp\\*" and process.parent.name : ("wscript.exe", "cscript.exe", "wmiprvse.exe")) or
+
+    /* suspicious parent powershell args */
+    (process.parent.name : "powershell.exe" and
+     process.parent.args : ("-enc", "IEX", "*wp-content*", "*wp-admin*", "*wp-includes*", "*$*$*$*$*$*", "*^*^*^*^*^*^*^*^*^*", "*.replace*"))
+    )
+
+   /* False Positives */
+   and not
+
+  process.command_line :
+           ("*JOBID=*",
+            "*davclnt.dll,DavSetCookie*",
+            "*PhotoViewer.dll*ImageView_Fu*",
+            "*url.dll,FileProtocolHandler*",
+            "*zzzzInvokeManagedCustomActionOutOfProc*",
+            "*,DeferredDelete*",
+            "*:\\WINDOWS\\system32\\spool\\*",
+            "*:\\Program Files (x86)\\*",
+            "*:\\Program Files\\*",
+            /* Issue #282 - FP */
+            "*cryptext.dll,CryptExtAddPFX*",
+            "*dfshim.dll*ShOpenVerbShortcut*",
+            "*\\Documents\\DocuShare\\*",
+
+            /* Issue #371 */
+            "*ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile*",
+            "*FirewallControlPanel.dll,ShowNotificationDialog*",
+            "*--type=renderer*--log-file=*",
+            "*--lang=*--log-file=*") and not
+   (process.command_line : "*.tmp*" and
+    process.parent.executable : ("?:\\Windows\\System32\\msiexec.exe", "?:\\Windows\\System32\\msiexec.exe") and
+    process.parent.args : "-Embedding") and
+  not process.args : "?:\\ProgramData\\Parallels\\RASLogs\\tmp*.tmp,StopMemshell"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_script_execution_via_microsoft_html_application.toml b/behavior/rules/defense_evasion_script_execution_via_microsoft_html_application.toml
new file mode 100644
index 00000000..ec7c6f79
--- /dev/null
+++ b/behavior/rules/defense_evasion_script_execution_via_microsoft_html_application.toml
@@ -0,0 +1,87 @@
+[rule]
+description = """
+Identifies the execution of scripts via HTML applications using Windows utilities rundll32.exe or mshta.exe. Adversaries
+may bypass process and/or signature-based defenses by proxying execution of malicious content with signed binaries.
+"""
+id = "f0630213-c4c4-4898-9514-746395eb9962"
+license = "Elastic License v2"
+name = "Script Execution via Microsoft HTML Application"
+os_list = ["windows"]
+version = "1.0.9"
+
+query = '''
+process where event.action == "start" and
+ (process.name : ("rundll32.exe", "mshta.exe") or
+  process.pe.original_file_name in ("MSHTA.EXE", "RUNDLL32.EXE")) and
+  (
+     (process.command_line :
+        (
+        "*script*eval(*",
+         "*script*GetObject*",
+         "*.regread(*",
+         "*WScript.Shell*",
+         "*.run(*",
+         "*).Exec()*",
+         "*mshta*http*",
+         "*mshtml*RunHTMLApplication*",
+         "*mshtml*,#135*",
+         "*StrReverse*",
+         "*.RegWrite*",
+         /* Issue #379 */
+         "*window.close(*",
+         "* Chr(*"
+         )
+     /* FPs observed in telemetry */
+     and not process.parent.executable :
+                  ("?:\\Program Files (x86)\\Citrix\\System32\\wfshell.exe",
+                   "?:\\Program Files (x86)\\Microsoft Office\\Office*\\MSACCESS.EXE",
+                   "?:\\Program Files\\Quokka.Works GTInstaller\\GTInstaller.exe")
+     and not (process.name : "mshta.exe" and process.parent.name : "cscript.exe" and process.parent.command_line : "*GTInstaller.vbs*")
+     ) or
+    /* Issue #379 */
+    (process.pe.original_file_name : "mshta.exe" and
+     not process.command_line : ("*.hta*", "*.htm*", "-Embedding") and process.args_count >=2) or
+
+     /* Execution of HTA file downloaded from the internet */
+     (process.pe.original_file_name : "mshta.exe" and process.command_line : "*\\Users\\*\\Downloads\\*.hta*") or 
+     
+     /* Execution of HTA file from archive */
+     (process.pe.original_file_name : "mshta.exe" and 
+      process.args : ("?:\\Users\\*\\Temp\\7z*", "?:\\Users\\*\\Temp\\Rar$*", "?:\\Users\\*\\Temp\\Temp?_*", "?:\\Users\\*\\Temp\\BNZ.*")) or
+      
+     /* Execution of HTA file from mounted ISO files */
+     (process.pe.original_file_name : "mshta.exe" and 
+      process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe") and process.working_directory : "?:\\")
+   )
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.005"
+name = "Mshta"
+reference = "https://attack.mitre.org/techniques/T1218/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_script_execution_via_msxsl.toml b/behavior/rules/defense_evasion_script_execution_via_msxsl.toml
new file mode 100644
index 00000000..ef78f516
--- /dev/null
+++ b/behavior/rules/defense_evasion_script_execution_via_msxsl.toml
@@ -0,0 +1,60 @@
+[rule]
+description = """
+Identifies when a Windows Script module is loaded into the Microsoft Core XML Services (MSXML) process. This may
+indicate an attempt to bypass application whitelisting by executing a malicious script in a trusted process.
+"""
+id = "de3615bc-4e50-485e-b3b5-8548ef6faa3d"
+license = "Elastic License v2"
+name = "Script Execution via MSXSL"
+os_list = ["windows"]
+reference = ["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/"]
+version = "1.0.7"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [process where event.action == "start" and process.pe.original_file_name == "msxsl.exe"]
+ [library where dll.name : ("scrobj.dll", "jscript.dll", "vbscript.dll", "jscript9.dll")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1220"
+name = "XSL Script Processing"
+reference = "https://attack.mitre.org/techniques/T1220/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_scriptlet_execution_via_cmstp.toml b/behavior/rules/defense_evasion_scriptlet_execution_via_cmstp.toml
new file mode 100644
index 00000000..551bbdc0
--- /dev/null
+++ b/behavior/rules/defense_evasion_scriptlet_execution_via_cmstp.toml
@@ -0,0 +1,65 @@
+[rule]
+description = """
+Identifies when scrobj.dll is loaded into the Microsoft Connection Manager Profile Installer (cmstp.exe) process. This
+may indicate an attempt to bypass application whitelisting by executing a malicious scriptlet in a trusted process.
+"""
+id = "8adfa9ad-0ed2-4b1b-bdad-f2c52e1d2a00"
+license = "Elastic License v2"
+name = "Scriptlet Execution via CMSTP"
+os_list = ["windows"]
+reference = ["https://lolbas-project.github.io/lolbas/Binaries/Cmstp/"]
+version = "1.0.7"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [process where event.action == "start" and process.pe.original_file_name == "CMSTP.EXE"]
+ [library where dll.name : "scrobj.dll"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.003"
+name = "CMSTP"
+reference = "https://attack.mitre.org/techniques/T1218/003/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_scriptlet_execution_via_rundll32.toml b/behavior/rules/defense_evasion_scriptlet_execution_via_rundll32.toml
new file mode 100644
index 00000000..0f06dbba
--- /dev/null
+++ b/behavior/rules/defense_evasion_scriptlet_execution_via_rundll32.toml
@@ -0,0 +1,69 @@
+[rule]
+description = """
+Identifies when scrobj.dll is loaded into rundll32.exe. An adversary may abuse rundll32.exe to proxy execution of
+malicious code.
+"""
+id = "93438ae3-becd-43fa-81de-645ce17afa8e"
+license = "Elastic License v2"
+name = "Scriptlet Execution via Rundll32"
+os_list = ["windows"]
+reference = [
+    "https://lolbas-project.github.io/lolbas/Libraries/Ieadvpack/",
+    "https://lolbas-project.github.io/lolbas/Libraries/Advpack/",
+]
+version = "1.0.7"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [process where event.action == "start" and process.pe.original_file_name == "RUNDLL32.EXE" and
+  process.command_line : "*advpack*LaunchINFSection*"]
+ [library where dll.name : "scrobj.dll"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_scriptlet_proxy_execution_via_pubprn.toml b/behavior/rules/defense_evasion_scriptlet_proxy_execution_via_pubprn.toml
new file mode 100644
index 00000000..1e82ff20
--- /dev/null
+++ b/behavior/rules/defense_evasion_scriptlet_proxy_execution_via_pubprn.toml
@@ -0,0 +1,66 @@
+[rule]
+description = """
+Adversaries may use the trusted PubPrn script to proxy execution of malicious files. This behavior may bypass signature
+validation restrictions and application control solutions that do not account for use of these scripts.
+"""
+id = "0d4454a7-c682-4085-995c-300973c5bdea"
+license = "Elastic License v2"
+name = "Scriptlet Proxy Execution via PubPrn"
+os_list = ["windows"]
+reference = ["https://lolbas-project.github.io/lolbas/Scripts/Pubprn/"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and
+ process.pe.original_file_name in ("cscript.exe", "wscript.exe") and process.args_count >= 4 and
+ /* Issue 259 - additional rule strictness */
+ process.command_line : ("*localhost*script:http*", "*127.0.0.*script:http*")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1216"
+name = "Signed Script Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1216/"
+[[threat.technique.subtechnique]]
+id = "T1216.001"
+name = "PubPrn"
+reference = "https://attack.mitre.org/techniques/T1216/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_solarmarker_backdoor_registry_modification.toml b/behavior/rules/defense_evasion_solarmarker_backdoor_registry_modification.toml
new file mode 100644
index 00000000..63d4f32c
--- /dev/null
+++ b/behavior/rules/defense_evasion_solarmarker_backdoor_registry_modification.toml
@@ -0,0 +1,69 @@
+[rule]
+description = """
+Identifies registry modification consistent with the SolarMarker Backdoor installer that registers a rogue custom shell
+extension handler which runs a PowerShell command when a file with a matching extension is opened.
+"""
+id = "f7e6d239-9af5-42e3-8d23-91e7188a5cb0"
+license = "Elastic License v2"
+name = "SolarMarker Backdoor Registry Modification"
+os_list = ["windows"]
+reference = [
+    "https://blog.morphisec.com/new-jupyter-evasive-delivery-through-msi-installer",
+    "https://www.ired.team/offensive-security/persistence/hijacking-default-file-extension",
+    "https://www.binarydefense.com/mars-deimos-solarmarker-jupyter-infostealer-part-1/",
+]
+version = "1.0.4"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [process where event.action == "start" and 
+   process.name : ("reg.exe", "powershell.exe", "msiexec.exe")]
+ [registry where
+  registry.path : "HKEY_USERS\\S-1-5-21-*Classes\\*\\shell\\open\\command*" and
+
+  /* Command value contains PowerShell and its length is greater or equal than 200 chars */
+  registry.data.strings : "*PowerShell*" and length(registry.data.strings) >= 200]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1546"
+name = "Event Triggered Execution"
+reference = "https://attack.mitre.org/techniques/T1546/"
+[[threat.technique.subtechnique]]
+id = "T1546.001"
+name = "Change Default File Association"
+reference = "https://attack.mitre.org/techniques/T1546/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1112"
+name = "Modify Registry"
+reference = "https://attack.mitre.org/techniques/T1112/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_suspicious_bitsadmin_activity.toml b/behavior/rules/defense_evasion_suspicious_bitsadmin_activity.toml
new file mode 100644
index 00000000..ae9b6156
--- /dev/null
+++ b/behavior/rules/defense_evasion_suspicious_bitsadmin_activity.toml
@@ -0,0 +1,104 @@
+[rule]
+description = """
+Identifies downloads, transfers, or job creations using Windows Background Intelligent Transfer Service (BITS) Admin
+Tool. This tactic may be indicative of malicious activity where malware is downloading second stage payloads using
+obscure methods.
+"""
+id = "676ac66c-4899-498f-ae21-ed5620af5477"
+license = "Elastic License v2"
+name = "Suspicious Bitsadmin Activity"
+os_list = ["windows"]
+reference = ["https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-2"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and
+  (process.name : "bitsadmin.exe" or process.pe.original_file_name : "bitsadmin.exe") and
+  process.command_line : ("*download*", "*transfer*", "*create*", "*addfile*", "*SetNotifyCmdLine*") and
+  (process.parent.name : (
+      "winword.exe",
+      "excel.exe",
+      "outlook.exe",
+      "powerpnt.exe",
+      "eqnedt32.exe",
+      "fltldr.exe",
+      "mspub.exe",
+      "msaccess.exe",
+      "acrord32.exe",
+      "rdrcef.exe",
+      "foxitphantomPDF.exe",
+      "foxitreader.exe",
+      "firefox.exe",
+      "chrome.exe",
+      "iexplore.exe",
+      "opera.exe",
+      "plugin-container.exe",
+      "safari.exe",
+      "microsoftedge.exe",
+      "w3wp.exe",
+      "httpd.exe",
+      "nginx.exe",
+      "php.exe",
+      "php-cgi.exe",
+      "tomcat.exe",
+      "wscript.exe",
+      "cscript.exe",
+      "powershell.exe",
+      "pwsh.exe",
+      "cmd.exe"
+      ) or
+  descendant of [process where event.action == "start" and
+    process.parent.name : (
+      "winword.exe",
+      "excel.exe",
+      "outlook.exe",
+      "powerpnt.exe",
+      "eqnedt32.exe",
+      "fltldr.exe",
+      "mspub.exe",
+      "msaccess.exe",
+      "acrord32.exe",
+      "rdrcef.exe",
+      "foxitphantomPDF.exe",
+      "foxitreader.exe",
+      "firefox.exe",
+      "chrome.exe",
+      "iexplore.exe",
+      "opera.exe",
+      "plugin-container.exe",
+      "safari.exe",
+      "microsoftedge.exe",
+      "w3wp.exe",
+      "httpd.exe",
+      "nginx.exe",
+      "php.exe",
+      "php-cgi.exe",
+      "tomcat.exe",
+      "wscript.exe",
+      "cscript.exe",
+      "powershell.exe",
+      "pwsh.exe",
+      "cmd.exe"
+    )])
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1197"
+name = "BITS Jobs"
+reference = "https://attack.mitre.org/techniques/T1197/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_suspicious_execution_from_a_mounted_device.toml b/behavior/rules/defense_evasion_suspicious_execution_from_a_mounted_device.toml
new file mode 100644
index 00000000..90359968
--- /dev/null
+++ b/behavior/rules/defense_evasion_suspicious_execution_from_a_mounted_device.toml
@@ -0,0 +1,88 @@
+[rule]
+description = """
+Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may
+use this technique to evade defenses.
+"""
+id = "42d2bbfb-a2fb-4327-b701-89ead6044ca1"
+license = "Elastic License v2"
+name = "Suspicious Execution from a Mounted Device"
+os_list = ["windows"]
+version = "1.0.9"
+
+query = '''
+sequence with maxspan=1m
+  [file where event.action == "creation" and file.extension : "lnk" and
+   process.name : "explorer.exe" and
+     file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.vhd.lnk",
+                  "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.iso.lnk")] by process.entity_id
+  [process where event.action == "start" and process.executable : "C:\\*" and
+   (process.working_directory : "?:\\" and not process.working_directory : "C:\\") and process.parent.name : "explorer.exe" and
+    process.name : ("rundll32.exe", "mshta.exe", "powershell.exe", "pwsh.exe", "cmd.exe", "regsvr32.exe", "cscript.exe",
+                    "wscript.exe", "wmic.exe", "msbuild.exe", "regsvcs.exe", "installutil.exe", "cmstp.exe", "msxsl.exe",
+                    "Microsoft.Workflow.Compiler.exe", "wuauclt.exe") and
+    /* Issue #316 */
+    process.args_count >= 2] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.003"
+name = "Windows Command Shell"
+reference = "https://attack.mitre.org/techniques/T1059/003/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.005"
+name = "Mshta"
+reference = "https://attack.mitre.org/techniques/T1218/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.010"
+name = "Regsvr32"
+reference = "https://attack.mitre.org/techniques/T1218/010/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_suspicious_imageload_from_an_iso_mounted_device.toml b/behavior/rules/defense_evasion_suspicious_imageload_from_an_iso_mounted_device.toml
new file mode 100644
index 00000000..7edba8ba
--- /dev/null
+++ b/behavior/rules/defense_evasion_suspicious_imageload_from_an_iso_mounted_device.toml
@@ -0,0 +1,53 @@
+[rule]
+description = """
+Identifies instances of RunDLL32 or Regsvr32 loading a DLL from a mounted ISO device. Adversaries may deliver a
+malicious payload via an ISO file and execute it via rundll32.exe or regsvr32.
+"""
+id = "779b9502-7912-4773-95a1-51cd702a71c8"
+license = "Elastic License v2"
+name = "Suspicious ImageLoad from an ISO Mounted Device"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [process where event.action == "start" and
+  process.name : ("rundll32.exe", "regsvr32.exe") and
+  process.parent.name : ("cmd.exe", "explorer.exe", "powershell.exe", "winrar.exe", "7zFM.exe")]
+ [library where process.name : ("rundll32.exe", "regsvr32.exe") and
+  not dll.code_signature.trusted == true and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+
+  /* loading dll from a mounted device */
+  (dll.path : "\\Device\\CdRom*" or dll.path regex """[d-zD-Z]:\\[0-9a-zA-Z\.]+""")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.010"
+name = "Regsvr32"
+reference = "https://attack.mitre.org/techniques/T1218/010/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/defense_evasion_suspicious_imageload_via_windows_update_auto_update_client.toml b/behavior/rules/defense_evasion_suspicious_imageload_via_windows_update_auto_update_client.toml
new file mode 100644
index 00000000..a2c1f34d
--- /dev/null
+++ b/behavior/rules/defense_evasion_suspicious_imageload_via_windows_update_auto_update_client.toml
@@ -0,0 +1,49 @@
+[rule]
+description = """
+Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load an arbitrary DLL. This behavior is used
+as a defense evasion technique to blend-in malicious activity with legitimate Windows software.
+"""
+id = "3788c03d-28a5-4466-b157-d6dd4dc449bb"
+license = "Elastic License v2"
+name = "Suspicious ImageLoad via Windows Update Auto Update Client"
+os_list = ["windows"]
+reference = ["https://dtm.uk/wuauclt/"]
+version = "1.0.5"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [process where event.action == "start" and
+  (process.pe.original_file_name == "wuauclt.exe" or process.name : "wuauclt.exe") and
+   process.parent.executable != null and
+   process.args : "/RunHandlerComServer" and process.args : "/UpdateDeploymentProvider" and
+   not process.parent.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\MoUsoCoreWorker.exe")]
+ [library where
+  not (dll.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation") and dll.code_signature.trusted == true) and
+  not (dll.code_signature.trusted == true and
+       dll.path : ("?:\\Program Files\\*.dll",
+                  "?:\\Program Files (x86)\\*.dll",
+                  "?:\\Windows\\System32\\*.dll",
+                  "?:\\Windows\\SysWOW64\\*.dll",
+                  "?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\*.dll"))]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/defense_evasion_suspicious_windows_defender_exclusions_added_via_powershell.toml b/behavior/rules/defense_evasion_suspicious_windows_defender_exclusions_added_via_powershell.toml
new file mode 100644
index 00000000..37846744
--- /dev/null
+++ b/behavior/rules/defense_evasion_suspicious_windows_defender_exclusions_added_via_powershell.toml
@@ -0,0 +1,88 @@
+[rule]
+description = """
+Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder
+directory or process level.
+"""
+id = "2ad8b514-baf0-4e29-a712-d6734868aa57"
+license = "Elastic License v2"
+name = "Suspicious Windows Defender Exclusions Added via PowerShell"
+os_list = ["windows"]
+reference = [
+    "https://docs.microsoft.com/en-us/powershell/module/defender/add-mppreference?view=windowsserver2019-ps",
+]
+version = "1.0.4"
+
+query = '''
+sequence with maxspan=1m
+  [process where event.action == "start" and
+   not process.Ext.token.integrity_level_name == "system" and
+   (
+    (process.code_signature.trusted != true) or
+    (process.executable : ("?:\\Windows\\Microsoft.NET\\*",
+                           "?:\\Users\\Public\\*",
+                           "?:\\Users\\*\\AppData\\Local\\Temp\\*",
+                           "?:\\Users\\*\\AppData\\Roaming\\*",
+                           "?:\\Users\\*\\Pictures\\*",
+                           "?:\\Users\\*\\Documents\\*",
+                           "?:\\Windows\\Resources\\Themes\\*",
+                           "?:\\ProgramData\\*") and not process.executable : "?:\\ProgramData\\*\\*") or
+    (process.name : ("rundll32.exe", "regsvr32.exe", "WScript.exe"))
+    )] by process.entity_id
+  [process where event.action == "start" and
+   process.name : ("cmd.exe", "powershell.exe") and
+   process.args : ("Add-MpPreference", "Set-MpPreference") and
+   process.args : ("-ExclusionPath", "-DisableRealtimeMonitoring", "-DisableScriptScanning", "-DisableArchiveScanning")] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.003"
+name = "Windows Command Shell"
+reference = "https://attack.mitre.org/techniques/T1059/003/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1562"
+name = "Impair Defenses"
+reference = "https://attack.mitre.org/techniques/T1562/"
+[[threat.technique.subtechnique]]
+id = "T1562.001"
+name = "Disable or Modify Tools"
+reference = "https://attack.mitre.org/techniques/T1562/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_suspicious_windows_lua_script_execution.toml b/behavior/rules/defense_evasion_suspicious_windows_lua_script_execution.toml
new file mode 100644
index 00000000..76ec8ddc
--- /dev/null
+++ b/behavior/rules/defense_evasion_suspicious_windows_lua_script_execution.toml
@@ -0,0 +1,44 @@
+[rule]
+description = """
+Identifies the execution of Lua Windows Standalone Interpreter modules from suspicious locations. Attackers may abuse
+Lua for Windows to execute malicious Lua script and bypass signature-based detection.
+"""
+id = "8f237d98-1825-4c27-a5cd-e38bde70882a"
+license = "Elastic License v2"
+name = "Suspicious Windows LUA Script Execution"
+os_list = ["windows"]
+version = "1.0.4"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [library where dll.name : ("luacom.dll", "lua?.?.dll") and not user.id : "S-1-5-18" and
+  not dll.code_signature.trusted == true and
+  dll.path : ("?:\\Programdata\\*", "?:\\Users\\*", "?:\\Windows\\Temp\\*", "?:\\windows\\System32\\Tasks\\*", "?:\\Windows\\Tasks\\*")]
+ [network where event.action == "connection_attempted"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1036"
+name = "Masquerading"
+reference = "https://attack.mitre.org/techniques/T1036/"
+[[threat.technique.subtechnique]]
+id = "T1036.003"
+name = "Rename System Utilities"
+reference = "https://attack.mitre.org/techniques/T1036/003/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/defense_evasion_suspicious_wmic_xsl_script_execution.toml b/behavior/rules/defense_evasion_suspicious_wmic_xsl_script_execution.toml
new file mode 100644
index 00000000..7319ddd7
--- /dev/null
+++ b/behavior/rules/defense_evasion_suspicious_wmic_xsl_script_execution.toml
@@ -0,0 +1,65 @@
+[rule]
+description = """
+Identifies Windows Management Instrumentation Command-Line utility (WMIC) whitelisting bypass attempts by alerting on
+suspicious execution of scripts. When WMIC loads scripting libraries, it may be indicative of an attempt to bypass
+application whitelisting
+"""
+id = "18371ec4-ee2f-465b-8757-ee726914006c"
+license = "Elastic License v2"
+name = "Suspicious WMIC XSL Script Execution"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+sequence by process.entity_id with maxspan=2m
+[process where event.action == "start" and
+   (process.name : "WMIC.exe" or process.pe.original_file_name : "wmic.exe") and
+   process.command_line : ("* format*:*", "*/format*:*", "*-format*:*") and
+   not process.command_line :
+              (
+               "*format:list*",
+               "*format:table*",
+               "*format:htable",
+               "*format:texttablewsys*",
+               "*format:texttable*",
+               "*format:textvaluelist*",
+               "*format:TEXTVALUELIST*",
+               "*format:csv*",
+               "*format:value*"
+               ) and
+   not process.parent.executable : "?:\\Program Files\\Trend Micro\\Titanium\\plugin\\Pt\\win32\\inspect\\Inspect.exe"]
+[library where dll.name : ("jscript.dll", "vbscript.dll")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1047"
+name = "Windows Management Instrumentation"
+reference = "https://attack.mitre.org/techniques/T1047/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1220"
+name = "XSL Script Processing"
+reference = "https://attack.mitre.org/techniques/T1220/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_unusual_dll_extension_loaded_by_rundll32_or_regsvr32.toml b/behavior/rules/defense_evasion_unusual_dll_extension_loaded_by_rundll32_or_regsvr32.toml
new file mode 100644
index 00000000..5e3191d7
--- /dev/null
+++ b/behavior/rules/defense_evasion_unusual_dll_extension_loaded_by_rundll32_or_regsvr32.toml
@@ -0,0 +1,61 @@
+[rule]
+description = """
+Identifies instances of RunDLL32 or Regsvr32 loading a DLL with an unusual file extension. Adversaries often abuse those
+programs to proxy execution of malicious code.
+"""
+id = "76da5dca-ffe5-4756-85ba-3ac2e6ccf623"
+license = "Elastic License v2"
+name = "Unusual DLL Extension Loaded by Rundll32 or Regsvr32"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+sequence by process.entity_id with maxspan=1s
+ [process where event.action == "start" and process.name : ("rundll32.exe", "regsvr32.exe") and
+  not (process.parent.executable : "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoBatteryGaugePackage\\*\\BGHelper.exe" and
+       process.args : "ShowBatteryGauge" and process.args : "updatestatus") and
+  not (process.name : "regsvr32.exe" and process.args : "?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\BSPHelperObject.dll")
+  ]
+ [library where process.name : ("rundll32.exe", "regsvr32.exe") and
+  not dll.name : ("*.dll", "*.cpl", "*.tmp", "*.exe", "*.tlb") and
+  not (dll.name : ("*.ocx", "*.ax") and process.name : "regsvr32.exe") and
+  not dll.code_signature.trusted == true and
+  not dll.path : ("?:\\Windows\\System32\\winspool.drv",
+                  "?:\\Windows\\SysWOW64\\winspool.drv",
+                  "?:\\Windows\\System32\\liunt.ime",
+                  "?:\\Windows\\SysWOW64\\liunt.ime",
+                  "?:\\Windows\\System32\\spool\\drivers\\*",
+                  "?:\\Program Files (x86)\\*",
+                  "?:\\Program Files\\*")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.010"
+name = "Regsvr32"
+reference = "https://attack.mitre.org/techniques/T1218/010/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/defense_evasion_unusual_network_connection_via_rundll32.toml b/behavior/rules/defense_evasion_unusual_network_connection_via_rundll32.toml
new file mode 100644
index 00000000..70c8d232
--- /dev/null
+++ b/behavior/rules/defense_evasion_unusual_network_connection_via_rundll32.toml
@@ -0,0 +1,50 @@
+[rule]
+description = """
+Identifies unusual instances of rundll32.exe making outbound network connections. This may be indicative of adversarial
+command and control activity.
+"""
+id = "2e708541-c6e8-4ded-923f-78a6c160987e"
+license = "Elastic License v2"
+name = "Unusual Network Connection via RunDLL32"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+  [process where event.action == "start" and process.name : "rundll32.exe" and process.args_count == 1 and
+   not (process.code_signature.subject_name == "Teramind Inc." and
+        process.code_signature.trusted == true and process.Ext.token.integrity_level_name == "system" and
+        process.args == "/update" and process.parent.name == "tmagentsvc.exe")]
+  [network where event.action == "connection_attempted" and process.name : "rundll32.exe"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1055"
+name = "Process Injection"
+reference = "https://attack.mitre.org/techniques/T1055/"
+
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_windows_error_manager_reporting_masquerading.toml b/behavior/rules/defense_evasion_windows_error_manager_reporting_masquerading.toml
new file mode 100644
index 00000000..1d2feded
--- /dev/null
+++ b/behavior/rules/defense_evasion_windows_error_manager_reporting_masquerading.toml
@@ -0,0 +1,44 @@
+[rule]
+description = """
+Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching
+command-line and process executable values performing outgoing network connections. This may be indicative of a
+masquerading attempt to evade suspicious child process behavior detections.
+"""
+id = "3d16f5f9-da4c-4b15-a501-505761b75ca6"
+license = "Elastic License v2"
+name = "Windows Error Manager/Reporting Masquerading"
+os_list = ["windows"]
+version = "1.0.7"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+  [process where event.action == "start" and
+   process.name : ("wermgr.exe", "WerFault.exe") and process.args_count == 1]
+  [network where event.action == "connection_attempted" and process.name : ("wermgr.exe", "WerFault.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1036"
+name = "Masquerading"
+reference = "https://attack.mitre.org/techniques/T1036/"
+
+[[threat.technique]]
+id = "T1055"
+name = "Process Injection"
+reference = "https://attack.mitre.org/techniques/T1055/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/defense_evasion_windows_firewall_exception_list_modified_via_untrusted_process.toml b/behavior/rules/defense_evasion_windows_firewall_exception_list_modified_via_untrusted_process.toml
new file mode 100644
index 00000000..5a8c4eb6
--- /dev/null
+++ b/behavior/rules/defense_evasion_windows_firewall_exception_list_modified_via_untrusted_process.toml
@@ -0,0 +1,55 @@
+[rule]
+description = """
+Identifies the execution of the built-in Windows program, Netsh, to add a program to the Windows Firewall exception list
+via an untrusted parent process.
+"""
+id = "5c01669c-e1cc-4acc-95b6-8b5e4a92c970"
+license = "Elastic License v2"
+name = "Windows Firewall Exception List Modified via Untrusted Process"
+os_list = ["windows"]
+reference = [
+    "https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/netsh-advfirewall-firewall-control-firewall-behavior",
+]
+version = "1.0.8"
+
+query = '''
+sequence with maxspan=1m
+  [process where event.action == "start" and
+   process.executable : ("?:\\ProgramData\\*", "?:\\Users\\*", "?:\\Python*") and not process.code_signature.trusted == true] by process.entity_id
+  [process where event.action == "start" and process.name : "netsh.exe" and
+   process.command_line : "*add*allowedprogram*ENABLE*" and
+   not process.args : ("program=*:\\Program Files\\*", "program=*:\\Program Files (x86)\\*") and
+   not (process.args : "name=Free Download Manager" and process.parent.name : "fdm_x64_setup.tmp")
+   ] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1562"
+name = "Impair Defenses"
+reference = "https://attack.mitre.org/techniques/T1562/"
+[[threat.technique.subtechnique]]
+id = "T1562.004"
+name = "Disable or Modify System Firewall"
+reference = "https://attack.mitre.org/techniques/T1562/004/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/discovery_external_ip_address_discovery_via_a_trusted_program.toml b/behavior/rules/discovery_external_ip_address_discovery_via_a_trusted_program.toml
new file mode 100644
index 00000000..691e9039
--- /dev/null
+++ b/behavior/rules/discovery_external_ip_address_discovery_via_a_trusted_program.toml
@@ -0,0 +1,84 @@
+[rule]
+description = """
+Identifies scripting utilities and commonly abused binary proxy programs making a DNS request to a known public IP
+address lookup web service. Malwares tend to perform this action to assess potential targets.
+"""
+id = "51894221-7657-4b56-9406-e080e19ad159"
+license = "Elastic License v2"
+name = "External IP Address Discovery via a Trusted Program"
+os_list = ["windows"]
+version = "1.0.7"
+
+query = '''
+sequence by process.entity_id with maxspan=5m
+  [process where event.action == "start" and user.id : "S-1-5-21-*" and
+    (
+     process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
+                     "powershell.exe", "pwsh.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe",
+                     "installutil.exe","RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe", "curl.exe") or
+     process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
+                           "?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe",
+                           "?:\\Windows\\Microsoft.NET\\*.exe")
+     )
+   ]
+  [dns where
+    dns.question.name :
+         (
+          "ip-api.com",
+          "checkip.dyndns.org",
+          "api.ipify.org",
+          "api.ipify.com",
+          "whatismyip.akamai.com",
+          "bot.whatismyipaddress.com",
+          "ifcfg.me",
+          "ident.me",
+          "ipof.in",
+          "ip.tyk.nu",
+          "icanhazip.com",
+          "curlmyip.com",
+          "wgetip.com",
+          "eth0.me",
+          "ipecho.net",
+          "ip.appspot.com",
+          "api.myip.com",
+          "geoiptool.com",
+          "api.2ip.ua",
+          "api.ip.sb",
+          "ipinfo.io",
+          "checkip.amazonaws.com",
+          "wtfismyip.com",
+          "iplogger.org",
+          "freegeoip.net",
+          "freegeoip.app",
+          "ipinfo.io",
+          "geoplugin.net",
+          "myip.dnsomatic.com",
+          "www.geoplugin.net",
+          "api64.ipify.org",
+          "ip4.seeip.org",
+          "*.geojs.io",
+          "*portmap.io"
+         )
+  ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1016"
+name = "System Network Configuration Discovery"
+reference = "https://attack.mitre.org/techniques/T1016/"
+
+
+[threat.tactic]
+id = "TA0007"
+name = "Discovery"
+reference = "https://attack.mitre.org/tactics/TA0007/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/discovery_external_ip_address_discovery_via_untrusted_program.toml b/behavior/rules/discovery_external_ip_address_discovery_via_untrusted_program.toml
new file mode 100644
index 00000000..57621ccb
--- /dev/null
+++ b/behavior/rules/discovery_external_ip_address_discovery_via_untrusted_program.toml
@@ -0,0 +1,78 @@
+[rule]
+description = """
+Identifies a dropped unsigned program making a DNS request to a known public IP address lookup web service. Malwares
+tend to perform this action to assess potential targets.
+"""
+id = "dfe28e03-9b0b-47f5-9753-65ed2666663f"
+license = "Elastic License v2"
+name = "External IP Address Discovery via Untrusted Program"
+os_list = ["windows"]
+version = "1.0.7"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+
+ /* execution of an unsigned PE file followed by dns request to public ip discovery web services */
+
+  [process where event.action == "start" and user.id : "S-1-5-21-*" and
+   not process.code_signature.trusted == true and
+   process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*")]
+  [dns where
+    dns.question.name :
+         (
+          "ip-api.com",
+          "checkip.dyndns.org",
+          "api.ipify.org",
+          "whatismyip.akamai.com",
+          "bot.whatismyipaddress.com",
+          "ifcfg.me",
+          "ident.me",
+          "ipof.in",
+          "ip.tyk.nu",
+          "icanhazip.com",
+          "curlmyip.com",
+          "wgetip.com",
+          "eth0.me",
+          "ipecho.net",
+          "ip.appspot.com",
+          "api.myip.com",
+          "geoiptool.com",
+          "api.2ip.ua",
+          "api.ip.sb",
+          "ipinfo.io",
+          "checkip.amazonaws.com",
+          "wtfismyip.com",
+          "iplogger.org",
+          "freegeoip.net",
+          "freegeoip.app",
+          "ipinfo.io",
+          "geoplugin.net",
+          "myip.dnsomatic.com",
+          "www.geoplugin.net",
+          "api64.ipify.org",
+          "ip4.seeip.org",
+          "*.geojs.io",
+          "*portmap.io"
+         )]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1016"
+name = "System Network Configuration Discovery"
+reference = "https://attack.mitre.org/techniques/T1016/"
+
+
+[threat.tactic]
+id = "TA0007"
+name = "Discovery"
+reference = "https://attack.mitre.org/tactics/TA0007/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/discovery_potential_security_software_discovery_via_grep.toml b/behavior/rules/discovery_potential_security_software_discovery_via_grep.toml
new file mode 100644
index 00000000..3e5470b5
--- /dev/null
+++ b/behavior/rules/discovery_potential_security_software_discovery_via_grep.toml
@@ -0,0 +1,48 @@
+[rule]
+description = """
+Identifies the use of the grep command to discover known third-party macOS and Linux security tools, such as Antivirus
+or Host Firewall details.
+"""
+id = "13eade2e-73dd-4fab-a511-88258635559d"
+license = "Elastic License v2"
+name = "Potential Security Software Discovery via Grep"
+os_list = ["linux", "macos"]
+reference = ["https://objective-see.com/blog/blog_0x4F.html"]
+version = "1.0.6"
+
+query = '''
+process where event.type == "start" and
+process.name : ("grep", "egrep", "sh") and user.id != 0 and
+   process.command_line : "*grep*Little Snitch*" and not process.parent.executable : "/Library/Application Support/*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1518"
+name = "Software Discovery"
+reference = "https://attack.mitre.org/techniques/T1518/"
+[[threat.technique.subtechnique]]
+id = "T1518.001"
+name = "Security Software Discovery"
+reference = "https://attack.mitre.org/techniques/T1518/001/"
+
+
+
+[threat.tactic]
+id = "TA0007"
+name = "Discovery"
+reference = "https://attack.mitre.org/tactics/TA0007/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/discovery_potential_virtual_machine_fingerprinting_via_grep.toml b/behavior/rules/discovery_potential_virtual_machine_fingerprinting_via_grep.toml
new file mode 100644
index 00000000..bc00146e
--- /dev/null
+++ b/behavior/rules/discovery_potential_virtual_machine_fingerprinting_via_grep.toml
@@ -0,0 +1,54 @@
+[rule]
+description = """
+An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies
+common locations used to discover virtual machine hardware by a non-root user.
+"""
+id = "e5c0963c-0367-4d24-bdf2-5af3a233e57b"
+license = "Elastic License v2"
+name = "Potential Virtual Machine Fingerprinting via Grep"
+os_list = ["macos"]
+reference = ["https://objective-see.com/blog/blog_0x4F.html"]
+version = "1.0.5"
+
+query = '''
+process where event.type == "start" and
+ process.name in ("grep", "egrep") and user.id != 0 and
+ process.command_line : ("*parallels*", "*vmware*", "*virtualbox*") and process.command_line : "*Manufacturer*" and
+ not process.parent.executable in ("/Applications/Docker.app/Contents/MacOS/Docker", "/usr/libexec/kcare/virt-what")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1082"
+name = "System Information Discovery"
+reference = "https://attack.mitre.org/techniques/T1082/"
+
+[[threat.technique]]
+id = "T1497"
+name = "Virtualization/Sandbox Evasion"
+reference = "https://attack.mitre.org/techniques/T1497/"
+[[threat.technique.subtechnique]]
+id = "T1497.001"
+name = "System Checks"
+reference = "https://attack.mitre.org/techniques/T1497/001/"
+
+
+
+[threat.tactic]
+id = "TA0007"
+name = "Discovery"
+reference = "https://attack.mitre.org/tactics/TA0007/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_command_shell_activity_started_via_rundll32.toml b/behavior/rules/execution_command_shell_activity_started_via_rundll32.toml
new file mode 100644
index 00000000..3cfcd11e
--- /dev/null
+++ b/behavior/rules/execution_command_shell_activity_started_via_rundll32.toml
@@ -0,0 +1,69 @@
+[rule]
+description = "Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code."
+id = "b8a0a3aa-0345-4035-b41d-f758a6c59a78"
+license = "Elastic License v2"
+name = "Command Shell Activity Started via RunDLL32"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+process where event.type == "start" and
+  process.name : ("cmd.exe", "powershell.exe") and
+    process.parent.name : "rundll32.exe" and process.parent.command_line != null and
+    not process.parent.command_line :
+                    ("*:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL*",
+                     "*zzzzInvokeManagedCustomActionOutOfProc*") and
+    not (process.parent.args : "aepdu.dll,AePduRunUpdate" and process.args : "osloader" and process.args : "%windir%\\system32\\bcdedit") and
+    not (process.parent.args : ("?:\\Windows\\System32\\LogiLDA.dll,LogiFetch", "?:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask") and
+         process.name : "powershell.exe" and process.command_line : "*install*") and
+    not (process.args : "dellpointstick://Mainpage/*" and process.parent.args : "Vxd_launch_UI") and
+    not (process.parent.args : "?:\\Windows\\system32\\davclnt.dll,DavSetCookie" and process.name : "powershell.exe") and
+    not process.parent.args : "AppXDeploymentExtensions.OneCore.dll,ShellRefresh" and
+    not (process.args : ("launchalpsdelltouchpad://Mainpage/path2?param=start", "alpsdelltouchpadsettings://Mainpage/path2?param=start") and
+         process.parent.args : "?:\\WINDOWS\\System32\\main.cpl") and
+    not (process.command_line : "*REG QUERY HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography*" and
+         process.parent.args : "?:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_delayed_execution_via_ping.toml b/behavior/rules/execution_delayed_execution_via_ping.toml
new file mode 100644
index 00000000..9e718a3f
--- /dev/null
+++ b/behavior/rules/execution_delayed_execution_via_ping.toml
@@ -0,0 +1,128 @@
+[rule]
+description = """
+Identifies the execution of commonly abused Windows utilities via a delayed Ping execution. This behavior is often
+observed during malware installation and is consistent with an attacker attempting to evade detection.
+"""
+id = "7615ca4b-c291-4f05-9488-114b6bf99157"
+license = "Elastic License v2"
+name = "Delayed Execution via Ping"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+sequence by process.parent.entity_id with maxspan=1m
+  [process where event.action == "start" and process.name : "ping.exe" and
+   process.parent.name : "cmd.exe" and not user.id : "S-1-5-18" and
+   process.args : "-n" and
+   process.args : ("8.8.*", "localhost", "127.*", "0.0.*.*")]
+  [process where event.action == "start" and
+   process.parent.name : "cmd.exe" and
+   process.name : ("rundll32.exe",
+                   "powershell.exe",
+                   "mshta.exe",
+                   "msbuild.exe",
+                   "certutil.exe",
+                   "regsvr32.exe",
+                   "powershell.exe",
+                   "cscript.exe",
+                   "wscript.exe",
+                   "wmic.exe",
+                   "installutil.exe",
+                   "msxsl.exe",
+                   "Microsoft.Workflow.Compiler.exe",
+                   "ieexec.exe",
+                   "iexpress.exe",
+                   "RegAsm.exe",
+                   "installutil.exe",
+                   "RegSvcs.exe",
+                   "RegAsm.exe") or
+    (process.executable : "?:\\Users\\*\\AppData\\*.exe" and not process.code_signature.trusted == true) and
+    not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
+    not (process.name : ("openssl.exe", "httpcfg.exe", "certutil.exe") and process.parent.command_line : "*ScreenConnectConfigurator.cmd*") and
+    not (process.pe.original_file_name : "DPInst.exe" and process.command_line : "driver\\DPInst_x64  /f ") and
+    not (process.name : "powershell.exe" and process.args : "Write-Host ======*")
+    ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1216"
+name = "Signed Script Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1216/"
+
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.003"
+name = "CMSTP"
+reference = "https://attack.mitre.org/techniques/T1218/003/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.004"
+name = "InstallUtil"
+reference = "https://attack.mitre.org/techniques/T1218/004/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.005"
+name = "Mshta"
+reference = "https://attack.mitre.org/techniques/T1218/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.009"
+name = "Regsvcs/Regasm"
+reference = "https://attack.mitre.org/techniques/T1218/009/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.010"
+name = "Regsvr32"
+reference = "https://attack.mitre.org/techniques/T1218/010/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+[[threat.technique]]
+id = "T1220"
+name = "XSL Script Processing"
+reference = "https://attack.mitre.org/techniques/T1220/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_download_and_execution_of_javascript_payload.toml b/behavior/rules/execution_download_and_execution_of_javascript_payload.toml
new file mode 100644
index 00000000..b1e2fc48
--- /dev/null
+++ b/behavior/rules/execution_download_and_execution_of_javascript_payload.toml
@@ -0,0 +1,56 @@
+[rule]
+description = """
+Identifies when curl is used to download a JavaScript payload and subsequently execute it using the built-in osascript
+utility. An adversary may use this technique to execute their malicious payload and obtain initial access to an
+endpoint.
+"""
+id = "871f0c30-a7c5-40a5-80e3-a50c6714632f"
+license = "Elastic License v2"
+name = "Download and Execution of JavaScript Payload"
+os_list = ["macos"]
+reference = ["https://github.com/its-a-feature/Mythic"]
+version = "1.0.8"
+
+query = '''
+sequence by user.id with maxspan=30s
+  [process where event.action == "exec" and
+    process.name : "curl" and process.args : "http*" and
+    not process.args : ("https://*.jamfcloud.com/JSSResource/*",
+                        "https://download.zerotier.com/RELEASES/*",
+                        "https://download.mozilla.org/?os=osx&product=firefox-latest-ssl")]
+  [process where event.action == "exec" and process.name : "osascript" and
+    process.command_line : "*-l JavaScript*" and
+    /* rule scope is limited to curl output passed to osascript via pipe */
+    process.args_count <= 3]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_dynwrapx_image_load_via_windows_scripts.toml b/behavior/rules/execution_dynwrapx_image_load_via_windows_scripts.toml
new file mode 100644
index 00000000..00bad516
--- /dev/null
+++ b/behavior/rules/execution_dynwrapx_image_load_via_windows_scripts.toml
@@ -0,0 +1,52 @@
+[rule]
+description = """
+Identifies when a Windows script interpreter loads an external library that allow to call Windows API functions from
+scripts in JScript and VBScript. Malware may abuse this legit capability to interact further with the Operating System.
+"""
+id = "4cd6f758-0057-4e8a-9701-20b6116c2118"
+license = "Elastic License v2"
+name = "Dynwrapx Image Load via Windows Scripts"
+os_list = ["windows"]
+reference = [
+    "https://www.script-coding.com/dynwrapx_eng.html",
+    "https://www.splunk.com/en_us/blog/security/detecting-malware-script-loaders-using-remcos-threat-research-release-december-2021.html",
+]
+version = "1.0.4"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [process where event.type == "start" and
+  process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe")]
+ [library where dll.pe.original_file_name : "dynwrapx.dll"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_eggshell_backdoor_execution.toml b/behavior/rules/execution_eggshell_backdoor_execution.toml
new file mode 100644
index 00000000..249b44eb
--- /dev/null
+++ b/behavior/rules/execution_eggshell_backdoor_execution.toml
@@ -0,0 +1,39 @@
+[rule]
+description = "Identifies the execution of the EggShell backdoor. EggShell is a known post exploitation tool for macOS and Linux."
+id = "feed7842-34a6-4764-b858-6e5ac01a5ab7"
+license = "Elastic License v2"
+name = "EggShell Backdoor Execution"
+os_list = ["linux", "macos"]
+reference = ["https://github.com/neoneggplant/EggShell"]
+version = "1.0.9"
+
+query = '''
+process where event.action == "exec" and
+ process.executable : ("/private/tmp/*", "/tmp/*") and process.args : "eyJkZWJ1ZyI6*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_embedded_executable_via_windows_shortcut_file.toml b/behavior/rules/execution_embedded_executable_via_windows_shortcut_file.toml
new file mode 100644
index 00000000..103dd278
--- /dev/null
+++ b/behavior/rules/execution_embedded_executable_via_windows_shortcut_file.toml
@@ -0,0 +1,89 @@
+[rule]
+description = """
+Identifies the execution of a an executable extracted from within a Windows shortcut (lnk) file. Adversaries may embed
+malicious files in a shortcut file before delivering it to their target in order to trick them into executing the
+payload.
+"""
+id = "9fdd772b-b483-404f-bc02-7ec87e332bec"
+license = "Elastic License v2"
+name = "Embedded Executable via Windows Shortcut File"
+os_list = ["windows"]
+reference = ["https://www.x86matthew.com/view_post?id=embed_exe_lnk"]
+version = "1.0.4"
+
+query = '''
+sequence with maxspan=1m
+ [ file where event.action != "deletion" and
+   (file.Ext.header_bytes : "4d5a*" or file.extension : ("exe", "scr", "pif", "com")) and
+   process.name : ("cmd.exe", "powershell.exe") ] by process.entity_id
+ [ process where event.action == "start" and
+   process.parent.name : ("cmd.exe", "powershell.exe") and process.parent.command_line : "*.lnk*"] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1566.002"
+name = "Spearphishing Link"
+reference = "https://attack.mitre.org/techniques/T1566/002/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.003"
+name = "Windows Command Shell"
+reference = "https://attack.mitre.org/techniques/T1059/003/"
+
+
+[[threat.technique]]
+id = "T1204"
+name = "User Execution"
+reference = "https://attack.mitre.org/techniques/T1204/"
+[[threat.technique.subtechnique]]
+id = "T1204.001"
+name = "Malicious Link"
+reference = "https://attack.mitre.org/techniques/T1204/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1204.002"
+name = "Malicious File"
+reference = "https://attack.mitre.org/techniques/T1204/002/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_empire_stager_execution.toml b/behavior/rules/execution_empire_stager_execution.toml
new file mode 100644
index 00000000..fa071b54
--- /dev/null
+++ b/behavior/rules/execution_empire_stager_execution.toml
@@ -0,0 +1,65 @@
+[rule]
+description = """
+Identifies when a script interpreter executes a base64-encoded Empire stager. Empire is penetration testing software
+that is often utilized by attackers.
+"""
+id = "b7974ff6-82ff-4743-9e07-1c6901b1f0ea"
+license = "Elastic License v2"
+name = "Empire Stager Execution"
+os_list = ["linux", "macos"]
+reference = ["https://github.com/EmpireProject/Empire", "https://github.com/BC-SECURITY/Empire"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "exec" and
+  process.name : ("python*", "osascript", "sh", "bash", "dash", "ksh", "tcsh", "zsh") and
+  process.command_line : "*exec(base64.b64decode*aW1wb3J0IHN5cztpbXBvcnQg*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.006"
+name = "Python"
+reference = "https://attack.mitre.org/techniques/T1059/006/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1132"
+name = "Data Encoding"
+reference = "https://attack.mitre.org/techniques/T1132/"
+[[threat.technique.subtechnique]]
+id = "T1132.001"
+name = "Standard Encoding"
+reference = "https://attack.mitre.org/techniques/T1132/001/"
+
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_execution_from_unusual_directory.toml b/behavior/rules/execution_execution_from_unusual_directory.toml
new file mode 100644
index 00000000..61bbd5d0
--- /dev/null
+++ b/behavior/rules/execution_execution_from_unusual_directory.toml
@@ -0,0 +1,174 @@
+[rule]
+description = """
+Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide
+malware in trusted paths.
+"""
+id = "16c84e67-e5e7-44ff-aefa-4d771bcafc0c"
+license = "Elastic License v2"
+name = "Execution from Unusual Directory"
+os_list = ["windows"]
+version = "1.0.11"
+
+query = '''
+process where event.action == "start" and
+  process.name : ("wscript.exe",
+                  "cscript.exe",
+                  "rundll32.exe",
+                  "regsvr32.exe",
+                  "cmstp.exe",
+                  "RegAsm.exe",
+                  "installutil.exe",
+                  "mshta.exe",
+                  "RegSvcs.exe",
+                  "msbuild.exe",
+                  "msxsl.exe",
+                  "xwizard.exe") and
+  /* add suspicious execution paths here */
+  process.args : ("?:\\PerfLogs\\*",
+                  "?:\\Users\\*\\Pictures\\*",
+                  "?:\\Users\\*\\Music\\*",
+                  "?:\\Users\\Public\\*",
+                  "?:\\Windows\\Tasks\\*",
+                  "?:\\Windows\\System32\\Tasks\\*",
+                  "?:\\Intel\\*",
+                  "?:\\AMD\\Temp\\*",
+                  "?:\\Windows\\AppReadiness\\*",
+                  "?:\\Windows\\ServiceState\\*",
+                  "?:\\Windows\\security\\*",
+                  "?:\\Windows\\IdentityCRL\\*",
+                  "?:\\Windows\\Branding\\*",
+                  "?:\\Windows\\csc\\*",
+                  "?:\\Windows\\DigitalLocker\\*",
+                  "?:\\Windows\\en-US\\*",
+                  "?:\\Windows\\wlansvc\\*",
+                  "?:\\Windows\\Prefetch\\*",
+                  "?:\\Windows\\Fonts\\*",
+                  "?:\\Windows\\diagnostics\\*",
+                  "?:\\Windows\\TAPI\\*",
+                  "?:\\Windows\\INF\\*",
+                  "?:\\windows\\tracing\\*",
+                  "?:\\windows\\IME\\*",
+                  "?:\\Windows\\Performance\\*",
+                  "?:\\windows\\intel\\*",
+                  "?:\\windows\\ms\\*",
+                  "?:\\Windows\\dot3svc\\*",
+                  "?:\\Windows\\ServiceProfiles\\*",
+                  "?:\\Windows\\panther\\*",
+                  "?:\\Windows\\RemotePackages\\*",
+                  "?:\\Windows\\OCR\\*",
+                  "?:\\Windows\\appcompat\\*",
+                  "?:\\Windows\\apppatch\\*",
+                  "?:\\Windows\\addins\\*",
+                  "?:\\Windows\\Setup\\*",
+                  "?:\\Windows\\Help\\*",
+                  "?:\\Windows\\SKB\\*",
+                  "?:\\Windows\\Vss\\*",
+                  "?:\\Windows\\Web\\*",
+                  "?:\\Windows\\servicing\\*",
+                  "?:\\Windows\\CbsTemp\\*",
+                  "?:\\Windows\\Logs\\*",
+                  "?:\\Windows\\WaaS\\*",
+                  "?:\\Windows\\twain_32\\*",
+                  "?:\\Windows\\ShellExperiences\\*",
+                  "?:\\Windows\\ShellComponents\\*",
+                  "?:\\Windows\\PLA\\*",
+                  "?:\\Windows\\Migration\\*",
+                  "?:\\Windows\\debug\\*",
+                  "?:\\Windows\\Cursors\\*",
+                  "?:\\Windows\\Containers\\*",
+                  "?:\\Windows\\Boot\\*",
+                  "?:\\Windows\\bcastdvr\\*",
+                  "?:\\Windows\\TextInput\\*",
+                  "?:\\Windows\\schemas\\*",
+                  "?:\\Windows\\SchCache\\*",
+                  "?:\\Windows\\Resources\\*",
+                  "?:\\Windows\\rescache\\*",
+                  "?:\\Windows\\Provisioning\\*",
+                  "?:\\Windows\\PrintDialog\\*",
+                  "?:\\Windows\\PolicyDefinitions\\*",
+                  "?:\\Windows\\media\\*",
+                  "?:\\Windows\\Globalization\\*",
+                  "?:\\Windows\\L2Schemas\\*",
+                  "?:\\Windows\\LiveKernelReports\\*",
+                  "?:\\Windows\\ModemLogs\\*",
+                  "?:\\Windows\\ImmersiveControlPanel\\*",
+                  "?:\\$Recycle.Bin\\*") and not
+    (process.name : "rundll32.exe" and
+     process.command_line : ("*uxtheme.dll,#64*", "*PRINTUI.DLL,PrintUIEntry*", "*OpenAs_RunDLL*", "*ShowNotificationDialog*")) and not
+    /* Issue #322 */
+    (process.name : "rundll32.exe" and 
+     process.command_line : ("*cryptext.dll*",
+                             "*:\\Users\\*\\Documents\\DocuShare\\*",
+                             "*dfshim.dll*ShOpenVerbShortcut*",
+                             "*dvpack.dll,LaunchINFSection*\\Windows\\INF\\*",
+                             "*PhotoViewer.dll*ImageView_Fu*",
+                             "*GeneralTel.dll,RunGeneralTelemetry*",
+                             "*setupapi,InstallHinfSection*")) and not
+    (process.name : "cscript.exe" and process.command_line : "*PerfLogs\\*\\ServerManager*") and not 
+    (process.name : "regsvr32.exe" and process.command_line : "*:\\WINDOWS\\Help\\*" and 
+     process.parent.executable : ("?:\\Program Files (x86)\\Hewlett-Packard\\*.exe", 
+                                  "?:\\Program Files\\Hewlett-Packard\\*.exe",
+                                  "?:\\Program Files (x86)\\HP\\*.exe",
+                                  "?:\\Program Files\\HP\\*.exe",
+                                  "?:\\ProgramData\\Hewlett-Packard\\UninstallHPSA.exe",
+                                  "?:\\*\\setup.exe")) and not
+    (process.name : "rundll32.exe" and process.parent.name : "svchost.exe" and process.parent.args : "LocalServiceNoNetworkFirewall") and not
+    (process.name : "cscript.exe" and process.args : "RemoveServerPeformanceLog" and process.args : "?:\\PerfLogs\\*" and
+     process.args : "?:\\Windows\\system32\\calluxxprovider.vbs") and not
+
+     /* Issue #535 */
+    (process.name : "rundll32.exe" and
+     process.args : ("?:\\Windows\\system32\\themecpl.dll,OpenThemeAction",
+                     "?:\\Users\\Public\\IBM\\ClientSolutions\\Start_Programs\\Windows_*\\acsnative.dll*",
+                     "?:\\WINDOWS\\System32\\shimgvw.dll,*",
+                     "?:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll*",
+                     "?:\\Program Files\\CopyTrans HEIC for Windows\\CopyTransHEICforWindows.dll*")) and not
+     /* MS Visual Studio */
+     process.executable : ("?:\\Program Files (x86)\\Microsoft Visual Studio\\*.exe", "?:\\Program Files (x86)\\Microsoft Visual Studio\\*.exe") and
+
+     not (process.parent.executable : "?:\\Windows\\system32\\CompatTelRunner.exe" and process.parent.args : "-m:appraiser.dll") and
+     not (process.name : "regsvr32.exe" and process.parent.name == "InstallHPSA.exe" and process.args : "?:\\Windows\\Help\\OEM\\scripts\\checkmui.dll")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_execution_of_a_file_written_by_windows_script_host.toml b/behavior/rules/execution_execution_of_a_file_written_by_windows_script_host.toml
new file mode 100644
index 00000000..0724d18e
--- /dev/null
+++ b/behavior/rules/execution_execution_of_a_file_written_by_windows_script_host.toml
@@ -0,0 +1,56 @@
+[rule]
+description = "Identifies the execution of a file written or modified by Microsoft Windows Script Host processes (cscript or wscript)."
+id = "49e47c2a-307f-4591-939a-dfdae6e5156c"
+license = "Elastic License v2"
+name = "Execution of a File Written by Windows Script Host"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+sequence with maxspan=1m
+  [file where event.action != "deletion" and
+   process.name : ("cscript.exe", "wscript.exe") and
+   not file.path : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe")] by file.path
+  [process where event.action == "start" and
+   not process.Ext.token.integrity_level_name == "system" and
+   not process.parent.executable : "?:\\Windows\\System32\\drvinst.exe" and
+   not (process.code_signature.trusted == true and
+        process.code_signature.subject_name : ("Microsoft *", "ESET, spol. s r.o.", "VORTECH SOLUTIONS PTY LTD")) and
+   not (process.pe.original_file_name : "Packman.exe" and process.args : "checkCompileErrors=true") and
+   not process.pe.original_file_name : ("CCCLauncher.exe", "Bginfo.exe") and
+   not process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*") and
+   not (process.pe.original_file_name == "cognosrcp.exe" and
+        process.code_signature.subject_name == "IBM Canada Ltd." and process.code_signature.trusted == true)
+   ] by process.executable
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_execution_of_a_windows_script_downloaded_via_a_lolbin.toml b/behavior/rules/execution_execution_of_a_windows_script_downloaded_via_a_lolbin.toml
new file mode 100644
index 00000000..0a70534a
--- /dev/null
+++ b/behavior/rules/execution_execution_of_a_windows_script_downloaded_via_a_lolbin.toml
@@ -0,0 +1,83 @@
+[rule]
+description = """
+Identifies when a Windows script interpreter executes a file downloaded via commonly abused legit Windows binaries such
+as Certutil or BitsAdmin.
+"""
+id = "f60d4c82-2de5-4c70-95f5-cde9f3ad41a7"
+license = "Elastic License v2"
+name = "Execution of a Windows Script Downloaded via a LOLBIN"
+os_list = ["windows"]
+version = "1.0.4"
+
+query = '''
+sequence by process.parent.entity_id with maxspan=1m
+ [process where event.type == "start" and
+  process.pe.original_file_name : ("certutil.exe", "bitsadmin.exe", "CertReq.exe") and
+  process.command_line : ("*download*", "*transfer*", "*-decode*", "*http*")]
+ [process where event.type == "start" and process.pe.original_file_name : ("wscript.exe", "cscript.exe", "mshta.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1197"
+name = "BITS Jobs"
+reference = "https://attack.mitre.org/techniques/T1197/"
+
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.005"
+name = "Mshta"
+reference = "https://attack.mitre.org/techniques/T1218/005/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1105"
+name = "Ingress Tool Transfer"
+reference = "https://attack.mitre.org/techniques/T1105/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_execution_of_a_windows_script_with_unusual_file_extension.toml b/behavior/rules/execution_execution_of_a_windows_script_with_unusual_file_extension.toml
new file mode 100644
index 00000000..e205b77b
--- /dev/null
+++ b/behavior/rules/execution_execution_of_a_windows_script_with_unusual_file_extension.toml
@@ -0,0 +1,51 @@
+[rule]
+description = """
+Identifies the execution of a script with an unusual file extension by Windows Script Host processes (cscript or
+wscript).
+"""
+id = "b76c0a04-b504-4a2f-a0cf-b4175a2f3eea"
+license = "Elastic License v2"
+name = "Execution of a Windows Script with Unusual File Extension"
+os_list = ["windows"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and
+ process.pe.original_file_name : ("cscript.exe", "wscript.exe") and
+ process.args : ("-e:*", "/e:*", "//e:*") and
+ not process.command_line : ("*.js*", "*.vb*", "*.wsf*", "*.wsh*", "*.wsc*", "*.tmp*") and
+ /* Issue #286 */
+ not process.parent.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and 
+ not process.command_line : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*", "*\\Windows\\system32\\spool\\DRIVERS\\*")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_execution_via_electron_child_process_node.js_module.toml b/behavior/rules/execution_execution_via_electron_child_process_node.js_module.toml
new file mode 100644
index 00000000..2a42495a
--- /dev/null
+++ b/behavior/rules/execution_execution_via_electron_child_process_node.js_module.toml
@@ -0,0 +1,58 @@
+[rule]
+description = """
+Identifies attempts to execute a child process from within the context of an Electron application using the
+child_process Node.js module. Adversaries may abuse this technique to inherit permissions from parent processes.
+"""
+id = "1d43f87d-2466-4714-8fef-d52816cc25fb"
+license = "Elastic License v2"
+name = "Execution via Electron Child Process Node.js Module"
+os_list = ["macos"]
+reference = [
+    "https://www.matthewslipper.com/2019/09/22/everything-you-wanted-electron-child-process.html",
+    "https://www.trustedsec.com/blog/macos-injection-via-third-party-frameworks/",
+    "https://nodejs.org/api/child_process.html",
+]
+version = "1.0.7"
+
+query = '''
+process where event.action == "exec" and
+ process.args : "-e" and process.command_line : "*require*child_process*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_execution_via_outlook_application_com_object.toml b/behavior/rules/execution_execution_via_outlook_application_com_object.toml
new file mode 100644
index 00000000..549dc637
--- /dev/null
+++ b/behavior/rules/execution_execution_via_outlook_application_com_object.toml
@@ -0,0 +1,112 @@
+[rule]
+description = """
+Identifies the execution of commonly abused utilities to run DLLs or scripts via the Outlook.Application COM Object.
+This behavior may indicate adversarial activity to evade defenses on the system.
+"""
+id = "17030515-5ed0-43c8-9602-f97cbebd43c0"
+license = "Elastic License v2"
+name = "Execution via Outlook Application COM Object"
+os_list = ["windows"]
+reference = ["https://www.darkoperator.com/blog/2017/11/11/windows-defender-exploit-guard-asr-rules-for-office"]
+version = "1.0.8"
+
+query = '''
+sequence with maxspan=1m
+   /* Outlook started via DCOM */
+ [process where event.action == "start" and
+  process.name : "outlook.exe" and process. command_line : "*-Embedding*" and
+  process.parent.name : "svchost.exe"] by process.entity_id
+   /* Suspicious Outlook child processes */
+ [process where event.action == "start" and
+   process.pe.original_file_name :
+               ("cscript.exe",
+                "wscript.exe",
+                "powershell.exe",
+                "rundll32.exe",
+                "cmd.exe",
+                "mshta.exe",
+                "msbuild.exe",
+                "InstallUtil.exe",
+                "Microsoft.Workflow.Compiler.exe",
+                "wmic.exe",
+                "regsvr32.exe",
+                "pwsh.exe",
+                "ScriptRunner.exe") and not
+   /* Issue #330 */
+   (process.name:"rundll32.exe" and process.args : ("--eoim", "--enable-speech-input"))] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.005"
+name = "Mshta"
+reference = "https://attack.mitre.org/techniques/T1218/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.010"
+name = "Regsvr32"
+reference = "https://attack.mitre.org/techniques/T1218/010/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_potential_execution_via_zipexec.toml b/behavior/rules/execution_potential_execution_via_zipexec.toml
new file mode 100644
index 00000000..372474ab
--- /dev/null
+++ b/behavior/rules/execution_potential_execution_via_zipexec.toml
@@ -0,0 +1,62 @@
+[rule]
+description = """
+Identifies the execution of file dropped via a compressed file (potentially password protected). This may indicate an
+attempt to bypass disk-based or anti-malware scanning mechanisms.
+"""
+id = "8eb74917-9363-4073-a09b-c47101f52c40"
+license = "Elastic License v2"
+name = "Potential Execution via ZIPExec"
+os_list = ["windows"]
+reference = ["https://github.com/Tylous/ZipExec"]
+version = "1.0.4"
+
+query = '''
+sequence with maxspan=5m
+
+  /* cmdkey invoking Windows Shell to open a compressed file */
+ [process where event.action == "start" and
+   process.pe.original_file_name : "cmdkey.exe" and
+   process.command_line : "*Microsoft_Windows_Shell*Folder*filename*"] by process.parent.entity_id
+
+ /* executable file creation by parent of cmdkey*/
+ [file where event.action == "creation" and file.Ext.header_bytes : "4d5a*"] by process.entity_id
+
+ /* execution from Explorer temp decompression directory by parent of cmdkey */
+ [process where event.action == "start" and process.command_line : "*\\Temp\\Temp?_*"] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 2
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 2
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_potential_reverse_shell_activity_via_terminal.toml b/behavior/rules/execution_potential_reverse_shell_activity_via_terminal.toml
new file mode 100644
index 00000000..6de36253
--- /dev/null
+++ b/behavior/rules/execution_potential_reverse_shell_activity_via_terminal.toml
@@ -0,0 +1,56 @@
+[rule]
+description = "Identifies the execution of a shell process with suspicious arguments which may be indicative of reverse shell activity."
+id = "d0e45f6c-1f83-4d97-a8d9-c8f9eb61c15c"
+license = "Elastic License v2"
+name = "Potential Reverse Shell Activity via Terminal"
+os_list = ["linux", "macos"]
+reference = [
+    "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md",
+    "https://github.com/WangYihang/Reverse-Shell-Manager",
+    "https://www.netsparker.com/blog/web-security/understanding-reverse-shells/",
+]
+version = "1.0.8"
+
+query = '''
+process where event.action == "exec" and
+  process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
+  process.args : ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*", "*zsh/net/udp*") and
+
+  /* noisy FPs */
+  not (process.parent.name : "timeout" and process.executable : "/var/lib/docker/overlay*") and
+  not process.command_line : ("*/dev/tcp/sirh_db/*", "*/dev/tcp/remoteiot.com/*", "*dev/tcp/elk.stag.one/*", "*dev/tcp/kafka/*", "*/dev/tcp/$0/$1*") and
+  not process.parent.command_line : "runc init"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1071"
+name = "Application Layer Protocol"
+reference = "https://attack.mitre.org/techniques/T1071/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_privilege_escalation_enumeration_via_linpeas.toml b/behavior/rules/execution_privilege_escalation_enumeration_via_linpeas.toml
new file mode 100644
index 00000000..94be5c54
--- /dev/null
+++ b/behavior/rules/execution_privilege_escalation_enumeration_via_linpeas.toml
@@ -0,0 +1,47 @@
+[rule]
+description = """
+Identifies suspicious command line patterns that indicate LinPEAS execution. LinPEAS is a script that search for
+possible paths to escalate privileges on Linux/Unix/MacOS hosts.
+"""
+id = "92bb2a27-745b-4291-90a1-b7b654df1379"
+license = "Elastic License v2"
+name = "Privilege Escalation Enumeration via LinPEAS"
+os_list = ["linux", "macos"]
+reference = ["https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS"]
+version = "1.0.6"
+
+query = '''
+process where event.action == "exec" and
+  process.name == "sed" and process.command_line like "*ImPoSSssSiBlEee*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.14.0"
diff --git a/behavior/rules/execution_shell_execution_via_windows_shortcut_file.toml b/behavior/rules/execution_shell_execution_via_windows_shortcut_file.toml
new file mode 100644
index 00000000..908b8884
--- /dev/null
+++ b/behavior/rules/execution_shell_execution_via_windows_shortcut_file.toml
@@ -0,0 +1,100 @@
+[rule]
+description = """
+Identifies the execution of a script or program extracted from within a Windows shortcut (lnk) file. Adversaries may
+embed malicious scripts or files in a shortcut file before delivering it to their target in order to trick them into
+executing the payload.
+"""
+id = "1a88b997-bcae-430a-8a24-7378e8bf5cc4"
+license = "Elastic License v2"
+name = "Shell Execution via Windows Shortcut File"
+os_list = ["windows"]
+reference = ["https://docs.google.com/presentation/d/13SsBd0wI0PpyH5C8WlnE_DsJjy1KxAjZ5Dmke9FHfRE/"]
+version = "1.0.11"
+
+query = '''
+sequence with maxspan=1m
+  [file where event.action == "creation" and file.extension : ("lnk", "url") and
+   (
+    (process.name : ("winrar.exe", "7zFM.exe", "Bandizip.exe") and
+     file.path : ("?:\\*\\Temp\\7z*\\*", "?:\\*\\Temp\\Rar$*\\*", "?:\\*\\Temp\\BNZ.*")) or
+     /* Issue #374 */
+    (process.name : "explorer.exe" and
+     /* lowered file.size condition as it creates evasion opportunities */
+     file.path : "?:\\*\\AppData\\Local\\Temp\\Temp?_*.lnk")
+   )
+  ] by process.entity_id
+  [process where event.action == "start" and
+   process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wmic.exe") and
+   (process.parent.name : ("winrar.exe", "7zFM.exe") or
+    /* Issue #374 */
+    (process.parent.name : "explorer.exe" and process.args_count >= 5))
+   ] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1566.002"
+name = "Spearphishing Link"
+reference = "https://attack.mitre.org/techniques/T1566/002/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.003"
+name = "Windows Command Shell"
+reference = "https://attack.mitre.org/techniques/T1059/003/"
+
+
+[[threat.technique]]
+id = "T1204"
+name = "User Execution"
+reference = "https://attack.mitre.org/techniques/T1204/"
+[[threat.technique.subtechnique]]
+id = "T1204.001"
+name = "Malicious Link"
+reference = "https://attack.mitre.org/techniques/T1204/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1204.002"
+name = "Malicious File"
+reference = "https://attack.mitre.org/techniques/T1204/002/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_suspicious_apple_script_execution.toml b/behavior/rules/execution_suspicious_apple_script_execution.toml
new file mode 100644
index 00000000..2e0cd328
--- /dev/null
+++ b/behavior/rules/execution_suspicious_apple_script_execution.toml
@@ -0,0 +1,52 @@
+[rule]
+description = """
+Identifies the execution of the Apple script interpreter (osascript) process with suspicious command line arguments.
+This behavior is consistent with an attacker executing malicious scripts for execution or command and control.
+"""
+id = "7b9d544a-5b2a-4f0d-984a-cdc89a7fad25"
+license = "Elastic License v2"
+name = "Suspicious Apple Script Execution"
+os_list = ["macos"]
+reference = ["https://github.com/its-a-feature/Mythic"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "exec" and
+ process.name : "osascript" and
+ process.args : "JavaScript" and
+ process.command_line : "*eval(*" and
+ process.command_line : ("*initWithDataEncoding*", "*dataWithContentsOfURL*", "*URLWithString*", "*http*")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1105"
+name = "Ingress Tool Transfer"
+reference = "https://attack.mitre.org/techniques/T1105/"
+
+
+[threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_suspicious_automator_workflows_execution.toml b/behavior/rules/execution_suspicious_automator_workflows_execution.toml
new file mode 100644
index 00000000..7a5f874f
--- /dev/null
+++ b/behavior/rules/execution_suspicious_automator_workflows_execution.toml
@@ -0,0 +1,44 @@
+[rule]
+description = """
+Identifies the execution of the Automator Workflows process followed by a network connection from the XPC service.
+Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an
+alternative to using osascript.
+"""
+id = "e390d36d-c739-43ee-9e3d-5a76fa853bd5"
+license = "Elastic License v2"
+name = "Suspicious Automator Workflows Execution"
+os_list = ["macos"]
+reference = ["https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5"]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=30s
+ [process where event.action == "exec" and process.name == "automator"]
+ [network where process.name == "com.apple.automator.runner"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_suspicious_cmd_execution_via_wmi.toml b/behavior/rules/execution_suspicious_cmd_execution_via_wmi.toml
new file mode 100644
index 00000000..c4d4e80b
--- /dev/null
+++ b/behavior/rules/execution_suspicious_cmd_execution_via_wmi.toml
@@ -0,0 +1,50 @@
+[rule]
+description = """
+Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could
+be indicative of adversary lateral movement.
+"""
+id = "242ccb88-5e28-4a74-ac6a-ff0e4c814ad8"
+license = "Elastic License v2"
+name = "Suspicious Cmd Execution via WMI"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+process where event.action == "start" and
+ descendant of [process where event.action == "start" and process.name : "cmd.exe" and
+                process.parent.name : "WmiPrvSE.exe" and
+                process.command_line : "*\\\\127.0.0.1\\*" and process.args : ("2>&1", "1>") and
+                not process.command_line : ("*servicenow\\psscript_output*", "*Impact360\\Software*")] and
+ not process.executable : "?:\\Windows\\system32\\conhost.exe"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1047"
+name = "Windows Management Instrumentation"
+reference = "https://attack.mitre.org/techniques/T1047/"
+
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.003"
+name = "Windows Command Shell"
+reference = "https://attack.mitre.org/techniques/T1059/003/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_suspicious_execution_via_windows_management_instrumentation.toml b/behavior/rules/execution_suspicious_execution_via_windows_management_instrumentation.toml
new file mode 100644
index 00000000..b3d2ecc6
--- /dev/null
+++ b/behavior/rules/execution_suspicious_execution_via_windows_management_instrumentation.toml
@@ -0,0 +1,102 @@
+[rule]
+description = "Identifies suspicious processes executing via the Windows Management Instrumentation (WMI) protocol."
+id = "7e554c18-6435-41ce-b57b-d0ac3b73817f"
+license = "Elastic License v2"
+name = "Suspicious Execution via Windows Management Instrumentation"
+os_list = ["windows"]
+version = "1.0.6"
+
+query = '''
+process where event.action == "start" and
+ process.parent.name : "WmiPrvSe.exe" and not user.id : "S-1-5-18" and
+ (
+  (process.name : ("rundll32.exe", "regsvr32.exe", "mshta.exe", "wmic.exe", "wscript.exe", "cscript.exe", "bitsadmin.exe", "certutil.exe", "vssadmin.exe", "curl.exe", "explorer.exe")) or
+  (process.name : "schtasks.exe" and process.args : "/create") or
+  (process.name : "cmd.exe" and process.command_line : ("*powershell*", "*mshta*", "*wmic*", "*msiexec*", "*\\AppData\\Local\\Temp\\*.bat")) or
+  process.executable : ("?:\\Users\\*\\AppData\\*.exe", "?:\\Users\\Public\\*", "?:\\ProgramData\\*.exe", "?:\\Windows\\Tasks\\*.exe") or
+  (process.name : ("powershell.exe", "cmd.exe") and
+      process.command_line :
+        (
+          "*^*^*^*^*^*^*^*^*^*",
+          "*set *set *set *",
+          "*set *for *call *",
+          "*set *for *cmd *",
+          "*$*$*$*$*$*$*$*$*$*$*$*",
+          "*comspec*",
+          "*%%*%%*%%*",
+          "*''*''*''*",
+          "*`*`*`*`*",
+          "*+*+*+*+*+*",
+          "*[char[]](*)*-join",
+          "*Base64String*",
+          "*[*Convert]*",
+          "*.Text.Encoding*",
+          "*.Compression.*",
+          "*.replace*",
+          "*MemoryStream*",
+          "*WriteAllBytes*",
+          "* -en* *",
+          "* -ec *",
+          "* -e *",
+          "* /e *",
+          "* /en* *",
+          "* /ec *",
+          "*WebClient*",
+          "*DownloadFile*",
+          "*DownloadString*",
+          "*Invoke-Exp*",
+          "*invoke-web*",
+          "*iex*",
+          "*iwr*",
+          "*Reflection.Assembly*",
+          "*Assembly.GetType*"
+        )) or
+	(process.name : "powershell.exe" and length(process.command_line) > 200 )
+) and
+
+/* Noisy FPs */
+
+not (process.name : ("powershell.exe", "cmd.exe") and
+     process.command_line : ("*Windows\\CCM\\*", "*WINDOWS\\TEMP\\nessus_*", "*%SystemRoot%\\TEMP\\nessus_*",
+     "*Get-NetFirewallProfile*", "*windows\\temp\\netstatcache_*", "*$ErrorActionPreference*", "*D:\\SMS_DP$\\Ms.Dsp.Do.Inc.Setup\\Install.ps1*",
+     "*app360edatabase\\Install-360DB.ps1*", "*CgAgACAAIAAgAHQAcgBhAHAAIA*")) and
+
+not (process.name : "cmd.exe" and process.command_line : ("*echo*Spiceworks\\spiceworks_upload.vbs*", "*\\psscript_output_*", "*SNC_isWmi*")) and
+
+not (process.pe.original_file_name in ("ATMGR.EXE", "git.exe") and process.code_signature.trusted == true) and
+
+not (process.name : ("cscript.exe", "wscript.exe") and
+     process.args : ("?:\\windows\\CCM\\*", "?:\\windows\\ccmcache\\*") and process.args_count <= 3) and
+
+not (process.pe.original_file_name in ("PinVantageToolbarToast.exe", "Update.exe", "git-credential-manager-core.exe", "DismHost.exe") and
+     process.code_signature.trusted == true) and
+
+not (process.name : "cmd.exe" and process.working_directory : "?:\\tmp\\smartcheck\\sitetool\\proc\\*" and
+     process.command_line : "*Citrix.SmartChecks.BlueprintBootstrap*-xdSiteId*") and
+
+not (process.pe.original_file_name == "360se.exe" and process.code_signature.trusted == true and
+     process.code_signature.subject_name == "Beijing Qihu Technology Co., Ltd.") and
+
+not (process.name : "regsvr32.exe" and process.args : "D:\\SMS_DP$\\sms\\bin\\smsdp.dll" and process.args : "/s")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1047"
+name = "Windows Management Instrumentation"
+reference = "https://attack.mitre.org/techniques/T1047/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_suspicious_java_execution_via_a_windows_script.toml b/behavior/rules/execution_suspicious_java_execution_via_a_windows_script.toml
new file mode 100644
index 00000000..3c6c15ee
--- /dev/null
+++ b/behavior/rules/execution_suspicious_java_execution_via_a_windows_script.toml
@@ -0,0 +1,51 @@
+[rule]
+description = """
+Identifies when a Java archive is executed via a Windows Script and followed by an immediate DNS query. This may
+indicate an attempt to bypass application whitelisting by delivering malicious JAR file via a malicious Windows Jscript
+or Vbscript.
+"""
+id = "15b1d979-5be0-4e7f-9202-0c4cfd76b146"
+license = "Elastic License v2"
+name = "Suspicious Java Execution via a Windows Script"
+os_list = ["windows"]
+version = "1.0.4"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [process where event.action == "start" and
+  process.name : "Java*.exe" and process.executable : "?:\\Program Files*\\Java\\jre*\\bin\\java*.exe" and
+  process.args : "-jar" and process.parent.name : ("wscript.exe", "cscript.exe") and
+  process.command_line : ("*\\AppData\\*", "*\\Public\\*", "*\\ProgramData\\*")]
+ [dns where process.name : "java*.exe" and not dns.question.name : "repo?.maven.org"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_suspicious_powershell_downloads.toml b/behavior/rules/execution_suspicious_powershell_downloads.toml
new file mode 100644
index 00000000..d317ceb9
--- /dev/null
+++ b/behavior/rules/execution_suspicious_powershell_downloads.toml
@@ -0,0 +1,124 @@
+[rule]
+description = """
+Identifies PowerShell processes that attempted to download files and were descendants of Microsoft Office, document
+viewers, web browsers, or other business application software.
+"""
+id = "7200673e-588c-45d5-be48-bc5c7a908d6b"
+license = "Elastic License v2"
+name = "Suspicious PowerShell Downloads"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+process where event.action == "start" and
+  (process.name : ("powershell.exe", "pwsh.exe") or process.pe.original_file_name : ("powershell.exe", "pwsh.exe")) and
+   process.command_line : ("*.downloadstring*", "*.downloadfile*", "*.downloaddata*", "*BitsTransfer*") and
+   not process.Ext.token.integrity_level_name : "system" and
+  (process.parent.name : (
+      "winword.exe",
+      "excel.exe",
+      "outlook.exe",
+      "powerpnt.exe",
+      "eqnedt32.exe",
+      "fltldr.exe",
+      "mspub.exe",
+      "msaccess.exe",
+      "acrord32.exe",
+      "rdrcef.exe",
+      "foxitphantomPDF.exe",
+      "foxitreader.exe",
+      "firefox.exe",
+      "chrome.exe",
+      "iexplore.exe",
+      "opera.exe",
+      "plugin-container.exe",
+      "safari.exe",
+      "microsoftedge.exe",
+      "w3wp.exe",
+      "httpd.exe",
+      "nginx.exe",
+      "php.exe",
+      "php-cgi.exe",
+      "tomcat.exe",
+      "msbuild.exe",
+      "mshta.exe"
+      ) or
+  descendant of [process where event.action == "start" and
+    process.parent.name : (
+      "winword.exe",
+      "excel.exe",
+      "outlook.exe",
+      "powerpnt.exe",
+      "eqnedt32.exe",
+      "fltldr.exe",
+      "mspub.exe",
+      "msaccess.exe",
+      "acrord32.exe",
+      "rdrcef.exe",
+      "foxitphantomPDF.exe",
+      "foxitreader.exe",
+      "firefox.exe",
+      "chrome.exe",
+      "iexplore.exe",
+      "opera.exe",
+      "plugin-container.exe",
+      "safari.exe",
+      "microsoftedge.exe",
+      "w3wp.exe",
+      "httpd.exe",
+      "nginx.exe",
+      "php.exe",
+      "php-cgi.exe",
+      "tomcat.exe"
+    )]) and
+  not process.parent.executable : "?:\\Program Files\\JumpCloud\\jumpcloud-agent.exe" and
+  not (process.command_line : "*https://us.ri.logicnow.com*" and process.parent.name : "cscript.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1566.002"
+name = "Spearphishing Link"
+reference = "https://attack.mitre.org/techniques/T1566/002/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_suspicious_powershell_execution_via_windows_scripts.toml b/behavior/rules/execution_suspicious_powershell_execution_via_windows_scripts.toml
new file mode 100644
index 00000000..4a5e807e
--- /dev/null
+++ b/behavior/rules/execution_suspicious_powershell_execution_via_windows_scripts.toml
@@ -0,0 +1,112 @@
+[rule]
+description = "Identifies suspicious PowerShell execution spawning from Windows Script Host processes (cscript or wscript.exe)."
+id = "3899dd3b-f31a-4634-8467-55326cd87597"
+license = "Elastic License v2"
+name = "Suspicious PowerShell Execution via Windows Scripts"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+process where event.action == "start" and
+  (process.name : ("powershell.exe", "pwsh.exe") or process.pe.original_file_name : ("powershell.exe", "pwsh.exe")) and
+  (
+   process.parent.name : ("wscript.exe", "cscript.exe") or
+   (descendant of [process where event.action == "start" and process.parent.name : ("wscript.exe", "cscript.exe")] and
+    not process.parent.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe"))
+   ) and
+   process.command_line :
+             ("*^*^*^*^*^*^*^*^*^*",
+              "*''*''*''*",
+              "*`*`*`*`*",
+              "*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*",
+              "*+*+*+*+*+*",
+              "*$*$*$*$*",
+              "*[char[]](*)*-join",
+              "*Base64String*",
+              "*[*Convert]*",
+              "*.Text.Encoding*",
+              "*.Compression.*",
+              "*.replace(*",
+              "*MemoryStream*",
+              "*WriteAllBytes*",
+              "* -en* *",
+              "* -ec *",
+              "* -e *",
+              "* -ep *",
+              "* /e *",
+              "* /en* *",
+              "* /ec *",
+              "* /ep *",
+              "*WebClient*",
+              "*DownloadFile*",
+              "*DownloadString*",
+              "*BitsTransfer*",
+              "*Invoke-Exp*",
+              "*invoke-web*",
+              "*iex*",
+              "*iwr*",
+              "*Reflection.Assembly*",
+              "*Assembly.GetType*",
+              "*.Sockets.*",
+              "*Add-MpPreference*ExclusionPath*",
+              "*raw.githubusercontent*") and
+    /* false positives */
+   not process.parent.name: ("gc_worker.exe", "gc_service.exe") and
+   not process.parent.command_line : "*Windows\\TEMP\\nessus_*" and
+   /* Issue #247 */
+   not process.parent.executable :
+                 ("?:\\Windows\\System32\\svchost.exe",
+                  "?:\\Windows\\System32\\CompatTelRunner.exe",
+                  "?:\\Windows\\System32\\taskeng.exe") and
+   not process.Ext.token.integrity_level_name == "system" and
+
+   /* many legit powershell commands uses those non shortened execution flags excluding Sync-AppvPublishingServer lolbas */
+   not (process.args : ("-EncodedCommand", "Import-Module*", "-NonInteractive") and
+        process.args : "-ExecutionPolicy" and not process.args : "Sync-AppvPublishingServer") and
+
+   /* third party installation related FPs */
+   not process.parent.args : "?:\\Windows\\system32\\gatherNetworkInfo.vbs" and
+   not (process.parent.args : "Microsoft.SystemCenter.ICMPProbe.WithConsecutiveSamples.vbs" and process.args : "Get-SCOMAgent") and
+   not (process.command_line : "*WEBLOGIC_ARGS_CURRENT_1.DATA*" and process.parent.command_line : "*Impact360*")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_suspicious_windows_script_file_name.toml b/behavior/rules/execution_suspicious_windows_script_file_name.toml
new file mode 100644
index 00000000..eab2f0cb
--- /dev/null
+++ b/behavior/rules/execution_suspicious_windows_script_file_name.toml
@@ -0,0 +1,116 @@
+[rule]
+description = """
+Identifies the execution of a Windows script with a file name following commonly used phishing naming convention via
+including legit document and image extensions or keywords that may lure a victim user into opening the malicious script.
+"""
+id = "8c69476a-d8ea-46da-8052-6a4f9254125c"
+license = "Elastic License v2"
+name = "Suspicious Windows Script File Name"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+process where event.action == "start" and
+ process.pe.original_file_name : ("cscript.exe", "wscript.exe", "mshta.exe") and
+ process.args_count >= 2 and
+ process.command_line : ("*\\AppData\\*", "*\\outlook\\*", "*\\users\\public\\*", "*Menu\\Programs\\Startup\\*", "*\\Downloads\\*") and
+ /* script name commonly used in phishing */
+ process.args :
+     (
+      "*.pdf.js",
+      "*.pdf.vbs",
+      "*_pdf.vbs",
+      "*_pdf.js",
+      "*.doc.js",
+      "*.doc.vbs",
+      "*.docx.js",
+      "*.docx.vbs",
+      "*.ppt.js",
+      "*.ppt.vbs",
+      "*.xls.js",
+      "*.xlsx.js",
+      "*.xls.vbs",
+      "*.xlsx.vbs",
+      "*.jpg.js",
+      "*.png.js",
+      "*.jpg.vbs",
+      "*.png.vbs",
+      "*.pdf.hta",
+      "_pdf.hta",
+      "*.doc.hta",
+      "*.xls.hta",
+      "*.jpg.hta",
+      "*Receipt.js",
+      "*Receipt.vbs",
+      "*Delivery*.js",
+      "*Delivery*.vbs",
+      "*Invoice*.js",
+      "*Invoice*.vbs",
+      "*Fedex*.js",
+      "*Fedex*.vbs",
+      "*Supplies.js",
+      "*Supplies.vbs",
+      "*PayOff Wire*",
+      "*PURCHASE ORDER*",
+      "*payment.js",
+      "*payment.vbs",
+      "*Quotation*.js",
+      "*Quotation*.vbs",
+      "*dhl*.js",
+      "*dhl*.vbs",
+      "*Confirmation*.js",
+      "*Confirmation*.vbs",
+      "*Wire Transfer*.js",
+      "*Wire Transfer*.vbs",
+      "*Moneygram*",
+      "*agreement*.js",
+      "*agreement*.vbs")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_suspicious_windows_script_interpreter_child_process.toml b/behavior/rules/execution_suspicious_windows_script_interpreter_child_process.toml
new file mode 100644
index 00000000..5c41b073
--- /dev/null
+++ b/behavior/rules/execution_suspicious_windows_script_interpreter_child_process.toml
@@ -0,0 +1,78 @@
+[rule]
+description = """
+Identifies unusual windows script interpreter child process which could indicate code injection or other form of
+malicious code execution via Windows scripts.
+"""
+id = "83da4fac-563a-4af8-8f32-5a3797a9068e"
+license = "Elastic License v2"
+name = "Suspicious Windows Script Interpreter Child Process"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+process where event.type == "start" and
+  process.parent.name : ("wscript.exe", "cscript.exe", "mshta.exe") and
+  process.parent.args_count >= 2 and
+  not process.Ext.token.integrity_level_name == "system" and
+   (
+    process.name : ("rundll32.exe", "regsvr32.exe") or
+
+    /* suspicious or unusual paths */
+    process.executable : ("?:\\Windows\\Microsoft.NET\\*",
+                          "?:\\Users\\Public\\*",
+                          "?:\\Windows\\Tasks\\*",
+                          "?:\\Windows\\System32\\Tasks\\*") or
+
+     /* potential hollowed trusted system process with no arguments */
+    (process.args_count == 1 and
+     process.executable : ("?:\\Windows\\System32\\*.exe", "?:\\Windows\\SysWOW64\\*.exe") and
+     process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft *" and
+     not process.name : ("conhost.exe", "gpupdate.exe", "logoff.exe", "HOSTNAME.EXE"))
+     ) and
+     not (process.parent.name : "mshta.exe" and process.parent.args : "?:\\Program Files\\HP\\*\\HPSolutionsPortal.hta") and
+     not (process.name : "regsvr32.exe" and process.parent.name : "wscript.exe" and process.parent.command_line : ("*LiteTouch.wsf*", "*LTICleanup.wsf*")) and
+     not (process.pe.original_file_name == "acslaunch" and process.executable : "?:\\Users\\Public\\IBM\\*.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1055"
+name = "Process Injection"
+reference = "https://attack.mitre.org/techniques/T1055/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_suspicious_windows_script_process_execution.toml b/behavior/rules/execution_suspicious_windows_script_process_execution.toml
new file mode 100644
index 00000000..fe5bde0d
--- /dev/null
+++ b/behavior/rules/execution_suspicious_windows_script_process_execution.toml
@@ -0,0 +1,85 @@
+[rule]
+description = """
+Identifies the execution of a Windows scripting interpreter with suspicious process arguments such as unusual script
+engine or unusual process working directory.
+"""
+id = "ffbab5db-73ae-42fd-a33f-36bf649f41cc"
+license = "Elastic License v2"
+name = "Suspicious Windows Script Process Execution"
+os_list = ["windows"]
+version = "1.0.7"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+[process where event.action == "start" and
+ process.pe.original_file_name : ("cscript.exe", "wscript.exe") and
+ not process.Ext.token.integrity_level_name == "system" and
+ process.working_directory != null and
+  (
+    /* execution from a RA or ZIP file */
+    process.working_directory :
+          ("?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*",
+           "?:\\Users\\*\\AppData\\Local\\Temp\\7z*",
+           "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*",
+           "?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*") or
+    process.command_line :
+          (
+            /* JScript9 */
+           "*{16d51579-a30b-4c8b-a276-0ff4dc41e755}*",
+
+            /* JScript or VBScript Language Encoding */
+           "*{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*",
+           "*{B54F3743-5B07-11cf-A4B0-00AA004A55E8}*",
+
+           /* chakra */
+           "*{1b7cd997-e5ff-4932-a7a6-2a9e636da385}*",
+           
+           /* appdata folder */
+           "*\\AppData\\Local\\Temp\\*",
+           "*\\AppData\\Roaming\\*"
+           ) or
+    (
+     process.command_line : "*\\Users\\*\\AppData\\Local\\Temp\\Temp?_*" and
+     process.args_count == 2
+    )
+  ) and
+
+  /* most legit executions from temp come from System32 working dir */
+  not (process.command_line : ("*\\AppData\\Local\\Temp\\*", "*\\AppData\\Roaming\\*") and
+       process.working_directory : "?:\\Windows\\system32\\" and not process.parent.name : "explorer.exe") and
+  not process.parent.executable : ("?:\\Program Files\\Adobe\\Adobe After Effects *\\Support Files\\AfterFX.exe",
+                                   "?:\\Program Files (x86)\\Microsoft Dynamics NAV\\*\\Classic\\finsql.exe") and
+  not process.working_directory : ("?:\\Windows\\system32\\spool\\DRIVERS\\*", "?:\\windows\\system32\\driverstore\\filerepository\\*")]
+ [network where event.action == "connection_attempted"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_suspicious_windows_shortcut_file_creation_or_modification.toml b/behavior/rules/execution_suspicious_windows_shortcut_file_creation_or_modification.toml
new file mode 100644
index 00000000..b77f9e3a
--- /dev/null
+++ b/behavior/rules/execution_suspicious_windows_shortcut_file_creation_or_modification.toml
@@ -0,0 +1,105 @@
+[rule]
+description = """
+Identifies when an unusually large Windows Shortcut (LNK) file is created or modified with a suspicious file name.
+Adversaries may embed malicious scripts or files in a shortcut file before delivering it to their target and tricking
+them into executing the payload. Adversaries also leverage malicious shortcut files to maintain persistence on an
+endpoint and ensure that their malicious code is executed when a routine event occurs such as when a user logs in to
+Windows.
+"""
+id = "bc8949e6-98e0-4b50-96d4-88fdbb29f0d4"
+license = "Elastic License v2"
+name = "Suspicious Windows Shortcut File Creation or Modification"
+os_list = ["windows"]
+reference = ["https://docs.google.com/presentation/d/13SsBd0wI0PpyH5C8WlnE_DsJjy1KxAjZ5Dmke9FHfRE/"]
+version = "1.0.10"
+
+query = '''
+file where event.action == "creation" and
+
+   // limited to common archive file handlers
+    process.name : ("winrar.exe", "7zFM.exe") and
+
+    // Match shortcut (LNK) files by header (4C 00 00 00)
+    file.Ext.header_bytes : "4c000000*" and
+
+    // LNK files larger than 200,000 bytes
+    file.size > 200000 and
+
+    // LNK files with suspicious file extension combinations
+    file.name : (
+      "*.pdf.lnk",
+      "*.doc.lnk",
+      "*.docx.lnk",
+      "*.ppt.lnk",
+      "*.pptx.lnk",
+      "*.xls.lnk",
+      "*.xlsx.lnk",
+      "*.rtf.lnk",
+      "*.jpg.lnk",
+      "*.png.lnk",
+      "*.html.lnk",
+      "*.htm.lnk",
+      "*.txt.lnk",
+      "*.exe.lnk",
+      "*.mp4.lnk",
+      "*.avi.lnk",
+      "*.bat.lnk",
+      "*.rar.lnk",
+      "*.zip.lnk",
+      "*.img.lnk",
+      "*.iso.lnk"
+      )
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1566.002"
+name = "Spearphishing Link"
+reference = "https://attack.mitre.org/techniques/T1566/002/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1204"
+name = "User Execution"
+reference = "https://attack.mitre.org/techniques/T1204/"
+[[threat.technique.subtechnique]]
+id = "T1204.001"
+name = "Malicious Link"
+reference = "https://attack.mitre.org/techniques/T1204/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1204.002"
+name = "Malicious File"
+reference = "https://attack.mitre.org/techniques/T1204/002/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_unusual_powershell_engine_imageload.toml b/behavior/rules/execution_unusual_powershell_engine_imageload.toml
new file mode 100644
index 00000000..c709745c
--- /dev/null
+++ b/behavior/rules/execution_unusual_powershell_engine_imageload.toml
@@ -0,0 +1,122 @@
+[rule]
+description = """
+Identifies the PowerShell engine being invoked by unexpected processes. Instead of executing PowerShell functionality
+with powershell.exe, some attackers do this to operate more stealthily.
+"""
+id = "f57505bb-a1d2-4d3b-b7b5-1d81d7bdb80e"
+license = "Elastic License v2"
+name = "Unusual PowerShell Engine ImageLoad"
+os_list = ["windows"]
+version = "1.0.7"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [process where event.action == "start" and
+  not process.Ext.token.integrity_level_name : ("system", "low") and 
+  process.code_signature.subject_name : "Microsoft *" and 
+  /* Issue #288 */
+  process.executable : ("?:\\Windows\\System32\\*.exe", 
+                        "?:\\Windows\\SysWOW64\\*.exe", 
+                        "?:\\Windows\\Microsoft.NET\\*.exe") and
+  not process.executable : ("?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
+                            "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe",
+                            "?:\\Windows\\System32\\inetsrv\\*",
+                            "?:\\Windows\\System32\\WindowsPowerShell\\*",
+                            "?:\\windows\\System32\\DriverStore\\*") and
+  not (process.name : "rundll32.exe" and process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*") and 
+  not (process.name : "dllhost.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and
+       /* CrowdStrike.RemoteResponse CLSIDs */
+       process.command_line : ("*BD07DDB9-1C61-4DCE-9202-A2BA1757CDB2*", 
+                               "*BFCC80BE-AE9A-4E79-8B13-454A10C3A1B1*", 
+                               "*AB8902B4-09CA-4BB6-B78D-A8F59079A8D5*",
+                               "*338B40F9-9D68-4B53-A793-6B9AA0C5F63B*")) and 
+  not (process.name : "SearchFilterHost.exe" and process.parent.executable : "?:\\WINDOWS\\system32\\SearchIndexer.exe") and 
+  not (process.name : ("RuntimeBroker.exe", "smartscreen.exe") and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and 
+  not (process.name : "RegAsm.exe" and process.args : "?:\\Program Files\\CloudBackup\\DS-Client\\\\System.Management.Automation.dll")]
+ [library where dll.name : ("System.Management.Automation.ni.dll", "System.Management.Automation.dll") and not
+  process.name :
+   (
+    "Altaro.SubAgent.exe",
+    "AppV_Manage.exe",
+    "azureadconnect.exe",
+    "CcmExec.exe",
+    "configsyncrun.exe",
+    "choco.exe",
+    "ctxappvservice.exe",
+    "DVLS.Console.exe",
+    "edgetransport.exe",
+    "exsetup.exe",
+    "forefrontactivedirectoryconnector.exe",
+    "InstallUtil.exe",
+    "JenkinsOnDesktop.exe",
+    "Microsoft.EnterpriseManagement.ServiceManager.UI.Console.exe",
+    "mmc.exe",
+    "mscorsvw.exe",
+    "msexchangedelivery.exe",
+    "msexchangefrontendtransport.exe",
+    "msexchangehmworker.exe",
+    "msexchangesubmission.exe",
+    "msiexec.exe",
+    "MsiExec.exe",
+    "noderunner.exe",
+    "NServiceBus.Host.exe",
+    "NServiceBus.Host32.exe",
+    "NServiceBus.Hosting.Azure.HostProcess.exe",
+    "OuiGui.WPF.exe",
+    "powershell.exe",
+    "powershell_ise.exe",
+    "pwsh.exe",
+    "SCCMCliCtrWPF.exe",
+    "ScriptEditor.exe",
+    "ScriptRunner.exe",
+    "sdiagnhost.exe",
+    "servermanager.exe",
+    "setup100.exe",
+    "ServiceHub.VSDetouredHost.exe",
+    "SPCAF.Client.exe",
+    "SPCAF.SettingsEditor.exe",
+    "SQLPS.exe",
+    "telemetryservice.exe",
+    "UMWorkerProcess.exe",
+    "w3wp.exe",
+    "wsmprovhost.exe",
+    "dsac.exe",
+    "RemoteFXvGPUDisablement.exe",
+    "RAMgmtUI.exe",
+    "taskhostw.exe",
+    "ClusterUpdateUI.exe",
+    "auditpol.exe",
+    "perfmon.exe",
+    "gpupdate.exe",
+    "conhost.exe",
+    "cmd.exe",
+    "Dsamain.exe",
+    "taskhost.exe",
+    "stordiag.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/execution_windows_shortcut_file_embedded_object_execution.toml b/behavior/rules/execution_windows_shortcut_file_embedded_object_execution.toml
new file mode 100644
index 00000000..6366f71d
--- /dev/null
+++ b/behavior/rules/execution_windows_shortcut_file_embedded_object_execution.toml
@@ -0,0 +1,116 @@
+[rule]
+description = """
+Identifies the execution of a script or program extracted from within a Windows shortcut (lnk) file. Adversaries may
+embed malicious scripts or files in a shortcut file before delivering it to their target in order to trick them into
+executing the payload.
+"""
+id = "8076640d-ec66-4d24-a252-ee2f054e00a1"
+license = "Elastic License v2"
+name = "Windows Shortcut File Embedded Object Execution"
+os_list = ["windows"]
+reference = ["https://docs.google.com/presentation/d/13SsBd0wI0PpyH5C8WlnE_DsJjy1KxAjZ5Dmke9FHfRE/"]
+version = "1.0.8"
+
+query = '''
+sequence with maxspan=60s
+  [process where event.action == "start" and process.name : "cmd.exe" and
+   process.command_line :
+         ("*find*.*.lnk*>*&*",
+          "*.lnk*find*>*&*",
+          "*dir*/s*/b*.lnk*",
+          "*dir*.lnk*/s*/b*",
+          "*for*/f*in*.lnk*",
+          "*LoadFromFile*.lnk*>*&*",
+          "*.lnk*do type*",
+          "*/s*/d*type*.lnk*",
+          "*.doc.lnk*",
+          "*.pdf.lnk*")
+   ] by process.entity_id
+  [file where event.action != "deletion" and process.name : "cmd.exe"] by process.entity_id
+  [process where event.action == "start" and
+   not process.executable : 
+           ("?:\\Windows\\system32\\attrib.exe", 
+            "?:\\Windows\\SysWOW64\\attrib.exe", 
+            "?:\\Windows\\system32\\find.exe", 
+            "?:\\Windows\\SysWOW64\\find.exe",
+            "?:\\Windows\\system32\\findstr.exe",
+            "?:\\Windows\\SysWOW64\\findstr.exe",
+            "?:\\Windows\\system32\\conhost.exe", 
+            "?:\\Windows\\SysWOW64\\conhost.exe") and
+   not (process.name : "cmd.exe" and
+          process.command_line :
+                 ("*find*.*.lnk*>*",
+                  "*.lnk*find*>*",
+                  "*dir*/s*/b*.lnk*",
+                  "*dir*.lnk*/s*/b*",
+                  "*for*/f*in*.lnk*",
+                  "*LoadFromFile*.lnk*",
+                  "*.lnk*do type*",
+                  "*/s*/d*type*.lnk*",
+                  "*.doc.lnk*",
+                  "*.pdf.lnk*"))
+   ] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 2
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1566.002"
+name = "Spearphishing Link"
+reference = "https://attack.mitre.org/techniques/T1566/002/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.003"
+name = "Windows Command Shell"
+reference = "https://attack.mitre.org/techniques/T1059/003/"
+
+
+[[threat.technique]]
+id = "T1204"
+name = "User Execution"
+reference = "https://attack.mitre.org/techniques/T1204/"
+[[threat.technique.subtechnique]]
+id = "T1204.001"
+name = "Malicious Link"
+reference = "https://attack.mitre.org/techniques/T1204/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1204.002"
+name = "Malicious File"
+reference = "https://attack.mitre.org/techniques/T1204/002/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/impact_bcdedit_safe_mode_command_execution.toml b/behavior/rules/impact_bcdedit_safe_mode_command_execution.toml
new file mode 100644
index 00000000..cb1abb59
--- /dev/null
+++ b/behavior/rules/impact_bcdedit_safe_mode_command_execution.toml
@@ -0,0 +1,98 @@
+[rule]
+description = """
+Identifies when the command-line tool for managing Boot Configuration Data (BCDEdit.exe) is spawned from an untrusted
+process, office application, or script interpreter and used to specify a reboot into Safe Mode.
+"""
+id = "6d660b32-23bf-434b-a588-1cdc91224664"
+license = "Elastic License v2"
+name = "BCDEdit Safe Mode Command Execution"
+os_list = ["windows"]
+reference = [
+    "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/",
+    "https://community.spiceworks.com/how_to/94471-how-to-reboot-into-safe-mode-at-a-command-prompt",
+]
+version = "1.0.9"
+
+query = '''
+process where event.action == "start" and
+  (process.name : "bcdedit.exe" or process.pe.original_file_name : "bcdedit.exe") and
+  process.args : ("minimal", "network", "safebootalternateshell") and
+    descendant of
+      [process where event.action == "start" and
+        (process.code_signature.trusted != true or
+         process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE", "MSPUB.EXE",
+                         "OUTLOOK.EXE", "fltldr.exe", "cscript.exe", "powershell.exe", "pwsh.exe",
+                         "wscript.exe", "cmd.exe", "rundll32.exe", "regsvr32.exe", "mshta.exe",
+                         "msbuild.exe"))
+      ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.003"
+name = "Windows Command Shell"
+reference = "https://attack.mitre.org/techniques/T1059/003/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.005"
+name = "Mshta"
+reference = "https://attack.mitre.org/techniques/T1218/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.010"
+name = "Regsvr32"
+reference = "https://attack.mitre.org/techniques/T1218/010/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1490"
+name = "Inhibit System Recovery"
+reference = "https://attack.mitre.org/techniques/T1490/"
+
+
+[threat.tactic]
+id = "TA0040"
+name = "Impact"
+reference = "https://attack.mitre.org/tactics/TA0040/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/impact_darkradiation_ransomware_infection.toml b/behavior/rules/impact_darkradiation_ransomware_infection.toml
new file mode 100644
index 00000000..705f1dc7
--- /dev/null
+++ b/behavior/rules/impact_darkradiation_ransomware_infection.toml
@@ -0,0 +1,47 @@
+[rule]
+description = """
+Identifies a file extension used by DARKRADIATION bash ransomware that abuses the openssl utility to encrypt files.
+Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to
+system and network resources.
+"""
+id = "33309858-3154-47a6-b601-eda2de62557b"
+license = "Elastic License v2"
+name = "DARKRADIATION Ransomware Infection"
+os_list = ["linux", "macos"]
+reference = [
+    "https://www.trendmicro.com/en_us/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html",
+]
+version = "1.0.5"
+
+query = '''
+process where event.action == "exec" and
+ process.name : "xargs" and process.args == "openssl" and process.args == "enc" and
+ /* radiation unicode symbol used by DARKRADIATION ransomware */
+ process.args : "*.☢*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1486"
+name = "Data Encrypted for Impact"
+reference = "https://attack.mitre.org/techniques/T1486/"
+
+
+[threat.tactic]
+id = "TA0040"
+name = "Impact"
+reference = "https://attack.mitre.org/tactics/TA0040/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/impact_inhibit_system_recovery_followed_by_a_suspicious_file_rename.toml b/behavior/rules/impact_inhibit_system_recovery_followed_by_a_suspicious_file_rename.toml
new file mode 100644
index 00000000..85a64c50
--- /dev/null
+++ b/behavior/rules/impact_inhibit_system_recovery_followed_by_a_suspicious_file_rename.toml
@@ -0,0 +1,57 @@
+[rule]
+description = """
+Identifies the execution of Windows utilities to tamper with system recovery settings and subsequently followed by a
+suspicious file rename operation. This may indicate Ransomware behavior.
+"""
+id = "92f114fb-7113-4e82-b021-6c2c4ca0a507"
+license = "Elastic License v2"
+name = "Inhibit System Recovery Followed by a Suspicious File Rename"
+os_list = ["windows"]
+version = "1.0.4"
+
+query = '''
+sequence with maxspan=5s
+ [process where event.action == "start" and
+  (
+    (process.pe.original_file_name == "wmic.exe" and process.command_line : "*shadowcopy*" and process.command_line : "*delete*") or
+    (process.pe.original_file_name == "VSSADMIN.EXE" and process.command_line : "*shadows*" and process.command_line : ("*delete*", "*resize*")) or
+    (process.pe.original_file_name == "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
+    (process.pe.original_file_name == "WBADMIN.EXE" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*") or
+    (process.pe.original_file_name == "iCACLS.EXE" and process.command_line : ("*/deny*S-1-1-0*", "*?:\\*\" /grant*Everyone:F*"))
+  )]
+ [file where event.action : "rename" and process.pid != 4 and
+  file.extension != null and file.Ext.entropy >= 7 and
+  file.Ext.original.name : ("*.jpg", "*.bmp", "*.png", "*.pdf", "*.doc", "*.docx", "*.xls", "*.xlsx", "*.ppt", "*.pptx") and
+  not file.extension : ("tmp", "~tmp", "diff", "gz", "download", "bak", "bck", "lnk", "part", "save", "url")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1486"
+name = "Data Encrypted for Impact"
+reference = "https://attack.mitre.org/techniques/T1486/"
+
+[[threat.technique]]
+id = "T1490"
+name = "Inhibit System Recovery"
+reference = "https://attack.mitre.org/techniques/T1490/"
+
+
+[threat.tactic]
+id = "TA0040"
+name = "Impact"
+reference = "https://attack.mitre.org/tactics/TA0040/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/impact_inhibit_system_recovery_via_microsoft_office_process.toml b/behavior/rules/impact_inhibit_system_recovery_via_microsoft_office_process.toml
new file mode 100644
index 00000000..51f3c345
--- /dev/null
+++ b/behavior/rules/impact_inhibit_system_recovery_via_microsoft_office_process.toml
@@ -0,0 +1,89 @@
+[rule]
+description = """
+Identifies the use of Windows commands to tamper with system recovery settings via Microsoft Office processes.
+Ransomware and other malware may do this to prevent system recovery.
+"""
+id = "58a08390-e69d-4b32-9487-1d1ddb16ba09"
+license = "Elastic License v2"
+name = "Inhibit System Recovery via Microsoft Office Process"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+process where event.action == "start" and
+  descendant of [process where event.action == "start" and
+    process.name : (
+      "WINWORD.EXE",
+      "EXCEL.EXE",
+      "POWERPNT.EXE",
+      "MSACCESS.EXE",
+      "MSPUB.EXE",
+      "fltldr.exe"
+    )] and
+  not descendant of [process where event.action == "start" and
+    process.name : (
+      "iexplore.exe",
+      "msedge.exe",
+      "microsoftedge.exe",
+      "chrome.exe",
+      "firefox.exe",
+      "opera.exe",
+      "safari.exe"
+    )] and
+    (
+    (process.pe.original_file_name : "wmic.exe" and process.command_line : "*shadowcopy*" and process.command_line : "*delete*") or
+    (process.pe.original_file_name : "vssadmin.exe" and process.command_line : "*shadows*" and process.command_line : ("*delete*", "*resize*")) or
+    (process.pe.original_file_name : "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
+    (process.pe.original_file_name : "wbadmin.exe" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*")
+    )
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1047"
+name = "Windows Management Instrumentation"
+reference = "https://attack.mitre.org/techniques/T1047/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1490"
+name = "Inhibit System Recovery"
+reference = "https://attack.mitre.org/techniques/T1490/"
+
+
+[threat.tactic]
+id = "TA0040"
+name = "Impact"
+reference = "https://attack.mitre.org/tactics/TA0040/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/impact_inhibit_system_recovery_via_obfuscated_commands.toml b/behavior/rules/impact_inhibit_system_recovery_via_obfuscated_commands.toml
new file mode 100644
index 00000000..0e5db4a1
--- /dev/null
+++ b/behavior/rules/impact_inhibit_system_recovery_via_obfuscated_commands.toml
@@ -0,0 +1,110 @@
+[rule]
+description = """
+Identifies the execution of Windows utilities to tamper with system recovery settings. Adversaries may delete or remove
+built-in operating system data and turn off services designed to aid in the recovery of a corrupted system and prevent
+recovery.
+"""
+id = "99358f31-a84a-4f92-bb91-4370083acda0"
+license = "Elastic License v2"
+name = "Inhibit System Recovery via Obfuscated Commands"
+os_list = ["windows"]
+version = "1.0.9"
+
+query = '''
+process where event.action == "start" and
+  descendant of
+    [process where process.name : ("powershell.exe", "pwsht.exe", "cmd.exe") and
+      process.command_line :
+        (
+          "*^*^*^*^*^*^*^*^*^*",
+          "*set *set *set *",
+          "*set *for *call *",
+          "*set *for *cmd *",
+          "*$*$*$*$*$*$*$*$*$*$*$*",
+          "*comspec*",
+          "*%%*%%*%%*",
+          "*''*''*''*",
+          "*`*`*`*`*",
+          "*+*+*+*+*+*",
+          "*[char[]](*)*-join",
+          "*Base64String*",
+          "*[*Convert]*",
+          "*.Text.Encoding*",
+          "*.Compression.*",
+          "*.replace(*",
+          "*MemoryStream*",
+          "*WriteAllBytes*",
+          "* -en* *",
+          "* -ec *",
+          "* -e *",
+          "* /e *",
+          "* /en* *",
+          "* /ec *",
+          "*WebClient*",
+          "*DownloadFile*",
+          "*DownloadString*",
+          "*Invoke-Exp*",
+          "*invoke-web*",
+          "*iex*",
+          "*iwr*",
+          "*Reflection.Assembly*",
+          "*Assembly.GetType*"
+        )
+  ] and
+  (
+    (process.pe.original_file_name : "wmic.exe" and process.command_line : "*shadowcopy*" and 
+	 process.command_line : "*delete*") or
+    (process.pe.original_file_name : "vssadmin.exe" and process.command_line : "*shadows*" and 
+	 process.command_line : ("*delete*", "*resize*")) or
+    (process.pe.original_file_name : "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
+    (process.pe.original_file_name : "wbadmin.exe" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*")
+  )
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1047"
+name = "Windows Management Instrumentation"
+reference = "https://attack.mitre.org/techniques/T1047/"
+
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.003"
+name = "Windows Command Shell"
+reference = "https://attack.mitre.org/techniques/T1059/003/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1490"
+name = "Inhibit System Recovery"
+reference = "https://attack.mitre.org/techniques/T1490/"
+
+
+[threat.tactic]
+id = "TA0040"
+name = "Impact"
+reference = "https://attack.mitre.org/tactics/TA0040/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/impact_inhibit_system_recovery_via_renamed_utilities.toml b/behavior/rules/impact_inhibit_system_recovery_via_renamed_utilities.toml
new file mode 100644
index 00000000..107f0ba9
--- /dev/null
+++ b/behavior/rules/impact_inhibit_system_recovery_via_renamed_utilities.toml
@@ -0,0 +1,60 @@
+[rule]
+description = """
+Identifies the execution of renamed Windows utilities to tamper with system recovery settings. Adversaries may delete or
+remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to
+prevent recovery.
+"""
+id = "153f52e2-2fe5-420b-8691-ddb8562b99d7"
+license = "Elastic License v2"
+name = "Inhibit System Recovery via Renamed Utilities"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+process where event.action == "start" and
+  (
+    process.pe.original_file_name : "vssadmin.exe" and process.command_line : "*shadows*" and
+    process.command_line : ("*delete*", "*resize*shadowstorage*") and not process.name : "vssadmin.exe"
+  ) or
+  (
+    process.pe.original_file_name : "bcdedit.exe" and
+    process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*") and not process.name : "bcdedit.exe"
+  ) or
+  (
+    process.pe.original_file_name : "wbadmin.exe" and process.command_line : ("*catalog*", "*systemstatebackup*") and
+    process.command_line : "*delete*" and not process.name : "wbadmin.exe"
+  )
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1490"
+name = "Inhibit System Recovery"
+reference = "https://attack.mitre.org/techniques/T1490/"
+
+
+[threat.tactic]
+id = "TA0040"
+name = "Impact"
+reference = "https://attack.mitre.org/tactics/TA0040/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/impact_inhibit_system_recovery_via_signed_binary_proxy.toml b/behavior/rules/impact_inhibit_system_recovery_via_signed_binary_proxy.toml
new file mode 100644
index 00000000..efe430b0
--- /dev/null
+++ b/behavior/rules/impact_inhibit_system_recovery_via_signed_binary_proxy.toml
@@ -0,0 +1,132 @@
+[rule]
+description = """
+Identifies the execution of Windows utilities to tamper with system recovery settings. Adversaries may delete or remove
+built-in operating system data and turn off services designed to aid in the recovery of a corrupted system and prevent
+recovery.
+"""
+id = "740ad26d-3e67-47e1-aff1-adb47a697375"
+license = "Elastic License v2"
+name = "Inhibit System Recovery via Signed Binary Proxy"
+os_list = ["windows"]
+version = "1.0.9"
+
+query = '''
+process where event.action == "start" and
+  descendant of [process where event.action == "start" and
+                 process.name:
+                    ( 
+					 "rundll32.exe", 
+					 "cscript.exe", 
+					 "wscript.exe", 
+					 "regsvr32.exe", 
+					 "regasm.exe", 
+					 "regsvcs.exe", 
+					 "installutil.exe", 
+					 "mshta.exe", 
+					 "cmstp.exe", 
+					 "msxsl.exe", 
+					 "Microsoft.Workflow.Compiler.exe", 
+					 "ieexec.exe", 
+					 "iexpress.exe"
+					 )]
+  and
+  (
+    (process.pe.original_file_name : "wmic.exe" and process.command_line : "*shadowcopy*" and 
+	 process.command_line : "*delete*") or
+    (process.pe.original_file_name : "vssadmin.exe" and process.command_line : "*shadows*" and 
+	 process.command_line : ("*delete*", "*resize*401*")) or
+    (process.pe.original_file_name : "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
+    (process.pe.original_file_name : "wbadmin.exe" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*")
+  ) and
+  not (process.name : "vssadmin.exe" and process.args : "Resize" and process.parent.executable : "?:\\Program Files\\Geni\\Insights\\GsAgent.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1216"
+name = "Signed Script Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1216/"
+
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.003"
+name = "CMSTP"
+reference = "https://attack.mitre.org/techniques/T1218/003/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.004"
+name = "InstallUtil"
+reference = "https://attack.mitre.org/techniques/T1218/004/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.005"
+name = "Mshta"
+reference = "https://attack.mitre.org/techniques/T1218/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.009"
+name = "Regsvcs/Regasm"
+reference = "https://attack.mitre.org/techniques/T1218/009/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.010"
+name = "Regsvr32"
+reference = "https://attack.mitre.org/techniques/T1218/010/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+[[threat.technique]]
+id = "T1220"
+name = "XSL Script Processing"
+reference = "https://attack.mitre.org/techniques/T1220/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1490"
+name = "Inhibit System Recovery"
+reference = "https://attack.mitre.org/techniques/T1490/"
+
+
+[threat.tactic]
+id = "TA0040"
+name = "Impact"
+reference = "https://attack.mitre.org/tactics/TA0040/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/impact_inhibit_system_recovery_via_untrusted_parent_process.toml b/behavior/rules/impact_inhibit_system_recovery_via_untrusted_parent_process.toml
new file mode 100644
index 00000000..a3065aa5
--- /dev/null
+++ b/behavior/rules/impact_inhibit_system_recovery_via_untrusted_parent_process.toml
@@ -0,0 +1,48 @@
+[rule]
+description = """
+Identifies the execution of Windows utilities to tamper with system recovery settings. Adversaries may delete or remove
+built-in operating system data and turn off services designed to aid in the recovery of a corrupted system and prevent
+recovery.
+"""
+id = "d3588fad-43ae-4f2d-badd-15a27df72132"
+license = "Elastic License v2"
+name = "Inhibit System Recovery via Untrusted Parent Process"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+sequence with maxspan=1m
+  [process where event.action == "start" and
+    process.Ext.token.integrity_level_name : ("high", "system") and
+    not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe", "?:\\Windows\\System32\\*.exe", "?:\\Windows\\SysWOW64\\*.exe") and
+    not process.code_signature.trusted == true] by process.entity_id
+  [process where event.action == "start" and
+    (
+      (process.pe.original_file_name : "wmic.exe" and process.command_line : "*shadowcopy*" and process.command_line : "*delete*") or
+      (process.pe.original_file_name : "vssadmin.exe" and process.command_line : "*shadows*" and process.command_line : ("*delete*", "*resize*")) or
+      (process.pe.original_file_name : "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
+      (process.pe.original_file_name : "wbadmin.exe" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*")
+    )
+  ] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1490"
+name = "Inhibit System Recovery"
+reference = "https://attack.mitre.org/techniques/T1490/"
+
+
+[threat.tactic]
+id = "TA0040"
+name = "Impact"
+reference = "https://attack.mitre.org/tactics/TA0040/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/impact_inhibit_system_recovery_via_windows_command_shell.toml b/behavior/rules/impact_inhibit_system_recovery_via_windows_command_shell.toml
new file mode 100644
index 00000000..2c66f964
--- /dev/null
+++ b/behavior/rules/impact_inhibit_system_recovery_via_windows_command_shell.toml
@@ -0,0 +1,75 @@
+[rule]
+description = """
+Identifies the execution of Windows utilities to tamper with system recovery settings. Adversaries may delete or remove
+built-in operating system data and turn off services designed to aid in the recovery of a corrupted system and prevent
+recovery.
+"""
+id = "d3588fad-43ae-4f2d-badd-15a27df72133"
+license = "Elastic License v2"
+name = "Inhibit System Recovery via Windows Command Shell"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+sequence with maxspan=1m
+  [process where event.action == "start" and process.name : "cmd.exe" and
+    not process.parent.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe")
+  ] by process.entity_id
+  [process where event.action == "start" and
+    (
+     (process.pe.original_file_name : "wmic.exe" and process.command_line : "*shadowcopy*" and process.command_line : "*delete*") or
+     (process.pe.original_file_name : "vssadmin.exe" and process.command_line : "*shadows*" and process.command_line : ("*delete*", "*resize*401*")) or
+     (process.pe.original_file_name : "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
+     (process.pe.original_file_name : "wbadmin.exe" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*")
+    ) and
+    /* noisy FP patterns */
+    not (process.name : "bcdedit.exe" and process.args : "DisplayAllFailures") and
+    not (process.name : "wbadmin.exe" and process.args : "-keepVersions*") and
+    not (process.name : "bcdedit.exe" and process.command_line: "*recoveryenabled*yes*") and
+    /* granular deletion of a shadowcopy by unique ID often seen in legit deletion */
+    not (process.name : "vssadmin.exe" and process.command_line : "*/shadow=*")
+  ] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1047"
+name = "Windows Management Instrumentation"
+reference = "https://attack.mitre.org/techniques/T1047/"
+
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.003"
+name = "Windows Command Shell"
+reference = "https://attack.mitre.org/techniques/T1059/003/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1490"
+name = "Inhibit System Recovery"
+reference = "https://attack.mitre.org/techniques/T1490/"
+
+
+[threat.tactic]
+id = "TA0040"
+name = "Impact"
+reference = "https://attack.mitre.org/tactics/TA0040/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/impact_potential_data_wiping_attack_behavior.toml b/behavior/rules/impact_potential_data_wiping_attack_behavior.toml
new file mode 100644
index 00000000..b1ffe2a5
--- /dev/null
+++ b/behavior/rules/impact_potential_data_wiping_attack_behavior.toml
@@ -0,0 +1,51 @@
+[rule]
+description = """
+Identifies a suspicious sequence of files modification where the entropy of the file is set to zero and it's original
+size is still shown as unmodified. This may indicate a data wiping attack behavior.
+"""
+id = "c8776070-eca6-4370-8438-f2b6282615ef"
+license = "Elastic License v2"
+name = "Potential Data wiping Attack Behavior"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+sequence by process.entity_id with maxspan=1s
+
+  /* a sequence of file mod by same process */
+
+ [file where event.action == "modification" and process.pid != 4 and 
+  file.Ext.entropy == 0 and file.Ext.header_bytes : "0000000*" and
+  file.extension : ("exe", "dll", "html", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "txt", "png") and file.size > 10 and
+  not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe")]
+ [file where event.action == "modification" and
+  file.Ext.entropy == 0 and file.Ext.header_bytes : "0000000*" and
+  file.extension : ("exe", "dll", "html", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "txt", "png") and file.size > 10]
+ [file where event.action == "modification" and
+  file.Ext.entropy == 0 and file.Ext.header_bytes : "0000000*" and
+  file.extension : ("exe", "dll", "html", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "txt", "png") and file.size > 10]
+ [file where event.action == "modification" and
+  file.Ext.entropy == 0 and file.Ext.header_bytes : "0000000*" and
+  file.extension : ("exe", "dll", "html", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "txt", "png") and file.size > 10]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1485"
+name = "Data Destruction"
+reference = "https://attack.mitre.org/techniques/T1485/"
+
+
+[threat.tactic]
+id = "TA0040"
+name = "Impact"
+reference = "https://attack.mitre.org/tactics/TA0040/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/impact_potential_ransomware_note_file.toml b/behavior/rules/impact_potential_ransomware_note_file.toml
new file mode 100644
index 00000000..142bbf9b
--- /dev/null
+++ b/behavior/rules/impact_potential_ransomware_note_file.toml
@@ -0,0 +1,75 @@
+[rule]
+description = """
+Identifies the execution of Windows utilities to tamper with system recovery settings and subsequently followed by the
+creation of a file with a name and file header content similar to common Ransomware notes files. This may indicate a
+Ransomware attack behavior.
+"""
+id = "5dba1130-72df-46f1-b581-18d9c866cb23"
+license = "Elastic License v2"
+name = "Potential Ransomware Note File"
+os_list = ["windows"]
+version = "1.0.4"
+
+query = '''
+sequence with maxspan=60s
+ [process where event.action == "start" and
+  (
+    (process.pe.original_file_name == "wmic.exe" and process.command_line : "*shadowcopy*" and process.command_line : "*delete*") or
+    (process.pe.original_file_name == "VSSADMIN.EXE" and process.command_line : "*shadows*" and process.command_line : ("*delete*", "*resize*")) or
+    (process.pe.original_file_name == "bcdedit.exe" and process.command_line : ("*bootstatuspolicy*", "*recoveryenabled*")) or
+    (process.pe.original_file_name == "WBADMIN.EXE" and process.command_line : ("*catalog*", "*systemstatebackup*") and process.command_line : "*delete*") or
+    (process.pe.original_file_name == "iCACLS.EXE" and process.command_line : ("*/deny*S-1-1-0*", "*?:\\*\" /grant*Everyone:F*"))
+  )]
+ [file where event.action == "creation" and file.extension : ("hta", "txt", "readme") and
+  ( 
+   /* ransom note header file content */
+    file.Ext.header_bytes :
+           ("416c6c20796f75722066696c65*",
+            "2d002d002d003d003d003d0020005700",
+            "596f7572206e6574776f726b20686173",
+            "54006f00200064006500630072007900",
+            "3a3a3a204772656574696e6773203a3a",
+            "49742773206e6f74206c61746520746f",
+            "5f5f5f5f5f202020202020205f5f205f",
+            "546865206e6574776f726b206973204c",
+            "415454454e54494f4e210d0a0d0a446f",
+            "4f6f6f70732120416c6c20796f757220",
+            "2d2d2d2d2d2d2d2d2d2d2d205b205765",
+            "2a2d2a414c4c2046494c4553204f4e20",
+            "3c68746d6c3e0d0a3c686561643e0d0a",
+            "3c21444f43545950452068746d6c3e0d",
+            "efbbbf3c21444f43545950452068746d",
+            "4c6f636b426974*",
+            "486920436f6d70616e792c0d0a0d0a45",
+            "2020202020207e2b2020202020202020",
+            "41766f734c6f636b6572*") or
+       /* ransom file name keywords */      
+    file.name : ("*read*me*", "*unlock*", "*@*", "*RECOVER*", "*decrypt*", "*restore*file*", "*FILES_BACK*")
+  )]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1485"
+name = "Data Destruction"
+reference = "https://attack.mitre.org/techniques/T1485/"
+
+
+[threat.tactic]
+id = "TA0040"
+name = "Impact"
+reference = "https://attack.mitre.org/tactics/TA0040/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_execution_from_a_downloaded_iso_file.toml b/behavior/rules/initial_access_execution_from_a_downloaded_iso_file.toml
new file mode 100644
index 00000000..4c54e002
--- /dev/null
+++ b/behavior/rules/initial_access_execution_from_a_downloaded_iso_file.toml
@@ -0,0 +1,55 @@
+[rule]
+description = """
+Identifies the execution of a process from a downloaded ISO file. Attacker may abuse ISO files to deliver malicious
+programs.
+"""
+id = "df9cc41e-4686-4aa0-8f79-60055dd01812"
+license = "Elastic License v2"
+name = "Execution from a Downloaded ISO File"
+os_list = ["windows"]
+version = "1.0.4"
+
+query = '''
+sequence with maxspan=5m
+ [file where event.action != "deletion" and file.extension : ("ISO", "IMG") and
+  (
+    file.path : ("?:\\Users\\*\\Downloads\\*",
+                 "?:\\Users\\*\\Content.Outlook\\*",
+                 "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*") or
+    file.name : "*:Zone.Identifier" or
+    file.Ext.windows.zone_identifier > 1
+   )
+  ]
+ [process where event.action == "start" and
+  process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe") and 
+  process.working_directory : "?:\\" and 
+
+  /* execution from mounted ISO file */
+  (process.executable : "\\Device\\CdRom*" or (process.executable : "?:\\*" and not process.executable : "?:\\*\\*"))]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_execution_of_file_written_or_modified_by_microsoft_equation_editor.toml b/behavior/rules/initial_access_execution_of_file_written_or_modified_by_microsoft_equation_editor.toml
new file mode 100644
index 00000000..a5567aac
--- /dev/null
+++ b/behavior/rules/initial_access_execution_of_file_written_or_modified_by_microsoft_equation_editor.toml
@@ -0,0 +1,66 @@
+[rule]
+description = """
+Identifies the execution of a file written or modified by Microsoft Equation Editor, which is frequently targeted by
+attackers using weaponized Microsoft Office documents. These files are often written or modified during the exploitation
+of Office applications via known vulnerabilities CVE-2017-1182 or CVE-2018-0798.
+"""
+id = "8bc4f22c-9bb1-4c76-a7b6-195bee3579db"
+license = "Elastic License v2"
+name = "Execution of File Written or Modified by Microsoft Equation Editor"
+os_list = ["windows"]
+reference = [
+    "https://www.anomali.com/blog/multiple-chinese-threat-groups-exploiting-cve-2018-0798-equation-editor-vulnerability-since-late-2018",
+    "https://nvd.nist.gov/vuln/detail/CVE-2017-11882",
+    "https://nvd.nist.gov/vuln/detail/CVE-2018-0798",
+]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=5m
+  [file where event.action != "deletion" and process.name : "eqnedt32.exe" and
+   (file.extension : ("exe", "com") or file.Ext.header_bytes : "4d5a*")] by file.path
+  [process where event.action == "start"] by process.executable
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1203"
+name = "Exploitation for Client Execution"
+reference = "https://attack.mitre.org/techniques/T1203/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_file_execution_via_microsoft_html_help.toml b/behavior/rules/initial_access_file_execution_via_microsoft_html_help.toml
new file mode 100644
index 00000000..4905ef89
--- /dev/null
+++ b/behavior/rules/initial_access_file_execution_via_microsoft_html_help.toml
@@ -0,0 +1,62 @@
+[rule]
+description = """
+Identifies when the Microsoft HTML Help Executable (hh.exe) creates a portable executable (PE) file and the file is
+subsequently executed. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution.
+"""
+id = "9c3b13f6-bc26-4397-9721-4ba23ddd1014"
+license = "Elastic License v2"
+name = "File Execution via Microsoft HTML Help"
+os_list = ["windows"]
+reference = [
+    "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/",
+]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=2m
+ [file where event.action != "deletion" and process.name : "hh.exe"] by file.path
+ [process where event.action == "start"] by process.executable
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.001"
+name = "Compiled HTML File"
+reference = "https://attack.mitre.org/techniques/T1218/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_microsoft_equation_editor_child_process.toml b/behavior/rules/initial_access_microsoft_equation_editor_child_process.toml
new file mode 100644
index 00000000..0ddb8398
--- /dev/null
+++ b/behavior/rules/initial_access_microsoft_equation_editor_child_process.toml
@@ -0,0 +1,59 @@
+[rule]
+description = """
+Identifies suspicious child processes of the Microsoft Equation Editor process, which is frequently targeted by
+attackers using weaponized Microsoft Office documents. These child processes are often launched during exploitation of
+Office applications via known vulnerabilities CVE-2017-1182 or CVE-2018-0798.
+"""
+id = "60eb5960-b26e-494a-8cf2-35ab5939f6c1"
+license = "Elastic License v2"
+name = "Microsoft Equation Editor Child Process"
+os_list = ["windows"]
+reference = [
+    "https://www.anomali.com/blog/multiple-chinese-threat-groups-exploiting-cve-2018-0798-equation-editor-vulnerability-since-late-2018",
+    "https://nvd.nist.gov/vuln/detail/CVE-2017-11882",
+    "https://nvd.nist.gov/vuln/detail/CVE-2018-0798",
+]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and process.parent.name : "EQNEDT32.EXE" and
+  not process.executable : ("?:\\Windows\\System32\\WerFault.exe", "?:\\Windows\\SysWOW64\\WerFault.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1203"
+name = "Exploitation for Client Execution"
+reference = "https://attack.mitre.org/techniques/T1203/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_microsoft_office_file_execution_via_script_interpreter.toml b/behavior/rules/initial_access_microsoft_office_file_execution_via_script_interpreter.toml
new file mode 100644
index 00000000..766a9a7d
--- /dev/null
+++ b/behavior/rules/initial_access_microsoft_office_file_execution_via_script_interpreter.toml
@@ -0,0 +1,47 @@
+[rule]
+description = """
+Identifies the execution of an unsigned file written or modified by Microsoft Office processes via a Windows Shell
+process.
+"""
+id = "54aabea0-3687-4ef1-b70c-015ca588e563"
+license = "Elastic License v2"
+name = "Microsoft Office File Execution via Script Interpreter"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+sequence by user.id with maxspan=1m
+  [file where event.action != "deletion" and
+    (file.extension : ("exe", "com", "pif", "scr") or
+      // Match Windows PE files by header data (MZ)
+      file.Ext.header_bytes : "4d5a*") and
+    process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE")] by file.path
+  [process where event.action == "start" and
+    process.parent.name : ("powershell.exe", "pwsh.exe", "cmd.exe", "cscript.exe", "wscript.exe")] by process.executable
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_microsoft_office_file_execution_via_wmi.toml b/behavior/rules/initial_access_microsoft_office_file_execution_via_wmi.toml
new file mode 100644
index 00000000..98546c26
--- /dev/null
+++ b/behavior/rules/initial_access_microsoft_office_file_execution_via_wmi.toml
@@ -0,0 +1,61 @@
+[rule]
+description = """
+Identifies the execution of a file written or modified by Microsoft Office processes followed by a child process spawned
+via Windows Management Instrumentation (WMI). This behavior may indicate adversarial activity to avoid spawning a
+suspicious MS Office child process.
+"""
+id = "792411bd-59ef-4ac0-89be-786d52d1a5c8"
+license = "Elastic License v2"
+name = "Microsoft Office File Execution via WMI"
+os_list = ["windows"]
+reference = [
+    "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16",
+]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=1m
+  [file where event.action != "deletion" and
+   (file.extension : ("exe", "com") or file.Ext.header_bytes : "4d5a*") and
+   process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE", "MSPUB.EXE", "fltldr.exe")] by file.path
+  [process where event.action == "start" and process.parent.name : "wmiprvse.exe" and
+   not process.Ext.token.integrity_level_name == "system"] by process.executable
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1047"
+name = "Windows Management Instrumentation"
+reference = "https://attack.mitre.org/techniques/T1047/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_microsoft_office_loaded_a_dropped_executable_file.toml b/behavior/rules/initial_access_microsoft_office_loaded_a_dropped_executable_file.toml
new file mode 100644
index 00000000..c96ef009
--- /dev/null
+++ b/behavior/rules/initial_access_microsoft_office_loaded_a_dropped_executable_file.toml
@@ -0,0 +1,55 @@
+[rule]
+description = """
+Identifies when a Microsoft Office process creates an executable file (DLL) and the file is subsequently loaded. An
+adversary may deliver a weaponized Office document to their target that writes and loads malicious modules.
+"""
+id = "a0a82ad6-98ed-4426-abd8-52e7b052e297"
+license = "Elastic License v2"
+name = "Microsoft Office Loaded a Dropped Executable File"
+os_list = ["windows"]
+version = "1.0.4"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+  [ file where event.action != "deletion" and
+      process.name :
+          ("WINWORD.EXE",
+           "EXCEL.EXE",
+           "POWERPNT.EXE",
+           "MSACCESS.EXE") and
+      (
+        file.extension : ("dll", "cpl", "ocx") or
+        // Match Windows PE files by header data (MZ)
+        file.Ext.header_bytes : "4d5a*"
+      )] by file.path
+  [ library where
+    process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE") and 
+    not (dll.code_signature.trusted == true and dll.path : "?:\\Users\\*\\appdata\\local\\assembly\\*.dll") and
+    not (dll.code_signature.subject_name == "Bloomberg L.P." and dll.code_signature.trusted == true) ] by dll.path
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/initial_access_microsoft_office_process_setting_persistence_via_startup.toml b/behavior/rules/initial_access_microsoft_office_process_setting_persistence_via_startup.toml
new file mode 100644
index 00000000..3a7359ed
--- /dev/null
+++ b/behavior/rules/initial_access_microsoft_office_process_setting_persistence_via_startup.toml
@@ -0,0 +1,60 @@
+[rule]
+description = """
+Identifies files written to or modified in the startup folder by a Microsoft Office process. Adversaries may use this
+technique to maintain persistence and avoid spawning suspicious child processes.
+"""
+id = "2b8ea430-897d-486c-85a8-add9d7072ff3"
+license = "Elastic License v2"
+name = "Microsoft Office Process Setting Persistence via Startup"
+os_list = ["windows"]
+version = "1.0.9"
+
+query = '''
+file where event.action != "deletion" and
+  file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
+               "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
+  process.name : ("EQNEDT32.EXE", "WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_potential_remote_file_execution_via_msiexec.toml b/behavior/rules/initial_access_potential_remote_file_execution_via_msiexec.toml
new file mode 100644
index 00000000..3f48d8c8
--- /dev/null
+++ b/behavior/rules/initial_access_potential_remote_file_execution_via_msiexec.toml
@@ -0,0 +1,75 @@
+[rule]
+description = """
+Identifies the execution of the built-in Windows Installer, MSIEXEC, to install a remote package. Adversaries may abuse
+msiexec.exe to launch local or network accessible MSI files.
+"""
+id = "17cd570a-979a-4806-80b5-9b3854e9d603"
+license = "Elastic License v2"
+name = "Potential Remote File Execution via MSIEXEC"
+os_list = ["windows"]
+version = "1.0.5"
+
+query = '''
+sequence with maxspan=1m
+ [process where event.action == "start" and process.name : "msiexec.exe" and process.args : "/V"] by process.entity_id
+ [network where process.name : "msiexec.exe" and event.action == "connection_attempted"] by process.entity_id
+ [process where event.action == "start" and
+  process.parent.name : "msiexec.exe" and user.id : "S-1-5-21-*" and
+  not process.executable : ("?:\\Windows\\SysWOW64\\msiexec.exe",
+                            "?:\\Windows\\System32\\msiexec.exe",
+                            "?:\\Windows\\System32\\srtasks.exe",
+                            "?:\\Windows\\SysWOW64\\srtasks.exe",
+                            "?:\\Windows\\System32\\taskkill.exe",
+                            "?:\\Windows\\Installer\\MSI*.tmp",
+                            "?:\\Program Files\\*.exe",
+                            "?:\\Program Files (x86)\\*.exe",
+                            "?:\\Windows\\System32\\ie4uinit.exe",
+                            "?:\\Windows\\SysWOW64\\ie4uinit.exe") and 
+  not (process.code_signature.subject_name == "Citrix Systems, Inc." and process.code_signature.trusted == true) and 
+  not (process.name : ("regsvr32.exe", "powershell.exe") and 
+       process.Ext.token.integrity_level_name == "high" and
+       process.args : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe"))] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 2
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.007"
+name = "Msiexec"
+reference = "https://attack.mitre.org/techniques/T1218/007/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_powershell_obfuscation_spawned_via_microsoft_office.toml b/behavior/rules/initial_access_powershell_obfuscation_spawned_via_microsoft_office.toml
new file mode 100644
index 00000000..04519a76
--- /dev/null
+++ b/behavior/rules/initial_access_powershell_obfuscation_spawned_via_microsoft_office.toml
@@ -0,0 +1,115 @@
+[rule]
+description = """
+Identifies a Microsoft Office application (Word, PowerPoint, Excel) starting Windows PowerShell with a suspicious
+command line.
+"""
+id = "93ef8a09-0f8d-4aa1-b0fb-47d5d5b40cf2"
+license = "Elastic License v2"
+name = "PowerShell Obfuscation Spawned via Microsoft Office"
+os_list = ["windows"]
+reference = ["https://github.com/danielbohannon/Invoke-Obfuscation"]
+version = "1.0.9"
+
+query = '''
+process where event.action == "start" and
+ (process.pe.original_file_name == "PowerShell.EXE" or process.name : ("powershell.exe", "pwsh.exe")) and
+ (
+  process.parent.name : ("excel.exe", "powerpnt.exe", "winword.exe") or
+  (descendant of [process where event.action == "start" and process.name : ("excel.exe", "powerpnt.exe", "winword.exe")] and
+   /* Issue #263 */
+   not process.parent.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe"))
+  ) and
+  not process.Ext.token.integrity_level_name == "system" and
+  process.command_line :
+              ("*^*^*^*^*^*^*^*^*^*",
+              "*''*''*''*",
+              "*`*`*`*`*",
+              "*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*",
+              "*+*+*+*+*+*",
+              "*$*$*$*$*",
+              "*[char[]](*)*-join",
+              "*Base64String*",
+              "*[*Convert]*",
+              "*.Text.Encoding*",
+              "*.Compression.*",
+              "*.replace(*",
+              "*MemoryStream*",
+              "*WriteAllBytes*",
+              "* -en* *",
+              "* -ec *",
+              "* -e *",
+              "* -ex* *",
+              "* -ep *",
+              "* /e *",
+              "* /en* *",
+              "* /ec *",
+              "* /ex* *",
+              "* /ep *",
+              "*WebClient*",
+              "*DownloadFile*",
+              "*DownloadString*",
+              "*BitsTransfer*",
+              "*Invoke-Exp*",
+              "*invoke-web*",
+              "*iex*",
+              "*iwr*",
+              "*Reflection.Assembly*",
+              "*Assembly.GetType*",
+              "*.Sockets.*") and
+  /* Issue #263 */
+  not process.parent.executable :
+                 ("?:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe",
+                  "?:\\Windows\\System32\\svchost.exe",
+                  "?:\\Windows\\System32\\CompatTelRunner.exe",
+                  "?:\\Windows\\System32\\taskeng.exe") and
+
+  not process.args : ("Get-AuthenticodeSignature*", "Write-Host") and not process.command_line : "*Get-AppxPackage*Microsoft.Office*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_registry_modification_via_microsoft_office.toml b/behavior/rules/initial_access_registry_modification_via_microsoft_office.toml
new file mode 100644
index 00000000..9a22d4c2
--- /dev/null
+++ b/behavior/rules/initial_access_registry_modification_via_microsoft_office.toml
@@ -0,0 +1,97 @@
+[rule]
+description = """
+Identifies modification of common autostart related registry keys by a Microsoft Office process. Adversaries may use
+this technique to maintain persistence and avoid spawning suspicious child processes.
+"""
+id = "926b6cd1-c0c7-46d4-82d6-9deb6ae431d6"
+license = "Elastic License v2"
+name = "Registry Modification via Microsoft Office"
+os_list = ["windows"]
+reference = ["https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ee851671(v=msdn.10)"]
+version = "1.0.9"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [process where event.action == "start" and process.name : ("EQNEDT32.EXE", "WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE")]
+ [registry where registry.data.strings != null and
+  process.name : ("EQNEDT32.EXE", "WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and
+  registry.path : (
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\\*",
+     "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript",
+     "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
+     "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
+     "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
+     "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
+     "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
+     "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
+     "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
+     "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
+     "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
+     "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script",
+     "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun"
+     ) and
+
+   not registry.data.strings : "?:\\Program Files\\Microsoft Office\\Root\\Office*\\officeappguardwin*.exe server"
+   ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1112"
+name = "Modify Registry"
+reference = "https://attack.mitre.org/techniques/T1112/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_rundll32_regsvr32_loads_dropped_executable.toml b/behavior/rules/initial_access_rundll32_regsvr32_loads_dropped_executable.toml
new file mode 100644
index 00000000..16499cde
--- /dev/null
+++ b/behavior/rules/initial_access_rundll32_regsvr32_loads_dropped_executable.toml
@@ -0,0 +1,127 @@
+[rule]
+description = """
+Identifies when RunDLL32 or Regsvr32 loads an executable that was dropped by commonly abused programs via phishing such
+as Microsoft Office or Powershell. An adversary may deliver a weaponized Office document to their target that writes and
+executes a malicious DLL.
+"""
+id = "901f0c30-a7c5-40a5-80e3-a50c6744632f"
+license = "Elastic License v2"
+name = "RunDLL32/Regsvr32 Loads Dropped Executable"
+os_list = ["windows"]
+version = "1.0.9"
+
+query = '''
+sequence with maxspan=1m
+  [ file where event.action != "deletion" and 
+    not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+      process.name :
+          ("WINWORD.EXE",
+           "EXCEL.EXE",
+           "POWERPNT.EXE",
+           "MSACCESS.EXE",
+           "MSHTA.EXE",
+           "cscript.exe",
+           "wscript.exe",
+           "CertUtil.exe",
+           "CertReq.exe",
+           "Cmd.exe",
+           "xcopy.exe",
+           "curl.exe",
+           "powershell.exe") and
+      (
+        file.extension : ("dll", "cpl", "ocx") or
+        // Match Windows PE files by header data (MZ)
+        file.Ext.header_bytes : "4d5a*"
+      )
+  ] by file.path
+  [ library where process.name : ("rundll32.exe", "regsvr32.exe") and 
+    not dll.code_signature.trusted == true and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and 
+    not dll.path : ("?:\\Program Files (x86)\\*.dll", "?:\\Program Files\\*.dll") and
+    not (dll.pe.original_file_name == "RbkVssProvider.dll" and dll.path : "?:\\Windows\\Temp\\rubrik_vmware*\\RbkVssProvider.dll")
+   ] by dll.path
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1566.002"
+name = "Spearphishing Link"
+reference = "https://attack.mitre.org/techniques/T1566/002/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.003"
+name = "Windows Command Shell"
+reference = "https://attack.mitre.org/techniques/T1059/003/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.010"
+name = "Regsvr32"
+reference = "https://attack.mitre.org/techniques/T1218/010/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/initial_access_script_file_written_by_microsoft_office_process.toml b/behavior/rules/initial_access_script_file_written_by_microsoft_office_process.toml
new file mode 100644
index 00000000..252f5479
--- /dev/null
+++ b/behavior/rules/initial_access_script_file_written_by_microsoft_office_process.toml
@@ -0,0 +1,103 @@
+[rule]
+description = """
+Identifies the execution of a script file written by a Microsoft Office application (Word, PowerPoint, or Excel). Script
+interpreters are often launched during exploitation of Office applications or from documents containing malicious
+macros.
+"""
+id = "78e2e5e1-e727-4106-9206-8cf43b9f8919"
+license = "Elastic License v2"
+name = "Script File Written by Microsoft Office Process"
+os_list = ["windows"]
+reference = ["https://lolbas-project.github.io/"]
+version = "1.0.5"
+
+query = '''
+sequence by user.id with maxspan=1m
+ [file where event.action != "deletion" and
+
+  /* script dropped by MS Office program */
+   file.extension : ("hta", "vbs", "js", "wsf", "vbe", "jse", "ps1", "bat", "cmd", "sct") and
+   process.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe", "fltldr.exe", "mspub.exe", "msaccess.exe")]
+ [process where event.action == "start" and
+  process.name : ("cscript.exe", "wscript.exe", "mshta.exe", "powershell.exe", "cmd.exe", "regsvr32.exe", "cmstp.exe", "wmic.exe") and not
+
+ /*  descendant of MS office but not a direct child - already covered by ruleId c34a9dca-66cf-4283-944d-1800b28ae690 */
+  process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe", "fltldr.exe", "mspub.exe",
+                         "msaccess.exe", "WmiPrvse.exe", "explorer.exe") and
+  descendant of [process where event.action == "start" and
+     process.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe", "fltldr.exe", "mspub.exe", "msaccess.exe")] and
+  not (process.name : "cmd.exe" and process.parent.executable : "\\Device\\Mup\\*\\netlogon\\*") and
+  not (process.name : "cmd.exe" and process.parent.name : ("chrome.exe", "msedge.exe", "iexplore.exe", "opera.exe", "firefox.exe")) and
+  not (process.command_line : "cmd.exe /c set" and process.parent.executable : "?:\\Program Files (x86)\\eparakstitajs?\\eparakstitajs?.exe")
+  ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.005"
+name = "Mshta"
+reference = "https://attack.mitre.org/techniques/T1218/005/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_signed_binary_execution_via_microsoft_office.toml b/behavior/rules/initial_access_signed_binary_execution_via_microsoft_office.toml
new file mode 100644
index 00000000..08c585e6
--- /dev/null
+++ b/behavior/rules/initial_access_signed_binary_execution_via_microsoft_office.toml
@@ -0,0 +1,103 @@
+[rule]
+description = """
+Identifies the execution of a signed file written or modified by a Microsoft Office process. This may indicate an
+attempt to side-load a DLL or execute signed malware.
+"""
+id = "321e7877-075a-4582-8eff-777dde15e787"
+license = "Elastic License v2"
+name = "Signed Binary Execution via Microsoft Office"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+sequence by user.id with maxspan=1m
+  [file where event.action != "deletion" and
+    (file.extension : ("exe", "com") or file.Ext.header_bytes : "4d5a*") and
+    process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE") and
+    not file.path : (
+               "?:\\Users\\*\\Desktop\\*",
+               "?:\\Users\\*\\Downloads\\*",
+               "?:\\Users\\*\\Documents\\*",
+               "?:\\Users\\*\\AppData\\Local\\Temp\\*-*-*-*\\*",
+               "?:\\Program Files (x86)\\*",
+               "?:\\Program Files\\*"
+             )
+    ] by file.path
+  [process where event.action == "start" and
+    process.parent.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE") and
+    process.code_signature.trusted == true and
+    not (
+        (
+          process.pe.original_file_name in ("ZoomIt.exe", "setup.exe", "Setup.exe", "SFXCAB.EXE") and
+          process.code_signature.subject_name == "Microsoft Corporation"
+	    ) or
+	      process.code_signature.subject_name in
+	        (
+	          "Add-in Express",
+	          "Adaptive Insights LLC",
+	           "Adaptive Insights, Inc.",
+	           "Beijing Yundong Zhixiao Network Technology Co. , Ltd.",
+	           "Dynamo Software, Inc.",
+	           "Environmental Systems Research Institute Inc.",
+	           "Essential Objects, Inc.",
+	           "iSpring Solutions, Inc.",
+	           "Insightsoftware.Com, Inc.",
+	           "JPMorgan Chase and Co.",
+	           "KNOWLEDGE MANAGEMENT ASSOCIATES, LLC",
+	           "Poll Everywhere, Inc.",
+	           "PitchBook Data, Inc.",
+	           "Tagetik Software Srl",
+	           "SAS Institute, Inc.",
+	           "Thomson Reuters Corporation",
+	           "TEAMDEV LTD.",
+	           "Vena Solutions Canada Inc.",
+	           "Zhuhai Kingsoft Office Software Co., Ltd.",
+	           "Citrix Systems, Inc.",
+	           "Grammarly, Inc."
+	        )
+    )
+    ] by process.executable
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.002"
+name = "DLL Side-Loading"
+reference = "https://attack.mitre.org/techniques/T1574/002/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_suspicious_execution_via_a_mounted_image_file.toml b/behavior/rules/initial_access_suspicious_execution_via_a_mounted_image_file.toml
new file mode 100644
index 00000000..3018c691
--- /dev/null
+++ b/behavior/rules/initial_access_suspicious_execution_via_a_mounted_image_file.toml
@@ -0,0 +1,46 @@
+[rule]
+description = """
+Identifies the execution of a process from a mounted image file. Attacker may abuse IMG files to deliver malicious
+programs.
+"""
+id = "9401d27c-200a-4d72-ad36-f7051c4b3dcb"
+license = "Elastic License v2"
+name = "Suspicious Execution via a Mounted Image File"
+os_list = ["windows"]
+version = "1.0.4"
+
+query = '''
+process where event.action == "start" and
+ process.parent.executable : "\\Device\\CdRom0\\*" and
+ not process.executable : ("?:\\Program Files\\*.exe",
+                           "?:\\Program Files (x86)\\*.exe",
+                           "\\Device\\CdRom0\\*") and
+ not process.code_signature.trusted == true and
+ not (process.parent.name : "setup.exe" and process.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\*.tmp\\setup.tmp")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_suspicious_execution_via_shellbrowserwindow_shellwindow_com.toml b/behavior/rules/initial_access_suspicious_execution_via_shellbrowserwindow_shellwindow_com.toml
new file mode 100644
index 00000000..e1fc6f38
--- /dev/null
+++ b/behavior/rules/initial_access_suspicious_execution_via_shellbrowserwindow_shellwindow_com.toml
@@ -0,0 +1,120 @@
+[rule]
+description = """
+Identifies suspicious access to the ShellBrowserWindow or ShellWindow COM objects by a Microsoft Office process followed
+by the execution of commonly abused signed proxy binary. This may indicate an attempt to avoid triggering a suspicious
+process tree using malicious phishing documents.
+"""
+id = "cbbb130f-d9d3-459d-a796-c61ee27f9f70"
+license = "Elastic License v2"
+name = "Suspicious Execution via ShellBrowserWindow/ShellWindow COM"
+os_list = ["windows"]
+reference = ["https://blog.f-secure.com/dechaining-macros-and-evading-edr/"]
+version = "1.0.4"
+
+query = '''
+sequence by user.id with maxspan=5s
+  [registry where event.action == "query" and
+    process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE") and
+    /* COM - ShellWindows and ShellBrowserWindows can be used to exec a
+     process via Explorer and avoid susp process tree */
+    registry.key :
+      (
+      "SOFTWARE\\Classes\\CLSID\\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}*",
+      "SOFTWARE\\Classes\\CLSID\\{c08afd90-f2a1-11d1-8455-00a0c91f3880}*")]
+   [process where event.action == "start" and
+     process.args_count >= 2 and
+     (process.parent.executable : "?:\\Windows\\explorer.exe" and process.parent.args_count == 1) and
+     /* for now limited to common lolbas + combined to maxspan set to 5s to avoid any unexpected high peak in FPs*/
+     process.name :
+              ("rundll32.exe",
+               "powershell.exe",
+               "mshta.exe",
+               "msbuild.exe",
+               "certutil.exe",
+               "regsvr32.exe",
+               "cscript.exe",
+               "wscript.exe",
+               "wmic.exe",
+               "msxsl.exe",
+               "Microsoft.Workflow.Compiler.exe",
+               "ieexec.exe",
+               "iexpress.exe",
+               "installutil.exe",
+               "RegSvcs.exe",
+               "RegAsm.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.005"
+name = "Mshta"
+reference = "https://attack.mitre.org/techniques/T1218/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.010"
+name = "Regsvr32"
+reference = "https://attack.mitre.org/techniques/T1218/010/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_suspicious_microsoft_office_child_process.toml b/behavior/rules/initial_access_suspicious_microsoft_office_child_process.toml
new file mode 100644
index 00000000..3e09567c
--- /dev/null
+++ b/behavior/rules/initial_access_suspicious_microsoft_office_child_process.toml
@@ -0,0 +1,113 @@
+[rule]
+description = """
+Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel).
+These child processes are often launched during exploitation of Office applications or from documents with malicious
+macros.
+"""
+id = "c34a9dca-66cf-4283-944d-1800b28ae690"
+license = "Elastic License v2"
+name = "Suspicious Microsoft Office Child Process"
+os_list = ["windows"]
+reference = ["https://lolbas-project.github.io/"]
+version = "1.0.10"
+
+query = '''
+process where event.action == "start" and
+  process.parent.name : ("excel.exe", "powerpnt.exe", "winword.exe") and
+  (
+		(process.pe.original_file_name : (
+		    "rundll32.exe", 
+		    "regsvr32.exe", 
+		    "bitsadmin.exe",
+		    "certutil.exe", 
+		    "installutil.exe", 
+		    "schtasks.exe", 
+		    "wmic.exe", 
+		    "cscript.exe",
+		    "cmstp.exe", 
+		    "Microsoft.Workflow.Compiler.exe", 
+		    "regasm.exe", 
+		    "regsvcs.exe", 
+		    "mshta.exe", 
+		    "msxsl.exe", 
+		    "ieexec.exe", 
+		    "sc.exe", 
+		    "hh.exe",
+		    "javaw.exe",
+		    "pcalua.exe",
+		    "curl.exe",
+		    "ScriptRunner.exe",
+		    "CertOC.exe",
+		    "Workfolders.exe"
+		   ) and
+		not process.args : ("-Embedding", "-hashfile")
+		) or
+		
+		(process.pe.original_file_name : "wscript.exe" and
+		 process.command_line : ("*:\\ProgramData\\*",
+		                         "*:\\Users\\Public\\*",
+		                         "*\\AppData\\*",
+		                         /* CVE-2021-40444 */
+		                         "*../../..*", "*..\\..\\*", "*js:..*", "*vbs:..*", "*wsf:..*", "*jse:..*", "*vbe:..*")) or
+		
+		(process.pe.original_file_name : "msiexec.exe" and process.args : "http*") or
+		/* Issue #439 */
+		(process.name : "explorer.exe" and
+		 process.args : ("*.hta*", "*.vb*", "*.wsh*", "*.js*", "*.ps*", "*.scr*", "*.pif*", "*bat*", "*.cmd*") and
+		 /* FPs related to execution from file share */
+		 not process.working_directory : "\\\\*"
+		 ) or
+
+		/* Masquerading as WerFault or Splwow64 both of which are common MS Office Child Processes */
+		(process.name : ("WerFault.exe", "splwow64.exe") and process.args_count == 1) or
+
+        /* in the wild 0 day - 52945af1def85b171870b31fa4782e52 */
+		(process.pe.original_file_name == "msdt.exe" and process.command_line : "*IT_BrowseForFile*")
+
+  ) and
+
+	/* FP related to printing */
+	not (process.name : "rundll32.exe" and process.command_line : "*\\system32\\spool\\*") and
+
+	/* Issue #458 */
+	not (process.name : "rundll32.exe" and
+	     process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile", "shwebsvc.dll,AddNetPlaceRunDll")) and
+
+    /* Issue #568 */
+	not (process.name : "schtasks.exe" and process.args : "/change" and process.args : "Microsoft\\Office\\Office Serviceability Manager") and
+
+	/* Issue #568 */
+	not (process.name : "regsvr32.exe" and
+	     process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\system32\\*.dll", "?:\\Windows\\system32\\*.ocx")) and
+
+	not (process.executable : "?:\\Windows\\hh.exe" and process.args : "-mapid") and
+	not (process.executable : "?:\\Windows\\System32\\sc.exe" and process.args : "queryex") and
+	not (process.name : "rundll32.exe" and process.command_line : ("?:\\Windows\\SysWOW64\\rundll32.exe --eoim", "*--enable-speech-input --auto-scan-plugin --lang=*")) and
+	not (process.name : "RegAsm.exe" and process.args :  "?:\\Program Files (x86)\\Thomson Reuters\\WSF\\*.dll")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_suspicious_ms_office_execution_via_dcom.toml b/behavior/rules/initial_access_suspicious_ms_office_execution_via_dcom.toml
new file mode 100644
index 00000000..81a5c771
--- /dev/null
+++ b/behavior/rules/initial_access_suspicious_ms_office_execution_via_dcom.toml
@@ -0,0 +1,66 @@
+[rule]
+description = """
+Identifies suspicious modification of the Microsoft Office AccessVBOM security setting followed by the execution of
+another Office process instance via DCOM. This may indicate an attempt to evade detection via suspicious process tree.
+"""
+id = "6a714747-2671-4523-b233-744f119949b6"
+license = "Elastic License v2"
+name = "Suspicious MS Office Execution via DCOM"
+os_list = ["windows"]
+reference = [
+    "https://www.elastic.co/blog/playing-defense-against-gamaredon-group",
+    "https://stigviewer.com/stig/microsoft_powerpoint_2007/2014-04-03/finding/V-17522",
+]
+version = "1.0.5"
+
+query = '''
+sequence by user.id with maxspan=1m
+   [registry where event.type == "change" and
+    registry.path : "HKEY_USERS\\S-1-5-21-*\\SOFTWARE\\Microsoft\\Office\\*\\Security\\AccessVBOM" and
+    registry.data.strings == "1"]
+   [process where event.action == "start" and
+    (process.parent.name :("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE") and
+     process.parent.args : "-Embedding") and
+    not (process.executable : ("?:\\Windows\\System32\\WerFault.exe", "?:\\Windows\\SysWOW64\\WerFault.exe") and process.args : "-u" and process.args : "-p") and
+    not (process.pe.original_file_name == "ItSukurti.exe" and process.executable : "?:\\SamExpert\\ItSukurti.exe") and
+    not (process.executable : "?:\\WINDOWS\\splwow64.exe" and process.args : "8192") and
+    not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and process.code_signature.trusted == true)]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1112"
+name = "Modify Registry"
+reference = "https://attack.mitre.org/techniques/T1112/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_suspicious_network_connection_from_microsoft_equation_editor.toml b/behavior/rules/initial_access_suspicious_network_connection_from_microsoft_equation_editor.toml
new file mode 100644
index 00000000..482c8821
--- /dev/null
+++ b/behavior/rules/initial_access_suspicious_network_connection_from_microsoft_equation_editor.toml
@@ -0,0 +1,60 @@
+[rule]
+description = """
+Identifies a suspicious network connection from the Microsoft Equation Editor process, which is frequently targeted by
+attackers using weaponized Microsoft Office documents. This behavior is consistent with the successful exploitation of
+Office applications via known vulnerabilities CVE-2017-1182 or CVE-2018-0798.
+"""
+id = "365571bb-2b93-4ae8-8c39-0558f8a6c4cc"
+license = "Elastic License v2"
+name = "Suspicious Network Connection from Microsoft Equation Editor"
+os_list = ["windows"]
+reference = [
+    "https://www.anomali.com/blog/multiple-chinese-threat-groups-exploiting-cve-2018-0798-equation-editor-vulnerability-since-late-2018",
+    "https://nvd.nist.gov/vuln/detail/CVE-2017-11882",
+    "https://nvd.nist.gov/vuln/detail/CVE-2018-0798",
+]
+version = "1.0.7"
+
+query = '''
+sequence by process.entity_id with maxspan=30s
+  [process where event.action == "start" and process.name : "EQNEDT32.EXE" and process.args : "-Embedding"]
+  [network where event.action == "connection_attempted" and process.name : "EQNEDT32.EXE"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1203"
+name = "Exploitation for Client Execution"
+reference = "https://attack.mitre.org/techniques/T1203/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_untrusted_file_execution_via_microsoft_office.toml b/behavior/rules/initial_access_untrusted_file_execution_via_microsoft_office.toml
new file mode 100644
index 00000000..f8ca4ef8
--- /dev/null
+++ b/behavior/rules/initial_access_untrusted_file_execution_via_microsoft_office.toml
@@ -0,0 +1,52 @@
+[rule]
+description = "Identifies the execution of an unsigned file written or modified by Microsoft Office processes."
+id = "bb23a662-2d75-4714-837d-4ec9c2e772a5"
+license = "Elastic License v2"
+name = "Untrusted File Execution via Microsoft Office"
+os_list = ["windows"]
+version = "1.0.9"
+
+query = '''
+sequence by user.id with maxspan=1m
+  [file where event.action != "deletion" and
+    (file.extension : ("exe", "com", "pif", "scr") or file.Ext.header_bytes : "4d5a*") and
+    process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE") and
+    not file.path :
+            (
+              "?:\\Users\\*\\Desktop\\*",
+              "?:\\Users\\*\\Downloads\\*",
+              "?:\\Users\\*\\AppData\\Local\\Temp\\*-*-*-*\\*",
+              "?:\\Program Files (x86)\\*",
+              "?:\\Program Files\\*"
+            )
+    ] by file.path
+  [process where event.action == "start" and
+    process.parent.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE") and
+    not process.code_signature.trusted == true] by process.executable
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_windows_command_shell_spawned_via_microsoft_office.toml b/behavior/rules/initial_access_windows_command_shell_spawned_via_microsoft_office.toml
new file mode 100644
index 00000000..a810a29d
--- /dev/null
+++ b/behavior/rules/initial_access_windows_command_shell_spawned_via_microsoft_office.toml
@@ -0,0 +1,86 @@
+[rule]
+description = """
+Identifies a Microsoft Office application starting a Windows command prompt with suspicious command line arguments. This
+behavior is consistent with a victim opening a malicious document and executing an attacker's malicious code.
+"""
+id = "2a396a3c-b343-42a9-b74b-c5b9925b6ee2"
+license = "Elastic License v2"
+name = "Windows Command Shell Spawned via Microsoft Office"
+os_list = ["windows"]
+reference = ["https://github.com/danielbohannon/Invoke-DOSfuscation"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and
+  process.parent.name : ("excel.exe", "powerpnt.exe", "winword.exe") and
+  (process.pe.original_file_name == "Cmd.Exe" or process.name : "cmd.exe") and
+  process.command_line :
+              ("*^*^*^*^*^*",
+              "*set *set *set *",
+              "*set *for *call *",
+              "*set *for *cmd *",
+              "*$*$*$*$*",
+              "*comspec*",
+              "*powershell*",
+              "*wscript*",
+              "*cscript*",
+              "*mshta*", 
+              "*certutil*", 
+              "*bitsadmin*", 
+              "*/transfer*",
+              "*-transfer*",
+              "*urlcache*", 
+              "*-decode*", 
+              "*addfile*",
+              "*msbuild*",
+              "*msiexec*",
+              "*rundll32*",
+              "*regsvr32*", 
+              "*ping * -n *&*",
+              "*http://*",
+              "*%%*%%*%%*") and
+  not process.command_line : ("*:\\Program Files\\Tableau\\*--server*http://tableau*", "*:\\Program Files (x86)\\Tableau\\*--server*http://tableau*")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.003"
+name = "Windows Command Shell"
+reference = "https://attack.mitre.org/techniques/T1059/003/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/initial_access_wmi_image_load_via_microsoft_office.toml b/behavior/rules/initial_access_wmi_image_load_via_microsoft_office.toml
new file mode 100644
index 00000000..1bdc22b8
--- /dev/null
+++ b/behavior/rules/initial_access_wmi_image_load_via_microsoft_office.toml
@@ -0,0 +1,93 @@
+[rule]
+description = """
+Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processes followed by a child process spawned
+via Windows Management Instrumentation (WMI). This behavior may indicate adversarial activity to avoid spawning a
+suspicious MS Office child process.
+"""
+id = "46952f58-6741-4280-8e74-fa43f63c9604"
+license = "Elastic License v2"
+name = "WMI Image Load via Microsoft Office"
+os_list = ["windows"]
+reference = [
+    "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16",
+]
+version = "1.0.8"
+
+query = '''
+sequence by user.id with maxspan=30s
+    [library where dll.name : ("wmiutils.dll", "fastprox.dll", "wbemprox.dll") and 
+     process.name : ("excel.exe", "powerpnt.exe", "winword.exe")]
+    [process where event.action == "start" and
+     process.parent.name : "wmiprvse.exe" and
+     not process.Ext.token.integrity_level_name == "system" and
+     (process.pe.original_file_name :
+        (
+          "cscript.exe",
+          "wscript.exe",
+          "PowerShell.EXE",
+          "Cmd.Exe",
+          "pwsh.exe",
+          "bitsadmin.exe",
+          "certutil.exe",
+          "hh.exe",
+          "MSHTA.EXE",
+          "RUNDLL32.EXE",
+          "REGSVR32.EXE",
+          "MSBuild.exe",
+          "InstallUtil.exe",
+          "RegAsm.exe",
+          "RegSvcs.exe",
+          "msxsl.exe",
+          "CONTROL.EXE",
+          "EXPLORER.EXE",
+          "Microsoft.Workflow.Compiler.exe",
+          "msiexec.exe",
+          "sc.exe",
+          "schtasks.exe",
+          "WMIC.exe",
+          "curl.exe"
+        ) or
+      process.executable : ("?:\\Users\\*.exe", "?:\\ProgramData\\*.exe")
+     ) and
+     not (process.name : "powershell.exe" and process.command_line : "*\\windows\\CCM\\*")
+
+    ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1047"
+name = "Windows Management Instrumentation"
+reference = "https://attack.mitre.org/techniques/T1047/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/lateral_movement_imageload_of_a_file_dropped_via_smb.toml b/behavior/rules/lateral_movement_imageload_of_a_file_dropped_via_smb.toml
new file mode 100644
index 00000000..d63d9498
--- /dev/null
+++ b/behavior/rules/lateral_movement_imageload_of_a_file_dropped_via_smb.toml
@@ -0,0 +1,74 @@
+[rule]
+description = """
+Identifies the transfer of a library via SMB followed by loading it into commonly DLL proxy execution binaries such as
+rundll32, regsvr32 and shared services via svchost.exe. This may indicate an attempt to remotely execute malicious code.
+"""
+id = "fdf66d17-0e2e-4667-a145-620bc1204c69"
+license = "Elastic License v2"
+name = "ImageLoad of a File dropped via SMB"
+os_list = ["windows"]
+version = "1.0.6"
+
+query = '''
+sequence with maxspan=5m
+  [ file where event.action != "deletion" and
+   /* library dropped via SMB */
+   process.pid == 4 and user.id : "S-1-5-21*" and
+   (file.extension : ("dll", "cpl", "ocx") or file.Ext.header_bytes : "4d5a*")] by file.path
+  [ library where
+    (process.name : ("rundll32.exe", "regsvr32.exe", "svchost.exe", "lsass.exe") or process.executable : "?:\\Windows\\Microsoft.NET\\*.exe") and
+
+    /* signed FPs */
+    not (dll.code_signature.subject_name in ("Veeam Software Group GmbH", "Veeam Software AG", "Lansweeper", "Microsoft Windows", 
+                                             "Microsoft Corporation", "GOVERLAN, LLC", "Cisco WebEx LLC") and dll.code_signature.trusted == true) and
+    not (dll.path : "?:\\oracle\\client\\product\\*\\ora*.dll" and dll.pe.original_file_name : "Ora*.dll" and process.name : "regsvr32.exe") and 
+    not (dll.path : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and dll.code_signature.trusted == true) ] by dll.path
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.010"
+name = "Regsvr32"
+reference = "https://attack.mitre.org/techniques/T1218/010/"
+
+[[threat.technique.subtechnique]]
+id = "T1218.011"
+name = "Rundll32"
+reference = "https://attack.mitre.org/techniques/T1218/011/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1021"
+name = "Remote Services"
+reference = "https://attack.mitre.org/techniques/T1021/"
+[[threat.technique.subtechnique]]
+id = "T1021.002"
+name = "SMB/Windows Admin Shares"
+reference = "https://attack.mitre.org/techniques/T1021/002/"
+
+
+
+[threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/lateral_movement_potential_kerberos_attack_via_bifrost.toml b/behavior/rules/lateral_movement_potential_kerberos_attack_via_bifrost.toml
new file mode 100644
index 00000000..30947e19
--- /dev/null
+++ b/behavior/rules/lateral_movement_potential_kerberos_attack_via_bifrost.toml
@@ -0,0 +1,63 @@
+[rule]
+description = """
+Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or
+attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting.
+"""
+id = "fecebe4f-2d28-46e7-9bc1-71cdd8ecdd60"
+license = "Elastic License v2"
+name = "Potential Kerberos Attack via Bifrost"
+os_list = ["macos"]
+reference = ["https://github.com/its-a-feature/bifrost"]
+version = "1.0.4"
+
+query = '''
+process where event.type == "start" and process.args : "-action" and
+ (
+  process.args : ("-kerberoast", "askhash", "asktgs", "asktgt", "s4u") or
+  (process.args : "-ticket" and process.args : "ptt") or
+  (process.args : "dump" and process.args : ("tickets", "keytab"))
+  )
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1558"
+name = "Steal or Forge Kerberos Tickets"
+reference = "https://attack.mitre.org/techniques/T1558/"
+[[threat.technique.subtechnique]]
+id = "T1558.003"
+name = "Kerberoasting"
+reference = "https://attack.mitre.org/techniques/T1558/003/"
+
+
+
+[threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1550"
+name = "Use Alternate Authentication Material"
+reference = "https://attack.mitre.org/techniques/T1550/"
+[[threat.technique.subtechnique]]
+id = "T1550.003"
+name = "Pass the Ticket"
+reference = "https://attack.mitre.org/techniques/T1550/003/"
+
+
+
+[threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/lateral_movement_potential_lateral_movement_via_smbexec.toml b/behavior/rules/lateral_movement_potential_lateral_movement_via_smbexec.toml
new file mode 100644
index 00000000..829153dc
--- /dev/null
+++ b/behavior/rules/lateral_movement_potential_lateral_movement_via_smbexec.toml
@@ -0,0 +1,63 @@
+[rule]
+description = """
+Identifies suspicious service execution via Windows Command Shell which may indicate lateral movement attempt via known
+offensive testing tool like SMBExec.
+"""
+id = "c6a9046e-7ca3-460b-9707-f17e6dfabcb6"
+license = "Elastic License v2"
+name = "Potential Lateral Movement via SMBExec"
+os_list = ["windows"]
+reference = ["https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py#L277"]
+version = "1.0.4"
+
+query = '''
+process where event.action == "start" and
+ (
+   ((process.name : "cmd.exe" or process.pe.original_file_name == "Cmd.Exe") and process.parent.name : "services.exe" and
+     process.command_line : "*/Q*echo*.bat*del*.bat*") or
+
+   /* descendant of SMBExec */
+   (descendant of
+    [process where event.action == "start" and (process.name : "cmd.exe" or process.pe.original_file_name == "Cmd.Exe") and
+     process.parent.name : "services.exe" and process.command_line : "*/Q*echo*.bat*del*.bat*"] and
+     not process.executable : ("?:\\Windows\\system32\\cmd.exe", "?:\\Windows\\System32\\conhost.exe"))
+  )
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.003"
+name = "Windows Command Shell"
+reference = "https://attack.mitre.org/techniques/T1059/003/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1021"
+name = "Remote Services"
+reference = "https://attack.mitre.org/techniques/T1021/"
+
+
+[threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/lateral_movement_suspicious_nullsessionpipe_registry_modification.toml b/behavior/rules/lateral_movement_suspicious_nullsessionpipe_registry_modification.toml
new file mode 100644
index 00000000..ce3f7102
--- /dev/null
+++ b/behavior/rules/lateral_movement_suspicious_nullsessionpipe_registry_modification.toml
@@ -0,0 +1,69 @@
+[rule]
+description = """
+Identifies NullSessionPipe registry modifications that specify pipe names that can be accessed anonymously. This could
+be indicative of adversary lateral movement preparation by making the added pipe accessible to remote systems.
+"""
+id = "11d374d8-2dad-4d9b-83a2-ee908eac8269"
+license = "Elastic License v2"
+name = "Suspicious NullSessionPipe Registry Modification"
+os_list = ["windows"]
+reference = [
+    "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/",
+    "https://decoded.avast.io/luigicamastra/operation-dragon-castling-apt-group-targeting-betting-companies/",
+    "https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares",
+]
+version = "1.0.4"
+
+query = '''
+registry where
+ event.action == "modification" and 
+ registry.path : "HKLM\\SYSTEM\\*ControlSet*\\services\\LanmanServer\\Parameters\\NullSessionPipes" and 
+ not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and 
+ registry.data.strings : "*?*" and process.executable : "?:\\*" and
+ not process.executable : ("?:\\Program Files\\*.exe",
+                           "?:\\Program Files (x86)\\*.exe",
+                           "?:\\Windows\\regedit.exe",
+                           "?:\\Windows\\System32\\drivers\\RivetNetworks\\Killer\\*.exe",
+                           "?:\\Windows\\System32\\svchost.exe",
+                           "?:\\Windows\\System32\\lsass.exe",
+                           "?:\\Windows\\System32\\msiexec.exe",
+                           "?:\\Windows\\System32\\services.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1112"
+name = "Modify Registry"
+reference = "https://attack.mitre.org/techniques/T1112/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1021"
+name = "Remote Services"
+reference = "https://attack.mitre.org/techniques/T1021/"
+[[threat.technique.subtechnique]]
+id = "T1021.002"
+name = "SMB/Windows Admin Shares"
+reference = "https://attack.mitre.org/techniques/T1021/002/"
+
+
+
+[threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/lateral_movement_unexpected_smb_connection_from_user_mode_process.toml b/behavior/rules/lateral_movement_unexpected_smb_connection_from_user_mode_process.toml
new file mode 100644
index 00000000..20b32e8b
--- /dev/null
+++ b/behavior/rules/lateral_movement_unexpected_smb_connection_from_user_mode_process.toml
@@ -0,0 +1,70 @@
+[rule]
+description = """
+Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented
+over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network
+connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or
+suspicious user-level processes moving laterally.
+"""
+id = "2fbbd139-3919-4b6b-9c50-9452b0aef005"
+license = "Elastic License v2"
+name = "Unexpected SMB Connection from User-mode Process"
+os_list = ["windows"]
+version = "1.0.9"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+  [process where event.action == "start" and
+   process.executable : "?:\\Windows\\*.exe" and
+   /* Issue #338 */
+   not (process.code_signature.subject_name : "RAPIDFIRE TOOLS INC." and process.code_signature.trusted == true) and
+   not user.id : ("S-1-5-19", "S-1-5-20")]
+  [network where network.direction : ("outgoing", "egress") and
+   destination.port == 445 and source.port >= 49152 and
+   not process.executable :
+                 ("?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
+                  "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
+                  "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe",
+                  "?:\\Windows\\System32\\wsmprovhost.exe",
+                  "?:\\Windows\\System32\\mmc.exe",
+                  "?:\\Windows\\SysWOW64\\mmc.exe",
+                  "?:\\Windows\\System32\\svchost.exe",
+                  "?:\\Windows\\System32\\WerFault.exe",
+                  "?:\\Windows\\System32\\userinit.exe",
+                  "?:\\Windows\\System32\\vpc.exe",
+                  "?:\\Windows\\SysWOW64\\vmnat.exe",
+                  "?:\\Windows\\System32\\telnet.exe",
+                  "?:\\windows\\system32\\windowspowershell\\v*\\powershell.exe",
+                  "?:\\windows\\SysWOW64\\windowspowershell\\v*\\powershell.exe",
+                  "?:\\windows\\system32\\windowspowershell\\v*\\powershell_ise.exe",
+                  "?:\\Windows\\NetworkDetective-RDC-*\\nacmdline.exe",
+                  "?:\\Windows\\ProPatches\\Installation\\InstallationSandbox*\\stdeploy.exe",
+                  "?:\\Windows\\System32\\ctfmon.exe",
+                  "?:\\Windows\\SysWOW64\\ctfmon.exe",
+                  "?:\\Windows\\System32\\OpenSSH\\ssh.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1021"
+name = "Remote Services"
+reference = "https://attack.mitre.org/techniques/T1021/"
+[[threat.technique.subtechnique]]
+id = "T1021.002"
+name = "SMB/Windows Admin Shares"
+reference = "https://attack.mitre.org/techniques/T1021/002/"
+
+
+
+[threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/lateral_movement_unusual_remote_desktop_client_process.toml b/behavior/rules/lateral_movement_unusual_remote_desktop_client_process.toml
new file mode 100644
index 00000000..4081fc1a
--- /dev/null
+++ b/behavior/rules/lateral_movement_unusual_remote_desktop_client_process.toml
@@ -0,0 +1,66 @@
+[rule]
+description = """
+Identifies a Remote Desktop Protocol (RDP) network connection from an unusual client process. Adversaries may attempt to
+connect to a remote system over RDP to achieve lateral movement and in some cases, may avoid using the Microsoft
+Terminal Services Client (mstsc.exe) binary in an attempt to evade detection.
+"""
+id = "d448566e-486f-4b61-a76f-945662313d49"
+license = "Elastic License v2"
+name = "Unusual Remote Desktop Client Process"
+os_list = ["windows"]
+version = "1.0.8"
+
+query = '''
+sequence by process.entity_id with maxspan=5m
+   [ library where dll.name : "mstscax.dll" and
+     process.executable:
+           ("?:\\Windows\\System32\\*.exe",
+            "?:\\Windows\\SysWOW64\\*.exe",
+            "?:\\Windows\\Microsoft.NET\\*",
+            "?:\\Windows\\notepad.exe") and
+     not process.executable :
+            ("?:\\Windows\\System32\\mstsc.exe",
+             "?:\\Windows\\SysWOW64\\mstsc.exe",
+             "?:\\Windows\\SysWOW64\\svchost.exe",
+             "?:\\Windows\\System32\\svchost.exe",
+             /* Issue #314 */
+             "?:\\Windows\\System32\\telnet.exe",
+             "?:\\Windows\\SysWOW64\\telnet.exe",
+             "?:\\Windows\\LTSvc\\LTSVC.exe",
+             "?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
+             "?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
+             "?:\\Windows\\System32\\OpenSSH\\*.exe")]
+    [ network where network.direction : ("outgoing", "egress") and
+      destination.port == 3389 and source.port >= 49152 and
+      process.executable:
+           ("?:\\Windows\\System32\\*.exe",
+            "?:\\Windows\\SysWOW64\\*.exe",
+            "?:\\Windows\\Microsoft.NET\\*",
+            "?:\\Windows\\notepad.exe") ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1021"
+name = "Remote Services"
+reference = "https://attack.mitre.org/techniques/T1021/"
+[[threat.technique.subtechnique]]
+id = "T1021.001"
+name = "Remote Desktop Protocol"
+reference = "https://attack.mitre.org/techniques/T1021/001/"
+
+
+
+[threat.tactic]
+id = "TA0008"
+name = "Lateral Movement"
+reference = "https://attack.mitre.org/tactics/TA0008/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/persistence_network_connection_via_startup_item.toml b/behavior/rules/persistence_network_connection_via_startup_item.toml
new file mode 100644
index 00000000..61b02f8d
--- /dev/null
+++ b/behavior/rules/persistence_network_connection_via_startup_item.toml
@@ -0,0 +1,96 @@
+[rule]
+description = """
+Identifies the execution of an unsigned program or script from the Startup shell folder followed by an immediate network
+connection. This may indicate the presence of a malicious persistent item.
+"""
+id = "0b33141a-3f73-4414-ba90-d8410e6ab176"
+license = "Elastic License v2"
+name = "Network Connection via Startup Item"
+os_list = ["windows"]
+version = "1.0.7"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [process where event.action == "start" and
+  // unsigned program starting from startup folder
+  (process.executable : (
+   "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
+   "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")  and
+   not process.code_signature.trusted == true) or
+  // Scripts starting from startup folder
+  (process.name : ("cscript.exe", "wscript.exe", "mshta.exe", "powershell.exe") and
+   process.command_line : (
+  "*:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
+  "*:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*") )]
+ [network where true]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.005"
+name = "Mshta"
+reference = "https://attack.mitre.org/techniques/T1218/005/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_potential_persistence_via_emond.toml b/behavior/rules/persistence_potential_persistence_via_emond.toml
new file mode 100644
index 00000000..7b5ad9cb
--- /dev/null
+++ b/behavior/rules/persistence_potential_persistence_via_emond.toml
@@ -0,0 +1,69 @@
+[rule]
+description = """
+Identifies the execution of a suspicious child process of the Event Monitor Daemon (emond). Adversaries may abuse this
+service by writing a rule to execute commands when a defined event occurs, such as system start up or user
+authentication.
+"""
+id = "1cd247d8-00e8-4c62-b9ee-90cd1811460b"
+license = "Elastic License v2"
+name = "Potential Persistence via Emond"
+os_list = ["macos"]
+reference = ["https://www.xorrior.com/emond-persistence/"]
+version = "1.0.4"
+
+query = '''
+process where event.type == "start" and
+ process.parent.name : "emond" and
+ process.name : (
+   "bash",
+   "dash",
+   "sh",
+   "tcsh",
+   "csh",
+   "zsh",
+   "ksh",
+   "fish",
+   "Python",
+   "python*",
+   "perl*",
+   "php*",
+   "osascript",
+   "pwsh",
+   "curl",
+   "wget",
+   "cp",
+   "mv",
+   "touch",
+   "echo",
+   "base64",
+   "launchctl",
+   "ruby*",
+   "node*",
+   "tcl*")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1546"
+name = "Event Triggered Execution"
+reference = "https://attack.mitre.org/techniques/T1546/"
+[[threat.technique.subtechnique]]
+id = "T1546.014"
+name = "Emond"
+reference = "https://attack.mitre.org/techniques/T1546/014/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_registry_persistence_via_microsoft_office_descendant_process.toml b/behavior/rules/persistence_registry_persistence_via_microsoft_office_descendant_process.toml
new file mode 100644
index 00000000..c84e4cab
--- /dev/null
+++ b/behavior/rules/persistence_registry_persistence_via_microsoft_office_descendant_process.toml
@@ -0,0 +1,105 @@
+[rule]
+description = """
+Identifies the modification of common AutoStart related registry keys descending from a Microsoft Office process.
+Adversaries may use this technique to maintain persistence.
+"""
+id = "999e7a9a-334f-4b74-834f-a652f91531f2"
+license = "Elastic License v2"
+name = "Registry Persistence via Microsoft Office Descendant Process"
+os_list = ["windows"]
+reference = ["https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ee851671(v=msdn.10)"]
+version = "1.0.9"
+
+query = '''
+sequence by process.entity_id with maxspan=5m
+  [process where event.action == "start" and
+    (process.parent.name : ("EQNEDT32.EXE", "WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") or
+      descendant of [process where event.action == "start" and
+                    process.name :
+                          ("EQNEDT32.EXE",
+                          "WINWORD.EXE",
+                          "EXCEL.EXE",
+                          "POWERPNT.EXE",
+                          "MSPUB.EXE",
+                          "MSACCESS.EXE")]) and
+    /* Issue #303 */
+    not process.Ext.token.integrity_level_name == "system" and
+    not (process.code_signature.trusted == true)
+  ]
+  [registry where registry.data.strings != null and
+    registry.path : (
+      "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+      "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\*",
+      "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\*",
+      "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+      "HKEY_USERS\\*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\\*",
+      "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
+      "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun"
+      )
+  ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1112"
+name = "Modify Registry"
+reference = "https://attack.mitre.org/techniques/T1112/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_registry_run_key_modified_by_unusual_process.toml b/behavior/rules/persistence_registry_run_key_modified_by_unusual_process.toml
new file mode 100644
index 00000000..d8a740e2
--- /dev/null
+++ b/behavior/rules/persistence_registry_run_key_modified_by_unusual_process.toml
@@ -0,0 +1,125 @@
+[rule]
+description = """
+Identifies trusted Windows processes that rarely modify the Run and RunOnce keys. Run and RunOnce registry keys cause
+programs to run each time that a user logs on and are often abused by adversaries to maintain persistence on an
+endpoint.
+"""
+id = "b2fcbb09-d9bd-4f6c-a08e-247548b4edcd"
+license = "Elastic License v2"
+name = "Registry Run Key Modified by Unusual Process"
+os_list = ["windows"]
+reference = ["https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys"]
+version = "1.0.8"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+  [process where event.action == "start" and process.executable : "?:\\Windows\\*" and not
+    process.executable :
+             ("?:\\Windows\\SysWOW64\\msiexec.exe",
+              "?:\\Windows\\System32\\msiexec.exe",
+              "?:\\Windows\\System32\\drvinst.exe",
+              "?:\\Windows\\System32\\WinSAT.exe",
+              "?:\\Windows\\System32\\reg.exe",
+              "?:\\Windows\\regedit.exe",
+              "?:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil*_*.exe",
+              "?:\\Windows\\SysWOW64\\reg.exe",
+              "?:\\Windows\\System32\\csrss.exe",
+              "?:\\Windows\\SysWOW64\\DriverStore\\*.exe",
+              "?:\\Windows\\System32\\DriverStore\\*.exe",
+              "?:\\Windows\\Installer\\*.exe",
+              "?:\\Windows\\IMECache\\*.exe",
+              "?:\\Windows\\System32\\sihost.exe",
+              "?:\\Windows\\System32\\Speech\\SpeechUX\\SpeechUXWiz.exe",
+              "?:\\Windows\\System32\\CompPkgSrv.exe",
+              "?:\\Windows\\SysWOW64\\prevhost.exe",
+              "?:\\Windows\\System32\\conhost.exe",
+              "?:\\Windows\\System32\\taskhostw.exe",
+              /* Issue #291 */
+              "?:\\Windows\\System32\\svchost.exe",
+              "?:\\Windows\\System32\\MRT.exe",
+              "?:\\Windows\\explorer.exe",
+              "?:\\Windows\\Temp\\*",
+              "?:\\Windows\\Downloaded Program Files\\*.exe",
+              "?:\\Windows\\ccmsetup\\*.exe",
+              "?:\\Windows\\CCM\\*",
+              "?:\\Windows\\ccmcache\\*",
+              "?:\\Windows\\Installer\\*",
+              "?:\\Windows\\SysWOW64\\config\\systemprofile\\*.exe",
+              "?:\\Windows\\System32\\config\\systemprofile\\*.exe",
+              "?:\\Windows\\System32\\WindowsPowerShell\\v*\\powershell*.exe",
+              "?:\\Windows\\SoftwareDistribution\\Download\\*.exe",
+              "?:\\Windows\\Samsung\\PanelMgr\\SSMMgr.exe",
+              "?:\\Windows\\SysWOW64\\d3con.exe",
+              "?:\\WINDOWS\\SysWOW64\\DWRCS.EXE",
+              "?:\\WINDOWS\\splwow64.exe",
+              "?:\\Windows\\Xerox\\PanelMgr\\SSMMgr.exe",
+              "?:\\Windows\\System32\\PrintIsolationHost.exe",
+              "?:\\windows\\syswow64\\d3con.exe",
+              "?:\\Windows\\Xerox\\PanelMgr\\SSMMgr.exe",
+              "?:\\Windows\\System32\\ZXPPlvAsyncUIClient.exe",
+              "?:\\Windows\\System32\\wsmprovhost.exe",
+              "?:\\Windows\\System32\\wmiprvse.exe",
+              "?:\\Windows\\System32\\userinit.exe") and
+   not (process.name : "rundll32.exe" and process.command_line : ("*\\Windows\\Downloaded Program Files\\*", "*zzzzInvokeManagedCustomActionOutOfProc*")) and
+   not (process.name : ("powershell.exe", "cscript.exe", "wscript.exe") and process.parent.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe")) and
+   not (process.pe.original_file_name == "NKHlp.exe" and process.code_signature.subject_name == "DBS AG" and process.code_signature.trusted == true) and
+   not (process.executable : "*\\WINDOWS\\system32\\mmc.exe" and process.args : "?:\\Windows\\System32\\gpme.msc") and
+   not process.Ext.token.integrity_level_name == "system" and
+   not (process.pe.original_file_name : "NKInstallOnShutdownComm.exe" and
+        process.code_signature.subject_name : "DBS AG" and process.code_signature.trusted == true) and
+   not (process.code_signature.subject_name : "Microsoft Windows Hardware Compatibility Publisher" and process.code_signature.trusted == true) and
+   not (process.executable : "?:\\WINDOWS\\system32\\wsl.exe" and process.args : "--install") and
+   not (process.name : "rundll32.exe" and process.args : "?:\\Windows\\system32\\Speech\\SpeechUX\\sapi.cpl")
+   ]
+  [registry where registry.data.strings != null and
+    registry.path : (
+      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+      "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+      "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*"
+    ) and not
+    registry.data.strings : (
+      "grpconv -o",
+      "?:\\Windows\\System32\\StikyNot.exe",
+      "ctfmon.exe /n",
+      "netsh.exe trace postreset",
+      "\"?:\\Windows\\System32\\RtkAudUService64.exe*-background",
+      "%WINDIR%\\system32\\BitLockerWizardElev.exe *Volume{*",
+      "?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\*",
+      "?:\\Program Files (x86)\\*.exe",
+      "?:\\Program Files\\*.exe",
+      "*\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*",
+      /* Issue #291 */
+      "*\\Windows\\Downloaded Program Files\\*",
+      "*%ProgramFiles%*",
+      "rundll32.exe ?:\\WINDOWS\\system32\\eed_ec.dll,SpeedLauncher",
+      "*:\\Program Files (x86)\\*",
+      "*:\\Program Files\\*"
+    )]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_registry_run_key_prefixed_with_asterisk.toml b/behavior/rules/persistence_registry_run_key_prefixed_with_asterisk.toml
new file mode 100644
index 00000000..7db06920
--- /dev/null
+++ b/behavior/rules/persistence_registry_run_key_prefixed_with_asterisk.toml
@@ -0,0 +1,65 @@
+[rule]
+description = """
+Run and RunOnce registry keys cause programs to run each time that a user logs on. By default, these keys are ignored
+when the computer is started in Safe Mode. The value name of RunOnce keys can be prefixed with an asterisk (*) to force
+the program to run even in Safe Mode. Attackers have been observed in the wild using this technique to execute
+ransomware in Safe Mode.
+"""
+id = "94d35931-5c48-49ed-8c18-d601c4f8aeaa"
+license = "Elastic License v2"
+name = "Registry Run Key Prefixed with Asterisk"
+os_list = ["windows"]
+reference = [
+    "https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys",
+    "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/",
+]
+version = "1.0.10"
+
+query = '''
+registry where registry.data.strings != null and
+    user.id : "S-1-5-21*" and
+    registry.path : (
+      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+      "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+      "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+      "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+      "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*"
+    ) and
+  startswith(registry.value, "*") and
+  /* Issue #318 */
+  not (process.name : "Lmi_*.exe" and registry.value : "*LogMeInRescue*") and
+  not (process.name : "G2AC_LauncherCustomer.exe" and registry.value : "*GoToAssist*") and
+  not process.executable :
+           ("?:\\Windows\\System32\\mmc.exe",
+            "?:\\WINDOWS\\system32\\rstrui.exe",
+            "?:\\Program Files (x86)\\*.exe",
+            "?:\\Program Files\\*.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_script_file_written_to_startup_folder.toml b/behavior/rules/persistence_script_file_written_to_startup_folder.toml
new file mode 100644
index 00000000..eb161915
--- /dev/null
+++ b/behavior/rules/persistence_script_file_written_to_startup_folder.toml
@@ -0,0 +1,45 @@
+[rule]
+description = """
+Identifies suspicious Windows script file extensions written to the startup folder. Adversaries may use this technique
+to maintain persistence.
+"""
+id = "dec8781c-ef73-4037-9684-ef28c0322fa4"
+license = "Elastic License v2"
+name = "Script File Written to Startup Folder"
+os_list = ["windows"]
+version = "1.0.11"
+
+query = '''
+file where event.action != "deletion" and
+  file.extension : ("js", "vbs") and file.name != null and user.id : "S-1-5-21*" and
+  file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
+               "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
+  not process.code_signature.trusted == true and
+  not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[internal]
+min_endpoint_version = "8.0.0"
diff --git a/behavior/rules/persistence_script_interpreter_process_writing_to_commonly_abused_persistence_locations.toml b/behavior/rules/persistence_script_interpreter_process_writing_to_commonly_abused_persistence_locations.toml
new file mode 100644
index 00000000..b7eb19db
--- /dev/null
+++ b/behavior/rules/persistence_script_interpreter_process_writing_to_commonly_abused_persistence_locations.toml
@@ -0,0 +1,98 @@
+[rule]
+description = """
+Identifies a Windows script interpreter writing to two persistence locations (registry run keys and startup folder).
+Adversaries may use this technique to maintain multiple methods of persistence on an endpoint.
+"""
+id = "be42f9fc-bdca-41cd-b125-f223d09eef69"
+license = "Elastic License v2"
+name = "Script Interpreter Process Writing to Commonly Abused Persistence Locations"
+os_list = ["windows"]
+reference = ["https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ee851671(v=msdn.10)"]
+version = "1.0.8"
+
+query = '''
+sequence by process.entity_id with maxspan=5m
+  [process where event.action == "start" and
+   process.pe.original_file_name : ("cscript.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "mshta.exe")]
+  [any where event.category : ("registry", "file") and event.action != "deletion" and
+   (
+    (registry.data.strings != null and
+     registry.path :
+            ("*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+             "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+             "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+             "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+             "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+             "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+             "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*")) or
+    (file.name != null and file.path : "?:\\*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")
+   )
+   ]
+ [any where event.category : ("registry", "file") and event.action != "deletion" and
+   (
+    (registry.data.strings != null and
+     registry.path :
+            ("*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+             "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+             "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+             "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+             "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+             "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+             "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*")) or
+    (file.name != null and file.path : "?:\\*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")
+   )
+   ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_startup_persistence_via_microsoft_office_descendant_process.toml b/behavior/rules/persistence_startup_persistence_via_microsoft_office_descendant_process.toml
new file mode 100644
index 00000000..5182bbd6
--- /dev/null
+++ b/behavior/rules/persistence_startup_persistence_via_microsoft_office_descendant_process.toml
@@ -0,0 +1,79 @@
+[rule]
+description = """
+Identifies files written to or modified in the startup folder by a Microsoft Office descendant process. Adversaries may
+use this technique to maintain persistence and to avoid spawning suspicious child processes in an attempt to evade
+detection.
+"""
+id = "c01cddb6-bbcf-437c-8256-6b4d44c6bdc3"
+license = "Elastic License v2"
+name = "Startup Persistence via Microsoft Office Descendant Process"
+os_list = ["windows"]
+version = "1.0.10"
+
+query = '''
+sequence by process.entity_id with maxspan=5m
+ [process where event.action == "start" and
+  (process.parent.name : ("EQNEDT32.EXE", "WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") or
+   descendant of [process where event.action == "start" and
+                  process.name :
+                       ("EQNEDT32.EXE",
+                        "WINWORD.EXE",
+                        "EXCEL.EXE",
+                        "POWERPNT.EXE",
+                        "MSPUB.EXE",
+                        "MSACCESS.EXE")]) and
+   /* Issue #334 */
+   not process.Ext.token.integrity_level_name == "system" and
+   /* Issue #409 */
+   not (process.code_signature.subject_name != null and process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true) and
+   not (process.name : "rundll32.exe" and process.args : "?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\*" and process.working_directory : "?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\*")
+   ]
+ [file where event.action != "deletion" and
+  file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
+               "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
+  /* Issue #334 */
+  not file.name : "desktop.ini"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_startup_persistence_via_unusual_process.toml b/behavior/rules/persistence_startup_persistence_via_unusual_process.toml
new file mode 100644
index 00000000..3fcf3235
--- /dev/null
+++ b/behavior/rules/persistence_startup_persistence_via_unusual_process.toml
@@ -0,0 +1,63 @@
+[rule]
+description = """
+Identifies files written to or modified in the startup folder by an unusual Microsoft process. Adversaries may use this
+technique to maintain persistence.
+"""
+id = "95d13ce1-ffb2-4be8-a56e-cc9a891e81e2"
+license = "Elastic License v2"
+name = "Startup Persistence via Unusual Process"
+os_list = ["windows"]
+version = "1.0.10"
+
+query = '''
+file where event.action != "deletion" and
+  file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
+               "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
+  process.executable : "?:\\Windows\\*" and
+  /* Issue #297 */
+  not file.name : "desktop.ini" and
+  not process.executable : "?:\\Windows\\Application Compatibility Scripts\\acregl.exe" and
+  not process.executable : "?:\\Windows\\Temp\\*.exe" and
+  not user.id : "S-1-5-18" and
+  not process.name :
+           ("wscript.exe",
+            "cscript.exe",
+            "powershell.exe",
+            "explorer.exe",
+            "dllhost.exe",
+            "notepad.exe",
+            "cmd.exe",
+            "Robocopy.exe",
+            "wuauclt.exe",
+            "msiexec.exe",
+            "CompPkgSrv.exe") and
+  not (process.executable : "?:\\Windows\\System32\\svchost.exe" and process.parent.pid < 1500) and
+  not (process.name : "rundll32.exe" and file.name : (" *HP Desk*.lnk", "*HP Office*.lnk", "*HP Photosmart*.lnk")) and
+  not (process.name : "svchost.exe" and event.action == "overwrite")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_startup_persistence_via_windows_script_interpreter.toml b/behavior/rules/persistence_startup_persistence_via_windows_script_interpreter.toml
new file mode 100644
index 00000000..d006f99b
--- /dev/null
+++ b/behavior/rules/persistence_startup_persistence_via_windows_script_interpreter.toml
@@ -0,0 +1,91 @@
+[rule]
+description = """
+Identifies modification of startup persistence locations (registry run keys and startup folder) by a Windows script
+interpreter. Adversaries may use this technique to maintain persistence.
+"""
+id = "a85000c8-3eac-413b-8353-079343c2b6f0"
+license = "Elastic License v2"
+name = "Startup Persistence via Windows Script Interpreter"
+os_list = ["windows"]
+reference = ["https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ee851671(v=msdn.10)"]
+version = "1.0.8"
+
+query = '''
+sequence by process.entity_id with maxspan=2m
+ [process where event.action : "start" and
+  process.pe.original_file_name : ("wscript.exe", "cscript.exe", "powershell.exe", "mshta.exe", "pwsh.exe") and
+  not process.Ext.token.integrity_level_name == "system" and
+  not process.command_line : ("*:\\Program Files\\*.exe", "*:\\Program Files (x86)\\*.exe", "*\\\\*\\SYSVOL\\*")
+  ]
+ [any where event.category : ("registry", "file") and event.action != "deletion" and
+   (
+    (file.name != null and file.path : "?:\\*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*") or
+    (registry.data.strings != null and
+     registry.path : (
+      "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+      "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+      "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+      "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+      "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+      "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+      "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*") and not
+     registry.data.strings :
+                   ("*%ProgramFiles%*",
+                    "*:\\Program Files\\*",
+                    "*:\\Program Files (x86)\\*"))
+   )
+  ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_suspicious_property_list_file_creation_or_modification.toml b/behavior/rules/persistence_suspicious_property_list_file_creation_or_modification.toml
new file mode 100644
index 00000000..cd1c1f04
--- /dev/null
+++ b/behavior/rules/persistence_suspicious_property_list_file_creation_or_modification.toml
@@ -0,0 +1,68 @@
+[rule]
+description = """
+Identifies when a Property List (plist) file is created or modified in a LaunchAgents directory using the built-in
+PlistBuddy utility. An adversary may attempt to evade detection by using PlistBuddy to build a plist file line by line
+or modify an existing plist file. Adversaries may create or modify launch agents to repeatedly execute malicious
+payloads and maintain persistence.
+"""
+id = "901f0c30-a7c5-40a5-80e3-a50c6714432f"
+license = "Elastic License v2"
+name = "Suspicious Property List File Creation or Modification"
+os_list = ["macos"]
+reference = ["https://redcanary.com/blog/clipping-silver-sparrows-wings/"]
+version = "1.0.7"
+
+query = '''
+sequence by user.id with maxspan=5m
+  [process where event.action == "exec" and
+    process.name : "plistbuddy" and
+    process.command_line : "*RunAtLoad *LaunchAgents*" and
+    /* Issue #649 */
+    not (process.args : "/Library/LaunchAgents/com.microsoft.OneDriveStandaloneUpdater.plist" and
+         process.args : "*/Applications/OneDrive.app/Contents/StandaloneUpdater.app/Contents/MacOS/OneDriveStandaloneUpdater*")
+   ]
+  [process where event.action == "exec" and
+    process.name : "plistbuddy" and
+    process.command_line : "*ProgramArguments*"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1543"
+name = "Create or Modify System Process"
+reference = "https://attack.mitre.org/techniques/T1543/"
+[[threat.technique.subtechnique]]
+id = "T1543.001"
+name = "Launch Agent"
+reference = "https://attack.mitre.org/techniques/T1543/001/"
+
+
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.011"
+name = "Plist Modification"
+reference = "https://attack.mitre.org/techniques/T1547/011/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_suspicious_scheduled_task_creation.toml b/behavior/rules/persistence_suspicious_scheduled_task_creation.toml
new file mode 100644
index 00000000..b69bba04
--- /dev/null
+++ b/behavior/rules/persistence_suspicious_scheduled_task_creation.toml
@@ -0,0 +1,62 @@
+[rule]
+description = """
+Identifies the creation of a scheduled task with suspicious argument such as task path or parent process. This behavior
+is consistent with an adversary attempting to establish persistence.
+"""
+id = "beebd95c-93f4-46d2-a902-053bfe78686b"
+license = "Elastic License v2"
+name = "Suspicious Scheduled Task Creation"
+os_list = ["windows"]
+reference = ["https://docs.microsoft.com/en-us/windows/win32/taskschd"]
+version = "1.0.4"
+
+query = '''
+process where event.action == "start" and
+  process.pe.original_file_name : "schtasks.exe" and
+  not process.Ext.token.integrity_level_name == "system" and
+  process.args : ("/create", "-create") and process.args : "/tr" and
+  not process.command_line : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*") and
+  not process.Ext.token.integrity_level_name == "system" and
+  (
+   (process.args : "minute" and process.args : "/mo" and
+    process.args : ("*\\AppData\\*", "*\\ProgramData\\*", "*Users\\Public\\*") and
+    process.parent.name : ("wscript.exe", "RegSvcs.exe", "regsvr32.exe")) or
+
+   (process.args : "HIGHEST" and process.args : "ONLOGON" and
+    process.parent.name : ("wmiprvse.exe", "rundll32.exe", "regsvr32.exe") and
+    not process.parent.command_line : "*rundll32*zzzzInvokeManagedCustomActionOutOfProc*") or
+
+   (process.args : ("onlogon", "minute", "onstart", "daily", "once") and
+    process.parent.name : "cmd.exe" and process.parent.command_line : "*schtasks*" and
+    descendant of [process where event.action == "start" and not process.code_signature.trusted == true]) or
+
+   (process.args : ("SYSTEM", "NT AUTHORITY\\SYSTEM") and process.args : "/ru" and
+    process.command_line : ("*vssadmin*Delete*Shadows*", "*wmic*shadowcopy*", "*regsvr32*-s*"))
+  )
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1053"
+name = "Scheduled Task/Job"
+reference = "https://attack.mitre.org/techniques/T1053/"
+[[threat.technique.subtechnique]]
+id = "T1053.005"
+name = "Scheduled Task"
+reference = "https://attack.mitre.org/techniques/T1053/005/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml b/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml
new file mode 100644
index 00000000..f25c3202
--- /dev/null
+++ b/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml
@@ -0,0 +1,72 @@
+[rule]
+description = """
+Identifies the creation of a scheduled task using an XML file that does not have a .xml file extension. This behavior is
+consistent with an adversary attempting to establish persistence in a stealthy manner to evade detection.
+"""
+id = "1efc0496-106b-4c09-b99b-91cdd17ba7b3"
+license = "Elastic License v2"
+name = "Suspicious Scheduled Task Creation via Masqueraded XML File"
+os_list = ["windows"]
+reference = ["https://docs.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-"]
+version = "1.0.8"
+
+query = '''
+process where event.action == "start" and
+  process.pe.original_file_name : "schtasks.exe" and
+  process.args : ("/create", "-create") and
+  process.args : ("/xml", "-xml") and
+  not process.command_line : "*.xml*" and
+  not process.Ext.token.integrity_level_name == "system" and
+  not process.parent.executable : 
+             ("?:\\ProgramData\\OEM\\UpgradeTool\\CareCenter_*\\BUnzip\\Setup_msi.exe", 
+              "?:\\Program Files\\Axis Communications\\AXIS Camera Station\\SetupActions.exe",
+              "?:\\Program Files (x86)\\Zemana\\AntiMalware\\AntiMalware.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1053"
+name = "Scheduled Task/Job"
+reference = "https://attack.mitre.org/techniques/T1053/"
+[[threat.technique.subtechnique]]
+id = "T1053.005"
+name = "Scheduled Task"
+reference = "https://attack.mitre.org/techniques/T1053/005/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1036"
+name = "Masquerading"
+reference = "https://attack.mitre.org/techniques/T1036/"
+[[threat.technique.subtechnique]]
+id = "T1036.005"
+name = "Match Legitimate Name or Location"
+reference = "https://attack.mitre.org/techniques/T1036/005/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_suspicious_string_value_written_to_registry_run_key.toml b/behavior/rules/persistence_suspicious_string_value_written_to_registry_run_key.toml
new file mode 100644
index 00000000..3e594b60
--- /dev/null
+++ b/behavior/rules/persistence_suspicious_string_value_written_to_registry_run_key.toml
@@ -0,0 +1,131 @@
+[rule]
+description = """
+Identifies when suspicious values are written to Run and RunOnce registry keys via signed binaries. Run and RunOnce
+registry keys cause programs to run each time that a user logs on and are often abused by adversaries to maintain
+persistence on an endpoint.
+"""
+id = "727db78e-e1dd-4bc0-89b0-885cd99e069e"
+license = "Elastic License v2"
+name = "Suspicious String Value Written to Registry Run Key"
+os_list = ["windows"]
+reference = ["https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys"]
+version = "1.0.10"
+
+query = '''
+registry where registry.data.strings != null and
+  user.id : "S-1-5-21*" and
+  registry.path : (
+      "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+      "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+      "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+      "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*") and
+  not process.executable :
+           ("?:\\Windows\\SysWOW64\\msiexec.exe",
+	    "?:\\Windows\\system32\\msiexec.exe",
+	    "?:\\Windows\\SysWOW64\\Macromed\\Flash\\*.exe",
+	    "?:\\Windows\\Downloaded Program Files\\*.exe",
+	    "?:\\Windows\\system32\\spool\\DRIVERS\\*",
+	    "?:\\Windows\\system32\\mmc.exe",
+	    "?:\\Windows\\Samsung\\PanelMgr\\SSMMgr.exe",
+	    "?:\\Windows\\System32\\wsl.exe",
+	    "?:\\Windows\\SysWOW64\\d3con.exe",
+	    "?:\\Windows\\System32\\StikyNot.exe",
+	    "?:\\WINDOWS\\splwow64.exe",
+	    "?:\\Program Files\\*.exe",
+	    "?:\\Program Files (x86)\\*.exe",
+	    "?:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil*_Plugin.exe") and
+  not (process.name : "cscript.exe" and registry.value : "ContingencyUninstallNXTSForCurrentUser") and
+  not (process.name : "ZoomInfoContactContributor*.exe" and registry.value : "ZoomInfo Contact Contributor") and
+  not (process.name : "rundll32.exe" and registry.value : ("bit4id csp store register*", "SafeDiveCertMgm")) and
+  not (process.name : ("bomgar-scc.exe", "ThinkGear Connector.exe") and registry.value : ("Bomgar_Cleanup_*", "ThinkGear Connector")) and
+  registry.data.strings :
+            ("*rundll32*",
+             "*regsvr32*",
+             "*mshta*",
+             "*msbuild*",
+             "*RegAsm*",
+             "*RegSvcs*",
+             "*InstallUtil*",
+             "*cscript*",
+             "*wscript*",
+             "*.js?",
+             "*.js",
+             "*.vbs?",
+             "*.vbs",
+             "*.vbe?",
+             "*.vbe",
+             "*.bat?",
+             "*.bat",
+             "*.url",
+             "*.url?",
+             "*.lnk",
+             "*.lnk?",
+             "*msxsl*",
+             "*cmstp*",
+             "*cerutil*",
+             "*bitsadmin*",
+             "*msiexec*",
+             "*wmic*",
+             "*powershell*",
+             "*cmd.exe *",
+             "*svchost*",
+             "*lsass*",
+             "*csrss*",
+             "*winlogon*",
+             "*Microsoft.Workflow.Compiler.exe*",
+             "*VBScript.Encode*",
+             "*http://*",
+             "*WScript.Shell*",
+             "*VBScript.Encode*",
+             "*:\\Users\\Public\\*",
+             "*:\\Users\\*\\Documents\\*",
+             "*:\\Documents and Settings\\*",
+             "*:\\Users\\*\\Pictures\\*",
+             "*:\\Users\\*\\Music\\*",
+             "*:\\Users\\*\\Pictures\\*",
+             "*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*") and not
+    registry.data.strings :
+                   ("*rundll32.exe*advpack.dll,DelNodeRunDLL32*",
+                    "*LogiLDA.dll,LogiFetch*",
+                    "*\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*",
+                    "*%ProgramFiles%*",
+                    "*:\\Program Files\\*",
+                    "*:\\Program Files (x86)\\*",
+                    "*:\\Windows\\SystemApps\\*",
+                    "*:\\Windows\\System32\\DriverStore\\*",
+                    "*:\\WINDOWS\\Speech\\*",
+                    "*:\\WINDOWS\\System32\\RtkAudUService*",
+                    "*:\\WINDOWS\\system32\\SecurityHealthSystray.exe",
+                    "*restartSAPinst.vbs*",
+                    /* Issue #324 */
+                    "*\\Windows\\Downloaded Program Files\\*",
+                    "*\\Windows\\SysWOW64\\Macromed\\*",
+                    "*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.lnk*",
+                    "*\\Pictures\\*com_Internet_Download_Manager*")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_untrusted_process_writing_to_commonly_abused_persistence_locations.toml b/behavior/rules/persistence_untrusted_process_writing_to_commonly_abused_persistence_locations.toml
new file mode 100644
index 00000000..dd74939f
--- /dev/null
+++ b/behavior/rules/persistence_untrusted_process_writing_to_commonly_abused_persistence_locations.toml
@@ -0,0 +1,73 @@
+[rule]
+description = """
+Identifies the execution of an untrusted program with two persistence locations (registry run keys and startup folder).
+Adversaries may use this technique to maintain multiple methods of persistence on an endpoint.
+"""
+id = "392b0c89-1427-4601-8b32-01e8e40600a6"
+license = "Elastic License v2"
+name = "Untrusted Process Writing to Commonly Abused Persistence Locations"
+os_list = ["windows"]
+reference = ["https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ee851671(v=msdn.10)"]
+version = "1.0.10"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+  [registry where
+   user.id : "S-1-5-21*" and
+   registry.path :
+            ("H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+             "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+             "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+             "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+             /* Issue #320 */
+             "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript",
+             "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
+             "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell") and
+   registry.data.strings != null and
+   not registry.data.strings : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*") and
+   not process.executable :
+                        ("?:\\Program Files\\*",
+                         "?:\\Program Files (x86)\\*",
+                         "?:\\programdata\\chocolatey\\*\\multiclip.exe",
+                         "?:\\Users\\*\\AppData\\Local\\Temp\\*.tmp\\*.tmp")]
+  [file where event.action != "deletion" and
+   file.path : "?:\\*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" and file.name != null]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1112"
+name = "Modify Registry"
+reference = "https://attack.mitre.org/techniques/T1112/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/persistence_unusual_file_written_or_modified_in_startup_folder.toml b/behavior/rules/persistence_unusual_file_written_or_modified_in_startup_folder.toml
new file mode 100644
index 00000000..b1620b4b
--- /dev/null
+++ b/behavior/rules/persistence_unusual_file_written_or_modified_in_startup_folder.toml
@@ -0,0 +1,89 @@
+[rule]
+description = """
+Identifies suspicious file extensions or names written to the startup folder. Adversaries may use this technique to
+maintain persistence.
+"""
+id = "30a90136-7831-41c3-a2aa-1a303c1186ac"
+license = "Elastic License v2"
+name = "Unusual File Written or Modified in Startup Folder"
+os_list = ["windows"]
+version = "1.0.10"
+
+query = '''
+file where event.action != "deletion" and
+  process.pid != 4 and
+  file.name != null and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+  file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
+               "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
+  (
+   /* file extensions rarely written to Startup folder by legit installers */
+   file.extension : ("exe", "com", "scr", "dll", "hta", "bat", "ps1", "cmd", "url", "wsh", "wsf", "vbe", "jse", "sick", "png", "jpg") or
+
+   /* suspicious file names */
+   length(file.name) <= 6 or
+   file.name :
+        ("*Microsoft*",
+         "*fuck*",
+         "*:*",
+         "*.*.",
+         "*update*",
+         "*windows*",
+         "*setup*",
+         "*googl*",
+         "*adobe*",
+         "*chrome*")
+   ) and
+   not process.executable :
+               ("?:\\Windows\\SysWOW64\\msiexec.exe",
+                "?:\\Windows\\system32\\msiexec.exe",
+                "?:\\Windows\\explorer.exe",
+                "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
+                "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*.exe",
+                "?:\\Program Files\\Windows Defender Advanced Threat Protection\\*.exe",
+                "?:\\Program Files\\*.exe",
+                "?:\\Program Files (x86)\\*.exe") and
+    not (process.executable : "?:\\Windows\\System32\\cmd.exe" and file.extension : "cmd")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1036"
+name = "Masquerading"
+reference = "https://attack.mitre.org/techniques/T1036/"
+[[threat.technique.subtechnique]]
+id = "T1036.005"
+name = "Match Legitimate Name or Location"
+reference = "https://attack.mitre.org/techniques/T1036/005/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/persistence_unusual_startup_shell_folder_modification.toml b/behavior/rules/persistence_unusual_startup_shell_folder_modification.toml
new file mode 100644
index 00000000..c9abd8b7
--- /dev/null
+++ b/behavior/rules/persistence_unusual_startup_shell_folder_modification.toml
@@ -0,0 +1,73 @@
+[rule]
+description = """
+Identifies suspicious startup shell folder modifications. An adversary may attempt to change the default startup
+directory in order to bypass detections that monitor for suspicious file creation events in the default Windows Startup
+folder.
+"""
+id = "377aad38-24e0-4dd7-93c2-bd231cb749e3"
+license = "Elastic License v2"
+name = "Unusual Startup Shell Folder Modification"
+os_list = ["windows"]
+version = "1.0.10"
+
+query = '''
+registry where
+  user.id : "S-1-5-21-*" and
+  registry.path : (
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Startup",
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup"
+     ) and
+  registry.data.strings != null and
+   // Normal Startup Folder Paths
+   not registry.data.strings :  (
+           "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "\\\\*"
+           ) and
+   not process.executable :
+             ("?:\\Windows\\explorer.exe",
+              "?:\\Windows\\System32\\regsvr32.exe",
+              "?:\\Windows\\System32\\runonce.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1547"
+name = "Boot or Logon Autostart Execution"
+reference = "https://attack.mitre.org/techniques/T1547/"
+[[threat.technique.subtechnique]]
+id = "T1547.001"
+name = "Registry Run Keys / Startup Folder"
+reference = "https://attack.mitre.org/techniques/T1547/001/"
+
+
+
+[threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1112"
+name = "Modify Registry"
+reference = "https://attack.mitre.org/techniques/T1112/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_elevated_execution_via_shellexecute_runas_administrator.toml b/behavior/rules/privilege_escalation_elevated_execution_via_shellexecute_runas_administrator.toml
new file mode 100644
index 00000000..0bcb635e
--- /dev/null
+++ b/behavior/rules/privilege_escalation_elevated_execution_via_shellexecute_runas_administrator.toml
@@ -0,0 +1,130 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via ShellExecute RunAS method. Attackers may attempt to bypass
+UAC to execute code with high integrity via malicious documents or scripts.
+"""
+id = "7609ebb3-0154-431b-badc-264b10527d13"
+license = "Elastic License v2"
+name = "Elevated Execution via ShellExecute RunAs Administrator"
+os_list = ["windows"]
+reference = [
+    "https://www.winhelponline.com/blog/vbscripts-and-uac-elevation/",
+    "https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/main/src/ShellApplication_ShellExecute_privileged.vba",
+]
+version = "1.0.6"
+
+query = '''
+sequence with maxspan=5m
+ [process where event.action == "start" and
+  process.name : ("WINWORD.EXE",
+                  "EXCEL.EXE",
+                  "POWERPNT.EXE",
+                  "MSACCESS.EXE",
+                  "cscript.exe",
+                  "mshta.exe") and
+  process.Ext.token.integrity_level_name == "medium"] by process.entity_id
+ [process where event.action == "start" and
+  /*
+    processes started via ShellApplication.ShellExecute.runas
+    will have high integrity and real parent set to AppInfo
+  */
+  process.Ext.token.integrity_level_name == "high" and process.parent.Ext.real.pid > 0 and
+
+  not (process.pe.original_file_name == "OfficeC2RClient.exe" and
+       process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) and
+
+  not (process.pe.original_file_name == "Acrobat.exe" and
+       process.code_signature.subject_name == "Adobe Inc." and process.code_signature.trusted == true) and
+
+  not process.executable : ("?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
+                            "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
+                            "?:\\Program Files\\Mozilla Firefox\\firefox.exe")
+  ] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1566"
+name = "Phishing"
+reference = "https://attack.mitre.org/techniques/T1566/"
+[[threat.technique.subtechnique]]
+id = "T1566.001"
+name = "Spearphishing Attachment"
+reference = "https://attack.mitre.org/techniques/T1566/001/"
+
+
+
+[threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.005"
+name = "Visual Basic"
+reference = "https://attack.mitre.org/techniques/T1059/005/"
+
+[[threat.technique.subtechnique]]
+id = "T1059.007"
+name = "JavaScript"
+reference = "https://attack.mitre.org/techniques/T1059/007/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1218"
+name = "Signed Binary Proxy Execution"
+reference = "https://attack.mitre.org/techniques/T1218/"
+[[threat.technique.subtechnique]]
+id = "T1218.005"
+name = "Mshta"
+reference = "https://attack.mitre.org/techniques/T1218/005/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_potential_privilege_escalation_via_dll_redirection.toml b/behavior/rules/privilege_escalation_potential_privilege_escalation_via_dll_redirection.toml
new file mode 100644
index 00000000..bc3d0f32
--- /dev/null
+++ b/behavior/rules/privilege_escalation_potential_privilege_escalation_via_dll_redirection.toml
@@ -0,0 +1,66 @@
+[rule]
+description = """
+Identifies attempts to load a module by a SYSTEM process and via side by side DLL redirection. This may indicate an
+attempt to elevate privileges via DLL search order hijacking.
+"""
+id = "f5dd34c1-733c-43d7-831c-a4b0affb914a"
+license = "Elastic License v2"
+name = "Potential Privilege Escalation via DLL Redirection"
+os_list = ["windows"]
+reference = [
+    "https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection",
+    "https://secret.club/2020/04/23/directory-deletion-shell.html",
+]
+version = "1.0.4"
+
+query = '''
+library where user.id : "S-1-5-18" and
+   dll.path : ("?:\\Windows\\system32\\*.exe.local\\*",
+               "?:\\Windows\\syswow64\\*.exe.local\\*",
+               "?:\\Program Files (x86)\\Microsoft\\*.exe.local\\*",
+               "?:\\Program Files\\Microsoft\\*.exe.local\\*") and
+  not (dll.code_signature.subject_name : "Microsoft *" and dll.code_signature.trusted == true) and
+  process.executable :
+               ("?:\\Windows\\system32\\*",
+                "?:\\Windows\\syswow64\\*",
+                "?:\\Program Files (x86)\\Microsoft\\*",
+                "?:\\Program Files\\Microsoft\\*")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1129"
+name = "Shared Modules"
+reference = "https://attack.mitre.org/techniques/T1129/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.001"
+name = "DLL Search Order Hijacking"
+reference = "https://attack.mitre.org/techniques/T1574/001/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation.toml b/behavior/rules/privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation.toml
new file mode 100644
index 00000000..30c6a467
--- /dev/null
+++ b/behavior/rules/privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation.toml
@@ -0,0 +1,87 @@
+[rule]
+description = """
+Identifies attempts to elevate privileges by dropping a DLL file via elevated IFileOperation (Rename, Move or Copy)
+followed by DLL side-loading into a process running with SYSTEM integrity. Attackers may attempt to hijack DLL search
+order and stealthily execute code with elevated permissions.
+"""
+id = "8b4791a8-2355-4f43-8b60-d367b5c2aa51"
+license = "Elastic License v2"
+name = "Potential Privilege Escalation via Elevated IFileOperation"
+os_list = ["windows"]
+reference = ["https://docs.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-ifileoperation"]
+version = "1.0.4"
+
+query = '''
+sequence with maxspan=1m
+  [file where event.action in ("creation", "overwrite", "rename", "modification") and
+
+   /* IFileOperation are performed by DllHost */
+   process.name : "dllhost.exe" and user.id : "S-1-5-21-*" and
+
+   /* executable file dropped via NewItem, Rename, Move or Copy IFileOperation */
+   (file.extension : "dll" or file.Ext.header_bytes : "4d5a*") and
+
+   /* protected system paths usually abused via DLL search order hijack */
+   file.path : ("?:\\Windows\\system32\\*",
+                "?:\\Windows\\syswow64\\*",
+                "?:\\Program Files (x86)\\Microsoft\\*",
+                "?:\\Program Files\\Microsoft\\*"
+                )] by file.path
+  [library where
+   /* non MS signed DLL loaded by a System Process */
+   user.id : "S-1-5-18" and
+   process.executable :
+               ("?:\\Windows\\system32\\*",
+                "?:\\Windows\\syswow64\\*",
+                "?:\\Program Files (x86)\\Microsoft\\*",
+                "?:\\Program Files\\Microsoft\\*") and
+  not (dll.code_signature.subject_name : "Microsoft *" and dll.code_signature.trusted == true)] by dll.path
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.001"
+name = "DLL Search Order Hijacking"
+reference = "https://attack.mitre.org/techniques/T1574/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1574.002"
+name = "DLL Side-Loading"
+reference = "https://attack.mitre.org/techniques/T1574/002/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/privilege_escalation_potential_privilege_escalation_via_file_redirection.toml b/behavior/rules/privilege_escalation_potential_privilege_escalation_via_file_redirection.toml
new file mode 100644
index 00000000..810f67f7
--- /dev/null
+++ b/behavior/rules/privilege_escalation_potential_privilege_escalation_via_file_redirection.toml
@@ -0,0 +1,58 @@
+[rule]
+description = """
+Identifies suspicious modification of an executable file in a protected Windows directory and by a medium or low
+integrity process. This may indicate an attempt to elevate privileges via privileged file redirection vulnerabilities or
+weak permissions.
+"""
+id = "3de7dc4a-9c3d-459d-b760-670ec240078e"
+license = "Elastic License v2"
+name = "Potential Privilege Escalation via File Redirection"
+os_list = ["windows"]
+reference = [
+    "https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html",
+    "https://i.blackhat.com/EU-21/Thursday/EU-21-Yan-From-Logic-to-Memory-Winning-the-Solitaire-in-Reparse-Points.pdf",
+]
+version = "1.0.7"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+ [process where event.action == "start" and process.Ext.token.integrity_level_name : "medium"]
+ [file where event.action != "deletion" and
+  (file.extension : ("exe", "com", "dll") or file.Ext.header_bytes : "4d5a*") and
+  file.path : ("?:\\Windows\\System32\\*", "?:\\Windows\\SysWOW64\\*", "?:\\Program Files (x86)\\Microsoft\\*", "?:\\Program Files\\Microsoft\\*") and
+  not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and process.executable != null and
+  not file.path : ("?:\\Windows\\System32\\Tasks\\*",
+                   "?:\\Windows\\SysWOW64\\wpcap.dll",
+                   "?:\\Windows\\SysWOW64\\Npcap\\wpcap.dll",
+                   "?:\\WINDOWS\\system32\\KOBDrvAPIIF.DLL",
+                   "?:\\WINDOWS\\SysWOW64\\uvxv1us.dll",
+                   "?:\\Windows\\SysWOW64\\rufus-3.18.exe",
+                   "?:\\Windows\\System32\\DriverStore\\Temp\\*.sys",
+                   "?:\\Program Files (x86)\\Microsoft\\EdgeCore\\*\\BHO\\ie_to_edge_bho.dll",
+                   "?:\\Program Files (x86)\\Microsoft\\Temp\\EU*.tmp\\msedgeupdate.dll") and
+  not (process.executable : "?:\\Windows\\splwow64.exe" and file.path : "?:\\Windows\\System32\\spool\\drivers\\*") and
+  not process.executable : ("?:\\Program Files\\Npcap\\NPFInstall.exe", "?:\\Program Files\\Wireshark\\npcap-*.exe")
+
+  ]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/privilege_escalation_potential_privilege_escalation_via_missing_dll.toml b/behavior/rules/privilege_escalation_potential_privilege_escalation_via_missing_dll.toml
new file mode 100644
index 00000000..22b38e9f
--- /dev/null
+++ b/behavior/rules/privilege_escalation_potential_privilege_escalation_via_missing_dll.toml
@@ -0,0 +1,95 @@
+[rule]
+description = """
+Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows installation (phantom DLL) or
+one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate
+privileges via privileged file write vulnerabilities.
+"""
+id = "a2a3d803-5c25-43cc-84b9-a4ae2a4dab27"
+license = "Elastic License v2"
+name = "Potential Privilege Escalation via Missing DLL"
+os_list = ["windows"]
+reference = [
+    "https://itm4n.github.io/windows-dll-hijacking-clarified/",
+    "http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html",
+    "https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html",
+    "https://shellz.club/edgegdi-dll-for-persistence-and-lateral-movement/",
+    "https://windows-internals.com/faxing-your-way-to-system/",
+    "http://waleedassar.blogspot.com/2013/01/wow64logdll.html",
+    "https://github.com/rapid7/metasploit-framework/blob/5863ff7e357af1634f5b370e811d647a9c999158/modules/exploits/windows/local/cve_2020_17136.rb#L192",
+]
+version = "1.0.10"
+
+query = '''
+sequence with maxspan=5m
+  [file where event.action != "deletion" and
+   not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+   file.name :
+        ("wlbsctrl.dll",
+         "WptsExtensions.dll",
+         "Tsmsisrv.dll",
+         "TSVIPSrv.dll",
+         "Msfte.dll",
+         "wow64log.dll",
+         "WindowsCoreDeviceInfo.dll",
+         "phoneinfo.dll",
+         "EdgeGdi.dll",
+         "cdpsgshims.dll",
+         "diagtrack_win.dll",
+         "wbemcomn.dll",
+         "Ualapi.dll",
+         "wlanhlp.dll",
+         "healthapi.dll",
+         "prntvpt.dll")] by file.name
+  [library where
+   user.id : "S-1-5-18" and
+     (
+       dll.name :
+         ("wlbsctrl.dll",
+          "WptsExtensions.dll",
+          "Tsmsisrv.dll",
+          "TSVIPSrv.dll",
+          "Msfte.dll",
+          "wow64log.dll",
+          "WindowsCoreDeviceInfo.dll",
+          "phoneinfo.dll",
+          "EdgeGdi.dll",
+          "cdpsgshims.dll",
+          "diagtrack_win.dll",
+          "wlanhlp.dll",
+          "healthapi.dll",
+          "prntvpt.dll") or
+       dll.path : ("?:\\Windows\\System32\\wbem\\wbemcomn.dll", "?:\\Windows\\SysWOW64\\wbem\\wbemcomn.dll") or
+       dll.path : ("?:\\Windows\\System32\\Ualapi.dll",
+                   "?:\\Windows\\SysWOW64\\Ualapi.dll",
+                   "?:\\Windows\\System\\Ualapi.dll",
+                   "?:\\Windows\\Ualapi.dll")
+     ) and
+     not (dll.code_signature.subject_name : "Microsoft*" and dll.code_signature.trusted == true) and
+     not dll.path : "?:\\Windows\\System32\\prntvpt.dll"] by dll.name
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.001"
+name = "DLL Search Order Hijacking"
+reference = "https://attack.mitre.org/techniques/T1574/001/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_potential_privilege_escalation_via_rogue_winrm.toml b/behavior/rules/privilege_escalation_potential_privilege_escalation_via_rogue_winrm.toml
new file mode 100644
index 00000000..09de8ece
--- /dev/null
+++ b/behavior/rules/privilege_escalation_potential_privilege_escalation_via_rogue_winrm.toml
@@ -0,0 +1,59 @@
+[rule]
+description = """
+Identifies a privilege escalation attempt via impersonation using RogueWinRM. RogueWinRM is a local privilege escalation
+exploit that allows to escalate from a Service account (with SeImpersonatePrivilege) to Local System account if the
+WinRM service is not running.
+"""
+id = "33962262-436f-43d7-86e9-06dbddfffb5d"
+license = "Elastic License v2"
+name = "Potential Privilege Escalation via Rogue WinRM"
+os_list = ["windows"]
+reference = [
+    "https://decoder.cloud/2019/12/06/we-thought-they-were-potatoes-but-they-were-beans/",
+    "https://github.com/antonioCoco/RogueWinRM",
+]
+version = "1.0.5"
+
+query = '''
+sequence with maxspan=1m
+ [network where event.action == "disconnect_received" and
+
+  /* localhost connection via WinRM default listening port */
+  destination.port == 5985 and source.port >= 49152 and
+  destination.address : ("127.*", "::1") and source.address : ("127.*", "::1") and
+  not process.executable : "?:\\Windows\\System32\\svchost.exe" and not user.id : "S-1-5-18"] by process.entity_id
+ [process where event.action == "start" and user.id : "S-1-5-18" and
+  /* started via seclogon service */
+  process.parent.Ext.real.pid > 0] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1134"
+name = "Access Token Manipulation"
+reference = "https://attack.mitre.org/techniques/T1134/"
+[[threat.technique.subtechnique]]
+id = "T1134.001"
+name = "Token Impersonation/Theft"
+reference = "https://attack.mitre.org/techniques/T1134/001/"
+
+[[threat.technique.subtechnique]]
+id = "T1134.002"
+name = "Create Process with Token"
+reference = "https://attack.mitre.org/techniques/T1134/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_potential_privilege_escalation_via_root_crontab_file_modification.toml b/behavior/rules/privilege_escalation_potential_privilege_escalation_via_root_crontab_file_modification.toml
new file mode 100644
index 00000000..b704ac2b
--- /dev/null
+++ b/behavior/rules/privilege_escalation_potential_privilege_escalation_via_root_crontab_file_modification.toml
@@ -0,0 +1,45 @@
+[rule]
+description = """
+Identifies modifications to the root crontab file. Adversaries may overwrite this file to gain code execution with root
+privileges by exploiting privileged file write or move related vulnerabilities.
+"""
+id = "31151602-1de1-4301-9b75-215ac8902b75"
+license = "Elastic License v2"
+name = "Potential Privilege Escalation via Root Crontab File Modification"
+os_list = ["macos"]
+reference = [
+    "https://phoenhex.re/2017-06-09/pwn2own-diskarbitrationd-privesc",
+    "https://www.exploit-db.com/exploits/42146",
+]
+version = "1.0.4"
+
+query = '''
+file where event.type != "deletion" and
+ file.path : "/private/var/at/tabs/root" and not process.executable : "/usr/bin/crontab"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1053"
+name = "Scheduled Task/Job"
+reference = "https://attack.mitre.org/techniques/T1053/"
+[[threat.technique.subtechnique]]
+id = "T1053.003"
+name = "Cron"
+reference = "https://attack.mitre.org/techniques/T1053/003/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_privilege_escalation_via_named_pipe_impersonation.toml b/behavior/rules/privilege_escalation_privilege_escalation_via_named_pipe_impersonation.toml
new file mode 100644
index 00000000..ef91e618
--- /dev/null
+++ b/behavior/rules/privilege_escalation_privilege_escalation_via_named_pipe_impersonation.toml
@@ -0,0 +1,40 @@
+[rule]
+description = """
+Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by
+utilizing a framework like Metasploit's getsystem command.
+"""
+id = "a0265178-779d-4bc5-b3f1-abb3bcddedab"
+license = "Elastic License v2"
+name = "Privilege Escalation via Named Pipe Impersonation"
+os_list = ["windows"]
+reference = [
+    "https://www.ired.team/offensive-security/privilege-escalation/windows-namedpipes-privilege-escalation",
+]
+version = "1.0.8"
+
+query = '''
+process where event.action == "start" and
+   process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE") and process.command_line : "*echo*>*\\\\.\\pipe\\*" and
+   not (process.command_line : "*chrome-extension://*" and process.parent.executable : "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1134"
+name = "Access Token Manipulation"
+reference = "https://attack.mitre.org/techniques/T1134/"
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_privilege_escalation_via_pkexec_exploitation.toml b/behavior/rules/privilege_escalation_privilege_escalation_via_pkexec_exploitation.toml
new file mode 100644
index 00000000..2f748dea
--- /dev/null
+++ b/behavior/rules/privilege_escalation_privilege_escalation_via_pkexec_exploitation.toml
@@ -0,0 +1,46 @@
+[rule]
+description = """
+Identifies attempt to exploit a local privilege escalation in polkit pkexec (CVE-2021-4034) via unsecure environment
+variable injection. Successful exploitation allows an unprivileged user to escalate to the root user.
+"""
+id = "30c89cc9-d93c-4134-a976-58f8413f2f32"
+license = "Elastic License v2"
+name = "Privilege Escalation via PKEXEC Exploitation"
+os_list = ["linux"]
+reference = ["https://seclists.org/oss-sec/2022/q1/80", "https://haxx.in/files/blasty-vs-pkexec.c"]
+version = "1.0.4"
+
+query = '''
+file where event.action != "deletion" and file.path : "/*GCONV_PATH*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1068"
+name = "Exploitation for Privilege Escalation"
+reference = "https://attack.mitre.org/techniques/T1068/"
+
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.007"
+name = "Path Interception by PATH Environment Variable"
+reference = "https://attack.mitre.org/techniques/T1574/007/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_privilege_escalation_via_windir_or_systemroot_environment_variable.toml b/behavior/rules/privilege_escalation_privilege_escalation_via_windir_or_systemroot_environment_variable.toml
new file mode 100644
index 00000000..451a3b03
--- /dev/null
+++ b/behavior/rules/privilege_escalation_privilege_escalation_via_windir_or_systemroot_environment_variable.toml
@@ -0,0 +1,45 @@
+[rule]
+description = """
+Identifies a privilege escalation attempt via a rogue Windows directory (Windir) or System Root environment variable.
+This is a known primitive that is often combined with other vulnerabilities to elevate privileges.
+"""
+id = "18ffee0c-5f40-4dd8-aa9a-28251a308dbc"
+license = "Elastic License v2"
+name = "Privilege Escalation via Windir or SystemRoot Environment Variable"
+os_list = ["windows"]
+reference = ["https://www.tiraniddo.dev/2017/05/exploiting-environment-variables-in.html"]
+version = "1.0.9"
+
+query = '''
+registry where registry.data.strings != null and
+ not user.id : "S-1-5-18" and
+ registry.path : ("HKEY_USERS\\*\\windir", "HKEY_USERS\\*\\systemroot") and
+ not registry.data.strings : ("?:\\windows", "?SystemRoot?") and
+ not registry.path : "HKEY_USERS\\*\\SOFTWARE\\*"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.007"
+name = "Path Interception by PATH Environment Variable"
+reference = "https://attack.mitre.org/techniques/T1574/007/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_sudo_heap_based_buffer_overflow_attempt.toml b/behavior/rules/privilege_escalation_sudo_heap_based_buffer_overflow_attempt.toml
new file mode 100644
index 00000000..e666f147
--- /dev/null
+++ b/behavior/rules/privilege_escalation_sudo_heap_based_buffer_overflow_attempt.toml
@@ -0,0 +1,65 @@
+[rule]
+description = """
+Identifies the attempted use of a heap-based buffer overflow vulnerability for the Sudo binary in Unix-like systems
+(CVE-2021-3156). Successful exploitation allows an unprivileged user to escalate to the root user.
+"""
+id = "95718a3c-edc7-46ef-978b-77891ca6198f"
+license = "Elastic License v2"
+name = "Sudo Heap-Based Buffer Overflow Attempt"
+os_list = ["linux", "macos"]
+reference = [
+    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3156",
+    "https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit",
+    "https://www.bleepingcomputer.com/news/security/latest-macos-big-sur-also-has-sudo-root-privilege-escalation-flaw",
+    "https://www.sudo.ws/alerts/unescape_overflow.html",
+]
+version = "1.0.6"
+
+query = '''
+process where event.action == "exec" and
+  process.name in ("sudoedit", "sudo") and
+  process.args in ("-s", "-S") and process.args : "sudoedit" and process.args : "*\\"
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[actions]]
+action = "kill_process"
+field = "process.parent.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[threat.technique.subtechnique]]
+id = "T1059.004"
+name = "Unix Shell"
+reference = "https://attack.mitre.org/techniques/T1059/004/"
+
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1068"
+name = "Exploitation for Privilege Escalation"
+reference = "https://attack.mitre.org/techniques/T1068/"
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_suspicious_windows_service_execution.toml b/behavior/rules/privilege_escalation_suspicious_windows_service_execution.toml
new file mode 100644
index 00000000..1f9a37b7
--- /dev/null
+++ b/behavior/rules/privilege_escalation_suspicious_windows_service_execution.toml
@@ -0,0 +1,43 @@
+[rule]
+description = """
+Identifies the execution of a Windows service from suspicious path such as mounted localhost admin share. This may
+indicate an attempt to elevate privileges via windows services.
+"""
+id = "cd25c529-73b4-4a9d-84a9-e24c4a3540d1"
+license = "Elastic License v2"
+name = "Suspicious Windows Service Execution"
+os_list = ["windows"]
+version = "1.0.4"
+
+query = '''
+process where event.action == "start" and
+  process.parent.name : "services.exe" and
+  process.Ext.token.integrity_level_name == "system" and
+  process.executable : ("\\\\127.0.0.1\\*", "\\Device\\Mup\\*\\c$\\*", "\\Device\\Mup\\*\\ADMIN$\\*")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1543"
+name = "Create or Modify System Process"
+reference = "https://attack.mitre.org/techniques/T1543/"
+[[threat.technique.subtechnique]]
+id = "T1543.003"
+name = "Windows Service"
+reference = "https://attack.mitre.org/techniques/T1543/003/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_attempt_via_cdssync_scheduled_task_hijack.toml b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_cdssync_scheduled_task_hijack.toml
new file mode 100644
index 00000000..9cbf82fd
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_cdssync_scheduled_task_hijack.toml
@@ -0,0 +1,63 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via CDSSync scheduled task hijack by modifying the system root
+environment variable leading to loading a malicious npmproxy.dll module. Attackers may attempt to bypass UAC to
+stealthily execute code with elevated permissions.
+"""
+id = "d8b7a157-c98f-42bd-8aac-7d1e4fcd53f4"
+license = "Elastic License v2"
+name = "UAC Bypass Attempt via CDSSync Scheduled Task Hijack"
+os_list = ["windows"]
+reference = ["https://github.com/AzAgarampur/byeintegrity5-uac"]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=60s
+  [file where file.path : "?:\\*\\system32\\npmproxy.dll" and
+   not file.path : ("?:\\Windows\\System32\\npmproxy.dll", "?:\\Windows\\SysWOW64\\npmproxy.dll")]
+  [process where event.action == "start" and
+   process.parent.name : "taskhostw.exe" and process.Ext.token.integrity_level_name == "high"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.002"
+name = "DLL Side-Loading"
+reference = "https://attack.mitre.org/techniques/T1574/002/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_attempt_via_consent_dll_search_order_hijacking.toml b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_consent_dll_search_order_hijacking.toml
new file mode 100644
index 00000000..009916b3
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_consent_dll_search_order_hijacking.toml
@@ -0,0 +1,82 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via DLL search order hijacking. Attackers may attempt to bypass
+UAC to stealthily execute code with elevated permissions.
+"""
+id = "39827014-4836-498e-8b16-bf62f7aae4bf"
+license = "Elastic License v2"
+name = "UAC Bypass Attempt via Consent DLL Search Order Hijacking"
+os_list = ["windows"]
+reference = [
+    "https://github.com/hfiref0x/UACME",
+    "https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection",
+]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=60s
+ [file where event.action : "rename" and process.name : "dllhost.exe" and
+  file.path : ("?:\\*\\consent.exe.*\\*.dll", "?:\\*\\consent.exe.*\\*.dll")]
+ [process where event.action == "start" and
+  process.parent.name : "consent.exe" and process.Ext.token.integrity_level_name == "system" and
+  not process.executable :
+           ("?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\System32\\wermgr.exe",
+            "?:\\Windows\\SysWOW64\\wermgr.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1129"
+name = "Shared Modules"
+reference = "https://attack.mitre.org/techniques/T1129/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.001"
+name = "DLL Search Order Hijacking"
+reference = "https://attack.mitre.org/techniques/T1574/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_attempt_via_dccw_dll_search_order_hijacking.toml b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_dccw_dll_search_order_hijacking.toml
new file mode 100644
index 00000000..4ef7663f
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_dccw_dll_search_order_hijacking.toml
@@ -0,0 +1,83 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via Display Color Calibration DLL search order hijacking.
+Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
+"""
+id = "093bd845-b59f-4868-a7dd-62d48b737bf6"
+license = "Elastic License v2"
+name = "UAC Bypass Attempt via DCCW DLL Search Order Hijacking"
+os_list = ["windows"]
+reference = [
+    "https://github.com/hfiref0x/UACME",
+    "https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection",
+]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=60s
+ [file where event.action : "rename" and
+  process.name : ("dllhost.exe", "wusa.exe") and
+  file.path : ("?:\\*\\dccw.exe.*\\*.dll", "?:\\*\\dccw.exe.*\\*.dll")]
+ [process where event.action == "start" and
+  process.parent.name : "dccw.exe" and process.Ext.token.integrity_level_name == "high" and
+  not process.executable :
+           ("?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\System32\\cttune.exe",
+            "?:\\Windows\\SysWOW64\\cttune.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1129"
+name = "Shared Modules"
+reference = "https://attack.mitre.org/techniques/T1129/"
+
+
+[threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.001"
+name = "DLL Search Order Hijacking"
+reference = "https://attack.mitre.org/techniques/T1574/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_attempt_via_dismcore_dll_side_loading.toml b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_dismcore_dll_side_loading.toml
new file mode 100644
index 00000000..99433e07
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_dismcore_dll_side_loading.toml
@@ -0,0 +1,75 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to
+stealthily execute code with elevated permissions.
+"""
+id = "38210b91-f593-4c1c-a582-e5309c5b5168"
+license = "Elastic License v2"
+name = "UAC Bypass Attempt via DismCore DLL Side-Loading"
+os_list = ["windows"]
+reference = [
+    "https://github.com/hfiref0x/UACME",
+    "https://app.any.run/tasks/6f2eb616-7786-4d42-9345-b682bda65c6b/",
+]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=60s
+ [file where event.action : "rename" and process.name : ("dllhost.exe", "wusa.exe") and
+  file.name : "DismCore.dll" and
+  not file.path : ("?:\\Windows\\SoftwareDistribution\\*.dll", "?:\\Windows\\WinSxS\\*.dll")]
+ [process where event.action == "start" and
+  process.parent.name : "Dism.exe" and process.Ext.token.integrity_level_name == "high" and
+  not process.executable :
+           ("?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\System32\\wermgr.exe",
+            "?:\\Windows\\SysWOW64\\wermgr.exe",
+            "?:\\Windows\\System32\\conhost.exe",
+            "?:\\Windows\\SysWOW64\\conhost.exe") and
+  not (process.pe.original_file_name == "DismHost.exe" and process.code_signature.trusted == true and
+       process.code_signature.subject_name : "Microsoft *")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.002"
+name = "DLL Side-Loading"
+reference = "https://attack.mitre.org/techniques/T1574/002/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_attempt_via_dll_side_loading_from_windows_media_player_folder.toml b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_dll_side_loading_from_windows_media_player_folder.toml
new file mode 100644
index 00000000..b4f531d1
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_dll_side_loading_from_windows_media_player_folder.toml
@@ -0,0 +1,64 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via DLL side-loading from the trusted Windows Media Player
+folder. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
+"""
+id = "2aac12a2-23e7-4557-950e-a7b9ab96a26d"
+license = "Elastic License v2"
+name = "UAC Bypass Attempt via DLL Side-Loading from Windows Media Player Folder"
+os_list = ["windows"]
+reference = ["https://github.com/hfiref0x/UACME"]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=60s
+  [file where event.action == "rename" and
+   process.name : "dllhost.exe" and
+   file.path : ("?:\\Program Files\\Windows Media Player\\*.dll", "?:\\Program Files (x86)\\Windows Media Player\\*.dll")]
+  [process where event.action == "start" and
+   process.Ext.token.integrity_level_name : ("high", "system") and
+   process.executable : ("?:\\Program Files\\Windows Media Player\\*.exe", "?:\\Program Files (x86)\\Windows Media Player\\*.dll")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.002"
+name = "DLL Side-Loading"
+reference = "https://attack.mitre.org/techniques/T1574/002/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_attempt_via_elevated_com_internet_explorer_add_on_installer.toml b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_elevated_com_internet_explorer_add_on_installer.toml
new file mode 100644
index 00000000..d193d804
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_elevated_com_internet_explorer_add_on_installer.toml
@@ -0,0 +1,47 @@
+[rule]
+description = """
+Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM Interface to launch a malicious
+program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
+"""
+id = "badd95ba-2416-4785-8f7f-787952b58a1d"
+license = "Elastic License v2"
+name = "UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer"
+os_list = ["windows"]
+reference = ["https://swapcontext.blogspot.com/2020/11/uac-bypasses-from-comautoapprovallist.html"]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=1m
+ [file where event.action == "rename" and
+  process.name : "dllhost.exe" and file.Ext.header_bytes : "4d5a*"] by file.path
+ [process where event.action == "start" and
+   process.Ext.token.integrity_level_name == "high" and
+   process.executable : "?:\\*\\AppData\\*\\Temp\\IDC*.tmp\\*.exe" and
+   process.parent.name : "ieinstal.exe" and process.parent.args : "-Embedding"] by process.executable
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_attempt_via_mmc_dll_search_order_hijacking.toml b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_mmc_dll_search_order_hijacking.toml
new file mode 100644
index 00000000..7c6ac209
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_mmc_dll_search_order_hijacking.toml
@@ -0,0 +1,68 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via DLL search order hijacking by setting the .NET Core
+profiler environment variable to force MMC loading a malicious DLL. Attackers may attempt to bypass UAC to stealthily
+execute code with elevated permissions.
+"""
+id = "28996098-b9be-4aa8-a1f3-4923c84b2649"
+license = "Elastic License v2"
+name = "UAC Bypass Attempt via MMC DLL Search Order Hijacking"
+os_list = ["windows"]
+reference = ["https://github.com/hfiref0x/UACME"]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=60s
+ [registry where
+   registry.path : "HKEY_USERS\\S-1-5-21*\\Environment\\COR_PROFILER_PATH" and
+   registry.data.strings : "*.dll"]
+ [process where event.action == "start" and process.name : "mmc.exe"]
+ [process where event.action == "start" and
+  process.parent.name : "mmc.exe" and process.Ext.token.integrity_level_name == "high" and
+  not process.executable :
+           ("?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 2
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.001"
+name = "DLL Search Order Hijacking"
+reference = "https://attack.mitre.org/techniques/T1574/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_attempt_via_silentcleanup_task_dll_search_order_hijacking.toml b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_silentcleanup_task_dll_search_order_hijacking.toml
new file mode 100644
index 00000000..344ed77e
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_silentcleanup_task_dll_search_order_hijacking.toml
@@ -0,0 +1,65 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via DLL search order hijacking. Attackers may attempt to bypass
+UAC to stealthily execute code with elevated permissions.
+"""
+id = "9389bb8e-fadc-42ca-8598-28e2bb94edee"
+license = "Elastic License v2"
+name = "UAC Bypass Attempt via SilentCleanup Task DLL Search Order Hijacking"
+os_list = ["windows"]
+reference = ["https://github.com/EncodeGroup/UAC-SilentClean"]
+version = "1.0.4"
+
+query = '''
+sequence by user.id with maxspan=1m
+   [library where
+    dll.path : "?:\\Users\\*\\AppData\\Local\\Microsoft\\WindowsApps\\api-ms-win-core-kernel32-legacy-l1.dll" and
+    process.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\*\\DismHost.exe"] by process.entity_id
+   [process where event.action == "start" and process.Ext.token.integrity_level_name == "high" and
+    process.parent.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\*\\DismHost.exe" and
+    not (process.executable : ("?:\\Users\\*\\AppData\\Local\\Temp\\*\\DismHost.exe", "?:\\Windows\\System32\\wermgr.exe") and
+         process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft *")] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.001"
+name = "DLL Search Order Hijacking"
+reference = "https://attack.mitre.org/techniques/T1574/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.16.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_attempt_via_windows_directory_masquerading.toml b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_windows_directory_masquerading.toml
new file mode 100644
index 00000000..8e6519e3
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_windows_directory_masquerading.toml
@@ -0,0 +1,47 @@
+[rule]
+description = """
+Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory.
+Attackers may bypass UAC to stealthily execute code with elevated permissions.
+"""
+id = "adaf95d2-28ce-4880-af16-f3041b624440"
+license = "Elastic License v2"
+name = "UAC Bypass Attempt via Windows Directory Masquerading"
+os_list = ["windows"]
+reference = ["https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and
+ process.Ext.token.integrity_level_name == "high" and
+  process.args :
+         ("?:\\Windows \\System32\\*.exe",
+          "?:\\Windows \\SysWOW64\\*.exe",
+          "?:\\ Windows*\\System32\\*.exe",
+          "?:\\ Windows*\\SysWOW64\\*.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_attempt_via_wow64_logger_dll_side_loading.toml b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_wow64_logger_dll_side_loading.toml
new file mode 100644
index 00000000..44d51eda
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_attempt_via_wow64_logger_dll_side_loading.toml
@@ -0,0 +1,70 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via WoW64 logger DLL side-loading. Attackers may attempt to
+bypass UAC to stealthily execute code with elevated permissions.
+"""
+id = "28a39a43-e850-4941-8605-ffa23dcfd25a"
+license = "Elastic License v2"
+name = "UAC Bypass Attempt via WOW64 Logger DLL Side-Loading"
+os_list = ["windows"]
+reference = ["https://github.com/hfiref0x/UACME", "http://waleedassar.blogspot.com/2013/01/wow64logdll.html"]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=60s
+ [library where dll.name : "wow64log.dll" and
+  not (dll.code_signature.subject_name : "Microsoft *" and dll.code_signature.trusted == true)
+ ] by process.entity_id
+ [process where event.action == "start" and
+  process.Ext.token.integrity_level_name : ("high", "system") and
+  not process.executable :
+           ("?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\System32\\wermgr.exe",
+            "?:\\Windows\\SysWOW64\\wermgr.exe",
+            "?:\\Windows\\System32\\conhost.exe",
+            "?:\\Windows\\SysWOW64\\conhost.exe")] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.002"
+name = "DLL Side-Loading"
+reference = "https://attack.mitre.org/techniques/T1574/002/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_attempt_with_ieditionupgrademanager_elevated_com_interface.toml b/behavior/rules/privilege_escalation_uac_bypass_attempt_with_ieditionupgrademanager_elevated_com_interface.toml
new file mode 100644
index 00000000..7bdfab3b
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_attempt_with_ieditionupgrademanager_elevated_com_interface.toml
@@ -0,0 +1,48 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM interface to launch a rogue Windows
+ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
+"""
+id = "f1008eeb-bc85-4d5e-91ac-e99aaba08ecf"
+license = "Elastic License v2"
+name = "UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface"
+os_list = ["windows"]
+reference = ["https://github.com/hfiref0x/UACME"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and
+ process.parent.name : "dllhost.exe" and
+ process.Ext.token.integrity_level_name == "high" and
+ process.parent.command_line : "*BD54C901-076B-434E-B6C7-17C531F4AB41*" and 
+ process.executable : ("?:\\*\\System32\\*.exe", "?:\\*\\SysWOW64\\*.exe") and
+ not process.executable : ("?:\\Windows\\System32\\*.exe", "?:\\Windows\\SysWOW64\\*.exe") and
+ not (process.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\*\\dismhost.exe" and
+      process.code_signature.subject_name : "Microsoft*" and process.code_signature.trusted == true)
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_via_computerdefaults_execution_hijack.toml b/behavior/rules/privilege_escalation_uac_bypass_via_computerdefaults_execution_hijack.toml
new file mode 100644
index 00000000..be719028
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_via_computerdefaults_execution_hijack.toml
@@ -0,0 +1,48 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via ComputerDefaults execution hijack. Attackers bypass UAC to
+stealthily execute code with elevated permissions.
+"""
+id = "7c0048d5-356d-4f69-839e-10c1e194958f"
+license = "Elastic License v2"
+name = "UAC Bypass via ComputerDefaults Execution Hijack"
+os_list = ["windows"]
+reference = ["https://github.com/hfiref0x/UACME"]
+version = "1.0.8"
+
+query = '''
+sequence with maxspan=60s
+ [registry where registry.hive == "HKEY_USERS" and registry.data.strings != null and
+   registry.key : "S-1-5-21-*Classes\\ms-settings\\shell\\open\\command"]
+ [process where event.action == "start" and process.parent.name : "ComputerDefaults.exe" and
+  process.Ext.token.integrity_level_name == "high" and
+  not process.executable :
+           ("?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_via_control_panel_execution_hijack.toml b/behavior/rules/privilege_escalation_uac_bypass_via_control_panel_execution_hijack.toml
new file mode 100644
index 00000000..48e6f9f1
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_via_control_panel_execution_hijack.toml
@@ -0,0 +1,48 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via hijacking the default handler of the Backup and Restore
+control panel. Attackers bypass UAC to stealthily execute code with elevated permissions.
+"""
+id = "0545f127-b1ae-478a-a68a-84f477f765e2"
+license = "Elastic License v2"
+name = "UAC Bypass via Control Panel Execution Hijack"
+os_list = ["windows"]
+reference = ["https://github.com/hfiref0x/UACME"]
+version = "1.0.8"
+
+query = '''
+sequence with maxspan=1m
+  [registry where registry.data.strings != null and
+   registry.hive == "HKEY_USERS" and
+   registry.key : "S-1-5-21*_Classes\\Folder\\Shell\\Open\\Command*"]
+  [process where event.action == "start" and process.pe.original_file_name : "sdclt.exe"]
+  [process where event.action == "start" and
+   process.Ext.token.integrity_level_name == "high" and
+   process.parent.name : "control.exe" and process.parent.command_line : "*Microsoft.BackupAndRestoreCenter*"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 2
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_via_delegateexecute_registry_modification.toml b/behavior/rules/privilege_escalation_uac_bypass_via_delegateexecute_registry_modification.toml
new file mode 100644
index 00000000..e10c28b3
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_via_delegateexecute_registry_modification.toml
@@ -0,0 +1,66 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) by modifying the DelegateExecute registry value. Attackers
+bypass UAC to stealthily execute code with elevated permissions.
+"""
+id = "25c41954-5d42-4530-b9cb-bdaf9d028ce7"
+license = "Elastic License v2"
+name = "UAC Bypass via DelegateExecute Registry Modification"
+os_list = ["windows"]
+reference = [
+    "https://medium.com/cybersecpadawan/utilizing-a-common-windows-binary-to-escalate-to-system-privileges-c16482cced4b",
+]
+version = "1.0.6"
+
+query = '''
+sequence by process.entity_id with maxspan=1m
+  [process where event.action == "start" and
+   process.Ext.token.integrity_level_name == "medium" and process.executable != null and not
+
+   /* excludes OpenWith which is used to delegate handling a file type to a chosen program */
+   process.executable : ("?:\\Windows\\System32\\OpenWith.exe", "?:\\Windows\\SysWOW64\\OpenWith.exe") and not
+
+   /* exclude signed third party programs */
+   (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
+     process.code_signature.trusted == true)]
+  [registry where registry.data.strings != null and
+   registry.value : "DelegateExecute" and registry.hive : "HKEY_USERS"]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1112"
+name = "Modify Registry"
+reference = "https://attack.mitre.org/techniques/T1112/"
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.toml b/behavior/rules/privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.toml
new file mode 100644
index 00000000..a7bc5b13
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.toml
@@ -0,0 +1,49 @@
+[rule]
+description = """
+Identifies User Account Control (UAC) bypass attempts via hijacking the DiskCleanup scheduled task. Attackers bypass UAC
+to stealthily execute code with elevated permissions.
+"""
+id = "d487049e-381d-44ad-9ec9-d23e88dbf573"
+license = "Elastic License v2"
+name = "UAC Bypass via DiskCleanup Scheduled Task Hijack"
+os_list = ["windows"]
+reference = ["https://www.tiraniddo.dev/2017/05/exploiting-environment-variables-in.html"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and
+ process.Ext.token.integrity_level_name == "high" and
+ process.args : "/autoclean" and process.args : "/d" and
+ not process.executable : ("?:\\Windows\\System32\\cleanmgr.exe",
+                           "?:\\Windows\\SysWOW64\\cleanmgr.exe",
+                           "?:\\Windows\\System32\\taskhostw.exe",
+                           /* Issue #359 */
+                           "?:\\Windows\\System32\\taskhost.exe",
+                           "?:\\Windows\\SysWOW64\\taskhost.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_via_event_viewer.toml b/behavior/rules/privilege_escalation_uac_bypass_via_event_viewer.toml
new file mode 100644
index 00000000..cc647772
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_via_event_viewer.toml
@@ -0,0 +1,50 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via eventvwr.exe. Attackers bypass UAC to stealthily execute
+code with elevated permissions.
+"""
+id = "ab29a79a-b3c2-4ae4-9670-70dd0ea68a4a"
+license = "Elastic License v2"
+name = "UAC Bypass via Event Viewer"
+os_list = ["windows"]
+reference = ["https://github.com/hfiref0x/UACME"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and
+ process.parent.name : "eventvwr.exe" and
+ process.Ext.token.integrity_level_name == "high" and
+ not process.executable :
+           ("?:\\Windows\\SysWOW64\\mmc.exe",
+            "?:\\Windows\\System32\\mmc.exe",
+            "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\System32\\wermgr.exe",
+            "?:\\Windows\\SysWOW64\\wermgr.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.13.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_via_fodhelper_execution_hijack.toml b/behavior/rules/privilege_escalation_uac_bypass_via_fodhelper_execution_hijack.toml
new file mode 100644
index 00000000..c170fbcc
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_via_fodhelper_execution_hijack.toml
@@ -0,0 +1,48 @@
+[rule]
+description = """
+Identifies User Account Control (UAC) bypass via fodhelper.exe execution hijack. Attackers bypass UAC to stealthily
+execute code with elevated permissions.
+"""
+id = "b5c0058e-2bca-4ed5-84b3-4e017c039c57"
+license = "Elastic License v2"
+name = "UAC Bypass via FodHelper Execution Hijack"
+os_list = ["windows"]
+reference = ["https://github.com/hfiref0x/UACME"]
+version = "1.0.8"
+
+query = '''
+sequence with maxspan=60s
+ [registry where registry.hive == "HKEY_USERS" and registry.data.strings != null and
+   registry.key : "*\\ms-settings*"]
+ [process where event.action == "start" and process.parent.name : "fodhelper.exe" and
+  process.Ext.token.integrity_level_name == "high" and
+  not process.executable :
+           ("?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_via_icmluautil_elevated_com_interface.toml b/behavior/rules/privilege_escalation_uac_bypass_via_icmluautil_elevated_com_interface.toml
new file mode 100644
index 00000000..65e0ab8b
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_via_icmluautil_elevated_com_interface.toml
@@ -0,0 +1,51 @@
+[rule]
+description = """
+Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil elevated COM interface. Attackers may attempt
+to bypass UAC to stealthily execute code with elevated permissions.
+"""
+id = "13fab475-06e4-4ac9-87fc-2105c7441244"
+license = "Elastic License v2"
+name = "UAC Bypass via ICMLuaUtil Elevated COM Interface"
+os_list = ["windows"]
+reference = ["https://github.com/hfiref0x/UACME"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and
+ process.parent.name : "dllhost.exe" and
+ process.Ext.token.integrity_level_name == "high" and
+ process.parent.command_line : ("*3E5FC7F9-9A51-4367-9063-A120244FBEC7*", "*D2E7041B-2927-42FB-8E9F-7CE93B6DC937*") and
+ not process.executable :
+             ("?:\\Windows\\System32\\WerFault.exe",
+              "?:\\Windows\\SysWOW64\\WerFault.exe",
+              "?:\\Windows\\System32\\wermgr.exe",
+              "?:\\Windows\\SysWOW64\\wermgr.exe") and
+ /* Issue #364 */
+ not (process.code_signature.subject_name == "WireGuard LLC" and process.code_signature.trusted == true)
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_via_malicious_mmc_snap_in_execution.toml b/behavior/rules/privilege_escalation_uac_bypass_via_malicious_mmc_snap_in_execution.toml
new file mode 100644
index 00000000..97928069
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_via_malicious_mmc_snap_in_execution.toml
@@ -0,0 +1,49 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) by executing a malicious Microsoft Management Console (MMC)
+snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.
+"""
+id = "ccdf56a8-697b-497c-ab90-3aa01bfc5f9f"
+license = "Elastic License v2"
+name = "UAC Bypass via Malicious MMC Snap-In Execution"
+os_list = ["windows"]
+reference = ["https://github.com/hfiref0x/UACME/"]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=60s
+ [file where event.action != "deletion" and file.extension : "msc" and not user.name : "SYSTEM"]
+ [process where event.action == "start" and
+  process.name : "mmc.exe" and process.command_line : "*.msc *.msc*"]
+ [process where event.action == "start" and
+  process.parent.name : "mmc.exe" and process.Ext.token.integrity_level_name == "high" and
+  not process.executable :
+           ("?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 2
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_via_sdclt.toml b/behavior/rules/privilege_escalation_uac_bypass_via_sdclt.toml
new file mode 100644
index 00000000..a21d7fd4
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_via_sdclt.toml
@@ -0,0 +1,52 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via sdclt.exe. Attackers bypass UAC to stealthily execute code
+with elevated permissions.
+"""
+id = "e9095298-65e0-40a2-97c9-055de8685645"
+license = "Elastic License v2"
+name = "UAC Bypass via Sdclt"
+os_list = ["windows"]
+reference = ["https://github.com/hfiref0x/UACME"]
+version = "1.0.7"
+
+query = '''
+process where event.action == "start" and
+ process.parent.name : "sdclt.exe" and process.parent.command_line : "*/kickoffelev*" and
+ process.Ext.token.integrity_level_name == "high" and
+ not process.executable :
+           ("?:\\Windows\\SysWOW64\\sdclt.exe",
+            "?:\\Windows\\System32\\sdclt.exe",
+            "?:\\Windows\\SysWOW64\\control.exe",
+            "?:\\Windows\\System32\\control.exe",
+            "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\System32\\wermgr.exe",
+            "?:\\Windows\\SysWOW64\\wermgr.exe")
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 0
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_via_windows_activation_execution_hijack.toml b/behavior/rules/privilege_escalation_uac_bypass_via_windows_activation_execution_hijack.toml
new file mode 100644
index 00000000..2f6b91d8
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_via_windows_activation_execution_hijack.toml
@@ -0,0 +1,56 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via Windows activation changepk.exe execution hijack. Attackers
+bypass UAC to stealthily execute code with elevated permissions.
+"""
+id = "71ad1420-ed83-46d0-835b-63d4b2008427"
+license = "Elastic License v2"
+name = "UAC Bypass via Windows Activation Execution Hijack"
+os_list = ["windows"]
+reference = [
+    "https://github.com/hfiref0x/UACME",
+    "https://medium.com/@mattharr0ey/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b",
+]
+version = "1.0.8"
+
+query = '''
+sequence with maxspan=60s
+ [registry where registry.hive == "HKEY_USERS" and registry.data.strings != null and
+   registry.key :
+          ("S-1-5-21-*Classes\\Launcher.SystemSettings\\shell\\open\\command",
+           "S-1-5-21-*Classes\\exefile\\shell\\open\\command")]
+ [process where event.action == "start" and
+  process.parent.name : ("changepk.exe", "slui.exe") and
+  process.Ext.token.integrity_level_name == "high" and
+  not process.executable :
+           ("?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\System32\\changepk.exe",
+            "?:\\WINDOWS\\system32\\slui.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_via_windows_firewall_snap_in_hijack.toml b/behavior/rules/privilege_escalation_uac_bypass_via_windows_firewall_snap_in_hijack.toml
new file mode 100644
index 00000000..b47f4514
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_via_windows_firewall_snap_in_hijack.toml
@@ -0,0 +1,69 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows
+Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.
+"""
+id = "65f52068-4d08-41af-9fd7-0c1a4f732494"
+license = "Elastic License v2"
+name = "UAC Bypass via Windows Firewall Snap-In Hijack"
+os_list = ["windows"]
+reference = ["https://github.com/AzAgarampur/byeintegrity-uac"]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=60s
+ [file where event.action == "rename" and process.name : "dllhost.exe" and
+  file.path : "?:\\Windows\\assembly\\*\\Accessibility.ni.dll"]
+ [process where event.action == "start" and
+  process.Ext.token.integrity_level_name == "high" and
+  process.parent.name : "mmc.exe" and
+  process.parent.args : ("WF.msc", "?:\\WINDOWS\\system32\\WF.msc", "?:\\WINDOWS\\SysWOW64\\WF.msc") and
+  not process.executable :
+           ("?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\System32\\wermgr.exe",
+            "?:\\Windows\\SysWOW64\\wermgr.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1574"
+name = "Hijack Execution Flow"
+reference = "https://attack.mitre.org/techniques/T1574/"
+[[threat.technique.subtechnique]]
+id = "T1574.001"
+name = "DLL Search Order Hijacking"
+reference = "https://attack.mitre.org/techniques/T1574/001/"
+
+
+
+[threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_uac_bypass_via_wsreset_execution_hijack.toml b/behavior/rules/privilege_escalation_uac_bypass_via_wsreset_execution_hijack.toml
new file mode 100644
index 00000000..b438ae57
--- /dev/null
+++ b/behavior/rules/privilege_escalation_uac_bypass_via_wsreset_execution_hijack.toml
@@ -0,0 +1,52 @@
+[rule]
+description = """
+Identifies attempts to bypass User Account Control (UAC) via WSReset execution hijack. Attackers bypass UAC to
+stealthily execute code with elevated permissions.
+"""
+id = "11c67af9-9599-4800-9e84-bd38f2a51581"
+license = "Elastic License v2"
+name = "UAC Bypass via WSReset Execution Hijack"
+os_list = ["windows"]
+reference = ["https://github.com/hfiref0x/UACME"]
+version = "1.0.7"
+
+query = '''
+sequence with maxspan=60s
+ [registry where
+  registry.path : ("HKEY_USERS\\S-1-5-21-*Classes\\*\\Shell\\open\\command\\DelegateExecute", "*\\ms-windows-store*")]
+ [process where event.action == "start" and process.parent.name : "WSReset.exe" and
+  process.Ext.token.integrity_level_name == "high" and
+  not process.executable :
+           ("?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\System32\\mmc.exe",
+            "?:\\Windows\\SysWOW64\\mmc.exe",
+            "?:\\Windows\\system32\\conhost.exe",
+            "?:\\Windows\\SysWOW6\\conhost.exe")]
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1548"
+name = "Abuse Elevation Control Mechanism"
+reference = "https://attack.mitre.org/techniques/T1548/"
+[[threat.technique.subtechnique]]
+id = "T1548.002"
+name = "Bypass User Account Control"
+reference = "https://attack.mitre.org/techniques/T1548/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/behavior/rules/privilege_escalation_unusual_child_process_integrity_level.toml b/behavior/rules/privilege_escalation_unusual_child_process_integrity_level.toml
new file mode 100644
index 00000000..eeac9299
--- /dev/null
+++ b/behavior/rules/privilege_escalation_unusual_child_process_integrity_level.toml
@@ -0,0 +1,57 @@
+[rule]
+description = """
+Identifies the execution of a process with an integrity level of SYSTEM from a parent process with an integrity level of
+Low or Medium. This behavior is consistent with a successful exploit to escalate privileges and create a process with
+SYSTEM privileges.
+"""
+id = "9ac68ab0-d251-4c84-a8df-85779ccc728f"
+license = "Elastic License v2"
+name = "Unusual Child Process Integrity Level"
+os_list = ["windows"]
+reference = [
+    "https://bsodtutorials.wordpress.com/2014/07/31/windows-integrity-levels-process-explorer-and-windbg/",
+]
+version = "1.0.10"
+
+query = '''
+sequence with maxspan=5m
+ [process where event.action == "start" and
+  process.Ext.token.integrity_level_name in ("medium", "low")] by process.entity_id
+ [process where event.action == "start" and
+  process.Ext.token.integrity_level_name == "system" and user.id : "S-1-5-18" and
+  /* limiting rule scope to processes created via seclogon to avoid some weird FPs */
+  process.parent.Ext.real.pid > 0 and
+  not (process.executable : "?:\\Windows\\System32\\wermgr.exe" and
+       process.parent.executable : "?:\\Windows\\Sys*\\WerFault.exe")] by process.parent.entity_id
+'''
+
+[[actions]]
+action = "kill_process"
+field = "process.entity_id"
+state = 1
+
+[[threat]]
+framework = "MITRE ATT&CK"
+[[threat.technique]]
+id = "T1068"
+name = "Exploitation for Privilege Escalation"
+reference = "https://attack.mitre.org/techniques/T1068/"
+
+[[threat.technique]]
+id = "T1134"
+name = "Access Token Manipulation"
+reference = "https://attack.mitre.org/techniques/T1134/"
+[[threat.technique.subtechnique]]
+id = "T1134.002"
+name = "Create Process with Token"
+reference = "https://attack.mitre.org/techniques/T1134/002/"
+
+
+
+[threat.tactic]
+id = "TA0004"
+name = "Privilege Escalation"
+reference = "https://attack.mitre.org/tactics/TA0004/"
+
+[internal]
+min_endpoint_version = "7.15.0"
diff --git a/yara/CONTRIBUTING.md b/yara/CONTRIBUTING.md
new file mode 100644
index 00000000..d7d9cbb7
--- /dev/null
+++ b/yara/CONTRIBUTING.md
@@ -0,0 +1,57 @@
+## Contributing to YARA Rules
+
+Our team is currently accepting issues related to rule tuning and requests for coverage that are missing against trending malware families. We are also exploring future opportunities to seek contributions in different ways from the community. 
+
+## Table of Contents
+
+- [Submitting an Issue](#submitting-an-issue)
+- [Principles around YARA](#principles-around-yara)
+- [Quality Testing](#quality-testing)
+- [Metadata Schema](#metadata-schema)
+- [Recommended Reading](#recommended-reading)
+
+## Submitting an Issue
+
+There are currently two different issue types that can be [chosen from](https://github.com/elastic/protections-artifacts-staging/issues/new/choose) our issue templates. Please leverage the guided instructions within these templates to fill out the issue.
+Requests for coverage: Create a suggestion for coverage on malware family that doesn’t currently exist in our repository
+Rule tuning: Suggest changes to an existing rule to fix false positives
+
+## Principles around YARA
+
+[YARA](https://virustotal.github.io/yara/) rules provide flexible pattern matching capabilities against data that can be used to identify and group malware families. YARA goes above and beyond standard indicator of compromise (IOC) matching which can be very static in nature, adversaries can make trivial adjustments by modifying a domain/IP/hash effectively bypassing the IOC.
+
+There are many different strategies when leveraging YARA for signatures such as using strings that are observed inside a program. This can be an effective way to identify malware and build detections with YARA, as it's something that can be automated and quickly generated without too much cost (time/resources). With that said, it is very similar to an IOC approach as it's very trivial for adversaries to obfuscate or change out strings so often times there is a need to create stronger anchors for detection such as detecting on the byte sequence for a unique implementation of a cryptographic function which will end up being harder for the adversary to change and possibly require them to re-tool. The downside of using these kinds of methodologies is that it takes time and can require strong expertise with malware analysis and reverse engineering skills.
+Our goal with these YARA signatures is to find the balance between these different approaches with the understanding that a signature represents a detection at a point in time. Another key principle that we believe in is leveraging the metadata section of our rules as much as possible to provide more context. This information is vital for bookkeeping purposes and makes it easier for other analysts to follow-up with the rule.
+
+## Quality Testing
+
+In order to ensure quality, our rules go through several internal stages of testing and validation before making it into this repository. These rules are tested against internal and external benign file sources as well as they go through a workflow involving our customer telemetry. 
+
+## Metadata Schema
+
+The metadata within YARA rules is really important since it is the only data available to provide context around the detection logic. When designing this artifact, we picked the following fields below. Some fields are required and some are optional. One of the major components of our testing is based on a tool ([CCCS-Yara](https://github.com/CybercentreCanada/CCCS-Yara)) released by the Canadian Centre for Cyber Security. This tool allows us to validate each rule to our own schema and helps standardize our rules.
+
+| Field | Requirement | Description |
+|------------------|---|---------------------------------------------------------------|
+| id               | ✓ | Unique UUID that follows the rule throughout entire lifecycle |
+| fingerprint      | ✓ | Autogenerated based on SHA256 hash of string values and condition statement of YARA rule |
+| creation_date    | ✓ | Creation date of the rule |
+| last_modified    | ✓ | Last modified date of the rule |
+| os               | ✓ | Describes the OS/platform for rule (Windows, Linux, MacOS) |
+| arch_context     | ✓ | Details the architecture (x86, ARM, Sparc) |
+| threat_name      | ✓ | Human-friendly name that combines the OS, category type and family name |
+| reference_sample | ✓ |  Malware sample related to YARA rule, helpful for testing/reference |
+| scan_context     | ✓ | YARA endpoint capability for scanning (File or Memory, if both use "File, Memory") |
+| severity         | ✓ | Leveraged for prioritizing the threat name in an alert |
+| description      |   | Provides detailed notes and context with rule, mostly found on manual generated rules |
+| reference        |   |  Display any kind of reference for the rule (Blog reference, URL, report, etc) |
+
+## Recommended Reading
+
+If you are interested in learning more about YARA, there are tons of great resources out there for learning. Below are some good references and handpicked material involving YARA and different malware topics.
+
+- [YARA Documentation](https://yara.readthedocs.io/en/stable/)
+- [Exposing Ryuk Variants Using YARA](https://blog.reversinglabs.com/blog/exposing-ryuk-variants-using-yara)
+- [Tracking Threat Actors through YARA Rules and Virus Total](https://www.youtube.com/watch?v=DdkLY99HgAA)
+- [To Catch an APT: YARA](https://www.youtube.com/watch?v=YFVZ-tjjWos)
+- [Detecting Cobalt Strike with memory signatures](https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures)
diff --git a/yara/README.md b/yara/README.md
new file mode 100644
index 00000000..6f21b1ec
--- /dev/null
+++ b/yara/README.md
@@ -0,0 +1,22 @@
+## Elastic Security YARA Rules
+
+Elastic Security provides signature-based YARA rules within the Elastic Endpoint product. These rules are used to detect and prevent emerging threats within Linux, Windows, and macOS systems. Our repository holds over 1,000 YARA rules that are used every day to stop a wide range of threats including: Trojans, ransomware, cryptominers, attack penetration frameworks, and more. 
+
+These YARA rules can be leveraged by the community and for different use cases such as:
+- Network Defending
+- Threat Hunting
+- Incident Response/Forensics
+- Alert Triage / Enrichment
+- Malware Analysis
+
+## How to contribute
+
+Our team welcomes your contributions to our YARA rules! Before contributing, please familiarize yourself with this repository, and read our contribution guide that provides an overview and our principles behind our rules. We are currently taking requests for false positives and requests seeking coverage for trending malware families. 
+
+## Licensing
+These rules are licensed under the Elastic License v2. All rules have been designed to be used in the context of the Elastic Endpoint within the Elastic Security application.
+
+## Questions? Problems? Suggestions?
+Want to know more about how our signatures are developed? Check out a [blog overview](https://www.elastic.co/blog/linux-malware-protection-in-elastic-security) explaining more details into our typical signature workflow.
+If you’d like to report a false positive or missing coverage for a malware family, please create a GitHub issue and check if there's an existing one first.
+Need help with our YARA rules? Post an issue or ask away in our [Security Discuss Forum](https://discuss.elastic.co/c/security/) or the #endpoint-security channel within our [Slack workspace](https://www.elastic.co/blog/join-our-elastic-stack-workspace-on-slack).
diff --git a/yara/rules/Linux_Backdoor_Bash.yar b/yara/rules/Linux_Backdoor_Bash.yar
new file mode 100644
index 00000000..e90e7fbf
--- /dev/null
+++ b/yara/rules/Linux_Backdoor_Bash.yar
@@ -0,0 +1,19 @@
+rule Linux_Backdoor_Bash_e427876d {
+    meta:
+        id = "e427876d-c7c5-447a-ad6d-5cbc12d9dacf"
+        fingerprint = "6cc13bb2591d896affc58f4a22b3463a72f6c9d896594fe1714b825e064b0956"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Backdoor.Bash"
+        reference_sample = "07db41a4ddaac802b04df5e5bbae0881fead30cb8f6fa53a8a2e1edf14f2d36b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 67 65 44 6F 6B 4B 47 6C 6B 49 43 31 31 4B 54 6F 67 4C 32 56 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Backdoor_Fontonlake.yar b/yara/rules/Linux_Backdoor_Fontonlake.yar
new file mode 100644
index 00000000..493159e8
--- /dev/null
+++ b/yara/rules/Linux_Backdoor_Fontonlake.yar
@@ -0,0 +1,29 @@
+rule Linux_Backdoor_Fontonlake_fe916a45 {
+    meta:
+        id = "fe916a45-75cc-40e4-94ad-6ac0f5d815b9"
+        fingerprint = "85f16dd4a127737501863ccba006a444d899c6edc6ab03af5dddef2d39edc483"
+        creation_date = "2021-10-12"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Backdoor.Fontonlake"
+        reference_sample = "8a0a9740cf928b3bd1157a9044c6aced0dfeef3aa25e9ff9c93e113cbc1117ee"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a1 = ".cmd.Upload_Passwd.PasswordInfo" fullword
+        $a2 = "Upload_Passwd" fullword
+        $a3 = "upload_file_beg" fullword
+        $a4 = "upload_file_ing" fullword
+        $a5 = "upload_file_end" fullword
+        $a6 = "modify_file_attr" fullword
+        $a7 = "modify_file_time" fullword
+        $a8 = "import platform;print(platform.linux_distribution()[0]);print(platform.linux_distribution()[1]);print(platform.release())" fullword
+        $a9 = "inject.so" fullword
+        $a10 = "rm -f /tmp/%s" fullword
+        $a11 = "/proc/.dot3" fullword
+    condition:
+        4 of them
+}
+
diff --git a/yara/rules/Linux_Backdoor_Generic.yar b/yara/rules/Linux_Backdoor_Generic.yar
new file mode 100644
index 00000000..8d78c0bc
--- /dev/null
+++ b/yara/rules/Linux_Backdoor_Generic.yar
@@ -0,0 +1,38 @@
+rule Linux_Backdoor_Generic_babf9101 {
+    meta:
+        id = "babf9101-1e6e-4268-a530-e99e2c905b0d"
+        fingerprint = "a578b052910962523f26f14f0d0494481fe0777c01d9f6816c7ab53083a47adc"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Backdoor.Generic"
+        reference_sample = "9ea73d2c2a5f480ae343846e2b6dd791937577cb2b3d8358f5b6ede8f3696b86"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C4 10 89 45 F4 83 7D F4 00 79 1F 83 EC 0C 68 22 }
+    condition:
+        all of them
+}
+
+rule Linux_Backdoor_Generic_5776ae49 {
+    meta:
+        id = "5776ae49-64e9-46a0-a0bb-b0226eb9a8bd"
+        fingerprint = "2d36fbe1820805c8fd41b2b34a2a2b950fc003ae4f177042dc0d2568925c5b76"
+        creation_date = "2021-04-06"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Backdoor.Generic"
+        reference_sample = "e247a5decb5184fd5dee0d209018e402c053f4a950dae23be59b71c082eb910c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 18 C1 E8 08 88 47 12 8B 46 18 88 47 13 83 C4 1C 5B 5E 5F 5D }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Backdoor_Python.yar b/yara/rules/Linux_Backdoor_Python.yar
new file mode 100644
index 00000000..6ad2a03e
--- /dev/null
+++ b/yara/rules/Linux_Backdoor_Python.yar
@@ -0,0 +1,19 @@
+rule Linux_Backdoor_Python_00606bac {
+    meta:
+        id = "00606bac-83eb-4a58-82d2-e4fd16d30846"
+        fingerprint = "cce1d0e7395a74c04f15ff95f6de7fd7d5f46ede83322b832df74133912c0b17"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Backdoor.Python"
+        reference_sample = "b3e3728d43535f47a1c15b915c2d29835d9769a9dc69eb1b16e40d5ba1b98460"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F4 01 83 45 F8 01 8B 45 F8 0F B6 00 84 C0 75 F2 83 45 F8 01 8B }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Backdoor_Tinyshell.yar b/yara/rules/Linux_Backdoor_Tinyshell.yar
new file mode 100644
index 00000000..ec86ee68
--- /dev/null
+++ b/yara/rules/Linux_Backdoor_Tinyshell.yar
@@ -0,0 +1,22 @@
+rule Linux_Backdoor_Tinyshell_67ee6fae {
+    meta:
+        id = "67ee6fae-304b-47f5-93b6-4086a864d433"
+        fingerprint = "f71ce364fb607ee6f4422864674ae3d053453b488c139679aa485466893c563d"
+        creation_date = "2021-10-12"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Backdoor.Tinyshell"
+        reference_sample = "9d2e25ec0208a55fba97ac70b23d3d3753e9b906b4546d1b14d8c92f8d8eb03d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a1 = "Usage: %s [ -c [ connect_back_host ] ] [ -s secret ] [ -p port ]" fullword
+        $a2 = "s:p:c::" fullword
+        $b1 = "Usage: %s [ -s secret ] [ -p port ] [command]" fullword
+        $b2 = "<hostname|cb> get <source-file> <dest-dir>" fullword
+    condition:
+        (all of ($a*)) or (all of ($b*))
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Attribute.yar b/yara/rules/Linux_Cryptominer_Attribute.yar
new file mode 100644
index 00000000..3bd525c2
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Attribute.yar
@@ -0,0 +1,19 @@
+rule Linux_Cryptominer_Attribute_3683d149 {
+    meta:
+        id = "3683d149-fa9c-4dbb-85b9-8ce2b1d1d128"
+        fingerprint = "31f45578eab3c94cff52056a723773d41aaad46d529b1a2063a0610d5948a633"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Attribute"
+        reference_sample = "ec9e74d52d745275718fe272bfd755335739ad5f680f73f5a4e66df6eb141a63"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 20 74 6F 20 66 61 73 74 29 20 6F 72 20 39 20 28 61 75 74 6F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Bscope.yar b/yara/rules/Linux_Cryptominer_Bscope.yar
new file mode 100644
index 00000000..e2761e47
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Bscope.yar
@@ -0,0 +1,19 @@
+rule Linux_Cryptominer_Bscope_348b7fa0 {
+    meta:
+        id = "348b7fa0-e226-4350-8697-345ae39fa0f6"
+        fingerprint = "caae9d3938f9269f8bc30e4837021513ca6e4e2edd1117d235b0d25474df5357"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Bscope"
+        reference_sample = "a6fb80d77986e00a6b861585bd4e573a927e970fb0061bf5516f83400ad7c0db"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 04 8B 00 03 45 C0 89 02 8B 45 08 8D 50 08 8B 45 08 83 C0 08 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Bulz.yar b/yara/rules/Linux_Cryptominer_Bulz.yar
new file mode 100644
index 00000000..b0906111
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Bulz.yar
@@ -0,0 +1,36 @@
+rule Linux_Cryptominer_Bulz_2aa8fbb5 {
+    meta:
+        id = "2aa8fbb5-b392-49fc-8f0f-12cd06d534e2"
+        fingerprint = "c8fbeae6cf935fe629c37abc4fdcda2c80c1b19fc8b6185a58decead781e1321"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Bulz"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FE D7 C5 D9 72 F2 09 C5 E9 72 D2 17 C5 E9 EF D4 C5 E9 EF D6 C5 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Bulz_0998f811 {
+    meta:
+        id = "0998f811-7be3-4d46-9dcb-1e8a0f19bab5"
+        fingerprint = "c8a83bc305998cb6256b004e9d8ce6d5d1618b107e42be139b73807462b53c31"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Bulz"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 79 70 E4 39 C5 F9 70 C9 4E C5 91 72 F0 12 C5 F9 72 D0 0E C5 91 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Camelot.yar b/yara/rules/Linux_Cryptominer_Camelot.yar
new file mode 100644
index 00000000..966c0a03
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Camelot.yar
@@ -0,0 +1,282 @@
+rule Linux_Cryptominer_Camelot_9ac1654b {
+    meta:
+        id = "9ac1654b-f2f0-4d32-8e2a-be30b3e61bb0"
+        fingerprint = "156c60ee17e9b39cb231d5f0703b6e2a7e18247484f35e11d3756a025873c954"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { CD 41 C1 CC 0B 31 D1 31 E9 44 89 D5 44 31 CD C1 C9 07 41 89 E8 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_dd167aa0 {
+    meta:
+        id = "dd167aa0-80e0-46dc-80d1-9ce9f6984860"
+        fingerprint = "2642e4c4c58d95cd6ed6d38bf89b108dc978a865473af92494b6cb89f4f877e2"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E7 F2 AE 4C 89 EF 48 F7 D1 48 89 CE 48 89 D1 F2 AE 48 89 C8 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_b25398dd {
+    meta:
+        id = "b25398dd-33cc-4ad8-b943-cd06ff7811fb"
+        fingerprint = "6bdcefe93b1c36848b79cdc6b2ff79deb04012a030e5d92e725c87e520c15554"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        reference_sample = "6fb3b77be0a66a10124a82f9ec6ad22247d7865a4d26aa49c5d602320318ce3c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 04 76 48 8B 44 07 23 48 33 82 C0 00 00 00 48 89 44 24 50 49 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_6a279f19 {
+    meta:
+        id = "6a279f19-3c9e-424b-b89e-8807f40b89eb"
+        fingerprint = "1c0ead7a7f7232edab86d2ef023c853332254ce1dffe1556c821605c0a83d826"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        reference_sample = "5b01f72b2c53db9b8f253bb98c6584581ebd1af1b1aaee62659f54193c269fca"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 F3 89 D6 48 83 EC 30 48 89 E2 64 48 8B 04 25 28 00 00 00 48 89 44 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_4e7945a4 {
+    meta:
+        id = "4e7945a4-b827-4496-89d8-e63c3141c773"
+        fingerprint = "bb2885705404c7d49491ab39fa8f50d85c354a43b4662b948c30635030feee74"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        reference_sample = "b7504ce57787956e486d951b4ff78d73807fcc2a7958b172febc6d914e7a23a7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 E5 48 81 EC A0 00 00 00 48 89 7D F0 48 8B 7D F0 48 89 F8 48 05 80 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_29c1c386 {
+    meta:
+        id = "29c1c386-c09c-4a58-b454-fc8feb78051d"
+        fingerprint = "2ad8d0d00002c969c50fde6482d797d76d60572db5935990649054b5a103c5d1"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        reference_sample = "fc73bbfb12c64d2f20efa22a6d8d8c5782ef57cb0ca6d844669b262e80db2444"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 65 20 62 72 61 6E 63 68 00 00 00 49 67 6E 6F 72 69 6E 67 20 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_25b63f54 {
+    meta:
+        id = "25b63f54-8a32-4866-8f90-b2949f5e7539"
+        fingerprint = "c0bc4f5fc0ad846a90e214dfca8252bf096463163940930636c1693c7f3833fa"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0F 6F 39 66 41 0F 6F 32 66 4D 0F 7E C3 66 44 0F D4 CB 66 45 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_73e2373e {
+    meta:
+        id = "73e2373e-75ac-4385-b663-a50423626fc8"
+        fingerprint = "6ce73e55565e9119a355b91ec16c2147cc698b1a57cc29be22639b34ba39eea9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        reference_sample = "fc73bbfb12c64d2f20efa22a6d8d8c5782ef57cb0ca6d844669b262e80db2444"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 F8 48 83 7D F8 00 74 4D 48 8B 55 80 48 8D 45 A0 48 89 D6 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_b8552fff {
+    meta:
+        id = "b8552fff-29a9-4e09-810a-b4b52a7a3fb4"
+        fingerprint = "d5998e0bf7df96dd21d404658589fb37b405398bd3585275419169b30c72ce62"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        reference_sample = "cdd3d567fbcbdd6799afad241ae29acbe4ab549445e5c4fc0678d16e75b40dfa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 18 8B 44 24 1C 8B 50 0C 83 E8 04 8B 0A FF 74 24 28 FF 74 24 28 FF 74 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_83550472 {
+    meta:
+        id = "83550472-4c97-4afc-b187-1a7ffc9acbbc"
+        fingerprint = "63cf1cf09ad06364e1b1f15774400e0544dbb0f38051fc795b4fc58bd08262d1"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        reference_sample = "d2d8421ffdcebb7fed00edcf306ec5e86fc30ad3e87d55e85b05bea5dc1f7d63"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FA 48 8D 4A 01 48 D1 E9 48 01 CA 48 29 F8 48 01 C3 49 89 C4 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_8799d8d6 {
+    meta:
+        id = "8799d8d6-714b-4837-be60-884d78e3b8f3"
+        fingerprint = "05c8d7c1d11352f2ec0b5d96a7b2378391ad9f8ae285a1299111aca38352f707"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        reference_sample = "4a6d98eae8951e5b9e0a226f1197732d6d14ed45c1b1534d3cdb4413261eb352"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 72 56 66 48 32 37 48 4D 5A 75 6D 74 46 75 4A 72 6D 48 47 38 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_0f7c5375 {
+    meta:
+        id = "0f7c5375-99dc-4204-833a-9128798ed2e9"
+        fingerprint = "53bb31c6ba477ed86e55ce31844055c26d7ab7392d78158d3f236d621181ca10"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        reference_sample = "e75be5377ad65abdc69e6c7f9fe17429a98188a217d0ca3a6f40e75c4f0c07e8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F8 7F 48 89 85 C0 00 00 00 77 08 48 83 85 C8 00 00 00 01 31 F6 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_87639dbd {
+    meta:
+        id = "87639dbd-da2d-4cf9-a058-16f4620a5a7f"
+        fingerprint = "c145df0a671691ef2bf17644ec7c33ebb5826d330ffa35120d4ba9e0cb486282"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        reference_sample = "d2d8421ffdcebb7fed00edcf306ec5e86fc30ad3e87d55e85b05bea5dc1f7d63"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 00 48 83 C2 01 48 89 EF 48 89 53 38 FF 50 18 48 8D 7C 24 30 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_cdd631c1 {
+    meta:
+        id = "cdd631c1-2c03-47dd-b50a-e8c0b9f67271"
+        fingerprint = "fa174ac25467ab6e0f11cf1f0a5c6bf653737e9bbdc9411aabeae460a33faa5e"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        reference_sample = "91549c171ae7f43c1a85a303be30169932a071b5c2b6cf3f4913f20073c97897"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Camelot_209b02dd {
+    meta:
+        id = "209b02dd-3087-475b-8d28-baa18647685b"
+        fingerprint = "5829daea974d581bb49ac08150b63b7b24e6fae68f669b6b7ab48418560894d4"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Camelot"
+        reference_sample = "60d33d1fdabc6b10f7bb304f4937051a53d63f39613853836e6c4d095343092e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 31 F5 44 0B 5C 24 F4 41 C1 EA 10 44 0B 54 24 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Casdet.yar b/yara/rules/Linux_Cryptominer_Casdet.yar
new file mode 100644
index 00000000..34c82661
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Casdet.yar
@@ -0,0 +1,19 @@
+rule Linux_Cryptominer_Casdet_5d0d33be {
+    meta:
+        id = "5d0d33be-e53e-4188-9957-e1af2a802867"
+        fingerprint = "2d584f6815093d37bd45a01146034d910b95be51462f01f0d4fc4a70881dfda6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Casdet"
+        reference_sample = "4b09115c876a8b610e1941c768100e03c963c76b250fdd5b12a74253ef9e5fb6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C3 EB 05 48 89 C3 EB CF 48 8B BC 24 A0 00 00 00 48 85 FF 74 D7 48 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Ccminer.yar b/yara/rules/Linux_Cryptominer_Ccminer.yar
new file mode 100644
index 00000000..810b8c8b
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Ccminer.yar
@@ -0,0 +1,38 @@
+rule Linux_Cryptominer_Ccminer_18fc60e5 {
+    meta:
+        id = "18fc60e5-680c-4ff6-8a76-12cc3ae9cd3d"
+        fingerprint = "461e942fcaf5faba60c3dc39d8089f9d506ff2daacb2a22573fb35bcfee9b6f1"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Ccminer"
+        reference_sample = "dbb403a00c75ef2a74b41b8b58d08a6749f37f922de6cc19127a8f244d901c60"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 68 27 52 22 02 02 32 22 22 03 5C 8B AE 00 00 00 48 03 5C }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Ccminer_3c593bc3 {
+    meta:
+        id = "3c593bc3-cb67-41da-bef1-aad9e73c34f7"
+        fingerprint = "0a382ef73d3b5d1b1ad223c66fc367cc5b6f2b23a9758002045076234f257dfe"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Ccminer"
+        reference_sample = "dbb403a00c75ef2a74b41b8b58d08a6749f37f922de6cc19127a8f244d901c60"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 20 83 5C DE C2 00 00 00 68 03 5C EB EA 00 00 00 48 03 1C DC }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Flystudio.yar b/yara/rules/Linux_Cryptominer_Flystudio.yar
new file mode 100644
index 00000000..05fd524c
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Flystudio.yar
@@ -0,0 +1,37 @@
+rule Linux_Cryptominer_Flystudio_579a3a4d {
+    meta:
+        id = "579a3a4d-ddb0-4f73-9224-16fba973d624"
+        fingerprint = "148b27046f72a7645ebced9f76424ffd7b368347311b04c9357d5d4ea8d373fb"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Flystudio"
+        reference_sample = "84afc47554cf42e76ef8d28f2d29c28f3d35c2876cec2fb1581b0ac7cfe719dd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { EF C1 66 0F 72 F1 05 66 0F EF C2 66 0F EF C1 66 0F 6F CD 66 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Flystudio_0a370634 {
+    meta:
+        id = "0a370634-51de-46bf-9397-c41ef08a7b83"
+        fingerprint = "6613ddd986e2bf4b306cd1a5c28952da8068f1bb533c53557e2e2add5c2dbd1f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Flystudio"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 72 D7 19 66 41 0F EF E9 66 0F EF EF 66 0F 6F FD 66 41 0F FE FD 66 44 0F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Generic.yar b/yara/rules/Linux_Cryptominer_Generic.yar
new file mode 100644
index 00000000..c9033dc9
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Generic.yar
@@ -0,0 +1,836 @@
+rule Linux_Cryptominer_Generic_d7bd0e5d {
+    meta:
+        id = "d7bd0e5d-3528-4648-aaa5-6cf44d22c0d5"
+        fingerprint = "fbc06c7603aa436df807ad3f77d5ba783c4d33f61b06a69e8641741068f3a543"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "afcfd67af99e437f553029ccf97b91ed0ca891f9bcc01c148c2b38c75482d671"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { CF 99 67 D8 37 AA 24 80 F2 F3 47 6A A5 5E 88 50 F1 28 61 18 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_69e1a763 {
+    meta:
+        id = "69e1a763-1e0d-4448-9bc4-769f3a36ac10"
+        fingerprint = "9007ab73902ef9bfa69e4ddc29513316cb6aa7185986cdb10fd833157cd7d434"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "b04d9fabd1e8fc42d1fa8e90a3299a3c36e6f05d858dfbed9f5e90a84b68bcbb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 43 08 49 89 46 08 48 8B 43 10 49 89 46 10 48 85 C0 74 8A F0 83 40 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_397a86bd {
+    meta:
+        id = "397a86bd-6d66-4db0-ad41-d0ae3dbbeb21"
+        fingerprint = "0bad343f28180822bcb45b0a84d69b40e26e5eedb650db1599514020b6736dd0"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "79c47a80ecc6e0f5f87749319f6d5d6a3f0fbff7c34082d747155b9b20510cde"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 74 4F 48 8B 75 00 48 8B 4D 08 4C 89 F7 48 8B 55 10 48 8B 45 18 48 89 74 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_37c3f8d3 {
+    meta:
+        id = "37c3f8d3-9d79-434c-b0e8-252122ebc62a"
+        fingerprint = "6ba0bae987db369ec6cdadf685b8c7184e6c916111743f1f2b43ead8d028338c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "efbddf1020d0845b7a524da357893730981b9ee65a90e54976d7289d46d0ffd4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F0 4C 01 F0 49 8B 75 08 48 01 C3 49 39 F4 74 29 48 89 DA 4C }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_28a80546 {
+    meta:
+        id = "28a80546-ae74-4616-8896-50f54da66650"
+        fingerprint = "7f49f04ba36e7ff38d313930c469d64337203a60792f935a3548cee176ae9523"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "96cc225cf20240592e1dcc8a13a69f2f97637ed8bc89e30a78b8b2423991d850"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 72 59 D4 B5 63 E2 4D B6 08 EF E8 0A 3A B1 AD 1B 61 6E 7C 65 D1 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_9d531f70 {
+    meta:
+        id = "9d531f70-c42f-4e1a-956a-f9ac43751e73"
+        fingerprint = "2c6019f7bc2fc47d7002e0ba6e35513950260b558f1fdc732d3556dabbaaa93d"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "36f2ce4e34faf42741f0a15f62e8b3477d69193bf289818e22d0e3ee3e906eb0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 49 10 58 00 10 D4 34 80 08 30 01 20 02 00 B1 00 83 49 23 16 54 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_23a5c29a {
+    meta:
+        id = "23a5c29a-6a8f-46f4-87ba-2a60139450ce"
+        fingerprint = "1a7a86ff6e1666c2da6e6f65074bb1db2fe1c97d1ad42d1f670dd5c88023eecf"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "1320d7a2b5e3b65fe974a95374b4ea7ed1a5aa27d76cd3d9517d3a271121103f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C1 48 29 D0 48 01 C0 4D 8B 39 48 29 C1 49 29 F8 48 8D 04 C9 4D 8D }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_ea5703ce {
+    meta:
+        id = "ea5703ce-4ad4-46cc-b253-8d022ca385a3"
+        fingerprint = "a58a41ab4602380c0989659127d099add042413f11e3815a5e1007a44effaa68"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "bec6eea63025e2afa5940d27ead403bfda3a7b95caac979079cabef88af5ee0b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0F 94 C0 EB 05 B8 01 00 00 00 44 21 E8 48 8B 4C 24 08 64 48 33 0C 25 28 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_6a4f4255 {
+    meta:
+        id = "6a4f4255-d202-48b7-96ae-cb7211dcbea3"
+        fingerprint = "0ed37d7eccd4e36b954824614b976e1371c3b2ffe318345d247198d387a13de6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "8cfc38db2b860efcce5da40ce1e3992f467ab0b7491639d68d530b79529cda80"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FD 48 8D 5D 01 4C 8D 14 1B 48 C1 E3 05 4C 01 EB 4D 8D 7A FF F2 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_9088d00b {
+    meta:
+        id = "9088d00b-622a-4cbf-9600-6dfcf2fc0c2c"
+        fingerprint = "85cbe86b9f96fc1b6899b35cc4aa16b66a91dc1239ed5f5cf3609322cec30f30"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "8abb2b058ec475b0b6fd0c994685db72e98d87ee3eec58e29cf5c324672df04a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 2C 1C 77 16 48 8B 44 24 08 64 48 33 04 25 28 00 00 00 75 24 48 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_71024c4a {
+    meta:
+        id = "71024c4a-e8da-44fc-9cf9-c71829dfe87a"
+        fingerprint = "dbbb74ec687e8e9293dfa2272d55b81ef863a50b0ff87daf15aaf6cee473efe6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "afe81c84dcb693326ee207ccd8aeed6ed62603ad3c8d361e8d75035f6ce7c80f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 46 08 48 89 45 08 48 8B 46 10 48 85 C0 48 89 45 10 74 BC F0 FF }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_d81368a3 {
+    meta:
+        id = "d81368a3-00ca-44cf-b009-718272d389eb"
+        fingerprint = "dd463df2c03389af3e7723fda684b0f42342817b3a76664d131cf03542837b8a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "71225e4702f2e0a0ecf79f7ec6c6a1efc95caf665fda93a646519f6f5744990b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { CB 49 C1 E3 04 49 01 FB 41 8B 13 39 D1 7F 3F 7C 06 4D 3B 43 08 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_97e9cebe {
+    meta:
+        id = "97e9cebe-d30b-49f6-95f4-fd551e7a42e4"
+        fingerprint = "61bef39d174d97897ac0820b624b1afbfe73206208db420ae40269967213ebed"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "b4ff62d92bd4d423379f26b37530776b3f4d927cc8a22bd9504ef6f457de4b7a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8B 04 25 28 00 00 00 48 89 44 24 58 31 C0 49 83 FF 3F 48 89 74 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_98ff0f36 {
+    meta:
+        id = "98ff0f36-5faf-417a-9431-8a44e9f088f4"
+        fingerprint = "b25420dfc32522a060dc8470315409280e3c03de0b347e92a5bc6c1a921af94a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "4c14aaf05149bb38bbff041432bf9574dd38e851038638aeb121b464a1e60dcc"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 A8 8B 00 89 C2 48 8B 45 C8 48 01 C2 8B 45 90 48 39 C2 7E 08 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_1512cf40 {
+    meta:
+        id = "1512cf40-ae62-40cf-935d-589be4fe3d93"
+        fingerprint = "f9800996d2e6d9ea8641d51aedc554aa732ebff871f0f607bb3fe664914efd5a"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "fc063a0e763894e86cdfcd2b1c73d588ae6ecb411c97df2a7a802cd85ee3f46d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C4 10 5B C3 E8 35 A7 F6 FF 0F 1F 44 00 00 53 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_0d6005a1 {
+    meta:
+        id = "0d6005a1-a481-4679-a214-f1e3ef8bf1d0"
+        fingerprint = "435040ec452d337c60435b07622d3a8af8e3b7e8eb6ec2791da6aae504cc2266"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "230d46b39b036552e8ca6525a0d2f7faadbf4246cdb5e0ac9a8569584ef295d4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 79 73 00 6E 6F 5F 6D 6C 63 6B 00 77 61 72 6E 00 6E 65 76 65 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_e1ff020a {
+    meta:
+        id = "e1ff020a-446c-4537-8cc3-3bcc56ba5a99"
+        fingerprint = "363872fe6ef89a0f4c920b1db4ac480a6ae70e80211200b73a804b43377fff01"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "5b611898f1605751a3d518173b5b3d4864b4bb4d1f8d9064cc90ad836dd61812"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0F B6 4F 3D 0B 5C 24 F4 41 C1 EB 10 44 0B 5C 24 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_102d6f7c {
+    meta:
+        id = "102d6f7c-0e77-4b23-9e84-756aba929d83"
+        fingerprint = "037b1da31ffe66015c959af94d89eef2f7f846e1649e4415c31deaa81945aea9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "bd40c2fbf775e3c8cb4de4a1c7c02bc4bcfa5b459855b2e5f1a8ab40f2fb1f9e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 70 D2 AA C5 F9 EF D2 C5 F1 EF CB C5 E1 73 FB 04 C4 E3 79 DF }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_9c8f3b1a {
+    meta:
+        id = "9c8f3b1a-0273-4164-ba48-b0bc090adf9e"
+        fingerprint = "a35efe6bad4e0906032ab2fd7c776758e71caed8be402948f39682cf1f858005"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "74d8344139c5deea854d8f82970e06fc6a51a6bf845e763de603bde7b8aa80ac"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6F 67 31 70 00 6C 6F 67 32 66 00 6C 6C 72 6F 75 6E 64 00 73 71 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_76cb94a9 {
+    meta:
+        id = "76cb94a9-5a3f-483c-91f3-aa0e3c27f7ba"
+        fingerprint = "623a33cc95af46b8f0d557c69f8bf72db7c57fe2018b7a911733be4ddd71f073"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "1320d7a2b5e3b65fe974a95374b4ea7ed1a5aa27d76cd3d9517d3a271121103f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8C 24 98 00 00 00 31 C9 80 7A 4A 00 48 89 74 24 18 48 89 54 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_616afaa1 {
+    meta:
+        id = "616afaa1-7679-4198-9e80-c3f044b3c07d"
+        fingerprint = "fd6afad9f318ce00b0f0f8be3a431a2c7b4395dd69f82328f4555b3715a8b298"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "0901672d2688660baa26fdaac05082c9e199c06337871d2ae40f369f5d575f71"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4B 04 31 C0 41 8B 14 07 89 14 01 48 83 C0 04 48 83 F8 14 75 EF 4C 8D 74 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_18af74b2 {
+    meta:
+        id = "18af74b2-99fe-42fc-aacd-7887116530a8"
+        fingerprint = "07a6b44ff1ba6143c76e7ccb3885bd04e968508e93c5f8bff9bc5efc42a16a96"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "52707aa413c488693da32bf2705d4ac702af34faee3f605b207db55cdcc66318"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 70 6F 77 00 6C 6F 67 31 70 00 6C 6F 67 32 66 00 63 65 69 6C 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_1b76c066 {
+    meta:
+        id = "1b76c066-463c-46e5-8a08-ccfc80e3f399"
+        fingerprint = "e33937322a1a2325539d7cdb1df13295e5ca041a513afe1d5e0941f0c66347dd"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "f60302de1a0e756e3af9da2547a28da5f57864191f448e341af1911d64e5bc8b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0C 14 89 0C 10 48 83 C2 04 48 83 FA 20 75 EF 48 8D 8C 24 F0 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_b6ea5ee1 {
+    meta:
+        id = "b6ea5ee1-ede5-4fa3-a065-99219b3530da"
+        fingerprint = "07c2f1fcb50ce5bcdebfc03fca4aaacdbabab42a857d7cc8f008712ca576b871"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "19b442c9aa229cd724ed9cbaa73f9dfaf0ed61aa3fd1bee7bf8ba964fc23a2b8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 47 20 49 8D 77 20 4C 89 74 24 10 4C 89 6C 24 18 4C 89 64 24 20 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_050ac14c {
+    meta:
+        id = "050ac14c-9aef-4212-97fd-e2a21c2f62e2"
+        fingerprint = "6f0a5a5d3cece7ae8db47ef5e1bbbea02b886e865f23b0061c2d346feb351663"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "36f2ce4e34faf42741f0a15f62e8b3477d69193bf289818e22d0e3ee3e906eb0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 47 08 49 3B 47 10 74 3C 48 85 C0 74 16 48 8B 13 48 89 10 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_df937caa {
+    meta:
+        id = "df937caa-ca6c-4a80-a68c-c265dab7c02c"
+        fingerprint = "963642e141db6c55bd8251ede57b38792278ded736833564ae455cc553ab7d24"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "19b442c9aa229cd724ed9cbaa73f9dfaf0ed61aa3fd1bee7bf8ba964fc23a2b8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 04 62 20 0A 10 02 0A 14 60 29 00 02 0C 24 14 60 7D 44 01 70 01 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_e9ff82a8 {
+    meta:
+        id = "e9ff82a8-b8ca-45fb-9738-3ce0c452044f"
+        fingerprint = "91e78b1777a0580f25f7796aa6d9bcbe2cbad257576924aecfe513b1e1206915"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "62ea137e42ce32680066693f02f57a0fb03483f78c365dffcebc1f992bb49c7a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D9 4D 01 CA 4C 89 74 24 D0 4C 8B 74 24 E8 4D 31 D4 49 C1 C4 20 48 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_a5267ea3 {
+    meta:
+        id = "a5267ea3-b98c-49e9-8051-e33a101f12d3"
+        fingerprint = "8391a4dbc361eec2877852acdc77681b3a15922d9a047d7ad12d06271d53f540"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "b342ceeef58b3eeb7a312038622bcce4d76fc112b9925379566b24f45390be7d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { EE 6A 00 41 B9 01 00 00 00 48 8D 4A 13 4C 89 E7 88 85 40 FF }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_4e9075e6 {
+    meta:
+        id = "4e9075e6-3ca9-459e-9f5f-3e614fd4f1c8"
+        fingerprint = "70d8c4ecb185b8817558ad9d26a47c340c977abb6abfca8efe1ff99efb43c579"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "098bf2f1ce9d7f125e1c9618f349ae798a987316e95345c037a744964277f0fe"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 2C 24 74 67 48 89 5C 24 18 4C 89 6C 24 20 4C 89 FB 4D 89 E5 4C 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_3a8d0974 {
+    meta:
+        id = "3a8d0974-384e-4d62-9aa8-0bd8f7d50206"
+        fingerprint = "60cb81033461e73fcb0fb8cafd228e2c9478c132f49e115c5e55d5579500caa2"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference = "193fe9ea690759f8e155458ef8f8e9efe9efc8c22ec8073bbb760e4f96b5aef7"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 07 41 89 34 06 48 83 C0 04 48 83 F8 20 75 EF 8B 42 D4 66 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_b9e6ffdf {
+    meta:
+        id = "b9e6ffdf-4b2b-4052-9c91-a06f43a2e7b8"
+        fingerprint = "fdd91d5802d5807d52f4c9635e325fc0765bb54cf51305c7477d2b791f393f3e"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "c0f3200a93f1be4589eec562c4f688e379e687d09c03d1d8850cc4b5f90f192a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 D8 48 83 C4 20 5B C3 0F 1F 00 BF ?? ?? 40 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_7ef74003 {
+    meta:
+        id = "7ef74003-cd1f-4f2f-9c96-4dbcabaa36e4"
+        fingerprint = "187fd82b91ae6eadc786cadac75de5d919a2b8a592037a5bf8da2efa2539f507"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "a172cfecdec8ebd365603ae094a16e247846fdbb47ba7fd79564091b7e8942a0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 41 56 45 31 F6 41 55 49 89 F5 41 54 44 8D 67 01 55 4D 63 E4 53 49 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_1d0700b8 {
+    meta:
+        id = "1d0700b8-1bc0-4da2-a903-9d78e79e71d8"
+        fingerprint = "19853be803f82e6758554a57981e1b52c43a017ab88242c42a7c39f6ead01cf3"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "de59bee1793b88e7b48b6278a52e579770f5204e92042142cc3a9b2d683798dd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 30 42 30 42 00 22 22 03 5C DA 10 00 C0 00 60 43 9C 64 48 00 00 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_55beb2ee {
+    meta:
+        id = "55beb2ee-7306-4134-a512-840671cc4490"
+        fingerprint = "707a1478f86da2ec72580cfe4715b466e44c345deb6382b8dc3ece4e3935514d"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "edda1c6b3395e7f14dd201095c1e9303968d02c127ff9bf6c76af6b3d02e80ad"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 FC 00 00 00 8B 84 24 C0 00 00 00 0F 29 84 24 80 00 00 00 0F 11 94 24 C4 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_fdd7340f {
+    meta:
+        id = "fdd7340f-49d6-4770-afac-24104a3c2f86"
+        fingerprint = "cc302eb6c133901cc3aa78e6ca0af16a620eb4dabb16b21d9322c4533f11d25f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "de59bee1793b88e7b48b6278a52e579770f5204e92042142cc3a9b2d683798dd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { EA 48 89 DE 48 8D 7C 24 08 FF 53 18 48 8B 44 24 08 48 83 78 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_2627921e {
+    meta:
+        id = "2627921e-6c0d-4515-a09a-b2c99a59598d"
+        fingerprint = "2551ece438a09700c825faa63caa3e21ced94c85bdaa5b1b0dd63603d4fa9bb6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "350a8ceabd8495e66cc58885f1ab38f602c66c162c05e4b6ae0e2a7977ec2cdf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0F 6F D0 66 44 0F 6F C1 66 0F 69 E2 66 44 0F 61 D2 66 44 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_e36a35b0 {
+    meta:
+        id = "e36a35b0-cb38-4d2d-bca2-f3734637faa8"
+        fingerprint = "0ee42ff704c82ee6c2bc0408cccb77bcbae8d4405bb1f405ee09b093e7a626c0"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "ab6d8f09df67a86fed4faabe4127cc65570dbb9ec56a1bdc484e72b72476f5a4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 71 F2 08 66 0F EF C1 66 0F EF D3 66 0F 7F 44 24 60 66 0F 7F 54 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_6dad0380 {
+    meta:
+        id = "6dad0380-7771-4fb9-a7e5-176eeb6fcfd7"
+        fingerprint = "ffe022f42e98c9c1eeb3aead0aca9d795200b4b22f89e7f3b03baf96f18c9473"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "628b1cc8ccdbe2ae0d4ef621da047e07e2532d00fe3d4da65f0a0bcab20fb546"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 48 C1 E6 05 48 01 C6 48 39 F1 74 05 49 89 74 24 08 44 89 E9 48 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_e73f501e {
+    meta:
+        id = "e73f501e-019c-4281-ae93-acde7ad421af"
+        fingerprint = "bd9e6f2548c918b2c439a047410b6b239c3993a3dbd85bfd70980c64d11a6c5c"
+        creation_date = "2021-12-13"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "2f646ced4d05ba1807f8e08a46ae92ae3eea7199e4a58daf27f9bd0f63108266"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 03 51 8A 92 FF F3 20 01 DE 63 AF 8B 54 73 0A 65 83 64 88 60 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_5e56d076 {
+    meta:
+        id = "5e56d076-0d6d-4979-8ebc-52607dcdb42d"
+        fingerprint = "e9ca9b9faee091afed534b89313d644a52476b4757663e1cdfbcbca379857740"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "32e1cb0369803f817a0c61f25ca410774b4f37882cab966133b4f3e9c74fac09"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 71 18 4C 89 FF FF D0 48 8B 84 24 A0 00 00 00 48 89 43 60 48 8B 84 24 98 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_54357231 {
+    meta:
+        id = "54357231-23d8-44f5-94d7-71da02a8ba38"
+        fingerprint = "8bbba49c863bc3d53903b1a204851dc656f3e3d68d3c8d5a975ed2dc9e797e13"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "388b927b850b388e0a46a6c9a22b733d469e0f93dc053ebd78996e903b25e38a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 73 F2 06 C5 F9 EB C2 C4 E3 79 16 E0 02 C4 E3 79 16 E2 03 C5 F9 70 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_467c4d46 {
+    meta:
+        id = "467c4d46-3272-452c-9251-3599d16fc916"
+        fingerprint = "cbde94513576fdb7cabf568bd8439f0194d6800373c3735844e26d262c8bc1cc"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "388b927b850b388e0a46a6c9a22b733d469e0f93dc053ebd78996e903b25e38a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 49 8B 77 08 48 21 DE 4C 39 EE 75 CE 66 41 83 7F 1E 04 4C 89 F5 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_e0cca9dc {
+    meta:
+        id = "e0cca9dc-0f3e-42d8-bb43-0625f4f9bfe1"
+        fingerprint = "e7bc17ba356774ed10e65c95a8db3b09d3b9be72703e6daa9b601ea820481db7"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "59a1d8aa677739f2edbb8bd34f566b31f19d729b0a115fef2eac8ab1d1acc383"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 54 24 40 48 8D 94 24 C0 00 00 00 F3 41 0F 6F 01 48 89 7C 24 50 48 89 74 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Generic_36e404e2 {
+    meta:
+        id = "36e404e2-be7c-40dc-b861-8ab929cad019"
+        fingerprint = "7268b94d67f586ded78ad3a52b23a81fd4edb866fedd0ab1e55997f1bbce4c72"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Cryptominer.Generic"
+        reference_sample = "59a1d8aa677739f2edbb8bd34f566b31f19d729b0a115fef2eac8ab1d1acc383"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 61 6C 73 65 20 70 6F 73 69 74 69 76 65 29 1B 5B 30 6D 00 44 45 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Loudminer.yar b/yara/rules/Linux_Cryptominer_Loudminer.yar
new file mode 100644
index 00000000..5c649f18
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Loudminer.yar
@@ -0,0 +1,57 @@
+rule Linux_Cryptominer_Loudminer_581f57a9 {
+    meta:
+        id = "581f57a9-36e0-4b95-9a1e-837bdd4aceab"
+        fingerprint = "1013e6e11ea2a30ecf9226ea2618a59fb08588cdc893053430e969fbdf6eb675"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Loudminer"
+        reference_sample = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 44 24 08 48 8B 70 20 48 8B 3B 48 83 C3 08 48 89 EA 48 8B 07 FF }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Loudminer_f2298a50 {
+    meta:
+        id = "f2298a50-7bd4-43d8-ac84-b36489405f2e"
+        fingerprint = "8eafc1c995c0efb81d9ce6bcc107b102551371f3fb8efdf8261ce32631947e03"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Loudminer"
+        reference_sample = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { B6 04 07 41 8D 40 D0 3C 09 76 AD 41 8D 40 9F 3C 05 76 A1 41 8D }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Loudminer_851fc7aa {
+    meta:
+        id = "851fc7aa-6514-4f47-b6b5-a1e730b5d460"
+        fingerprint = "e4d78229c1877a023802d7d99eca48bffc55d986af436c8a1df7c6c4e5e435ba"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Loudminer"
+        reference_sample = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 49 8B 45 00 4C 8B 40 08 49 8D 78 18 49 89 FA 49 29 D2 49 01 C2 4C }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Malxmr.yar b/yara/rules/Linux_Cryptominer_Malxmr.yar
new file mode 100644
index 00000000..1f671fd7
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Malxmr.yar
@@ -0,0 +1,303 @@
+rule Linux_Cryptominer_Malxmr_d13544d7 {
+    meta:
+        id = "d13544d7-4834-4ce7-9339-9c933ee51b2c"
+        fingerprint = "02e1be4a7073e849b183851994c83f1f2077fe74cbcdd0b3066999d0c9499a09"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "85fa30ba59602199fd99463acf50bd607e755c2e18cd8843ffcfb6b1aca24bb3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 51 50 4D 21 EB 4B 8D 0C 24 4C 89 54 24 90 4C 89 DD 48 BA AA AA AA AA AA AA }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_ad09e090 {
+    meta:
+        id = "ad09e090-098e-461d-b967-e45654b902bb"
+        fingerprint = "a62729bbe04eca01dbb3c56de63466ed115f30926fc5d203c9bae75a93227e09"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "cdd3d567fbcbdd6799afad241ae29acbe4ab549445e5c4fc0678d16e75b40dfa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 50 8B 44 24 64 89 54 24 54 39 C3 77 0E 72 08 8B 44 24 60 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_12299814 {
+    meta:
+        id = "12299814-c916-4cad-a627-f8b082f5643d"
+        fingerprint = "b626f04a8648b0f42564df9c2ef3989e602d1307b18256e028450c495dc15260"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "eb3802496bd2fef72bd2a07e32ea753f69f1c2cc0b5a605e480f3bbb80b22676"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 3C 40 00 83 C4 10 89 44 24 04 80 7D 00 00 74 97 83 EC 0C 89 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_a47b77e4 {
+    meta:
+        id = "a47b77e4-0d8d-4714-8527-7b783f0f27b8"
+        fingerprint = "635a35defde186972cd6626bd75a1e557a1a9008ab93b38ef1a3635b3210354b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "995b43ccb20343494e314824343a567fd85f430e241fdeb43704d9d4937d76cc"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8D 48 49 5E 97 87 DC 73 86 19 51 B3 36 1A 6E FC 8C CC 2C 6E 0B }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_21d0550b {
+    meta:
+        id = "21d0550b-4f15-4481-ba9c-2be26ea8f81a"
+        fingerprint = "5b556d2e3e48fda57c741c4c7b9efb72aad579e5055df366cdb9cfa38e496494"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "07db41a4ddaac802b04df5e5bbae0881fead30cb8f6fa53a8a2e1edf14f2d36b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 3B 31 C0 48 83 C9 FF 48 89 EE F2 AE 48 8B 3B 48 F7 D1 48 FF C9 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_c8adb449 {
+    meta:
+        id = "c8adb449-3de5-4cdd-9b62-fe4bcbe82394"
+        fingerprint = "838950826835e811eb7ea3af7a612b4263d171ded4761d2b547a4012adba4028"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "00ec7a6e9611b5c0e26c148ae5ebfedc57cf52b21e93c2fe3eac85bf88edc7ea"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D2 4C 89 54 24 A0 4C 89 FA 48 F7 D2 48 23 54 24 88 49 89 D2 48 8B 54 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_bcab1e8f {
+    meta:
+        id = "bcab1e8f-8a8f-4309-8e47-416861d1894c"
+        fingerprint = "2106f2ba97c75468a2f25d1266053791034ff9a15d57df1ba3caf21f74b812f7"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "19df7fd22051abe3f782432398ea30f8be88cf42ef14bc301b1676f35b37cd7e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { EB D9 D3 0B EB D5 29 0B EB D1 03 48 6C 01 0B EB CA 0F AF 0B }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_6671f33a {
+    meta:
+        id = "6671f33a-03bb-40d8-b439-64a66082457d"
+        fingerprint = "cb178050ee351059b083c6a71b5b1b6a9e0aa733598a05b3571701949b4e6b28"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "85fa30ba59602199fd99463acf50bd607e755c2e18cd8843ffcfb6b1aca24bb3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4D 18 48 01 4B 18 5A 5B 5D C3 83 C8 FF C3 48 85 FF 49 89 F8 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_74418ec5 {
+    meta:
+        id = "74418ec5-f84a-4d79-b1b0-c1d579ad7b97"
+        fingerprint = "ec14cac86b2b0f75f1d01b7fb4b57bfa3365f8e4d11bfed2707b0174875d1234"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "d79ad967ac9fc0b1b6d54e844de60d7ba3eaad673ee69d30f9f804e5ccbf2880"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F9 75 7A A8 8A 65 FC 5C E0 6E 09 4B 8F AA B3 A4 66 44 B1 D1 13 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_979160f6 {
+    meta:
+        id = "979160f6-402a-4e4b-858a-374c9415493b"
+        fingerprint = "fb933702578e2cf7e8ad74554ef93c07b610d6da8bc5743cbf86c363c1615f40"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E0 08 C1 ED 10 41 31 C3 89 D8 45 09 D0 C1 E8 10 C1 E3 10 41 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_fe7139e5 {
+    meta:
+        id = "fe7139e5-3c8e-422c-aaf7-e683369d23d4"
+        fingerprint = "4af38ca3ec66ca86190e6196a9a4ba81a0a2b77f88695957137f6cda8fafdec9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "8b13dc59db58b6c4cd51abf9c1d6f350fa2cb0dbb44b387d3e171eacc82a04de"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FF 74 5B 48 29 F9 49 89 DC 4C 8D 69 01 49 D1 ED 4C 01 E9 4D 8D 6C }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_f35a670c {
+    meta:
+        id = "f35a670c-7599-4c93-b08b-463c4a93808a"
+        fingerprint = "9064024118d30d89bdc093d5372a0d9fefd43eb1ac6359dbedcf3b73ba93f312"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "a73808211ba00b92f8d0027831b3aa74db15f068c53dd7f20fcadb294224f480"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4C 01 CD 48 0F AF D6 48 8D 54 55 00 89 DD 48 31 D7 48 C1 C7 20 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_70e5946e {
+    meta:
+        id = "70e5946e-3e73-4b07-9e7d-af036a3242f9"
+        fingerprint = "ced6885fda17c862753232fde3e7e8797f5a900ebab7570b78aa7138a0068eb9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4F 70 48 8D B4 24 B0 00 00 00 48 89 34 CA 49 8B 57 68 48 89 C8 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_033f06dd {
+    meta:
+        id = "033f06dd-f3ed-4140-bbff-138ed2d8378c"
+        fingerprint = "2f1f39e10df0ca6c133237b6d92afcb8a9c23de511120e8860c1e6ed571252ed"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "3afc8d2d85aca61108d21f82355ad813eba7a189e81dde263d318988c5ea50bd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 42 68 63 33 4E 33 5A 48 78 6A 64 58 51 67 4C 57 51 36 49 43 31 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_ce0c185f {
+    meta:
+        id = "ce0c185f-fca2-47d3-9e7c-57b541af98a5"
+        fingerprint = "0d2e3e2b04e93f25c500677482e15d92408cb1da2a5e3c5a13dc71e52d140f85"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "cdd3d567fbcbdd6799afad241ae29acbe4ab549445e5c4fc0678d16e75b40dfa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { EF E5 66 0F 6F AC 24 80 00 00 00 66 0F EB E8 66 0F EF D5 66 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Malxmr_da08e491 {
+    meta:
+        id = "da08e491-c6fa-4228-8b6a-8adae2f0324a"
+        fingerprint = "c4911fdeece4c3f97bbc9ef4da478c5f5363ab71a70b0767edec0f94b87fd939"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Malxmr"
+        reference_sample = "4638d9ece32cd1385121146378772d487666548066aecd7e40c3ba5231f54cc0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F9 48 31 CD 48 89 F9 48 F7 D1 4C 21 F9 48 21 DA 49 31 CA 48 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Miancha.yar b/yara/rules/Linux_Cryptominer_Miancha.yar
new file mode 100644
index 00000000..11f17905
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Miancha.yar
@@ -0,0 +1,19 @@
+rule Linux_Cryptominer_Miancha_646803ef {
+    meta:
+        id = "646803ef-e8a5-46e2-94a5-dcc6cb41cead"
+        fingerprint = "b22f87b60c19855c3ac622bc557655915441f5e12c7d7c27c51c05e12c743ee5"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Miancha"
+        reference_sample = "4c7761c9376ed065887dc6ce852491641419eb2d1f393c37ed0a5cb29bd108d4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6F DC 66 0F 73 FB 04 66 0F EF C1 66 0F 6F D3 66 0F EF C7 66 0F 6F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Minertr.yar b/yara/rules/Linux_Cryptominer_Minertr.yar
new file mode 100644
index 00000000..9cf84c40
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Minertr.yar
@@ -0,0 +1,19 @@
+rule Linux_Cryptominer_Minertr_9901e275 {
+    meta:
+        id = "9901e275-3053-47ea-8c36-6c9271923b64"
+        fingerprint = "f27e404d545f3876963fd6174c4235a4fe4f69d53fe30a2d29df9dad6d97b7f7"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Minertr"
+        reference_sample = "f77246a93782fd8ee40f12659f41fccc5012a429a8600f332c67a7c2669e4e8f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 41 56 41 55 41 54 55 53 48 83 EC 78 48 89 3C 24 89 F3 89 74 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Pgminer.yar b/yara/rules/Linux_Cryptominer_Pgminer.yar
new file mode 100644
index 00000000..4e1c7149
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Pgminer.yar
@@ -0,0 +1,38 @@
+rule Linux_Cryptominer_Pgminer_ccf88a37 {
+    meta:
+        id = "ccf88a37-2a58-40f9-8c13-f1ce218a2ec4"
+        fingerprint = "dc82b841a7e72687921c9b14bc86218c3377f939166d11a7cccd885dad4a06e7"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Pgminer"
+        reference_sample = "3afc8d2d85aca61108d21f82355ad813eba7a189e81dde263d318988c5ea50bd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F6 41 83 C5 02 48 8B 5D 00 8A 0B 80 F9 2F 76 7E 41 83 FF 0A B8 0A 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Pgminer_5fb2efd5 {
+    meta:
+        id = "5fb2efd5-4adc-4285-bef1-6e4987066944"
+        fingerprint = "8ac56b60418e3f3f4d1f52c7a58d0b7c1f374611d45e560452c75a01c092a59b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Pgminer"
+        reference_sample = "6d296648fdbc693e604f6375eaf7e28b87a73b8405dc8cd3147663b5e8b96ff0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 16 00 00 00 0E 00 00 00 18 03 00 7F EB 28 33 C5 56 5D F2 50 67 C5 6F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Presenoker.yar b/yara/rules/Linux_Cryptominer_Presenoker.yar
new file mode 100644
index 00000000..307cf022
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Presenoker.yar
@@ -0,0 +1,19 @@
+rule Linux_Cryptominer_Presenoker_3bb5533d {
+    meta:
+        id = "3bb5533d-4722-4801-9fbb-dd2c916cffc6"
+        fingerprint = "a3005a07901953ae8def7bd9d9ec96874da0a8aedbebde536504abed9d4191fd"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Presenoker"
+        reference_sample = "bbc155c610c7aa439f98e32f97895d7eeaef06dab7cca05a5179b0eb3ba3cc00"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 47 10 74 72 F3 0F 6F 00 66 0F 7E C2 0F 29 04 24 85 D2 F3 0F 6F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Roboto.yar b/yara/rules/Linux_Cryptominer_Roboto.yar
new file mode 100644
index 00000000..dc2425f3
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Roboto.yar
@@ -0,0 +1,38 @@
+rule Linux_Cryptominer_Roboto_0b6807f8 {
+    meta:
+        id = "0b6807f8-49c1-485f-9233-1a14f98935bc"
+        fingerprint = "65f373b6e820c2a1fa555182b8e4547bf5853326bdf3746c7592d018dc2ed89f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Roboto"
+        reference_sample = "c2542e399f865b5c490ee66b882f5ff246786b3f004abb7489ec433c11007dda"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FB 49 89 CF 4D 0F AF FC 4D 01 DF 4D 89 CB 4C 0F AF D8 4D 01 FB 4D }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Roboto_1f1cfe9a {
+    meta:
+        id = "1f1cfe9a-ab4a-423c-a62b-ead6901e2a86"
+        fingerprint = "8dd9f4a091713b8992abd97474f66fdc7d34b0124f06022ab82942f88f3b330c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Roboto"
+        reference_sample = "497a6d426ff93d5cd18cea623074fb209d4f407a02ef8f382f089f1ed3f108c5"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 20 85 FF 74 0D 39 FE 73 13 83 FE 0F 77 0E 01 F6 EB F3 BF 01 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Stak.yar b/yara/rules/Linux_Cryptominer_Stak.yar
new file mode 100644
index 00000000..aafa2e6e
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Stak.yar
@@ -0,0 +1,94 @@
+rule Linux_Cryptominer_Stak_05088561 {
+    meta:
+        id = "05088561-ec73-4068-a7f3-3eff612ecd28"
+        fingerprint = "dfcfa99a2924eb9e8bc0e7b51db6d1b633e742e34add40dc5d1bb90375f85f6e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Stak"
+        reference_sample = "d0d2bab33076121cf6a0a2c4ff1738759464a09ae4771c39442a865a76daff59"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { CD 49 8D 4D 07 48 83 E1 F8 48 39 CD 73 55 49 8B 06 48 8B 50 08 48 8D }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Stak_ae8b98a9 {
+    meta:
+        id = "ae8b98a9-cc25-4606-a775-1129e0f08c3b"
+        fingerprint = "0b5da501c97f53ecd79d708d898d4f5baae3c5fd80a4c39b891a952c0bcc86e5"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Stak"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D1 73 5A 49 8B 06 48 8B 78 08 4C 8B 10 4C 8D 4F 18 4D 89 CB 49 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Stak_d707fd3a {
+    meta:
+        id = "d707fd3a-41ce-4f88-ad42-d663094db5fb"
+        fingerprint = "c218a3c637f58a6e0dc2aa774eb681757c94e1d34f622b4ee5520985b893f631"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Stak"
+        reference_sample = "d0d2bab33076121cf6a0a2c4ff1738759464a09ae4771c39442a865a76daff59"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C2 01 48 89 10 49 8B 55 00 48 8B 02 48 8B 4A 10 48 39 C8 74 9E 80 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Stak_52dc7af3 {
+    meta:
+        id = "52dc7af3-a742-4307-a5ae-c929fede1cc4"
+        fingerprint = "330262703d3fcdd8b2c217db552f07e19f5df4d6bf115bfa291bb1c7f802ad97"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Stak"
+        reference_sample = "a9c14b51f95d0c368bf90fb10e7d821a2fbcc79df32fd9f068a7fc053cbd7e83"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F9 48 89 D3 4D 8B 74 24 20 48 8D 41 01 4C 29 FB 4C 8D 6B 10 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Stak_bb3153ac {
+    meta:
+        id = "bb3153ac-b11b-4e84-afab-05dab61424ae"
+        fingerprint = "c4c33125a1fad9ff393138b333a8cebfd67217e90780c45f73f660ed1fd02753"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Stak"
+        reference_sample = "5b974b6e6a239bcdc067c53cc8a6180c900052d7874075244dc49aaaa9414cca"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6C 77 61 79 73 22 2C 20 22 6E 6F 5F 6D 6C 63 6B 22 2C 20 22 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Ursu.yar b/yara/rules/Linux_Cryptominer_Ursu.yar
new file mode 100644
index 00000000..291eddc0
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Ursu.yar
@@ -0,0 +1,19 @@
+rule Linux_Cryptominer_Ursu_3c05f8ab {
+    meta:
+        id = "3c05f8ab-d1b8-424b-99b7-1fe292ae68ff"
+        fingerprint = "463d4f675589e00284103ef53d0749539152bbc3772423f89a788042805b3a21"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Ursu"
+        reference_sample = "d72361010184f5a48386860918052dbb8726d40e860ea0287994936702577956"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 64 55 4C 2C 20 0A 09 30 78 33 30 32 38 36 30 37 38 32 38 37 38 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Uwamson.yar b/yara/rules/Linux_Cryptominer_Uwamson.yar
new file mode 100644
index 00000000..e6656422
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Uwamson.yar
@@ -0,0 +1,76 @@
+rule Linux_Cryptominer_Uwamson_c42fd06d {
+    meta:
+        id = "c42fd06d-b9ab-4f1f-bb59-e7b49355115c"
+        fingerprint = "dac171e66289e2222cd631d616f31829f31dfeeffb34f0e1dcdd687d294f117c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Uwamson"
+        reference_sample = "8cfc38db2b860efcce5da40ce1e3992f467ab0b7491639d68d530b79529cda80"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F0 4C 89 F3 48 8B 34 24 48 C1 E0 04 48 C1 E3 07 48 8B 7C 24 10 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Uwamson_d08b1d2e {
+    meta:
+        id = "d08b1d2e-cbd5-420e-8f36-22b9efb5f12c"
+        fingerprint = "1e55dc81a44af9c15b7a803e72681b5c24030d34705219f83ca4779fd885098c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Uwamson"
+        reference_sample = "4f7ad24b53b8e255710e4080d55f797564aa8c270bf100129bdbe52a29906b78"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4F F8 49 8D 7D 18 89 D9 49 83 C5 20 48 89 FE 41 83 E1 0F 4D 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Uwamson_0797de34 {
+    meta:
+        id = "0797de34-9181-4f28-a4b0-eafa67e20b41"
+        fingerprint = "b6a210c23f09ffa0114f12aa741be50f234b8798a3275ac300aa17da29b8727c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Uwamson"
+        reference_sample = "e4699e35ce8091f97decbeebff63d7fa8c868172a79f9d9d52b6778c3faab8f2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 43 20 48 B9 AB AA AA AA AA AA AA AA 88 44 24 30 8B 43 24 89 44 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Uwamson_41e36585 {
+    meta:
+        id = "41e36585-0ef1-4896-a887-dac437c716a5"
+        fingerprint = "ad2d4a46b9378c09b1aef0f2bf67a990b3bacaba65a5b8c55c2edb0c9a63470d"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Uwamson"
+        reference_sample = "8cfc38db2b860efcce5da40ce1e3992f467ab0b7491639d68d530b79529cda80"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F8 03 48 C1 FF 03 4F 8D 44 40 FD 48 0F AF FE 49 01 F8 4C 01 C2 4C }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Xmrig.yar b/yara/rules/Linux_Cryptominer_Xmrig.yar
new file mode 100644
index 00000000..8d422f47
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Xmrig.yar
@@ -0,0 +1,225 @@
+rule Linux_Cryptominer_Xmrig_57c0c6d7 {
+    meta:
+        id = "57c0c6d7-ded1-4a3e-9877-4003ab46d4a6"
+        fingerprint = "b36ef33a052cdbda0db0048fc9da4ae4b4208c0fa944bc9322f029d4dfef35b8"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrig"
+        reference_sample = "100dc1ede4c0832a729d77725784d9deb358b3a768dfaf7ff9e96535f5b5a361"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 78 01 66 0F EF C9 49 89 38 0F BE 00 83 E8 30 F2 0F 2A C8 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrig_7e42bf80 {
+    meta:
+        id = "7e42bf80-60a4-4d45-bf07-b96a188c6e6b"
+        fingerprint = "cf3b74ae6ff38b0131763fbcf65fa21fb6fd4462d2571b298c77a43184ac5415"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrig"
+        reference_sample = "551b6e6617fa3f438ec1b3bd558b3cbc981141904cab261c0ac082a697e5b07d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0F 70 F8 FF 66 0F 73 FD 04 66 44 0F EF ED 66 41 0F 73 FE 04 66 41 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrig_271121fb {
+    meta:
+        id = "271121fb-47cf-47a7-9e90-8565d4694c9e"
+        fingerprint = "e0968731b0e006f3db92762822e4a3509d800e8f270b1c38303814fd672377a2"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrig"
+        reference_sample = "19aeafb63430b5ac98e93dfd6469c20b9c1145e6b5b86202553bd7bd9e118842"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 18 41 C1 E4 10 C1 E1 08 41 C1 EA 10 44 89 CB 41 C1 E9 18 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrig_e7e64fb7 {
+    meta:
+        id = "e7e64fb7-e07c-4184-86bd-db491a2a11e0"
+        fingerprint = "444240375f4b9c6948907c7e338764ac8221e5fcbbc2684bbd0a1102fef45e06"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrig"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 03 48 89 74 24 48 77 05 48 8B 5C C4 30 4C 8B 0A 48 8B 0F 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrig_79b42b21 {
+    meta:
+        id = "79b42b21-1408-4837-8f1f-6de30d7f5777"
+        fingerprint = "4cd0481edd1263accdac3ff941df4e31ef748bded0fba5fe55a9cffa8a37b372"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrig"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FC 00 79 0A 8B 45 B8 83 E0 04 85 C0 75 38 8B 45 EC 83 C0 01 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrig_77fbc695 {
+    meta:
+        id = "77fbc695-6fe3-4e30-bb2f-f64379ec4efd"
+        fingerprint = "e0c6cb7a05c622aa40dfe2167099c496b714a3db4e9b92001bbe6928c3774c85"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrig"
+        reference_sample = "e723a2b976adddb01abb1101f2d3407b783067bec042a135b21b14d63bc18a68"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F2 0F 58 44 24 08 F2 0F 11 44 24 08 8B 7B 08 41 8D 76 01 49 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrig_403b0a12 {
+    meta:
+        id = "403b0a12-8475-4e28-960b-ef33eabf0fcf"
+        fingerprint = "785ac520b9f2fd9c6b49d8a485118eee7707f0fa0400b3db99eb7dfb1e14e350"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrig"
+        reference_sample = "54d806b3060404ccde80d9f3153eebe8fdda49b6e8cdba197df0659c6724a52d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 28 03 1C C3 0C 00 C0 00 60 83 1C A7 71 00 00 00 68 83 5C D7 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrig_bffa106b {
+    meta:
+        id = "bffa106b-0a9a-4433-b9ac-ae41a020e7e0"
+        fingerprint = "665b5684c55c88e55bcdb8761305d6428c6a8e810043bf9df0ba567faea4c435"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrig"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 54 24 9C 44 0F B6 94 24 BC 00 00 00 89 5C 24 A0 46 8B 0C 8A 66 0F 6E 5C }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrig_73faf972 {
+    meta:
+        id = "73faf972-43e4-448d-bdfd-cda9be15fce6"
+        fingerprint = "f31c2658acd6d13ae000426d3845bcec7a8a587bbaed75173baa84b2871b0b42"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrig"
+        reference_sample = "00e29303b66cb39a8bc23fe91379c087376ea26baa21f6b7f7817289ba89f655"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6F C4 83 E0 01 83 E1 06 09 C1 44 89 E8 01 C9 D3 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrig_af809eea {
+    meta:
+        id = "af809eea-fe42-4495-b7e5-c22b39102fcd"
+        fingerprint = "373d2f57aede0b41296011d12b59ac006f6cf0e2bd95163f518e6e252459411b"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrig"
+        reference_sample = "00e29303b66cb39a8bc23fe91379c087376ea26baa21f6b7f7817289ba89f655"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 83 E0 01 83 E1 06 09 C1 44 89 ?? 01 C9 D3 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrig_9f6ac00f {
+    meta:
+        id = "9f6ac00f-1562-4be1-8b54-bf9a89672b0e"
+        fingerprint = "77b171a3099327a5edb59b8f1b17fb3f415ab7fd15beabcd3b53916cde206568"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrig"
+        reference_sample = "9cd58c1759056c0c5bbd78248b9192c4f8c568ed89894aff3724fdb2be44ca43"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { B8 31 75 00 00 83 E3 06 09 D9 01 C9 D3 F8 89 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrig_dbcc9d87 {
+    meta:
+        id = "dbcc9d87-5064-446d-9581-b14cf183ec3f"
+        fingerprint = "ebb6d184d7470437aace81d55ada5083e55c0de67e566b052245665aeda96d69"
+        creation_date = "2021-12-13"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Cryptominer.Xmrig"
+        reference_sample = "da9b8fb5c26e81fb3aed3b0bc95d855339fced303aae2af281daf0f1a873e585"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 78 72 47 47 58 34 53 58 5F 34 74 43 41 66 30 5A 57 73 00 64 48 8B 0C 25 F8 FF }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Xmrminer.yar b/yara/rules/Linux_Cryptominer_Xmrminer.yar
new file mode 100644
index 00000000..22dcff1e
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Xmrminer.yar
@@ -0,0 +1,226 @@
+rule Linux_Cryptominer_Xmrminer_70c153b5 {
+    meta:
+        id = "70c153b5-2628-4504-8f21-2c7f0201b133"
+        fingerprint = "51d304812e72045387b002824fdc9231d64bf4e8437c70150625c4b2aa292284"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrminer"
+        reference_sample = "55b133ba805bb691dc27a5d16d3473650360c988e48af8adc017377eed07935b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { EC 18 BA 08 00 00 00 48 8D 4C 24 08 48 89 74 24 08 BE 02 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrminer_98b00f9c {
+    meta:
+        id = "98b00f9c-354a-47dd-8546-a2842559d247"
+        fingerprint = "8d231a490e818614141d6805a9e7328dc4b116b34fd027d5806043628b347141"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrminer"
+        reference_sample = "c01b88c5d3df7ce828e567bd8d639b135c48106e388cd81497fcbd5dcf30f332"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0F 38 DC DF 49 89 D4 66 0F 7F 24 1A 66 0F EF C3 66 42 0F 7F }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrminer_2b250178 {
+    meta:
+        id = "2b250178-3f9a-4aeb-819a-970b5ef9c98a"
+        fingerprint = "e297a790a78d32b973d6a028a09c96186c3971279b5c5eea4ff6409f12308e67"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrminer"
+        reference_sample = "636605cf63d3e335fe9481d4d110c43572e9ab365edfa2b6d16d96b52d6283ef"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 03 7E 11 8B 44 24 38 89 EF 31 D2 89 06 8B 44 24 3C 89 46 04 F7 C7 02 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrminer_67bf4b54 {
+    meta:
+        id = "67bf4b54-aa02-4f4c-ba70-3f2db1418c7e"
+        fingerprint = "5f2fae0eee79dac3c202796d987ad139520fadae145c84ab5769d46afb2518c2"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrminer"
+        reference_sample = "9d33fba4fda6831d22afc72bf3d6d5349c5393abb3823dfa2a5c9e391d2b9ddf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 46 70 4A 8B 2C E0 83 7D 00 03 74 DA 8B 4D 68 85 C9 74 DC 45 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrminer_504b42ca {
+    meta:
+        id = "504b42ca-00a7-4917-8bb1-1957838a1d27"
+        fingerprint = "265a3cb860e1f0ddafbe5658fa3a341d7419c89eecc350f8fc16e7a1e05a7673"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrminer"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D7 8B 04 8C 44 8D 50 FF 4C 89 04 C6 44 89 14 8C 75 D7 48 8B 2E 45 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrminer_d1bb752f {
+    meta:
+        id = "d1bb752f-f5d6-4d93-96af-d977b501776a"
+        fingerprint = "0f2455a4e80d93e7f1e420dc2f36e89c28ecb495879bca2e683a131b2770c3ee"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrminer"
+        reference_sample = "bea55bc9495ee51c78ceedadf3a685ea9d6dd428170888c67276c100d4d94beb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F8 12 48 29 C8 48 2B 83 B0 00 00 00 48 C1 E8 03 48 F7 E2 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrminer_d625fcd2 {
+    meta:
+        id = "d625fcd2-2951-4ecf-91cd-d58e16c33c65"
+        fingerprint = "08c8d00e38fbf62cbf0aa329d6293fba302c3c76aee8c33341260329c14a58aa"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrminer"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 20 00 00 40 00 0C C0 5C 02 60 01 02 03 12 00 40 04 50 09 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrminer_02d19c01 {
+    meta:
+        id = "02d19c01-51e9-4a46-a06b-d5f7e97285d9"
+        fingerprint = "724bbc2910217bcac457e6ba0c0848caf38e12f272b0104ade1c7bc57dc85c27"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrminer"
+        reference_sample = "b6df662f5f7566851b95884c0058e7476e49aeb7a96d2aa203393d88e584972f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4C 8D 7E 15 41 56 41 55 41 54 41 BB 03 00 00 00 55 53 48 89 FB 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrminer_2dd045fc {
+    meta:
+        id = "2dd045fc-a585-4a49-b334-773bc86a3370"
+        fingerprint = "b5f02ac76db686e61c6f293183f2c17fe0f901a65eebaccfe109f07fc9abeeaa"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrminer"
+        reference_sample = "30a77ab582f0558829a78960929f657a7c3c03c2cf89cd5a0f6934b79a74b7a4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { BA 0E 00 00 00 74 25 48 8B 8C 24 B8 00 00 00 64 48 33 0C 25 28 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrminer_d1a814b0 {
+    meta:
+        id = "d1a814b0-38a6-4469-a29b-75787f52d789"
+        fingerprint = "1746bc1d96207bd1bb44e9ff248b76245feb76c1d965400c3abd3b9116ea8455"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrminer"
+        reference_sample = "bea55bc9495ee51c78ceedadf3a685ea9d6dd428170888c67276c100d4d94beb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 01 48 8B 44 24 58 49 89 41 08 8B 01 48 C1 E0 05 4D 8D 04 07 48 8B 44 }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrminer_c6218e30 {
+    meta:
+        id = "c6218e30-1a49-46ea-aac8-5f0f652156c5"
+        fingerprint = "c3171cf17ff3b0ca3d5d62fd4c2bd02a4e0a8616a84ea5ef9e78307283e4a360"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrminer"
+        reference_sample = "b43ddd8e355b0c538c123c43832e7c8c557e4aee9e914baaed0866ee5d68ee55"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { AC 24 B0 00 00 00 48 89 FA 66 0F EF DD 48 C1 E2 20 66 41 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Cryptominer_Xmrminer_b17a7888 {
+    meta:
+        id = "b17a7888-dc12-4bb4-bc77-558223814e8b"
+        fingerprint = "2b11457488e6098d777fb0d8f401cf10af5cd48e05248b89cb9e377d781b516c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xmrminer"
+        reference_sample = "65c9fdd7c559554af06cd394dcebece1bc0fdc7dd861929a35c74547376324a6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D4 FF C5 55 F4 C9 C5 F5 D4 CD C4 41 35 D4 C9 C5 B5 D4 C9 C5 C5 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Xpaj.yar b/yara/rules/Linux_Cryptominer_Xpaj.yar
new file mode 100644
index 00000000..90043ac9
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Xpaj.yar
@@ -0,0 +1,19 @@
+rule Linux_Cryptominer_Xpaj_fdbd614e {
+    meta:
+        id = "fdbd614e-e628-43ff-86d4-1057f9d544ac"
+        fingerprint = "456b69d4035aa2d682ba081c2f7b24c696f655ec164645f83c9aef5bd262f510"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Xpaj"
+        reference_sample = "3e2b1b36981713217301dd02db33fb01458b3ff47f28dfdc795d8d1d332f13ea"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 72 72 6F 72 3A 20 47 65 74 25 73 20 74 65 6D 70 20 72 65 74 75 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Cryptominer_Zexaf.yar b/yara/rules/Linux_Cryptominer_Zexaf.yar
new file mode 100644
index 00000000..57f47bfd
--- /dev/null
+++ b/yara/rules/Linux_Cryptominer_Zexaf.yar
@@ -0,0 +1,19 @@
+rule Linux_Cryptominer_Zexaf_b90e7683 {
+    meta:
+        id = "b90e7683-84bf-4c07-b6ef-54c631280217"
+        fingerprint = "4ca9fad98bdde19f71c117af9cb87007dc46494666e7664af111beded1100ae4"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Cryptominer.Zexaf"
+        reference_sample = "98650ebb7e463a06e737bcea4fd2b0f9036fafb0638ba8f002e6fe141b9fecfe"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 F2 C1 E7 18 C1 E2 18 C1 ED 08 09 D5 C1 EE 08 8B 14 24 09 FE }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Downloader_Generic.yar b/yara/rules/Linux_Downloader_Generic.yar
new file mode 100644
index 00000000..5e4f7b4e
--- /dev/null
+++ b/yara/rules/Linux_Downloader_Generic.yar
@@ -0,0 +1,19 @@
+rule Linux_Downloader_Generic_0bd15ae0 {
+    meta:
+        id = "0bd15ae0-e4fe-48a9-84a6-f8447b467651"
+        fingerprint = "67e14ea693baee8437157f6e450ac5e469b1bab7d9ff401493220575aae9bc91"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Downloader.Generic"
+        reference_sample = "e511efb068e76a4a939c2ce2f2f0a089ef55ca56ee5f2ba922828d23e6181f09"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 D0 83 C0 01 EB 05 B8 FF FF FF FF 48 8B 5D E8 64 48 33 1C 25 28 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Abrox.yar b/yara/rules/Linux_Exploit_Abrox.yar
new file mode 100644
index 00000000..b9c68fd3
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Abrox.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_Abrox_5641ba81 {
+    meta:
+        id = "5641ba81-2c37-4dd1-82d8-532182e8ed15"
+        fingerprint = "d2abedb6182f86982ebe283215331ce238fda3964535047768f2ea55719b052f"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Abrox"
+        reference_sample = "8de96c8e61536cae870f4a24127d28b86bd8122428bf13965c596f92182625aa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 04 58 CD 80 6A 17 58 31 DB CD 80 31 D2 52 68 2E }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Alie.yar b/yara/rules/Linux_Exploit_Alie.yar
new file mode 100644
index 00000000..5e2d88f1
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Alie.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_Alie_e69de1ee {
+    meta:
+        id = "e69de1ee-294d-437e-a943-abb731842523"
+        fingerprint = "01fa5343fa0fb60c320f9fa49beb9c7a8a821ace7f1d6e48ea103e746b3f27a2"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Alie"
+        reference_sample = "882839549f062ab4cbe6df91336ed320eaf6c2300fc2ed64d1877426a0da567d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0C 8D 4B 08 8D 53 0C B0 0B CD 80 89 C3 31 C0 B0 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2009_1897.yar b/yara/rules/Linux_Exploit_CVE_2009_1897.yar
new file mode 100644
index 00000000..92ba54f9
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2009_1897.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_CVE_2009_1897_6cf0a073 {
+    meta:
+        id = "6cf0a073-571e-48ef-be58-807bff1a5e97"
+        fingerprint = "8fcb3687d4ec5dd467d937787f0659448a91446f92a476ff7ba471a02d6b07a9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2009-1897"
+        reference_sample = "85f371bf73ee6d8fcb6fa9a8a68b38c5e023151257fd549855c4c290cc340724"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 31 C0 85 DB 78 28 45 31 C9 41 89 D8 B9 02 00 00 00 BA 01 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2009_2698.yar b/yara/rules/Linux_Exploit_CVE_2009_2698.yar
new file mode 100644
index 00000000..ae3fd10f
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2009_2698.yar
@@ -0,0 +1,38 @@
+rule Linux_Exploit_CVE_2009_2698_12374e97 {
+    meta:
+        id = "12374e97-385e-4b3a-9d50-39f35ad4f6dd"
+        fingerprint = "2c669220ac8909e2336bbf9c38489c8e32d573ab6c29fa1e2e0c1fe69f7441ed"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2009-2698"
+        reference_sample = "656fddc1bf4743a08a455628b6151076b81e604ff49c93d797fa49b1f7d09c2f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 74 64 6F 75 74 00 66 77 72 69 74 65 00 64 65 73 63 00 63 76 65 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2009_2698_cc04dddd {
+    meta:
+        id = "cc04dddd-91d0-4c5f-a0ac-01787da7f369"
+        fingerprint = "d3fdd66e486cb06bd63f6d8e471e66bc80990c4f0729eea16b47adc4cac80538"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2009-2698"
+        reference_sample = "502b73ea04095e8a7ec4e8d7cc306242b45850ad28690156754beac8cd8d7b2d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C4 10 89 45 F4 83 7D F4 FF 75 1F 83 EC 0C 68 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2009_2908.yar b/yara/rules/Linux_Exploit_CVE_2009_2908.yar
new file mode 100644
index 00000000..98a9018f
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2009_2908.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_CVE_2009_2908_406c2fef {
+    meta:
+        id = "406c2fef-0f1a-441a-96b9-e4168c283c90"
+        fingerprint = "94a94217823a8d682ba27889ba2b53fef7b18ae14d75a73456f21184e51581cf"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2009-2908"
+        reference_sample = "1e05a23f5b3b9cfde183aec26b723147e1816b95dc0fb7f9ac57376efcb22fcd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 74 00 66 70 72 69 6E 74 66 00 66 77 72 69 74 65 00 64 65 73 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2010_3301.yar b/yara/rules/Linux_Exploit_CVE_2010_3301.yar
new file mode 100644
index 00000000..294a46d0
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2010_3301.yar
@@ -0,0 +1,57 @@
+rule Linux_Exploit_CVE_2010_3301_79d52efd {
+    meta:
+        id = "79d52efd-7955-4aa3-afbe-b7d172c30f34"
+        fingerprint = "22235427bc621e07c16c365ddbf22a4e1c04d7a0f23c3e4c46d967d908256567"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2010-3301"
+        reference_sample = "53a2163ad17a414d9db95f5287d9981c9410e7eaeea096610ba622eb763a6970"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 3B F9 FF FF 83 7D D4 FF 75 16 48 8D 3D 35 03 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2010_3301_d0eb0924 {
+    meta:
+        id = "d0eb0924-dae1-46f9-a4d0-c9e69f781a22"
+        fingerprint = "bb288a990938aa21aba087a0400d6f4765a622f8ed36d1dd7953d09cbb09ff83"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2010-3301"
+        reference_sample = "907995e90a80d3ace862f2ffdf13fd361762b5acc5397e14135d85ca6a61619b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 3C FA FF FF 83 7D EC FF 75 19 BF 20 13 40 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2010_3301_a5828970 {
+    meta:
+        id = "a5828970-7a30-421c-be92-5659c18b88d1"
+        fingerprint = "72223f502b2a129380ab011b785f6589986d2eb177580339755d12840617ce5f"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2010-3301"
+        reference_sample = "4fc781f765a65b714ec27080f25c03f20e06830216506e06325240068ba62d83"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 7C FC FF FF 83 7D EC FF 75 19 BF 40 0E 40 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2012_0056.yar b/yara/rules/Linux_Exploit_CVE_2012_0056.yar
new file mode 100644
index 00000000..1a7090b3
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2012_0056.yar
@@ -0,0 +1,57 @@
+rule Linux_Exploit_CVE_2012_0056_06b2dff5 {
+    meta:
+        id = "06b2dff5-250a-46e0-b763-8e6b04498fe2"
+        fingerprint = "82b200deae93c8fa376d670f5091d9a63730a6f5b5e8a0567fe9c283075d57c0"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2012-0056"
+        reference_sample = "168b3fb1c675ab76224c641e228434495160502a738b64172c679e8ce791ac17"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 20 66 64 20 69 6E 20 70 61 72 65 6E 74 2E 00 5B 2B 5D 20 52 65 63 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2012_0056_b39839f4 {
+    meta:
+        id = "b39839f4-e6f4-44bd-a636-ce355f3c5c6a"
+        fingerprint = "f269c4aecbb55e24d9081d7a1e4bd6cfa9799409b3a3d7a6f9bf127f7468dedc"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2012-0056"
+        reference_sample = "cf569647759e011ff31d8626cea65ed506e8d0ef1d26f3bbb7c02a4060ce58dc"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 08 02 7E 3E 8B 45 0C 83 C0 04 8B 00 0F B6 00 3C 2D 75 2F 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2012_0056_a1e53450 {
+    meta:
+        id = "a1e53450-036e-4ae3-bfe4-64a6c7239a04"
+        fingerprint = "d0a0635fb356ccedb1448082cc63748d49d45f8a25e43eab7ac1d67e87062b8f"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2012-0056"
+        reference_sample = "15a4d149e935758199f6df946ff889e12097f5fec4ef450e9cbd554d1efbd5e6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 80 31 C9 B3 ?? B1 02 B0 3F CD 80 31 C0 50 68 6E }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2014_3153.yar b/yara/rules/Linux_Exploit_CVE_2014_3153.yar
new file mode 100644
index 00000000..690f55d6
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2014_3153.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_CVE_2014_3153_1c1e02ad {
+    meta:
+        id = "1c1e02ad-eb06-4eb6-a424-0f1dd6eebb2a"
+        fingerprint = "a0a82cd15713be3f262021d6ed6572a0d4763ccfd0499e6b9374764c89705c2a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2014-3153"
+        reference_sample = "64b8c61b73f0c0c0bd44ea5c2bcfb7b665fcca219dbe074a4a16ae20cd565812"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 48 89 E5 48 83 EC 40 48 89 7D C8 48 8D 4D D0 48 8B 45 C8 BA 24 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2016_4557.yar b/yara/rules/Linux_Exploit_CVE_2016_4557.yar
new file mode 100644
index 00000000..f53ac0b8
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2016_4557.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_CVE_2016_4557_b7e15f5e {
+    meta:
+        id = "b7e15f5e-73d2-4718-8fac-e6a285b0c73c"
+        fingerprint = "14baf456521fd7357a70ddde9da11f27d17a45d7d12c70a0101d6bdc45e30c74"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Exploit.CVE-2016-4557"
+        reference_sample = "bbed2f81104b5eb4a8475deff73b29a350dc8b0f96dcc4987d0112b993675271"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 2E 20 69 66 20 74 68 69 73 20 77 6F 72 6B 65 64 2C 20 79 6F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2016_5195.yar b/yara/rules/Linux_Exploit_CVE_2016_5195.yar
new file mode 100644
index 00000000..47b03c2e
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2016_5195.yar
@@ -0,0 +1,304 @@
+rule Linux_Exploit_CVE_2016_5195_364f3b7b {
+    meta:
+        id = "364f3b7b-4361-44ca-bf49-e26c123ae4bd"
+        fingerprint = "ec6cf1d090cd57434c4d3c1c3511fd4b683ff109bfd0ce859552d58cbb83984a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "0d4c43bf0cdd6486a4bcab988517e58b8c15d276f41600e596ecc28b0b728e69"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 9C 01 7E 24 48 8B 45 90 48 8B 40 08 48 89 45 F8 48 8B 45 F8 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_3a2ed31b {
+    meta:
+        id = "3a2ed31b-a8be-4aff-af5e-e1ff2676f3f9"
+        fingerprint = "0e8e0f58deadf4838464c2f2bc860013e6d47c3d770d0ef743b5dd9021832cae"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "ebbf3bc39ec661e2029d88960a5608e348de92089099019348bc0e891841690f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 48 89 E5 48 83 EC 30 48 89 7D D8 48 8B 45 D8 48 89 45 F0 BE 02 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_7448814c {
+    meta:
+        id = "7448814c-1685-45a9-9a00-039b30485545"
+        fingerprint = "25ffa8f3b2356deebc88d8831bc8664edd6543a7d722d6ddd72e89fad18c66e7"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "e95d0783b635e34743109d090af17aef2e507e8c90060d171e71d9ac79e083ba"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 9C 01 7E 24 48 8B 45 90 48 8B 40 08 48 89 45 C0 48 8B 45 C0 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_2fa988e3 {
+    meta:
+        id = "2fa988e3-dfaf-44c8-bfaa-889778858e22"
+        fingerprint = "a841f4b929c79eadfa8deeb3a6f410056aec94dd1e0d9c8e5dc31675de936403"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "679392e78d4abefc05b885e43aaccc2da235bd7f2a267c6ecfbe2cf824776993"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 48 89 E5 48 83 EC 20 89 7D EC 89 75 E8 8B 45 E8 48 C1 E0 05 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_ea8801ac {
+    meta:
+        id = "ea8801ac-ee95-4294-9cfa-99c773a04183"
+        fingerprint = "aa191347bdf2e9fdcf6f9591c370b85208a1c46a329bc648268447dbb5ea898f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "7acccfd8c2e5555a3e3bf979ad2314c12a939c1ef32b66e61e30a712f07164fd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 48 89 E5 48 83 EC 30 89 7D DC 48 89 75 D0 83 7D DC 02 7F 0A B8 01 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_b2ebdebd {
+    meta:
+        id = "b2ebdebd-0110-46b4-a97f-27c4c495b23d"
+        fingerprint = "2a98a2d1be205145eb2d30a57aaa547b30281b31981f0872ba3f7e1d684a0cc2"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "dee49d4b7f406fd1728dad4dc217484ced2586e014e2cd265ea64eff70a2633d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 48 89 E5 48 83 EC 30 48 89 7D D8 48 8B 45 D8 48 89 45 F8 BE 02 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_9190d516 {
+    meta:
+        id = "9190d516-dea0-4d74-9f2c-bd2337538258"
+        fingerprint = "977bafd175a994edaef5f3fa19d19fe161cebb2447ee32fd5d4b0a3b93fb51fa"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "837ffed1f23293dc9c7cb994601488fc121751a249ffde51326947c33c5fca7f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4D 18 48 8B 55 10 48 8B 75 F0 48 8B 45 F8 48 83 EC 08 41 51 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_3b460716 {
+    meta:
+        id = "3b460716-812e-4884-ab66-e01f2e61996d"
+        fingerprint = "900e22d1a157677698a47d49d2deeb52c938e3a790aba689b920ba1bbd7ed39d"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "8c4d49d4881ebdab1bd0e083d4e644cfc8eb7af3b96664598526ab3d175fc420"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 48 89 E5 48 83 EC 30 48 89 7D D8 48 8B 45 D8 48 89 45 E8 BE 02 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_ccfd7518 {
+    meta:
+        id = "ccfd7518-af6c-4378-bd9c-7267a7f0dab4"
+        fingerprint = "4797064d6416f2799691ae7df956d0383dfe6094de29fb03fc8233ad89149942"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "b1017db71cf195aa565c57fed91ff1cdfcce344dc76526256d5817018f1351bf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 83 45 FC 01 81 7D FC FF E0 F5 05 7F 0A 8B 05 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_d41c2c63 {
+    meta:
+        id = "d41c2c63-1af7-47c9-88a0-16454c9583db"
+        fingerprint = "77fb7e9911d1037bba0a718d8983a42ad1877c13d865ce415351d599064ea7ea"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "a4e5751b4e8fa2e9b70e1e234f435a03290c414f9547dc7709ce2ee4263a35f1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F4 83 45 F0 01 81 7D F0 FF C1 EB 0B 7E D3 C9 C3 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_ffa7f059 {
+    meta:
+        id = "ffa7f059-b825-4dd6-b10d-e57549a2704f"
+        fingerprint = "c451689042d9290d1bb5b931e002237584217bbddfc0d96c2486a61cb5c37d31"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "a073c6be047ea7b4500b1ffdc8bdadd9a06f9efccd38c88e0fc976b97b2b2df5"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F8 83 45 FC 01 81 7D FC FF C1 EB 0B 7E D7 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_fb24c7e4 {
+    meta:
+        id = "fb24c7e4-db4f-405e-8e88-bc313b9a0358"
+        fingerprint = "0a5f15ddb425a6e00f6c3964b4dbdc91a856fd06b6e45dfd4fded8ed97f21ae8"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "a073c6be047ea7b4500b1ffdc8bdadd9a06f9efccd38c88e0fc976b97b2b2df5"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F8 83 45 FC 01 81 7D FC FF C1 EB 0B 7E ?? 8B 45 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_b45098df {
+    meta:
+        id = "b45098df-7f26-44a9-8078-f1c05d15cc38"
+        fingerprint = "ed32e66f2c18b16a6f00d6a696a32cdb1b0b18413b4c1af059097f5d301ee084"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "e053aca86570b3781b3e08daab51382712270d2a375257c8b5789d3d87149314"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FC 83 45 F8 01 81 7D F8 FF C1 EB 0B 7E D7 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_9c67a994 {
+    meta:
+        id = "9c67a994-dabf-4cb7-95d7-4cc47402be28"
+        fingerprint = "fc6690eef99dd9f84f62444d7a7e1b52dc7f46e831a5ab3e87d4282bba979fde"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "70429d67402a43ed801e295b1ae1757e4fccd5d786c09ee054591ae51dfc1b25"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FC 83 45 F8 01 81 7D F8 FF C1 EB 0B 7E ?? 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_ab87c1ed {
+    meta:
+        id = "ab87c1ed-f538-4785-b7ae-5333a7ff2808"
+        fingerprint = "3bf2be85120ef3711dd3508bf8fcd573a70c7ad4a5066be1b60d777a53cd37b6"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "c13c32d3a14cbc9c2580b1c76625cce8d48c5ae683230149a3f41640655e7f28"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FF FF 88 45 EF 80 7D EF FF 75 D6 B8 ?? ?? 04 08 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2016_5195_f1c0482a {
+    meta:
+        id = "f1c0482a-fe88-4777-8d49-aa782bf25a98"
+        fingerprint = "96d1ed843aeb59dd43dd76f4edd9e9928dd29f86df87b70d875473b9d908e75c"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2016-5195"
+        reference_sample = "a12a1e8253ee1244b018fd3bdcb6b7729dfe16e06aed470f6b08344a110a4061"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FF FF 88 45 F7 80 7D F7 FF 75 D6 B8 ?? ?? 04 08 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2017_100011.yar b/yara/rules/Linux_Exploit_CVE_2017_100011.yar
new file mode 100644
index 00000000..c4f2f0d1
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2017_100011.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_CVE_2017_100011_21025f50 {
+    meta:
+        id = "21025f50-93af-4ea7-bdcb-ab4e210b8ac6"
+        fingerprint = "a50c81daf4f081d7ddf61d05ab64d8fada5c4d6cdf8d28eb30c689e868d905aa"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2017-100011"
+        reference_sample = "32db88b2c964ce48e6d1397ca655075ea54ce298340af55ea890a2411a67d554"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 5D 20 64 6F 6E 65 2C 20 6B 65 72 6E 65 6C 20 74 65 78 74 3A }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2017_16995.yar b/yara/rules/Linux_Exploit_CVE_2017_16995.yar
new file mode 100644
index 00000000..71c912f6
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2017_16995.yar
@@ -0,0 +1,57 @@
+rule Linux_Exploit_CVE_2017_16995_0c81a317 {
+    meta:
+        id = "0c81a317-b296-4cda-839c-a37903e86786"
+        fingerprint = "40d192607a7237c41c35d90a48cbcfd95a79c0fe7c8017d41389f15a78d620f5"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2017-16995"
+        reference_sample = "48d927b4b18a03dfbce54bb5f4518869773737e449301ba2477eb797afbb9972"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 48 89 E5 48 89 7D F8 48 8B 45 F8 48 25 00 C0 FF FF 5D C3 55 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2017_16995_82816caa {
+    meta:
+        id = "82816caa-2fff-4b71-9544-443e611aacbf"
+        fingerprint = "1a716566946fdd368230c02e2c749b6ce371fa6211be6b3db137af9b117bec87"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Exploit.CVE-2017-16995"
+        reference_sample = "14e6b788db0db57067d9885ab5ff3d3a5749639549d82abd98fa4fcf27000f34"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { BC 89 45 C0 8B 45 B8 48 98 48 C1 E8 03 89 45 C4 48 8B 45 B0 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2017_16995_5edb0181 {
+    meta:
+        id = "5edb0181-dfb1-47e2-873b-0fa3043bee67"
+        fingerprint = "804635a4922830b894ed38f58751f481d389e5bfbea7a50912763952971844e6"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Exploit.CVE-2017-16995"
+        reference_sample = "e4df84e1dffbad217d07222314a7e13fd74771a9111d07adc467a89d8ba81127"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F8 2F 77 0F 45 89 C2 49 89 D1 41 83 C0 08 4A 8D 54 15 D0 48 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2018_10561.yar b/yara/rules/Linux_Exploit_CVE_2018_10561.yar
new file mode 100644
index 00000000..b65e6e19
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2018_10561.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_CVE_2018_10561_0f246e33 {
+    meta:
+        id = "0f246e33-0e98-4778-8a2f-14876d1a0efe"
+        fingerprint = "718b66d3d65d31f0908c8f7d7aee8113e9b51cb576cd725bbca1a23d3ccd4d72"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2018-10561"
+        reference_sample = "eac08c105495e6fadd8651d2e9e650b6feba601ec78f537b17fb0e73f2973a1c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0B DF 0B 75 87 8C 5C 03 03 7A 4B 7A 95 4A A5 D2 13 6A 6A 5A 5A }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2019_13272.yar b/yara/rules/Linux_Exploit_CVE_2019_13272.yar
new file mode 100644
index 00000000..0bcd970f
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2019_13272.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_CVE_2019_13272_583dd2c0 {
+    meta:
+        id = "583dd2c0-9e94-4d38-bdff-e6c3b7c7d594"
+        fingerprint = "afc96d47ad2564f69d2fb9a39e882bfc5b4879f0a8abbf36d5e3af6a52dccd63"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.CVE-2019-13272"
+        reference_sample = "3191b9473f3e59f55e062e6bdcfe61b88974602c36477bfa6855ccd92ff7ca83"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 48 89 85 40 FF FF FF 48 8B 45 D8 48 83 C0 20 48 89 85 38 FF }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2021_3156.yar b/yara/rules/Linux_Exploit_CVE_2021_3156.yar
new file mode 100644
index 00000000..91768e52
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2021_3156.yar
@@ -0,0 +1,44 @@
+rule Linux_Exploit_CVE_2021_3156_f3fb10cd {
+    meta:
+        id = "f3fb10cd-1d49-420f-8740-5c8990560943"
+        fingerprint = "66aca7d13fb9c5495f17b7891e388db0a746d8827c8ae302a6cb8d86f7630bbb"
+        creation_date = "2021-09-15"
+        last_modified = "2021-09-21"
+        threat_name = "Linux.Exploit.CVE-2021-3156"
+        reference_sample = "65fb8baa5ec3bfb4473e4b2f565b461dd59989d43c72b1c5ec2e1a68baa8b51a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a1 = "/usr/bin/sudoedit" fullword
+        $a2 = "<smash_len_a>" fullword
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_CVE_2021_3156_7f5672d0 {
+    meta:
+        id = "7f5672d0-73f1-4143-b3e2-3aed110779e3"
+        fingerprint = "71e90dd36342686bb4be7ef86e1ceb2e915c70f437f4733ddcc5175860ca4084"
+        creation_date = "2021-09-15"
+        last_modified = "2021-09-21"
+        threat_name = "Linux.Exploit.CVE-2021-3156"
+        reference_sample = "1a4517d2582ac97b88ae568c23e75beba93daf8518bd3971985d6a798049fd61"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a1 = "/tmp/gogogo123456789012345678901234567890go" fullword
+        $a2 = "gg:$5$a$gemgwVPxLx/tdtByhncd4joKlMRYQ3IVwdoBXPACCL2:0:0:gg:/root:/bin/bash" fullword
+        $sudo = "sudoedit" fullword
+        $msg1 = "succes with sleep time %d us" fullword
+        $msg2 = "[+] Success with %d attempts" fullword
+        $msg3 = "symlink 2nd time success at: %d" fullword
+    condition:
+        (any of ($a*)) or ($sudo and 2 of ($msg*))
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2021_3490.yar b/yara/rules/Linux_Exploit_CVE_2021_3490.yar
new file mode 100644
index 00000000..2d6e8f85
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2021_3490.yar
@@ -0,0 +1,30 @@
+rule Linux_Exploit_CVE_2021_3490_d369d615 {
+    meta:
+        id = "d369d615-d2a3-4f9d-b5c7-eb0fac5d43e7"
+        fingerprint = "4f8f4c7fabe32a023f8aafb817e2c27c5a5e0e9246ddccacf99a47f2ab850014"
+        creation_date = "2021-11-12"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Exploit.CVE-2021-3490"
+        reference_sample = "e65ba616942fd1e893e10898d546fe54458debbc42e0d6826aff7a4bb4b2cf19"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $c1 = "frame_dummy_init_array_entry"
+        $c2 = "leak_oob_map_ptr"
+        $c3 = "overwrite_cred"
+        $c4 = "obj_get_info_by_fd"
+        $c5 = "kernel_write_uint"
+        $c6 = "search_init_pid_ns_kstrtab"
+        $c7 = "search_init_pid_ns_ksymtab"
+        $msg1 = "failed to leak ptr to BPF map"
+        $msg2 = "preparing to overwrite creds..."
+        $msg3 = "success! enjoy r00t"
+        $msg4 = "Useage: %s <path to program to execute as root>"
+        $msg5 = "searching for init_pid_ns in ksymtab"
+    condition:
+        4 of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2021_4034.yar b/yara/rules/Linux_Exploit_CVE_2021_4034.yar
new file mode 100644
index 00000000..294c7c6e
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2021_4034.yar
@@ -0,0 +1,20 @@
+rule Linux_Exploit_CVE_2021_4034_1c8f235d {
+    meta:
+        id = "1c8f235d-1345-4d5f-a5db-427dbbe6fc9a"
+        fingerprint = "b145df35499a55e3e920f7701aab3b2f19af9fafbb2e0c1af53cb0b318ad06a6"
+        creation_date = "2022-01-26"
+        last_modified = "2022-07-22"
+        threat_name = "Linux.Exploit.CVE-2021-4034"
+        reference_sample = "94052c42aa41d0911e4b425dcfd6b829cec8f673bf1245af4050ef9c257f6c4b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $s1 = "PATH=GCONV_PATH="
+        $s2 = "pkexec"
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_CVE_2022_0847.yar b/yara/rules/Linux_Exploit_CVE_2022_0847.yar
new file mode 100644
index 00000000..27cde9b1
--- /dev/null
+++ b/yara/rules/Linux_Exploit_CVE_2022_0847.yar
@@ -0,0 +1,27 @@
+rule Linux_Exploit_CVE_2022_0847_e831c285 {
+    meta:
+        id = "e831c285-b2b9-49f3-a87c-3deb806e31e4"
+        fingerprint = "376b791f9bb5f48d0f41ead4e48b5bcc74cb68002bb7c170760428ace169457e"
+        creation_date = "2022-03-10"
+        last_modified = "2022-03-14"
+        threat_name = "Linux.Exploit.CVE-2022-0847"
+        reference_sample = "c6b2cef2f2bc04e3ae33e0d368eb39eb5ea38d1bca390df47f7096117c1aecca"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $pp = "prepare_pipe"
+        $s1 = "splice failed"
+        $s2 = "short splice"
+        $s3 = "short write"
+        $s4 = "hijacking suid binary"
+        $s5 = "Usage: %s TARGETFILE OFFSET DATA"
+        $s6 = "Usage: %s SUID"
+        $bs1 = { B8 00 10 00 00 81 7D EC 00 10 00 00 0F 46 45 EC 89 45 FC 8B 55 FC 48 8B 45 D8 48 83 C0 04 8B 00 48 8D 35 }
+        $bs2 = { B8 00 10 00 00 81 7D F0 00 10 00 00 0F 46 45 F0 89 45 F8 8B 55 F8 48 8B 45 D8 8B 00 48 }
+    condition:
+        ($pp and 2 of ($s*)) or (all of ($bs*))
+}
+
diff --git a/yara/rules/Linux_Exploit_Cornelgen.yar b/yara/rules/Linux_Exploit_Cornelgen.yar
new file mode 100644
index 00000000..d0987f71
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Cornelgen.yar
@@ -0,0 +1,57 @@
+rule Linux_Exploit_Cornelgen_584a227a {
+    meta:
+        id = "584a227a-bf17-4620-8b10-97676f12ea5b"
+        fingerprint = "65a23e20166b99544b2d0b4969240618d50e80a53a69829756721e19e4e6899f"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Cornelgen"
+        reference_sample = "c823cb669f1d6cb9258d6f0b187609c226af23396f9c5be26eb479e5722a9d97"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6E 89 E3 52 53 89 E1 B0 0B CD 80 31 C0 40 CD 80 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Cornelgen_be0bc02d {
+    meta:
+        id = "be0bc02d-2d9d-4cbe-9d6a-3a88ffa1234b"
+        fingerprint = "6b57eb6fd3c8e28cbff5e7cc51246de74ca7111a9cd1c795b21aa89142a693b4"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Cornelgen"
+        reference_sample = "24c0ba8ad4f543f9b0aff0d0b66537137bc78606b47ced9b6d08039bbae78d80"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8B 44 24 08 A3 B8 9F 04 08 0F B7 05 04 A1 04 08 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Cornelgen_03ee53d3 {
+    meta:
+        id = "03ee53d3-4f03-4c5e-9187-45e0e33584b4"
+        fingerprint = "f2a8ecfffb0328c309a3a5db7e62fae56bf168806a1db961a57effdebba7645e"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Cornelgen"
+        reference_sample = "711eafd09d4e5433be142d54db153993ee55b6c53779d8ec7e76ca534b4f81a5"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C9 B0 27 CD 80 31 C0 B0 3D CD 80 31 C0 8D 5E 02 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Courier.yar b/yara/rules/Linux_Exploit_Courier.yar
new file mode 100644
index 00000000..17a46e84
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Courier.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_Courier_190258dd {
+    meta:
+        id = "190258dd-1384-4144-aa05-7957ca0b464b"
+        fingerprint = "4ba94b87847a76df80200d40383d2d289dc463faa609237dbc43f317db45074d"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Courier"
+        reference_sample = "349866d0fb81d07a35b53eac6f11176721629bbd692526851e483eaa83d690c3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E3 31 C0 50 54 53 50 B0 3B CD 80 31 C0 B0 01 CD }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Criscras.yar b/yara/rules/Linux_Exploit_Criscras.yar
new file mode 100644
index 00000000..9dd3db80
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Criscras.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_Criscras_fc505c1d {
+    meta:
+        id = "fc505c1d-f77d-48cc-b8fe-7b24b9cc6a97"
+        fingerprint = "bc5e980599c4c8fc3c9b560738d7187a0c91e2813c64b3ad0ff014230100c8d8"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Criscras"
+        reference_sample = "7399f6b8fbd6d6c6fb56ab350c84910fe19cc5da67e4de37065ff3d4648078ab"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0C 89 21 89 E3 31 C0 B0 0B CD 80 31 C0 FE C0 CD }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Dirtycow.yar b/yara/rules/Linux_Exploit_Dirtycow.yar
new file mode 100644
index 00000000..ed4fc3a9
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Dirtycow.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_Dirtycow_8555f149 {
+    meta:
+        id = "8555f149-0c91-4384-9199-8250c0fd74fd"
+        fingerprint = "3d607c7ba6667c375eaab454debf8745746230d08a00499395a275e5bd05b3e4"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Dirtycow"
+        reference_sample = "0fd66e120f97100e48c65322b946b812fa9df4cfb533fb327760a999e4d43945"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 83 45 F8 01 81 7D F8 FF E0 F5 05 7E ?? 8B 45 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Enoket.yar b/yara/rules/Linux_Exploit_Enoket.yar
new file mode 100644
index 00000000..eb086d11
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Enoket.yar
@@ -0,0 +1,114 @@
+rule Linux_Exploit_Enoket_79b52a4c {
+    meta:
+        id = "79b52a4c-80cd-4fe1-aa6c-463e2cdd64ac"
+        fingerprint = "84be6877d6b1eb091de9817a5cf0ecba5e0e82089a6dd1dc0af2e91b01fe4003"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Enoket"
+        reference_sample = "3ae8f7e7df62316400d0c5fe0139d7a48c9f184e92706b552aad3d827d3dbbbf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 66 6F 75 6E 64 20 61 74 20 30 78 25 30 34 78 20 69 6E 20 74 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Enoket_5969a348 {
+    meta:
+        id = "5969a348-6573-4cb3-b81e-db455ff7b484"
+        fingerprint = "7e9b9ba6146754857632451be2f98a5008268091ae1cfab1a87322b6fe30097c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Enoket"
+        reference_sample = "4b4d7ca9e1ffa2c46cb097d4a014c59b1a9feb93b3adcb5936ef6a1dfef9b0ae"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FC 83 7D FC FF 75 07 B8 FF FF FF FF EB 0F 8B 45 FC 01 45 F0 83 7D }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Enoket_80fac3e9 {
+    meta:
+        id = "80fac3e9-bf77-46d1-8d9b-25f3cf06a3b7"
+        fingerprint = "627418bfe84af36e9b34d42aa42cb6d793e6bc41aa555a77e4f9389a9407d6f2"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Enoket"
+        reference_sample = "3355ad81c566914a7d7734b40c46ded0cfa53aa22c6e834d42e185bf8bbe6128"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 42 4C 45 20 54 4F 20 4D 41 50 20 5A 45 52 4F 20 50 41 47 45 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Enoket_7da5f86a {
+    meta:
+        id = "7da5f86a-c177-47c9-a82e-50648c84174a"
+        fingerprint = "cf9a703969e3f9a3cd20119fc0a24fa2d16bec5ea7e3b1a8df763872625c90fc"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Enoket"
+        reference_sample = "406b003978d79d453d3e2c21b991b113bf2fc53ffbf3a1724c5b97a4903ef550"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FF 75 F2 80 7D 94 00 74 23 0F B6 0F B8 01 00 00 00 3A 4D 94 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Enoket_c77c0d6d {
+    meta:
+        id = "c77c0d6d-7f5c-4618-b6f6-3c1ddc70783c"
+        fingerprint = "739e23abbd2971d6ff24c94a87d7aab082aec85f9cd7eb3a168b35fa22f32eb9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Enoket"
+        reference_sample = "3ae8f7e7df62316400d0c5fe0139d7a48c9f184e92706b552aad3d827d3dbbbf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6E 64 20 74 68 65 20 77 6F 72 6C 64 2C 20 6F 6E 65 20 68 61 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Enoket_fbf508e1 {
+    meta:
+        id = "fbf508e1-2a44-417e-a2e4-8d43c2b64017"
+        fingerprint = "4909d3a04b820547fbff774c64c112b8a6a5e95452992639296a220776826d98"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Enoket"
+        reference_sample = "d1fa8520d3c3811d29c3d5702e7e0e7296b3faef0553835c495223a2bc015214"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 E8 76 0F 48 8B 45 E8 48 83 E8 01 0F B6 00 3C 5F 74 DF 48 8B }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Foda.yar b/yara/rules/Linux_Exploit_Foda.yar
new file mode 100644
index 00000000..bef255c9
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Foda.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_Foda_f41e9ef9 {
+    meta:
+        id = "f41e9ef9-b280-44cb-b877-ac998eea84d3"
+        fingerprint = "d24064932ef3a972970ce446d465c28379bf83b1b72f5bf77d1def3074747a8e"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Foda"
+        reference_sample = "6059a6dd039b5efa36ce97acbb01406128aaf6062429474e422624ee69783ca8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C0 50 89 E2 53 89 E1 B0 0B CD 80 31 C0 B0 01 CD }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Intfour.yar b/yara/rules/Linux_Exploit_Intfour.yar
new file mode 100644
index 00000000..c5d6637d
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Intfour.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_Intfour_0ca45cd3 {
+    meta:
+        id = "0ca45cd3-089c-4d7f-9088-dc972c14bd9d"
+        fingerprint = "8926a8cfd7f3adf29e399a945592063039b80dcc0545b133b453aaf198d31461"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Intfour"
+        reference_sample = "9d32c5447aa5182b4be66b7a283616cf531a2fd3ba3dde1bc363b24d8b22682f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6D 28 63 6F 64 65 2C 20 31 30 32 34 2C 20 26 6E 65 65 64 6C 65 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Local.yar b/yara/rules/Linux_Exploit_Local.yar
new file mode 100644
index 00000000..319de0e6
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Local.yar
@@ -0,0 +1,228 @@
+rule Linux_Exploit_Local_47c64fb6 {
+    meta:
+        id = "47c64fb6-cfa6-4350-a41f-870b87116b32"
+        fingerprint = "aa286440061fb31167f314111dde7c2f596357b41fb6a5656216892fee6bf56e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Local"
+        reference_sample = "0caa9035027ff88788e6b8e43bfc012a367a12148be809555c025942054a6360"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F4 C6 00 FF 8B 45 F4 40 C6 00 25 8B 45 F4 83 C0 02 C7 00 08 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Local_76c24b62 {
+    meta:
+        id = "76c24b62-e04f-410d-b7cb-668daa9aea20"
+        fingerprint = "907cb776c9200b715c5b20475c2d4b16cb55c607dfb4b57bd3bd95368ce66257"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Local"
+        reference_sample = "330de2ca1add7e06389d94dfc541c367a484394c51663b26d27d89346b08ad1b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 00 31 DB 89 D8 B0 17 CD 80 31 C0 50 50 B0 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Local_30c21b03 {
+    meta:
+        id = "30c21b03-22fc-4ec8-8b65-084e98da8d8d"
+        fingerprint = "8112c4a9bce4b4c9407e851849a5850fa36591570694950a4b53e8a09a1dd92b"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Local"
+        reference_sample = "a09c81f185a4ceed134406fa7fefdfa7d8dfc10d639dd044c94fbb6d570fa029"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 1B CD 80 31 DB 89 D8 B0 17 CD 80 31 C0 50 50 B0 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Local_9ace9649 {
+    meta:
+        id = "9ace9649-c74a-4b27-a147-d14123104c0a"
+        fingerprint = "2e526d7ec47a30c7683725c2d2c3db0a8267630bb0f270599325d50227f6ae29"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Local"
+        reference_sample = "b38869605521531153cfd8077f05e0d6b52dca0fffbc627a4d5eaa84855a491c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 31 C0 31 DB 31 C9 B0 46 CD 80 31 C0 50 68 2F }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Local_705c9589 {
+    meta:
+        id = "705c9589-f735-45ef-8cf0-b99a05905a9f"
+        fingerprint = "d75edca622f0ab8a0b60c4ba5c1026c89d3613c0e101c5c12c03ee08cb7c576e"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Local"
+        reference_sample = "845727ea46491b46a665d4e1a3a9dbbe6cd0536d070f1c1efd533b91b75cdc88"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 51 53 8D 0C 24 31 C0 B0 0B CD 80 31 C0 B0 01 CD }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Local_a677fb9c {
+    meta:
+        id = "a677fb9c-0271-4491-a7c7-48504b6ec389"
+        fingerprint = "b7916eefad806131b39af5f9bef27648e2444c9a9c95216b520d73e64fa734f0"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Local"
+        reference_sample = "d20b260c7485173264e3e674adc7563ea3891224a3dc98bdd342ebac4a1349e8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 C0 89 45 EC 83 7D EC FF 75 1A 83 EC 0C 68 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Local_78e50162 {
+    meta:
+        id = "78e50162-8f1e-4c78-94fe-9b793b006269"
+        fingerprint = "a5771dad186d0c23d25efb7b22b11aa0a67148cf6efb9657b09ca6e160c192aa"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Local"
+        reference_sample = "706c865257d5e1f5f434ae0f31e11dfc7e16423c4c639cb2763ec0f51bc73300"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 90 90 90 31 C0 31 DB B0 17 CD 80 31 C0 B0 2E CD }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Local_3b767a1f {
+    meta:
+        id = "3b767a1f-5844-4742-a5fd-ef8a3ddb6c12"
+        fingerprint = "2bc0dc4de92306076cda6f2d069855b85861375c8b7eb5324f915a1ed10c39e5"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Local"
+        reference_sample = "e05fed9e514cccbdb775f295327d8f8838b73ad12f25e7bb0b9d607ff3d0511c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E3 50 53 89 E1 89 C2 B0 0B CD 80 89 C3 31 C0 40 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Local_2535c9b6 {
+    meta:
+        id = "2535c9b6-a575-4190-8e33-88758675e5b4"
+        fingerprint = "4ec419bfd0ac83da2f826ba4cbd6a4b05bbd7b6f6cc077529ec4667b7d2f761a"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Local"
+        reference_sample = "d0f9cc114f6a1f788f36e359e03a9bbf89c075f41aec006229b6ad20ebbfba0b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 63 F9 FF FF 83 7D D8 FF 75 14 BF 47 12 40 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Local_6a9b5d50 {
+    meta:
+        id = "6a9b5d50-3cd4-4b64-9a52-713e1a8f02b2"
+        fingerprint = "7eea1345492359984e9be089c3e7339b79927abcff0ae4a40a713e956bb25919"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Local"
+        reference_sample = "80ab71dc9ed2131b08b5b75b5a4a12719d499c6b6ee6819ad5a6626df4a1b862"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 ?? F9 FF FF 83 7D D8 FF 75 14 BF ?? 13 40 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Local_66557224 {
+    meta:
+        id = "66557224-2c7a-4770-8333-8984d4a7b3f7"
+        fingerprint = "88503c2e1e389866962704a8b19a47c22f758bb2cee9b76600e5d9bab125d4ca"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Local"
+        reference_sample = "f58151a2f653972e744822cdc420ab1c2b8b642877d3dfa2e8b2b6915e8edf40"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FF FF 83 BD E4 FB FF FF FF 75 1A 83 EC 0C 68 24 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Local_6229602f {
+    meta:
+        id = "6229602f-1c88-46fa-8fae-a6268ed6d632"
+        fingerprint = "b26b21518fd436d79d6a23dbf3d7056b7c056e4df6639718e285de096476f61d"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Local"
+        reference_sample = "4fdb15663a405f6fc4379aad9a5021040d7063b8bb82403bedb9578d45d428fa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 C0 89 45 FC 83 7D FC 00 7D 17 68 ?? ?? 04 08 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Log4j.yar b/yara/rules/Linux_Exploit_Log4j.yar
new file mode 100644
index 00000000..aec4dd0f
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Log4j.yar
@@ -0,0 +1,24 @@
+rule Linux_Exploit_Log4j_7fc4d480 {
+    meta:
+        id = "7fc4d480-5354-4b0b-93ee-2937ddd1565c"
+        fingerprint = "cd06db6f5bebf0412d056017259b5451184d5ba5b2976efd18fa8f96dba6a159"
+        creation_date = "2021-12-13"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Exploit.Log4j"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $jndi1 = "jndi.ldap.LdapCtx.c_lookup"
+        $jndi2 = "logging.log4j.core.lookup.JndiLookup.lookup"
+        $jndi3 = "com.sun.jndi.url.ldap.ldapURLContext.lookup"
+        $exp1 = "Basic/Command/Base64/"
+        $exp2 = "java.lang.ClassCastException: Exploit"
+        $exp3 = "WEB-INF/classes/Exploit"
+        $exp4 = "Exploit.java"
+    condition:
+        2 of ($jndi*) and 1 of ($exp*)
+}
+
diff --git a/yara/rules/Linux_Exploit_Lotoor.yar b/yara/rules/Linux_Exploit_Lotoor.yar
new file mode 100644
index 00000000..bc3342da
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Lotoor.yar
@@ -0,0 +1,304 @@
+rule Linux_Exploit_Lotoor_03c81bd9 {
+    meta:
+        id = "03c81bd9-c7d1-4044-9cce-951637b2b523"
+        fingerprint = "329dc1e21088c87095ee030c597a3340f838c338403ae64aec574e0086281461"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "3fc701a2caab0297112501f55eaeb05264c5e4099c411dcadc7095627e19837a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 65 00 65 78 70 5F 73 74 61 74 65 00 6D 65 6D 73 65 74 00 70 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_757637d9 {
+    meta:
+        id = "757637d9-6171-4e2a-bf7c-3ee2c71066a7"
+        fingerprint = "7fa3e2432ddd696b5d40aafbde1e026e74294d31c9201800ce66b343a3724c6e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "0762fa4e0d74e3c21b2afc8e4c28e2292d1c3de3683c46b5b77f0f9fe1faeec7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 64 00 73 70 72 69 6E 74 66 00 6F 70 65 6E 00 69 73 5F 6F 6C }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_78543893 {
+    meta:
+        id = "78543893-7180-4857-8951-4190ca4602f1"
+        fingerprint = "b581e0820d7895021841d67e4e9dc40cec8f5ae5ba4dbc0585abcb76f97c9a2f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "ff5b02d2b4dfa9c3d53e7218533f3c57e82315be8f62aa17e26eda55a3b53479"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 48 8B 48 08 48 8B 54 24 F0 48 63 C6 48 89 8C C2 88 00 00 00 83 44 24 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_4f8d83d2 {
+    meta:
+        id = "4f8d83d2-4f7b-4a55-9d08-f7bc84263302"
+        fingerprint = "1a4e2746eb1da2a841c08ea44c6d0476c02dae5b4fbbe17926433bdb8c4e6df5"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "d78128eca706557eeab8a454cf875362a097459347ddc32118f71bd6c73d5bbd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 75 6E 61 6D 65 00 73 74 64 6F 75 74 00 66 77 72 69 74 65 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_f4afd230 {
+    meta:
+        id = "f4afd230-6c9f-49e8-8f13-429635b38eb5"
+        fingerprint = "1709244fdc1e2d9d7fba01743b0cf87de7b940d2b25a0016e021b7e9696525bc"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "805e900ffc9edb9f550dcbc938a3b06d28e9e7d3fb604ff68a311a0accbcd2b1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 83 20 FF FF FF 85 C0 74 25 8B 83 F8 FF FF FF 85 C0 74 1B 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_bb384bc9 {
+    meta:
+        id = "bb384bc9-fcda-4ad4-82ad-b95de750d31c"
+        fingerprint = "6878670c1fa154f5c4a845a824c63d0a900359b6e122b3fa759077c6a7e33e4c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "ecc6635117b99419255af5d292a7af3887b06d5f3b0f59d158281eebfe606445"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C2 75 64 4C 8B 45 F0 49 83 C0 04 4C 8B 4D F0 49 83 C1 08 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_b293f6ec {
+    meta:
+        id = "b293f6ec-0342-4727-b2a1-bd60be11ef74"
+        fingerprint = "42c95bdd82e398bceeb985cff50f4613596b71024c052487f5b337bb35489594"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "d1fa8520d3c3811d29c3d5702e7e0e7296b3faef0553835c495223a2bc015214"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { B8 89 45 A8 8B 45 A8 83 C0 64 89 45 B4 EB 2A 8B 45 A8 48 98 48 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_c5983669 {
+    meta:
+        id = "c5983669-67d6-4a9e-945f-aae383211872"
+        fingerprint = "1d74ddacc623a433f84b1ab6e74bcfc0e69afb29f40a8b2d660d96a88610c3b2"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "d08be92a484991afae3567256b6cec60a53400e0e9b6f6b4d5c416a22ccca1cf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 48 83 C0 58 48 89 44 24 20 48 8B 44 24 18 48 89 C7 BA 60 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_fbff22da {
+    meta:
+        id = "fbff22da-2f31-416c-8aa0-1003e3be8baa"
+        fingerprint = "b649b172fad3e3b085cbf250bd17dbea4c409a7337914c63230d188f9b8135fa"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "0762fa4e0d74e3c21b2afc8e4c28e2292d1c3de3683c46b5b77f0f9fe1faeec7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 75 6E 61 6D 65 00 73 74 72 6C 65 6E 00 73 74 64 6F 75 74 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_e2d5fad8 {
+    meta:
+        id = "e2d5fad8-45b6-4d65-826d-b909230e2b69"
+        fingerprint = "ec64f2c3ca5ec2bfc2146159dab3258e389be5962bdddf4c6db5975cc730a231"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "7e54e57db3de32555c15e529c04b35f52d75af630e45b5f8d6c21149866b6929"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8B 45 E4 8B 00 89 45 E8 8B 45 E8 8B 00 85 C0 75 08 8B 45 E8 89 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_f2f8eb6b {
+    meta:
+        id = "f2f8eb6b-1fc3-4fca-b58d-d71ad932e1a7"
+        fingerprint = "881e2cd5b644c2511306b3670320224810de369971278516f7562076226fa5b7"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "01721b9c024ca943f42c402a57f45bd4c77203a604c5c2cd26e5670df76a95b2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 14 40 00 00 00 EB 38 8B 44 24 14 48 98 83 E0 3F 48 85 C0 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_f8e9f93c {
+    meta:
+        id = "f8e9f93c-78ad-4ca5-a210-e62072e6f8c8"
+        fingerprint = "bdf87b68d1101cd3fcbc505de0d2e9b2aed9535aaafa9f746f7a3c4fba03b464"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "50a6d546d4c45dc33c5ece3c09dbc850b469b9b8deeb7181a45ba84459cb24c9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 61 ?? 3A 20 4C 69 6E 75 78 20 32 2E 36 2E 33 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_89671b03 {
+    meta:
+        id = "89671b03-5bd4-481b-9304-2655ea689c5f"
+        fingerprint = "e8b9631e5d4d8db559615504cc3f6fbd8a81bfbdb9e570113f20d006c44c8a9c"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "001098473574cfac1edaca9f1180ab2005569e094be63186c45b48c18f880cf8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 62 65 6C 3A 20 4C 69 6E 75 78 20 3C 20 32 2E 36 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_dbc73db0 {
+    meta:
+        id = "dbc73db0-527c-436f-afdc-bc3750f10ea0"
+        fingerprint = "2f6ad833b84f00be1d385de686a979d3738147c38b4126506e56225080ee81ef"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "9fe78e4dd7975856a74d8dfd83e69793a769143e0fe6994cbc3ef28ea37d6cf8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 63 75 73 3A 20 4C 69 6E 75 78 20 32 2E 36 2E 33 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_ec339160 {
+    meta:
+        id = "ec339160-5f25-495c-8e48-4683ad2fcca0"
+        fingerprint = "24a3630fd49860104c60c4f4d0ef03bd17c124383a0b5d027a06c7ca6cb9cbba"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "0002b469972f5c77a29e2a2719186059a3e96a6f4b1ef2d18a68fee3205ea0ba"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 69 75 6D 3A 20 4C 69 6E 75 78 20 32 2E 58 20 73 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Lotoor_7cd57e18 {
+    meta:
+        id = "7cd57e18-2315-419b-b373-ea801181232c"
+        fingerprint = "a7d3183de1bccd816bcd2346e9754aaf6e7eb124d7416d79bdbe422b33035414"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Lotoor"
+        reference_sample = "1eecf16dae302ae788d1bc81278139cd9f6af52d7bed48b8677b35ba5eb14e30"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 76 65 3A 20 4C 69 6E 75 78 20 32 2E 36 2E }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Moogrey.yar b/yara/rules/Linux_Exploit_Moogrey.yar
new file mode 100644
index 00000000..766387bf
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Moogrey.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_Moogrey_81131b66 {
+    meta:
+        id = "81131b66-788e-4456-9cb4-ffade713e8d4"
+        fingerprint = "d21e48c7afe580a764153ca489c24a7039ae663ebb281a4605f3a230a963e33e"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Moogrey"
+        reference_sample = "cc27b9755bd9feb1fb2c510f66e36c20a1503e6769cdaeee2bea7fe962d22ccc"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 C0 89 45 D4 83 7D D4 00 79 1A 83 EC 0C 68 50 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Openssl.yar b/yara/rules/Linux_Exploit_Openssl.yar
new file mode 100644
index 00000000..fd91bb40
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Openssl.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_Openssl_47c6fad7 {
+    meta:
+        id = "47c6fad7-0582-4a7a-9c51-68830e6b6132"
+        fingerprint = "bde819830cc991269275ce5de2db50489368c821271aaa397ab914011f2fcb91"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Openssl"
+        reference_sample = "8024af0931dff24b5444f0b06a27366a776014358aa0b7fc073030958f863ef8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 31 C9 F7 E1 51 5B B0 A4 CD 80 31 C0 50 68 2F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Perl.yar b/yara/rules/Linux_Exploit_Perl.yar
new file mode 100644
index 00000000..7fee3f47
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Perl.yar
@@ -0,0 +1,38 @@
+rule Linux_Exploit_Perl_4a4b8a42 {
+    meta:
+        id = "4a4b8a42-bf26-4323-a12d-06360cd88aa3"
+        fingerprint = "70ae986009e1d375a0322bf31fbae2090b7c0b6051ddd850e103e654d7b237b2"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Perl"
+        reference_sample = "d1fa8520d3c3811d29c3d5702e7e0e7296b3faef0553835c495223a2bc015214"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 20 73 65 65 6B 69 6E 67 20 6F 75 74 20 74 68 65 20 73 6D 61 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Perl_982bb709 {
+    meta:
+        id = "982bb709-beec-4f7f-b249-44b1fb46c3be"
+        fingerprint = "a2f68acb31b84e93f902aeb838ad550e1644c20e1c8060bb8de8ad57fa4ba4bb"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Perl"
+        reference_sample = "f3e4e2b5af9d0c72aae83cec57e5c091a95c549f826e8f13559aaf7d300f6e13"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 54 75 65 20 53 65 70 20 32 31 20 31 36 3A 34 38 3A 31 32 20 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Pulse.yar b/yara/rules/Linux_Exploit_Pulse.yar
new file mode 100644
index 00000000..001b03bb
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Pulse.yar
@@ -0,0 +1,38 @@
+rule Linux_Exploit_Pulse_2bea17e8 {
+    meta:
+        id = "2bea17e8-2324-4502-9ced-7a45d94099ec"
+        fingerprint = "4d57fb355e7d68ad3da26ff3bade291ebbfa8df5f0727579787e33ebee888d41"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Pulse"
+        reference_sample = "c29cb4c2d83127cf4731573a7fac531f90f27799857f5e250b9f71362108f559"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 E5 48 8D 45 F8 48 89 45 F8 48 8B 45 F8 48 25 00 F0 FF FF 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Pulse_246e6f31 {
+    meta:
+        id = "246e6f31-fcfb-474e-9709-a5d7ea6586fd"
+        fingerprint = "e98007a2fa62576e1847cf350283f60f1e4e49585574601ab44b304f391240db"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Pulse"
+        reference_sample = "c29cb4c2d83127cf4731573a7fac531f90f27799857f5e250b9f71362108f559"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 48 8D 45 F8 48 89 45 F8 48 8B 45 F8 48 25 00 E0 FF FF 48 8B 00 48 89 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Race.yar b/yara/rules/Linux_Exploit_Race.yar
new file mode 100644
index 00000000..bd16529c
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Race.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_Race_758a0884 {
+    meta:
+        id = "758a0884-0174-46c8-a57a-980fc04360d0"
+        fingerprint = "3516086ae773ec1c1de75a54bafbb72ad49b4c7f1661961d5613462b53f26c43"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Race"
+        reference_sample = "a4966baaa34b05cb782071ef114a53cac164e6dece275c862fe96a2cff4a6f06"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 22 00 00 00 36 00 00 00 18 85 04 08 34 00 00 00 12 00 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Ramen.yar b/yara/rules/Linux_Exploit_Ramen.yar
new file mode 100644
index 00000000..f7dcc4b9
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Ramen.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_Ramen_01b205eb {
+    meta:
+        id = "01b205eb-4718-4ffd-9fdc-b9de567c4603"
+        fingerprint = "a39afcf7cec82dc511fd39b4a019ef161250afe7cb0880e488badb56d021cc9f"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Ramen"
+        reference_sample = "c0b6303300f38013840abe17abe192db6a99ace78c83bc7ef705f5c568bc98fd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 31 C0 31 DB 31 C9 B0 46 CD 80 31 C0 31 DB 43 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Sorso.yar b/yara/rules/Linux_Exploit_Sorso.yar
new file mode 100644
index 00000000..2525308c
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Sorso.yar
@@ -0,0 +1,57 @@
+rule Linux_Exploit_Sorso_ecf99f8f {
+    meta:
+        id = "ecf99f8f-1692-41ee-a70d-8c868e269529"
+        fingerprint = "d2c0ccceed8a76d13c8b388e5c3b560f23ecff2b1b9c90d18e5e0d0bbdc91364"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Sorso"
+        reference_sample = "c0f0a7b45fb91bc18264d901c20539dd32bc03fa5b7d839a0ef5012fb0d895cd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6E 89 E3 50 54 53 50 B0 3B CD 80 31 C0 B0 01 CD }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Sorso_91a4d487 {
+    meta:
+        id = "91a4d487-cbb6-4805-a4fc-5f4ff3b0e22b"
+        fingerprint = "4965d806fa46b74023791ca17a90031753fbbe6094d25868e8d93e720f61d4c0"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Sorso"
+        reference_sample = "c0f0a7b45fb91bc18264d901c20539dd32bc03fa5b7d839a0ef5012fb0d895cd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 80 31 C0 43 53 56 50 B0 5A CD 80 31 C0 50 68 2F }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Sorso_61eae7dd {
+    meta:
+        id = "61eae7dd-3335-4a50-b70b-c7c5657fc540"
+        fingerprint = "8ada74a60e30a26f7789bfdf00b3373843f39dc7d71bd6e1b603a7a41b5a63e9"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Sorso"
+        reference_sample = "c0f0a7b45fb91bc18264d901c20539dd32bc03fa5b7d839a0ef5012fb0d895cd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 69 89 E3 50 53 89 E1 B0 0B CD 80 31 C0 B0 01 CD }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Vmsplice.yar b/yara/rules/Linux_Exploit_Vmsplice.yar
new file mode 100644
index 00000000..b9af99a3
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Vmsplice.yar
@@ -0,0 +1,95 @@
+rule Linux_Exploit_Vmsplice_cfa94001 {
+    meta:
+        id = "cfa94001-6000-4633-9af2-efabfaa96f94"
+        fingerprint = "3fb484112484e2afc04a88d50326312af950605c61f258651479427b7bae300a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Vmsplice"
+        reference_sample = "0a26e67692605253819c489cd4793a57e86089d50150124394c30a8801bf33e6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 7A 00 21 40 23 24 00 6D 6D 61 70 00 5B 2B 5D 20 6D 6D 61 70 3A }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Vmsplice_a000f267 {
+    meta:
+        id = "a000f267-b4d7-46e9-ab61-818633083ba2"
+        fingerprint = "0753ef1bc3e151fd6d4773967b5cde6ad789df593e7d8b9ed08052151a1a1849"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Vmsplice"
+        reference_sample = "c85cc6768a28fb7de16f1cad8d3c69d8f0b4aa01e00c8e48759d27092747ca6f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 04 73 00 00 00 89 44 24 00 CF 83 C4 10 5B C9 C3 55 89 E5 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Vmsplice_8b9e4f9f {
+    meta:
+        id = "8b9e4f9f-7903-4aa5-9098-766f4311a22b"
+        fingerprint = "585b16ad3e4489a17610f0a226be428def33e411886f273d0c1db45b3819ba3f"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Vmsplice"
+        reference_sample = "0230c81ba747e588cd9b6113df6e1867dcabf9d8ada0c1921d1bffa9c1b9c75d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 00 00 20 4C 69 6E 75 78 20 76 6D 73 70 6C }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Vmsplice_055f88b8 {
+    meta:
+        id = "055f88b8-b1b0-4b02-8fc5-97804b564d27"
+        fingerprint = "38f7d6c56ee1cd465062b5c82320710c4d0393a3b33f5586b6c0c0c778e5d3b2"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Vmsplice"
+        reference_sample = "607c8c5edc8cbbd79a40ce4a0eccf46e01447985d9415d1eff6a91bf64074507"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 2D 2D 2D 00 20 4C 69 6E 75 78 20 76 6D 73 70 6C }
+    condition:
+        all of them
+}
+
+rule Linux_Exploit_Vmsplice_431e689d {
+    meta:
+        id = "431e689d-0c41-4c92-98b0-0dac529d8328"
+        fingerprint = "1e8aee445a3adef6ccbd2d25f7b38202bef98a99b828eda56fb8b9269b6316b4"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Vmsplice"
+        reference = "1cbb09223f16af4cd13545d72dbeeb996900535b1e279e4bcf447670728de1e1"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 69 6F 6E 00 70 75 74 65 6E 76 00 73 74 64 6F 75 74 00 73 65 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Exploit_Wuftpd.yar b/yara/rules/Linux_Exploit_Wuftpd.yar
new file mode 100644
index 00000000..a6d5f39e
--- /dev/null
+++ b/yara/rules/Linux_Exploit_Wuftpd.yar
@@ -0,0 +1,19 @@
+rule Linux_Exploit_Wuftpd_0991e62f {
+    meta:
+        id = "0991e62f-af72-416a-b88b-6bc8a501b8bb"
+        fingerprint = "642c7b059fa604a0a5110372e2247da9625b07008b012fd498670a6dd1b29974"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Exploit.Wuftpd"
+        reference_sample = "c0b6303300f38013840abe17abe192db6a99ace78c83bc7ef705f5c568bc98fd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F3 8D 4E 08 8D 56 0C B0 0B CD 80 31 C0 31 DB }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Hacktool_Aduh.yar b/yara/rules/Linux_Hacktool_Aduh.yar
new file mode 100644
index 00000000..608ef58b
--- /dev/null
+++ b/yara/rules/Linux_Hacktool_Aduh.yar
@@ -0,0 +1,19 @@
+rule Linux_Hacktool_Aduh_6cae7c78 {
+    meta:
+        id = "6cae7c78-a4b4-4096-9f7c-746b1e5a1e38"
+        fingerprint = "8d7b0c1a95ec15c7d1ede5670ccd448b166467ed8eb2b4f38ebbb2c8bc323cdc"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Aduh"
+        reference_sample = "9c67207546ad274dc78a0819444d1c8805537f9ac36d3c53eba9278ed44b360c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E3 51 89 E2 51 89 E1 B0 0B CD 80 31 C0 B0 01 CD }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Hacktool_Bruteforce.yar b/yara/rules/Linux_Hacktool_Bruteforce.yar
new file mode 100644
index 00000000..9b449221
--- /dev/null
+++ b/yara/rules/Linux_Hacktool_Bruteforce.yar
@@ -0,0 +1,57 @@
+rule Linux_Hacktool_Bruteforce_bad95bd6 {
+    meta:
+        id = "bad95bd6-94a9-4abf-9d3b-781f0b79c5ce"
+        fingerprint = "10698122ff9fe06b398307ec15ad4f5bb519285e1eaad97011abf0914f1e7afd"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Bruteforce"
+        reference_sample = "8e8be482357ebddc6ac3ea9ee60241d011063f7e558a59e6bd119e72e4862024"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 73 65 6E 64 6D 6D 73 67 00 66 70 75 74 73 00 6D 65 6D 63 70 79 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Bruteforce_66a14c03 {
+    meta:
+        id = "66a14c03-f4a3-4b24-a5db-5a9235334e37"
+        fingerprint = "255c1a2e781ff7f330c09b3c82f08db110579f77ccef8780d03e9aa3eec86607"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Bruteforce"
+        reference_sample = "a2d8e2c34ae95243477820583c0b00dfe3f475811d57ffb95a557a227f94cd55"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 48 8B 4C 24 08 78 3D 48 8B 44 24 30 48 29 C8 48 89 4D 08 48 89 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Bruteforce_eb83b6aa {
+    meta:
+        id = "eb83b6aa-d7b5-4d10-9258-4bf619fc6582"
+        fingerprint = "7767bf57c57d398f27646f5ae2bcda07d6c62959becb31a5186ff0b027ff02b4"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Bruteforce"
+        reference_sample = "8dec88576f61f37fbaece3c30e71d338c340c8fb9c231f9d7b1c32510d2c3167"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 89 45 EC EB 04 83 6D EC 01 83 7D EC 00 74 12 8B 45 EC 8D }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Hacktool_Cleanlog.yar b/yara/rules/Linux_Hacktool_Cleanlog.yar
new file mode 100644
index 00000000..55cad664
--- /dev/null
+++ b/yara/rules/Linux_Hacktool_Cleanlog.yar
@@ -0,0 +1,57 @@
+rule Linux_Hacktool_Cleanlog_c2907d77 {
+    meta:
+        id = "c2907d77-6ea9-493f-a7b3-4a0795da0a1d"
+        fingerprint = "131c71086c30ab22ca16b3020470561fa3d32c7ece9a8faa399a733e8894da30"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Cleanlog"
+        reference_sample = "613ac236130ab1654f051d6f0661fa62414f3bef036ea4cc585b4b21a4bb9d2b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 E5 48 83 EC 10 89 7D FC 83 7D FC 00 7E 11 8B 45 FC BE 09 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Cleanlog_3eb725d1 {
+    meta:
+        id = "3eb725d1-24de-427a-b6ed-3ca03c0716df"
+        fingerprint = "54d3c59ba5ca16fbe99a4629f4fe7464d13f781985a7f35d05604165f9284483"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Cleanlog"
+        reference_sample = "4df4ebcc61ab2cdb8e5112eeb4e2f29e4e841048de43d7426b1ec11afe175bf6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 E0 83 45 C0 01 EB 11 83 45 DC 01 EB 0B 83 45 D8 01 EB 05 83 45 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Cleanlog_400b7595 {
+    meta:
+        id = "400b7595-c3c4-4999-b3b9-dcfe9b5df3f6"
+        fingerprint = "4423f1597b199046bfc87923e3e229520daa2da68c4c4a3ac69127ace518f19a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Cleanlog"
+        reference_sample = "4df4ebcc61ab2cdb8e5112eeb4e2f29e4e841048de43d7426b1ec11afe175bf6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 72 20 65 6E 74 72 79 20 28 64 65 66 61 75 6C 74 3A 20 31 73 74 20 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Hacktool_Earthworm.yar b/yara/rules/Linux_Hacktool_Earthworm.yar
new file mode 100644
index 00000000..dab195c3
--- /dev/null
+++ b/yara/rules/Linux_Hacktool_Earthworm.yar
@@ -0,0 +1,95 @@
+rule Linux_Hacktool_Earthworm_4de7b584 {
+    meta:
+        id = "4de7b584-d25f-414b-bdd5-45f3672a62d8"
+        fingerprint = "af2dc166ad5bbd3e312338a3932134c33c33c124551e7828eeef299d89419d21"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Earthworm"
+        reference_sample = "9d61aabcf935121b4f7fc6b0d082d7d6c31cb43bf253a8603dd46435e66b7955"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 73 6F 63 6B 73 64 20 2C 20 72 63 73 6F 63 6B 73 20 2C 20 72 73 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Earthworm_e3da43e2 {
+    meta:
+        id = "e3da43e2-1737-4c51-af6c-7c64d9cbfb07"
+        fingerprint = "fdf19096c6afc1c3be75fe4bb2935aca8ac915c97ad0ab3c2b87e803347cc460"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Earthworm"
+        reference_sample = "da0cffc4222d11825778fe4fa985fef2945caa0cc3b4de26af0a06509ebafb21"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8D 20 FF FF FF 4C 89 C1 4C 8B 85 20 FF FF FF 49 D3 E0 4C 21 C7 48 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Earthworm_a6e229b5 {
+    meta:
+        id = "a6e229b5-d43c-4ff5-b604-761b906f1d2b"
+        fingerprint = "ff59695e5146703990a2e16945393532cc14c201248c79fbb015063d4838a761"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Earthworm"
+        reference_sample = "dc412d4f2b0e9ca92063a47adfb0657507d3f2a54a415619db5a7ccb59afb204"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FC 01 00 00 00 89 85 48 FF FF FF 8B 45 FC 48 81 C4 C0 00 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Earthworm_82d5c4cf {
+    meta:
+        id = "82d5c4cf-ab96-4644-b1f3-2e95f1b49e7c"
+        fingerprint = "400342ab702de1a7ec4dd7e9b415b8823512f74a9abe578f08f7d79265bef385"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Earthworm"
+        reference_sample = "dc412d4f2b0e9ca92063a47adfb0657507d3f2a54a415619db5a7ccb59afb204"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 E5 48 83 EC 20 31 C0 89 C1 48 8D 55 F0 48 89 7D F8 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Earthworm_4ec2ec63 {
+    meta:
+        id = "4ec2ec63-6b22-404f-a217-4e7d32bfbe9f"
+        fingerprint = "1dfb594e369ca92a9e3f193499708c4992f6497ff1aa74ae0d6c2475a7e87641"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Earthworm"
+        reference_sample = "dc412d4f2b0e9ca92063a47adfb0657507d3f2a54a415619db5a7ccb59afb204"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 E5 48 83 EC 20 BA 04 00 00 00 48 8D 45 F0 48 89 7D F8 89 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Hacktool_Exploitscan.yar b/yara/rules/Linux_Hacktool_Exploitscan.yar
new file mode 100644
index 00000000..fa51339c
--- /dev/null
+++ b/yara/rules/Linux_Hacktool_Exploitscan.yar
@@ -0,0 +1,19 @@
+rule Linux_Hacktool_Exploitscan_4327f817 {
+    meta:
+        id = "4327f817-cb11-480f-aba7-4d5170c77758"
+        fingerprint = "3f70c8ef8f20f763dcada4353c254fe1df238829ce590fb87c279d8a892cf9c4"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Exploitscan"
+        reference_sample = "66c6d0e58916d863a1a973b4f5cb7d691fbd01d26b408dbc8c74f0f1e4088dfb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 08 8B 4C 24 0C 85 C0 74 20 8B 58 20 84 03 83 C3 10 8B 68 24 89 9C 24 DC 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Hacktool_Flooder.yar b/yara/rules/Linux_Hacktool_Flooder.yar
new file mode 100644
index 00000000..4419f120
--- /dev/null
+++ b/yara/rules/Linux_Hacktool_Flooder.yar
@@ -0,0 +1,645 @@
+rule Linux_Hacktool_Flooder_825b6808 {
+    meta:
+        id = "825b6808-9b23-4a55-9f26-a34cab6ea92b"
+        fingerprint = "e2db86e614b9bc0de06daf626abe652cc6385cca8ba96a2f2e394cf82be7a29b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "7db9a0760dd16e23cb299559a0e31a431b836a105d5309a9880fa4b821937659"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 83 EC 04 8B 45 E4 FF 70 0C 8D 45 E8 83 C0 04 50 8B 45 E4 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_a44ab8cd {
+    meta:
+        id = "a44ab8cd-c45e-4fe8-b96d-d4fe227f3107"
+        fingerprint = "0d77547064aeca6714ede98df686011c139ca720a71bcac23e40b0c02d302d6a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "4b2068a4a666b0279358b8eb4f480d2df4c518a8b4518d0d77c6687c3bff0a32"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E0 03 48 89 45 A8 8B 45 BC 48 63 D0 48 83 EA 01 48 89 55 A0 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_7026f674 {
+    meta:
+        id = "7026f674-83b7-432b-9197-2d71abdb9579"
+        fingerprint = "acf93628ecbda544c6c5d88388ac85bb2755c71544a0980ee1b2854c6bdb7c77"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "b7a77ebb66664c54d01a57abed5bb034ef2933a9590b595bba0566938b099438"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 08 1E 77 DA 00 43 6F 75 6C 64 20 6E 6F 74 20 6F 70 65 6E 20 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_761ad88e {
+    meta:
+        id = "761ad88e-1667-4253-81f6-52c92e0ccd68"
+        fingerprint = "14e701abdef422dcde869a2278ec6e1fb7889dcd9681a224b29a00bcb365e391"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "1d88971f342e4bc4e6615e42080a3b6cec9f84912aa273c36fc46aaf86ff6771"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 2E 31 36 38 2E 33 2E 31 30 30 00 43 6F 75 6C 64 20 6E 6F 74 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_b93655d3 {
+    meta:
+        id = "b93655d3-1d3f-42f4-a47f-a69624e90da5"
+        fingerprint = "55119467cb5f9789b74064e63c1e7d905457b54f6e4da1a83c498313d6c90b5b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C0 49 89 C5 74 45 45 85 F6 7E 28 48 89 C3 41 8D 46 FF 4D 8D 64 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_af9f75e6 {
+    meta:
+        id = "af9f75e6-9a9b-4e03-9c76-8c0c9f07c8b1"
+        fingerprint = "f6e7d6e9c03c8ce3e14b214fe268e7aab2e15c1b4378fe253021497fb9a884e6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "bf6f3ffaf94444a09b69cbd4c8c0224d7eb98eb41514bdc3f58c1fb90ac0e705"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C4 48 89 E0 48 83 C0 07 48 C1 E8 03 48 C1 E0 03 48 89 45 C0 C7 45 B4 14 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_1bf0e994 {
+    meta:
+        id = "1bf0e994-2648-4dbb-9b9c-b86b9a347700"
+        fingerprint = "1f844c349b47dd49a75d50e43b6664e9d2b95c362efb730448934788b6bddb79"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "1ea2dc13eec0d7a8ec20307f5afac8e9344d827a6037bb96a54ad7b12f65b59c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 05 88 10 48 8B 45 B8 0F B6 10 83 E2 0F 83 CA 40 88 10 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_d710a5da {
+    meta:
+        id = "d710a5da-26bf-4f6a-bf51-9cdac1f83aa3"
+        fingerprint = "e673aa8785c7076f4cced9f12b284a2927b762fe1066aba8d6a5ace775f3480c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "ba895a9c449bf9bf6c092df88b6d862a3e8ed4079ef795e5520cb163a45bcdb4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 74 24 48 8B 45 E0 48 83 C0 10 48 8B 08 48 8B 45 E0 48 83 C0 08 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_f434a3fb {
+    meta:
+        id = "f434a3fb-e5fd-4749-8e53-fc6c80ee5406"
+        fingerprint = "b74e55c56a063e14608f7e8f578cc3c74ec57954df39e63e49b60c0055725d51"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "ba895a9c449bf9bf6c092df88b6d862a3e8ed4079ef795e5520cb163a45bcdb4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C0 48 01 45 F8 48 83 45 E8 02 83 6D E4 01 83 7D E4 00 7F E3 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_a2795a4c {
+    meta:
+        id = "a2795a4c-16c0-4237-a014-3570d1edb287"
+        fingerprint = "7c8bf248b159f3a140f10cd40d182fa84f334555b92306e6f44e746711b184cc"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "9a564d6b29d2aaff960e6f84cd0ef4c701fefa2a62e2ea690106f3fdbabb0d71"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 48 8B 45 D8 66 89 50 04 48 8B 45 D8 0F B7 40 02 66 D1 E8 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_678c1145 {
+    meta:
+        id = "678c1145-cc41-4e83-bc88-30f64da46dd3"
+        fingerprint = "f4f66668b45f520bc107b7f671f8c7f42073d7ff28863e846a74fbd6cac03e87"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "559793b9cb5340478f76aaf5f81c8dbfbcfa826657713d5257dac3c496b243a6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C8 48 BA AB AA AA AA AA AA AA AA 48 89 C8 48 F7 E2 48 C1 EA 05 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_3cbdfb1f {
+    meta:
+        id = "3cbdfb1f-6c66-48be-931e-3ae609c46ff4"
+        fingerprint = "c7f5d7641ea6e780bc3045181c929be73621acfe6aec4d157f6a9e0334ba7fb9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "bd40ac964f3ad2011841c7eb4bf7cab332d4d95191122e830ab031dc9511c079"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 5B 53 54 44 32 2E 43 20 42 59 20 53 54 41 43 4B 44 5D 20 53 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_8b63ff02 {
+    meta:
+        id = "8b63ff02-be86-4c63-8f7b-4c70fbd8a83a"
+        fingerprint = "af7a4df7e707c1b70fb2b29efe2492e6f77cdde5e8d1e6bfdf141acabc8759eb"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "a57de6cd3468f55b4bfded5f1eed610fdb2cbffbb584660ae000c20663d5b304"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { DC 02 83 7D DC 01 0F 9F C0 84 C0 75 DF 83 7D DC 01 75 1D 66 C7 45 F6 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_30973084 {
+    meta:
+        id = "30973084-60d2-494d-a3c6-2a015a9459a0"
+        fingerprint = "44fc236199ccf53107f1a617ac872f51d58a99ec242fe97b913e55b3ec9638e2"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "a22ffa748bcaaed801f48f38b26a9cfdd5e62183a9f6f31c8a1d4a8443bf62a4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4C 69 73 74 20 49 6D 70 6F 72 74 20 46 6F 72 20 53 6F 75 72 63 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_1cfa95dd {
+    meta:
+        id = "1cfa95dd-e768-4071-9038-389c580741f9"
+        fingerprint = "6ec21acb987464613830b3bbe1e2396093d269dae138c68fe77f35d88796001e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "1d88971f342e4bc4e6615e42080a3b6cec9f84912aa273c36fc46aaf86ff6771"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 83 7D EC 00 7E 0F 48 8B 45 F0 0F B6 00 0F B6 C0 48 01 C3 EB 10 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_25c48456 {
+    meta:
+        id = "25c48456-2f83-41a8-ba37-b557014d1d86"
+        fingerprint = "0c79f8eaacd2aa1fa60d5bfb7b567a9fc3e65068be1516ca723cb1394bb564ce"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "eba6f3e4f7b53e22522d82bdbdf5271c3fc701cbe07e9ecb7b4c0b85adc9d6b4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 F8 48 83 6D E0 01 48 83 7D E0 00 75 DD 48 8B 45 F0 C9 C3 55 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_b1ca2abd {
+    meta:
+        id = "b1ca2abd-b8ab-435d-85b6-a1c93212e492"
+        fingerprint = "214c9dedf34b2c8502c6ef14aff5727ac5a2941e1a8278a48d34fea14d584a1a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "1d88971f342e4bc4e6615e42080a3b6cec9f84912aa273c36fc46aaf86ff6771"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C4 48 89 E0 48 83 C0 07 48 C1 E8 03 48 C1 E0 03 48 89 45 B0 C7 45 AC 14 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_8f25995c {
+    meta:
+        id = "8f25995c-a1d1-454d-8210-4c929c8a1f3b"
+        fingerprint = "0ab165b98a31375e089f212b26cbe919657fb402f7be9bf10024ca57ea14924f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "1d88971f342e4bc4e6615e42080a3b6cec9f84912aa273c36fc46aaf86ff6771"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 50 0C 83 E2 0F 83 CA 50 88 50 0C 48 8B 45 F8 0F B6 50 0D 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_cce8c792 {
+    meta:
+        id = "cce8c792-ef3e-43c2-b4ad-343de6a69cc7"
+        fingerprint = "03541eb8a293e88c0b8e6509310f8c57f2cd16b5ff76783a73bde2b614b607fc"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "ea56da9584fc36dc67cb1e746bd13c95c4d878f9d594e33221baad7e01571ee6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 01 48 89 51 08 48 8B 45 A0 8B 55 CC 48 63 D2 48 C1 E2 05 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_4bcea1c4 {
+    meta:
+        id = "4bcea1c4-de08-4526-8d31-89c5512f07af"
+        fingerprint = "e859966e8281e024c82dedd5bd237ab53af28a0cb21d24daa456e5cd1186c352"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "9a564d6b29d2aaff960e6f84cd0ef4c701fefa2a62e2ea690106f3fdbabb0d71"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 50 FF 48 8B 45 C0 48 01 D0 0F B6 00 3C 0A 74 22 48 8B 45 C0 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_ab561a1b {
+    meta:
+        id = "ab561a1b-d8dd-4768-9b4c-07ef4777b252"
+        fingerprint = "081dd5eb061c8023756e413420241e20a2c86097f95859181ca5d6b1d24fdd76"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "1b7df0d491974bead05d04ede6cf763ecac30ecff4d27bb4097c90cc9c3f4155"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { B5 50 FF FF FF 64 48 8B 04 25 28 00 00 00 48 89 45 C8 31 C0 83 BD 5C FF FF }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_1a4eb229 {
+    meta:
+        id = "1a4eb229-a194-46a5-8e93-370a40ba999b"
+        fingerprint = "de076ef23c2669512efc00ddfe926ef04f8ad939061c69131a0ef9a743639371"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "bf6f3ffaf94444a09b69cbd4c8c0224d7eb98eb41514bdc3f58c1fb90ac0e705"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F4 8B 45 E8 83 C0 01 89 45 F8 EB 0F 8B 45 E8 83 C0 01 89 45 F4 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_51ef0659 {
+    meta:
+        id = "51ef0659-2691-4558-bff8-fce614f10ab9"
+        fingerprint = "41f517a19a3c4dc412200b683f4902a656f3dcfdead8b8292e309413577c3850"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "b7a2bc75dd9c44c38b2a6e4e7e579142ece92a75b8a3f815940c5aa31470be2b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E0 03 48 89 45 B0 8B 45 9C 48 63 D0 48 83 EA 01 48 89 55 B8 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_d90c4cbe {
+    meta:
+        id = "d90c4cbe-4d0a-4341-a58b-a472b67282d6"
+        fingerprint = "64796aa7faa2e945b5c856c1c913cb62175413dc1df88505dececcfbd2878cb1"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "409c55110d392aed1a9ec98a6598fb8da86ab415534c8754aa48e3949e7c4b62"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 D8 F7 D0 5B 5D C3 55 48 89 E5 48 83 EC 40 48 89 7D C8 48 89 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_63d14795 {
+    meta:
+        id = "63d14795-59c9-4387-aeca-400dcc4a9063"
+        fingerprint = "89a32efdd6e39ec16988e4f64ff6b6ee4090dd05f005bf7ac1ebcded97955835"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "bf6f3ffaf94444a09b69cbd4c8c0224d7eb98eb41514bdc3f58c1fb90ac0e705"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C1 48 BA 01 80 00 80 00 80 00 80 48 89 C8 48 F7 E2 48 89 D0 48 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_c680c9fd {
+    meta:
+        id = "c680c9fd-34ad-4d92-b8d6-1b511c7c07a3"
+        fingerprint = "5cb5b36d3ae5525b992a9d395b54429f52b11ea229e0cecbd62317af7b5faf84"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "ea56da9584fc36dc67cb1e746bd13c95c4d878f9d594e33221baad7e01571ee6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 A0 8B 55 CC 48 63 D2 48 C1 E2 05 48 01 D0 48 8D 48 10 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_e63396f4 {
+    meta:
+        id = "e63396f4-a297-4d99-b341-34cb22498078"
+        fingerprint = "269285d03ea1a3b41ff134ab2cf5e22502626c72401b83add6c1e165f4dd83f8"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference_sample = "913e6d2538bd7eed3a8f3d958cf445fe11c5c299a70e5385e0df6a9b2f638323"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 02 83 45 FC 01 81 7D FC FF 0F 00 00 7E ?? 90 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_7d5355da {
+    meta:
+        id = "7d5355da-5fbd-46c0-8bd2-33a27cbcca63"
+        fingerprint = "52882595f28e1778ee3b0e6bda94319f5c348523f16566833281f19912360270"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference = "03397525f90c8c2242058d2f6afc81ceab199c5abcab8fd460fabb6b083d8d20"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 E5 48 83 EC 60 64 48 8B 04 25 28 00 00 00 48 89 45 F8 31 C0 BF 0A 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_a9e8a90f {
+    meta:
+        id = "a9e8a90f-5d95-4f4e-a9e0-c595be3729dd"
+        fingerprint = "a06bbcbc09e5e44447b458d302c47e4f18438be8d57687700cb4bf3f3630fba8"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference = "0558cf8cab0ba1515b3b69ac32975e5e18d754874e7a54d19098e7240ebf44e4"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 D8 48 89 45 F0 66 C7 45 EE 00 00 EB 19 48 8B 45 F0 48 8D }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_a598192a {
+    meta:
+        id = "a598192a-c804-4c57-9cc3-c2205cb431d3"
+        fingerprint = "61cb72180283746ebbd82047baffc4bf2384658019970c4dceadfb5c946abcd2"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference = "101f2240cd032831b9c0930a68ea6f74688f68ae801c776c71b488e17bc71871"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8D 65 D8 5B 5E 5F C9 C3 8D 36 55 89 E5 83 EC 18 57 56 53 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_53bf4e37 {
+    meta:
+        id = "53bf4e37-e043-4cf2-ad2a-bc63d69585ae"
+        fingerprint = "83e804640b0848caa532dadc33923c226a34e0272457bde00325069ded55f256"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference = "101f2240cd032831b9c0930a68ea6f74688f68ae801c776c71b488e17bc71871"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 74 00 49 50 5F 48 44 52 49 4E 43 4C 00 57 68 61 74 20 74 68 65 20 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_50158a6e {
+    meta:
+        id = "50158a6e-d412-4e37-a8b5-c7c79a2a5393"
+        fingerprint = "f6286d1fd84aad72cdb8c655814a9df1848fae94ae931ccf62187c100b27a349"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference = "1e0cdb655e48d21a6b02d2e1e62052ffaaec9fdfe65a3d180fc8afabc249e1d8"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 F8 48 01 D0 48 89 45 D8 0F B7 45 E6 48 8D 50 33 48 8B 45 F8 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_f454ec10 {
+    meta:
+        id = "f454ec10-7a67-4717-9e95-fecb7c357566"
+        fingerprint = "2ae5e2c3190a4ce5d238efdb10ac0520987425fb7af52246b6bf948abd0259da"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference = "0297e1ad6e180af85256a175183102776212d324a2ce0c4f32e8a44a2e2e9dad"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8B 45 EC 48 63 D0 48 8B 45 D0 48 01 D0 0F B6 00 3C 2E 75 4D 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Flooder_9417f77b {
+    meta:
+        id = "9417f77b-190b-4834-b57a-08a7cbfac884"
+        fingerprint = "d321ea7aeb293f8f50236bddeee99802225b70e8695bb3527a89beea51e3ffb3"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Hacktool.Flooder"
+        reference = "60ff13e27dad5e6eadb04011aa653a15e1a07200b6630fdd0d0d72a9ba797d68"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0F B7 45 F6 0F B7 C0 48 01 C3 48 89 DA 48 C1 FA 10 0F B7 C3 48 8D }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Hacktool_Fontonlake.yar b/yara/rules/Linux_Hacktool_Fontonlake.yar
new file mode 100644
index 00000000..dbc26023
--- /dev/null
+++ b/yara/rules/Linux_Hacktool_Fontonlake.yar
@@ -0,0 +1,30 @@
+rule Linux_Hacktool_Fontonlake_68ad8568 {
+    meta:
+        id = "68ad8568-2b00-4680-a83f-1689eff6099c"
+        fingerprint = "81936e696a525cf02070fa7cfa27574cdad37e1b3d8f278950390a1945c21611"
+        creation_date = "2021-10-12"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Hacktool.Fontonlake"
+        reference_sample = "717953f52318e7687fc95626561cc607d4875d77ff7e3cf5c7b21cf91f576fa4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $s1 = "run_in_bash"
+        $s2 = "run_in_ss"
+        $s3 = "real_bash_fork"
+        $s4 = "fake_bash_add_history"
+        $s5 = "hook_bash_add_history"
+        $s6 = "real_bash_add_history"
+        $s7 = "real_current_user.5417"
+        $s8 = "real_bash_execve"
+        $s9 = "inject_so_symbol.c"
+        $s10 = "/root/rmgr_ko/subhook-0.5/subhook_x86.c"
+        $s11 = "|1|%ld|%d|%d|%d|%d|%s|%s"
+        $s12 = "/proc/.dot3"
+    condition:
+        4 of them
+}
+
diff --git a/yara/rules/Linux_Hacktool_Infectionmonkey.yar b/yara/rules/Linux_Hacktool_Infectionmonkey.yar
new file mode 100644
index 00000000..6345a02b
--- /dev/null
+++ b/yara/rules/Linux_Hacktool_Infectionmonkey.yar
@@ -0,0 +1,19 @@
+rule Linux_Hacktool_Infectionmonkey_6c84537b {
+    meta:
+        id = "6c84537b-6aa1-40d5-b14c-f78d7e67823d"
+        fingerprint = "e9275f5fd8df389a4c99f69c09df1e3e515d8b958616e6d4d2c82d693deb4908"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Hacktool.Infectionmonkey"
+        reference_sample = "d941943046db48cf0eb7f11e144a79749848ae6b50014833c5390936e829f6c3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 75 14 8B 54 24 0C 83 FA FF 0F 44 D0 83 C4 1C 89 D0 C3 8D 74 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Hacktool_Portscan.yar b/yara/rules/Linux_Hacktool_Portscan.yar
new file mode 100644
index 00000000..ec3b6d49
--- /dev/null
+++ b/yara/rules/Linux_Hacktool_Portscan.yar
@@ -0,0 +1,76 @@
+rule Linux_Hacktool_Portscan_a40c7ef0 {
+    meta:
+        id = "a40c7ef0-627c-4965-b4d3-b05b79586170"
+        fingerprint = "bf686c3c313936a144265cbf75850c8aee3af3ae36cb571050c7fceed385451d"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Portscan"
+        reference_sample = "c389c42bac5d4261dbca50c848f22c701df4c9a2c5877dc01e2eaa81300bdc29"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 54 50 44 00 52 65 73 70 6F 6E 73 65 20 77 61 73 20 4E 54 50 20 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Portscan_6c6000c2 {
+    meta:
+        id = "6c6000c2-7e9a-457c-a745-00a3ac83a4bc"
+        fingerprint = "3c893aebe688d70aebcb15fdc0d2780d2ec0589084c915ff71519ec29e5017f1"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Portscan"
+        reference_sample = "8877009fc8ee27ba3b35a7680b80d21c84ee7296bcabe1de51aeeafcc8978da7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 30 B9 0E 00 00 00 4C 89 D7 F3 A6 0F 97 C2 80 DA 00 84 D2 45 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Portscan_e191222d {
+    meta:
+        id = "e191222d-633a-4408-9a54-a70bb9e89cc0"
+        fingerprint = "5580dd8b9180b8ff36c7d08a134b1b3782b41054d8b29b23fc5a79e7b0059fd1"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Portscan"
+        reference_sample = "e2f4313538c3ef23adbfc50f37451c318bfd1ffd0e5aaa346cce4cc37417f812"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 46 4F 55 4E 44 00 56 41 4C 55 45 00 44 45 4C 45 54 45 44 00 54 }
+    condition:
+        all of them
+}
+
+rule Linux_Hacktool_Portscan_e57b0a0c {
+    meta:
+        id = "e57b0a0c-66b8-488b-b19d-ae06623645fd"
+        fingerprint = "829c7d271ae475ef06d583148bbdf91af67ce4c7a831da73cc52e8406e7e8f9e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Portscan"
+        reference_sample = "f8ee385316b60ee551565876287c06d76ac5765f005ca584d1ca6da13a6eb619"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 83 7D 08 03 75 2B 83 EC 0C 8B 45 0C 83 C0 08 FF 30 8B 45 0C 83 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Hacktool_Prochide.yar b/yara/rules/Linux_Hacktool_Prochide.yar
new file mode 100644
index 00000000..8a18457a
--- /dev/null
+++ b/yara/rules/Linux_Hacktool_Prochide.yar
@@ -0,0 +1,19 @@
+rule Linux_Hacktool_Prochide_7333221a {
+    meta:
+        id = "7333221a-b3dc-4b26-8ec7-7e4f5405e228"
+        fingerprint = "e3aa99d48a8554dfaf9f7d947170e6e169b99bf5b6347d4832181e80cc2845cf"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Prochide"
+        reference_sample = "fad956a6a38abac8a8a0f14cc50f473ec6fc1c9fd204e235b89523183931090b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FF FF 83 BD 9C FC FF FF FF 75 14 BF 7F 22 40 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Hacktool_Tcpscan.yar b/yara/rules/Linux_Hacktool_Tcpscan.yar
new file mode 100644
index 00000000..2db59cd9
--- /dev/null
+++ b/yara/rules/Linux_Hacktool_Tcpscan.yar
@@ -0,0 +1,19 @@
+rule Linux_Hacktool_Tcpscan_334d0ca5 {
+    meta:
+        id = "334d0ca5-d143-4a32-8632-9fbdd2d96987"
+        fingerprint = "1f8fc064770bd76577b9455ae858d8a98b573e01a199adf2928d8433d990eaa7"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Hacktool.Tcpscan"
+        reference_sample = "62de04185c2e3c22af349479a68ad53c31b3874794e7c4f0f33e8d125c37f6b0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C4 10 89 45 D4 83 7D D4 00 79 1A 83 EC 0C 68 13 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Hacktool_Wipelog.yar b/yara/rules/Linux_Hacktool_Wipelog.yar
new file mode 100644
index 00000000..5bb600f8
--- /dev/null
+++ b/yara/rules/Linux_Hacktool_Wipelog.yar
@@ -0,0 +1,29 @@
+rule Linux_Hacktool_Wipelog_daea1aa4 {
+    meta:
+        id = "daea1aa4-0df7-4308-83e1-0707dcda2e54"
+        fingerprint = "93f899e14e6331c2149ba5c0c1e9dd8def5a7d1b6d2a7af66eade991dea77b3c"
+        creation_date = "2022-03-17"
+        last_modified = "2022-07-22"
+        threat_name = "Linux.Hacktool.Wipelog"
+        reference_sample = "39b3a95928326012c3b2f64e2663663adde4b028d940c7e804ac4d3953677ea6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $s1 = "Erase one username on tty"
+        $s2 = "wipe_utmp"
+        $s3 = "wipe_acct"
+        $s4 = "wipe_lastlog"
+        $s5 = "wipe_wtmp"
+        $s6 = "getpwnam"
+        $s7 = "ERROR: Can't find user in passwd"
+        $s8 = "ERROR: Opening tmp ACCT file"
+        $s9 = "/var/log/wtmp"
+        $s10 = "/var/log/lastlog"
+        $s11 = "Patching %s ...."
+    condition:
+        4 of them
+}
+
diff --git a/yara/rules/Linux_Packer_Patched_UPX.yar b/yara/rules/Linux_Packer_Patched_UPX.yar
new file mode 100644
index 00000000..8a3380db
--- /dev/null
+++ b/yara/rules/Linux_Packer_Patched_UPX.yar
@@ -0,0 +1,20 @@
+rule Linux_Packer_Patched_UPX_62e11c64 {
+    meta:
+        id = "62e11c64-fc7d-4a0a-9d72-ad53ec3987ff"
+        fingerprint = "3297b5c63e70c557e71b739428b453039b142e1e04c2ab15eea4627d023b686d"
+        creation_date = "2021-06-08"
+        last_modified = "2021-07-28"
+        threat_name = "Linux.Packer.Patched_UPX"
+        reference = "https://cujo.com/upx-anti-unpacking-techniques-in-iot-malware/"
+        reference_sample = "02f81a1e1edcb9032a1d7256a002b11e1e864b2e9989f5d24ea1c9b507895669"
+        severity = 60
+        arch_context = "x86"
+        scan_context = "file"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 50 58 21 [4] 00 00 00 00 00 00 00 00 00 00 00 00 }
+    condition:
+        all of them and $a in (0 .. 255)
+}
+
diff --git a/yara/rules/Linux_Proxy_Frp.yar b/yara/rules/Linux_Proxy_Frp.yar
new file mode 100644
index 00000000..c7623187
--- /dev/null
+++ b/yara/rules/Linux_Proxy_Frp.yar
@@ -0,0 +1,28 @@
+rule Linux_Proxy_Frp_4213778f {
+    meta:
+        id = "4213778f-d05e-4af8-9650-2d813d5a64e5"
+        fingerprint = "70bb186a9719767a9a60786fbe10bf4cc2f04c19ea58aaaa90018ec89a9f9b84"
+        creation_date = "2021-10-20"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Proxy.Frp"
+        reference_sample = "16294086be1cc853f75e864a405f31e2da621cb9d6a59f2a71a2fca4e268b6c2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $s1 = "github.com/fatedier/frp/client/proxy.TcpProxy"
+        $s2 = "frp/cmd/frpc/sub/xtcp.go"
+        $s3 = "frp/client/proxy/proxy_manager.go"
+        $s4 = "fatedier/frp/models/config/proxy.go"
+        $s5 = "github.com/fatedier/frp/server/proxy"
+        $s6 = "frp/cmd/frps/main.go"
+        $p1 = "json:\"remote_port\""
+        $p2 = "remote_port"
+        $p3 = "remote_addr"
+        $p4 = "range section [%s] local_port and remote_port is necessary[ERR]"
+    condition:
+        2 of ($s*) and 2 of ($p*)
+}
+
diff --git a/yara/rules/Linux_Ransomware_Gonnacry.yar b/yara/rules/Linux_Ransomware_Gonnacry.yar
new file mode 100644
index 00000000..7e9903e9
--- /dev/null
+++ b/yara/rules/Linux_Ransomware_Gonnacry.yar
@@ -0,0 +1,19 @@
+rule Linux_Ransomware_Gonnacry_53c3832d {
+    meta:
+        id = "53c3832d-ceff-407d-920b-7b6442688fa9"
+        fingerprint = "7d93c26c9e069af5cef964f5747104ba6d1d0d030a1f6b1c377355223c5359a1"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Ransomware.Gonnacry"
+        reference_sample = "f5de75a6db591fe6bb6b656aa1dcfc8f7fe0686869c34192bfa4ec092554a4ac"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 48 89 E5 48 83 EC 10 48 89 7D F8 EB 56 48 8B 45 F8 48 8B }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Ransomware_Hive.yar b/yara/rules/Linux_Ransomware_Hive.yar
new file mode 100644
index 00000000..0a4c414c
--- /dev/null
+++ b/yara/rules/Linux_Ransomware_Hive.yar
@@ -0,0 +1,19 @@
+rule Linux_Ransomware_Hive_bdc7de59 {
+    meta:
+        id = "bdc7de59-bf12-461f-99e0-ec2532ace4e9"
+        fingerprint = "415ef589a1c2da6b16ab30fb68f938a9ee7917f5509f73aa90aeec51c10dc1ff"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Ransomware.Hive"
+        reference_sample = "713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 40 03 4C 39 C1 73 3A 4C 89 84 24 F0 00 00 00 48 89 D3 48 89 CF 4C }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Ransomware_Sodinokibi.yar b/yara/rules/Linux_Ransomware_Sodinokibi.yar
new file mode 100644
index 00000000..d75ab492
--- /dev/null
+++ b/yara/rules/Linux_Ransomware_Sodinokibi.yar
@@ -0,0 +1,19 @@
+rule Linux_Ransomware_Sodinokibi_2883d7cd {
+    meta:
+        id = "2883d7cd-fd3b-47a5-9283-a40335172c62"
+        fingerprint = "d6570a8e9358cef95388a72b2e7f747ee5092620c4f92a4b4e6c1bb277e1cb36"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Ransomware.Sodinokibi"
+        reference_sample = "a322b230a3451fd11dcfe72af4da1df07183d6aaf1ab9e062f0e6b14cf6d23cd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 85 08 FF FF FF 48 01 85 28 FF FF FF 48 8B 85 08 FF FF FF 48 29 85 20 FF }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Rootkit_Adore.yar b/yara/rules/Linux_Rootkit_Adore.yar
new file mode 100644
index 00000000..2fa0ecb9
--- /dev/null
+++ b/yara/rules/Linux_Rootkit_Adore.yar
@@ -0,0 +1,19 @@
+rule Linux_Rootkit_Adore_fe3fd09f {
+    meta:
+        id = "fe3fd09f-d170-4bb0-bc8d-6d61bdc22164"
+        fingerprint = "2bab2a4391359c6a7148417b010887d0754b91ac99820258e849e81f7752069f"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Rootkit.Adore"
+        reference_sample = "f4e532b840e279daf3d206e9214a1b065f97deb7c1487a34ac5cbd7cbbf33e1a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 C0 89 45 F4 83 7D F4 00 75 17 68 E4 A1 04 08 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Rootkit_Arkd.yar b/yara/rules/Linux_Rootkit_Arkd.yar
new file mode 100644
index 00000000..812c1ef8
--- /dev/null
+++ b/yara/rules/Linux_Rootkit_Arkd.yar
@@ -0,0 +1,19 @@
+rule Linux_Rootkit_Arkd_bbd56917 {
+    meta:
+        id = "bbd56917-aeab-4e73-b85b-adc41fc7ffe4"
+        fingerprint = "73c8b2685b6b568575afca3c3c2fe2095d94f2040f4a1207974fe77bbb657163"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Rootkit.Arkd"
+        reference_sample = "e0765f0e90839b551778214c2f9ae567dd44838516a3df2c73396a488227a600"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 7D 0B B8 FF FF FF FF EB 11 8D 74 26 00 39 C1 7F 04 31 C0 EB 05 B8 01 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Rootkit_Dakkatoni.yar b/yara/rules/Linux_Rootkit_Dakkatoni.yar
new file mode 100644
index 00000000..e0ca525b
--- /dev/null
+++ b/yara/rules/Linux_Rootkit_Dakkatoni.yar
@@ -0,0 +1,19 @@
+rule Linux_Rootkit_Dakkatoni_010d3ac2 {
+    meta:
+        id = "010d3ac2-0bb2-4966-bf5f-fd040ba07311"
+        fingerprint = "2c7935079dc971d2b8a64c512ad677e946ff45f7f1d1b62c3ca011ebde82f13b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Rootkit.Dakkatoni"
+        reference_sample = "38b2d033eb5ce87faa4faa7fcac943d9373e432e0d45e741a0c01d714ee9d4d3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 C8 C1 E0 0D 31 C1 89 CE 83 E6 03 83 C6 05 89 C8 31 D2 C1 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Rootkit_Fontonlake.yar b/yara/rules/Linux_Rootkit_Fontonlake.yar
new file mode 100644
index 00000000..00ff1ceb
--- /dev/null
+++ b/yara/rules/Linux_Rootkit_Fontonlake.yar
@@ -0,0 +1,26 @@
+rule Linux_Rootkit_Fontonlake_8fa41f5e {
+    meta:
+        id = "8fa41f5e-d03d-4647-86fb-335e056c1c0d"
+        fingerprint = "187aae8e659061a06b44e0d353e35e22ada9076c78d8a7e4493e1e4cc600bc9d"
+        creation_date = "2021-10-12"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Rootkit.Fontonlake"
+        reference_sample = "826222d399e2fb17ae6bc6a4e1493003881b1406154c4b817f0216249d04a234"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a1 = "kernel_write" fullword
+        $a2 = "/proc/.dot3" fullword
+        $a3 = "hide_pid" fullword
+        $h2 = "s_hide_pids" fullword
+        $h3 = "s_hide_tcp4_ports" fullword
+        $h4 = "s_hide_strs" fullword
+        $tmp1 = "/tmp/.tmH" fullword
+        $tmp2 = "/tmp/.tmp_" fullword
+    condition:
+        (all of ($a*) and 1 of ($tmp*)) or (all of ($h*))
+}
+
diff --git a/yara/rules/Linux_Shellcode_Generic.yar b/yara/rules/Linux_Shellcode_Generic.yar
new file mode 100644
index 00000000..fd60e517
--- /dev/null
+++ b/yara/rules/Linux_Shellcode_Generic.yar
@@ -0,0 +1,152 @@
+rule Linux_Shellcode_Generic_5669055f {
+    meta:
+        id = "5669055f-8ce7-4163-af06-cb265fde3eef"
+        fingerprint = "616fe440ff330a1d22cacbdc2592c99328ea028700447724d2d5b930554a22f4"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Shellcode.Generic"
+        reference_sample = "87ef4def16d956cdfecaea899cbb55ff59a6739bbb438bf44a8b5fec7fcfd85b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 31 C0 31 DB 31 C9 B0 17 CD 80 31 C0 51 B1 06 }
+    condition:
+        all of them
+}
+
+rule Linux_Shellcode_Generic_d2c96b1d {
+    meta:
+        id = "d2c96b1d-f424-476c-9463-dd34a1da524e"
+        fingerprint = "ee042895d863310ff493fdd33721571edd322e764a735381d236b2c0a7077cfa"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Shellcode.Generic"
+        reference_sample = "403d53a65bd77856f7c565307af5003b07413f2aba50869655cdd88ce15b0c82"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 E1 8D 54 24 04 5B B0 0B CD 80 31 C0 B0 01 31 }
+    condition:
+        all of them
+}
+
+rule Linux_Shellcode_Generic_30c70926 {
+    meta:
+        id = "30c70926-9414-499a-a4db-7c3bb902dd82"
+        fingerprint = "4af586211c56e92b1c60fcd09b4def9801086fbe633418459dc07839fe9c735a"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Shellcode.Generic"
+        reference_sample = "a742e23f26726293b1bff3db72864471d6bb4062db1cc6e1c4241f51ec0e21b1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E3 52 53 89 E1 31 C0 B0 0B CD 80 31 C0 40 CD 80 }
+    condition:
+        all of them
+}
+
+rule Linux_Shellcode_Generic_224bdcc4 {
+    meta:
+        id = "224bdcc4-4b38-44b5-96c6-d3b378628fa4"
+        fingerprint = "e23b239775c321d4326eff2a7edf0787116dd6d8a9e279657e4b2b01b33e72aa"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Shellcode.Generic"
+        reference_sample = "bd22648babbee04555cef52bfe3e0285d33852e85d254b8ebc847e4e841b447e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 E6 6A 10 5A 6A 2A 58 0F 05 48 85 C0 79 1B 49 FF C9 74 22 }
+    condition:
+        all of them
+}
+
+rule Linux_Shellcode_Generic_99b991cd {
+    meta:
+        id = "99b991cd-a5ca-475c-8c10-e43b9d22d26e"
+        fingerprint = "ed904a3214ccf43482e3ddf75f3683fea45f7c43a2f1860bac427d7d15d8c399"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Shellcode.Generic"
+        reference_sample = "954b5a073ce99075b60beec72936975e48787bea936b4c5f13e254496a20d81d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6E 89 E3 50 53 89 E1 B0 0B CD 80 00 4C 65 6E 67 }
+    condition:
+        all of them
+}
+
+rule Linux_Shellcode_Generic_24b9aa12 {
+    meta:
+        id = "24b9aa12-92b2-492d-9a0e-078cdab5830a"
+        fingerprint = "0ded0ad2fdfff464bf9a0b5a59b8edfe1151a513203386daae6f9f166fd48e5c"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Shellcode.Generic"
+        reference_sample = "24b2c1ccbbbe135d40597fbd23f7951d93260d0039e0281919de60fa74eb5977"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6E 89 E3 89 C1 89 C2 B0 0B CD 80 31 C0 40 CD 80 }
+    condition:
+        all of them
+}
+
+rule Linux_Shellcode_Generic_8ac37612 {
+    meta:
+        id = "8ac37612-aec8-4376-8269-2594152ced8a"
+        fingerprint = "97a3d3e7ff4c9ae31f71e609d10b3b848cb0390ae2d1d738ef53fd23ff0621bc"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Shellcode.Generic"
+        reference_sample = "c199b902fa4b0fcf54dc6bf3e25ad16c12f862b47e055863a5e9e1f98c6bd6ca"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 E3 ?? 53 89 E1 B0 0B CD 80 00 47 43 43 3A }
+    condition:
+        all of them
+}
+
+rule Linux_Shellcode_Generic_932ed0f0 {
+    meta:
+        id = "932ed0f0-bd43-4367-bcc3-ecd8f65b52ee"
+        fingerprint = "7aa4619d2629b5d795e675d17a6e962c6d66a75e11fa884c0b195cb566090070"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Shellcode.Generic"
+        reference_sample = "f357597f718f86258e7a640250f2e9cf1c3363ab5af8ddbbabb10ebfa3c91251"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E3 50 89 E2 53 89 E1 B0 0B CD 80 31 C0 40 CD 80 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Adlibrary.yar b/yara/rules/Linux_Trojan_Adlibrary.yar
new file mode 100644
index 00000000..673f4288
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Adlibrary.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Adlibrary_0287a105 {
+    meta:
+        id = "0287a105-a1ba-4256-bfcf-aad40e6070ed"
+        fingerprint = "bb12e72441f87971febb50141e3f520c1858220b081c2b0587dd8f1fac29b4ed"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Adlibrary"
+        reference_sample = "acb22b88ecfb31664dc07b2cb3490b78d949cd35a67f3fdcd65b1a4335f728f1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 07 2A 00 00 F4 9F 01 00 07 2B 00 00 F8 9F 01 00 07 2C 00 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Asacub.yar b/yara/rules/Linux_Trojan_Asacub.yar
new file mode 100644
index 00000000..dfe69540
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Asacub.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Asacub_d3c4aa41 {
+    meta:
+        id = "d3c4aa41-faae-4c85-bdc5-9e09483e92fb"
+        fingerprint = "4961023c719599bd8da6b8a17dbe409911334c21b45d62385dd02a6dd35fd2be"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Asacub"
+        reference_sample = "15044273a506f825859e287689a57c6249b01bb0a848f113c946056163b7e5f1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 8B 0F 83 EC 08 50 57 FF 51 54 83 C4 10 8B 8B DC FF FF FF 89 4C }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Azeela.yar b/yara/rules/Linux_Trojan_Azeela.yar
new file mode 100644
index 00000000..7c0fbcd0
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Azeela.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Azeela_aad9d6cc {
+    meta:
+        id = "aad9d6cc-32ff-431a-9914-01c7adc80877"
+        fingerprint = "3b7c73a378157350344d52acd6c210d5924cf55081b386d0d60345e4c44c5921"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Azeela"
+        reference_sample = "6c476a7457ae07eca3d3d19eda6bb6b6b3fa61fa72722958b5a77caff899aaa6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C0 74 07 B8 01 00 00 00 EB 31 48 8B 45 F8 0F B6 00 3C FF 74 21 48 83 45 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_BPFDoor.yar b/yara/rules/Linux_Trojan_BPFDoor.yar
new file mode 100644
index 00000000..20c278e5
--- /dev/null
+++ b/yara/rules/Linux_Trojan_BPFDoor.yar
@@ -0,0 +1,141 @@
+rule Linux_Trojan_BPFDoor_59e029c3 {
+    meta:
+        id = "59e029c3-a57c-44ad-a554-432efc6b591a"
+        fingerprint = "cc9b75b1f1230e3e2ed289ef5b8fa2deec51197e270ec5d64ff73722c43bb4e8"
+        creation_date = "2022-05-10"
+        last_modified = "2022-05-10"
+        threat_name = "Linux.Trojan.BPFDoor"
+        reference_sample = "144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
+        $a2 = "/sbin/iptables -t nat -D PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-ports %d" ascii fullword
+        $a3 = "avahi-daemon: chroot helper" ascii fullword
+        $a4 = "/sbin/mingetty /dev/tty6" ascii fullword
+        $a5 = "ttcompat" ascii fullword
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_BPFDoor_0f768f60 {
+    meta:
+        id = "0f768f60-1d6c-4af9-8ae3-c1c8fbbd32f4"
+        fingerprint = "55097020a70d792e480542da40b91fd9ab0cc23f8736427f398998962e22348e"
+        creation_date = "2022-05-10"
+        last_modified = "2022-05-10"
+        threat_name = "Linux.Trojan.BPFDoor"
+        reference_sample = "3a1b174f0c19c28f71e1babde01982c56d38d3672ea14d47c35ae3062e49b155"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
+        $a2 = "/sbin/mingetty /dev/tty7" ascii fullword
+        $a3 = "pickup -l -t fifo -u" ascii fullword
+        $a4 = "kdmtmpflush" ascii fullword
+        $a5 = "avahi-daemon: chroot helper" ascii fullword
+        $a6 = "/sbin/auditd -n" ascii fullword
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_BPFDoor_8453771b {
+    meta:
+        id = "8453771b-a78f-439d-be36-60439051586a"
+        fingerprint = "b9d07bda8909e7afb1a1411a3bad1e6cffec4a81eb47d42f2292a2c4c0d97fa7"
+        creation_date = "2022-05-10"
+        last_modified = "2022-05-10"
+        threat_name = "Linux.Trojan.BPFDoor"
+        reference_sample = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a1 = "[-] Spawn shell failed." ascii fullword
+        $a2 = "[+] Packet Successfuly Sending %d Size." ascii fullword
+        $a3 = "[+] Monitor packet send." ascii fullword
+        $a4 = "[+] Using port %d"
+        $a5 = "decrypt_ctx" ascii fullword
+        $a6 = "getshell" ascii fullword
+        $a7 = "getpassw" ascii fullword
+        $a8 = "export %s=%s" ascii fullword
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_BPFDoor_f690fe3b {
+    meta:
+        id = "f690fe3b-1b3f-4101-931b-10932596f546"
+        fingerprint = "504bfe57dcc3689881bdd0af55aab9a28dcd98e44b5a9255d2c60d9bc021130b"
+        creation_date = "2022-05-10"
+        last_modified = "2022-05-10"
+        threat_name = "Linux.Trojan.BPFDoor"
+        reference_sample = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a1 = { 45 D8 0F B6 10 0F B6 45 FF 48 03 45 F0 0F B6 00 8D 04 02 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_BPFDoor_1a7d804b {
+    meta:
+        id = "1a7d804b-9d39-4855-abe9-47b72bd28f07"
+        fingerprint = "e7f92df3e3929b8296320300bb341ccc69e00d89e0d503a41190d7c84a29bce2"
+        creation_date = "2022-05-10"
+        last_modified = "2022-05-10"
+        threat_name = "Linux.Trojan.BPFDoor"
+        reference_sample = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a1 = "getshell" ascii fullword
+        $a2 = "/sbin/agetty --noclear tty1 linux" ascii fullword
+        $a3 = "packet_loop" ascii fullword
+        $a4 = "godpid" ascii fullword
+        $a5 = "ttcompat" ascii fullword
+        $a6 = "decrypt_ctx" ascii fullword
+        $a7 = "rc4_init" ascii fullword
+        $b1 = { D0 48 89 45 F8 48 8B 45 F8 0F B6 40 0C C0 E8 04 0F B6 C0 C1 }
+    condition:
+        all of ($a*) or 1 of ($b*)
+}
+
+rule Linux_Trojan_BPFDoor_e14b0b79 {
+    meta:
+        id = "e14b0b79-a6f3-4fb3-a314-0ec20dcd242c"
+        fingerprint = "1c4cb6c8a255840c5a2cb7674283678686e228dc2f2a9304fa118bb5bdc73968"
+        creation_date = "2022-05-10"
+        last_modified = "2022-05-10"
+        threat_name = "Linux.Trojan.BPFDoor"
+        reference_sample = "dc8346bf443b7b453f062740d8ae8d8d7ce879672810f4296158f90359dcae3a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a1 = "getpassw" ascii fullword
+        $a2 = "(udp[8:2]=0x7255) or (icmp[8:2]=0x7255) or (tcp[((tcp[12]&0xf0)>>2):2]=0x5293)" ascii fullword
+        $a3 = "/var/run/haldrund.pid" ascii fullword
+        $a4 = "Couldn't install filter %s: %s" ascii fullword
+        $a5 = "godpid" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Backconnect.yar b/yara/rules/Linux_Trojan_Backconnect.yar
new file mode 100644
index 00000000..15824b11
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Backconnect.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Backconnect_c6803b39 {
+    meta:
+        id = "c6803b39-e2e0-4ab8-9ead-e53eab26bb53"
+        fingerprint = "1dfb097c90b0cf008dc9d3ae624e08504755222f68ee23ed98d0fa8803cff91a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Backconnect"
+        reference_sample = "a5e6b084cdabe9a4557b5ff8b2313db6c3bb4ba424d107474024030115eeaa0f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 78 3A 48 98 48 01 C3 49 01 C5 48 83 FB 33 76 DC 31 C9 BA 10 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Backegmm.yar b/yara/rules/Linux_Trojan_Backegmm.yar
new file mode 100644
index 00000000..34d20502
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Backegmm.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Backegmm_b59712e6 {
+    meta:
+        id = "b59712e6-d14d-4a57-a3d6-2dc323bf840d"
+        fingerprint = "61b2f0c7cb98439b05776edeaf06b114d364119ebe733d924158792110c5e21c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Backegmm"
+        reference_sample = "d6c8e15cb65102b442b7ee42186c58fa69cd0cb68f4fd47eb5ad23763371e0be"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 69 73 74 65 6E 00 66 6F 72 6B 00 73 70 72 69 6E 74 66 00 68 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Badbee.yar b/yara/rules/Linux_Trojan_Badbee.yar
new file mode 100644
index 00000000..6c055429
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Badbee.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Badbee_231cb054 {
+    meta:
+        id = "231cb054-36a9-434f-8254-17fee38e5275"
+        fingerprint = "ebe789fc467daf9276f72210f94e87b7fa79fc92a72740de49e47b71f123ed5c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Badbee"
+        reference_sample = "832ba859c3030e58b94398ff663ddfe27078946a83dcfc81a5ef88351d41f4e2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8D B4 41 31 44 97 10 83 F9 10 75 E4 89 DE C1 FE 14 F7 C6 01 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Banload.yar b/yara/rules/Linux_Trojan_Banload.yar
new file mode 100644
index 00000000..4dd7b980
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Banload.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Banload_d5e1c189 {
+    meta:
+        id = "d5e1c189-7d19-4f03-a4f3-a0aaf6d499dc"
+        fingerprint = "4aa04f08005b1b7ed941dbfc563737728099e35e3f0f025532921b91b79c967c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Banload"
+        reference_sample = "48bf0403f777db5da9c6a7eada17ad4ddf471bd73ea6cf02817dd202b49204f4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E4 E4 E4 58 88 60 90 E4 E4 E4 E4 68 98 70 A0 E4 E4 E4 E4 78 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Bedevil.yar b/yara/rules/Linux_Trojan_Bedevil.yar
new file mode 100644
index 00000000..df8c11ca
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Bedevil.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Bedevil_a1a72c39 {
+    meta:
+        id = "a1a72c39-c8a3-4372-bd1d-de6360c9c19e"
+        fingerprint = "ea4762d6ba0b88017feda1ed68d70bedd1438bb853b8ee1f83cbca2276bfbd1e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Bedevil"
+        reference_sample = "017a9d7290cf327444d23227518ab612111ca148da7225e64a9f6ebd253449ab"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 73 3A 20 1B 5B 31 3B 33 31 6D 25 64 1B 5B 30 6D 0A 00 1B 5B }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Bish.yar b/yara/rules/Linux_Trojan_Bish.yar
new file mode 100644
index 00000000..1a61cdb6
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Bish.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Bish_974b4b47 {
+    meta:
+        id = "974b4b47-38cf-4460-8ff3-e066e5c8a5fc"
+        fingerprint = "8858f99934e367b7489d60bfaa74ab57e2ae507a8c06fb29693197792f6f5069"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Bish"
+        reference_sample = "9171fd2bbe182f0a3cd35937f3ee0076c9358f52f5bc047498dd9e233ae11757"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 31 C0 31 DB 31 C9 B0 17 CD 80 31 C0 50 68 6E }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Bluez.yar b/yara/rules/Linux_Trojan_Bluez.yar
new file mode 100644
index 00000000..1d799ffc
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Bluez.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Bluez_50e87fa9 {
+    meta:
+        id = "50e87fa9-f053-4507-ae10-b5d33b693bb3"
+        fingerprint = "67855d65973d0bbdad90299f1432e7f0b4b8b1e6dfd0737ee5bee89161f2a890"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Bluez"
+        reference = "1e526b6e3be273489afa8f0a3d50be233b97dc07f85815cc2231a87f5a651ef1"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 63 68 72 00 6B 69 6C 6C 00 73 74 72 6C 65 6E 00 62 69 6E 64 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Cerbu.yar b/yara/rules/Linux_Trojan_Cerbu.yar
new file mode 100644
index 00000000..e2099fb3
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Cerbu.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Cerbu_69d5657e {
+    meta:
+        id = "69d5657e-1fe9-4367-b478-218c278c7fbc"
+        fingerprint = "7dfaebc6934c8fa97509831e0011f2befd0dbc24a68e4a07bc1ee0decae45a42"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Cerbu"
+        reference_sample = "f10bf3cf2fdfbd365d3c2d8dedb2d01b85236eaa97d15370dbcb5166149d70e9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 5B 5E C9 C3 55 89 E5 83 EC 08 83 C4 FC FF 75 0C 6A 05 FF }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Chinaz.yar b/yara/rules/Linux_Trojan_Chinaz.yar
new file mode 100644
index 00000000..89f5f985
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Chinaz.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Chinaz_a2140ca1 {
+    meta:
+        id = "a2140ca1-0a72-4dcb-bf7c-2f51e84a996b"
+        fingerprint = "ac620f3617ea448b2ad62f06490c37200fa0af8a6fe75a6a2a294a7b5b4a634a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Chinaz"
+        reference_sample = "7c44c2ca77ef7a62446f6266a757817a6c9af5e010a219a43a1905e2bc5725b0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C0 53 8B 74 24 0C 8B 5C 24 10 8D 74 26 00 89 C2 89 C1 C1 FA 03 83 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Connectback.yar b/yara/rules/Linux_Trojan_Connectback.yar
new file mode 100644
index 00000000..6c3f5969
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Connectback.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Connectback_bf194c93 {
+    meta:
+        id = "bf194c93-92d8-4eba-99c4-326a5ea76d0d"
+        fingerprint = "6e72b14be0a0a6e42813fa82ee77d057246ccba4774897b38acf2dc30c894023"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Connectback"
+        reference_sample = "6784cb86460bddf1226f71f5f5361463cbda487f813d19cd88e8a4a1eb1a417b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { B6 0C B0 03 CD 80 85 C0 78 02 FF E1 B8 01 00 00 00 BB 01 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Ddostf.yar b/yara/rules/Linux_Trojan_Ddostf.yar
new file mode 100644
index 00000000..bb9cde59
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Ddostf.yar
@@ -0,0 +1,94 @@
+rule Linux_Trojan_Ddostf_e4874cd4 {
+    meta:
+        id = "e4874cd4-50e3-4a4c-b14c-976e29aaaaae"
+        fingerprint = "dfbf7476794611718a1cd2c837560423e3a6c8b454a5d9eecb9c6f9d31d01889"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ddostf"
+        reference_sample = "1015b9aef1f749dfc31eb33528c4a4169035b6d73542e068b617965d3e948ef2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E4 01 8B 45 F0 2B 45 F4 89 C2 8B 45 E4 39 C2 73 82 8B 45 EC }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ddostf_32c35334 {
+    meta:
+        id = "32c35334-f264-4509-b5c4-b07e477bd07d"
+        fingerprint = "f71d1e9188f67147de8808d65374b4e34915e9d60ff475f7fc519c8918c75724"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ddostf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0E 18 41 0E 1C 41 0E 20 48 0E 10 00 4C 00 00 00 64 4B 00 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ddostf_6dc1caab {
+    meta:
+        id = "6dc1caab-be84-4f27-a059-2acffc20ca2c"
+        fingerprint = "43bcb29d92e0ed2dfd0ff182991864f8efabd16a0f87e8c3bb453b47bd8e272b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ddostf"
+        reference_sample = "f4587bd45e57d4106ebe502d2eaa1d97fd68613095234038d67490e74c62ba70"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FC 01 83 45 F8 01 83 7D F8 5A 7E E6 C7 45 F8 61 00 00 00 EB 14 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ddostf_dc47a873 {
+    meta:
+        id = "dc47a873-65a0-430d-a598-95be7134f207"
+        fingerprint = "f103490a9dedc0197f50ca2b412cf18d2749c8d6025fd557f1686bc38f32db52"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ddostf"
+        reference_sample = "1015b9aef1f749dfc31eb33528c4a4169035b6d73542e068b617965d3e948ef2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 05 88 10 8B 45 08 0F B6 10 83 E2 0F 83 CA 40 88 10 8B 45 08 C6 40 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ddostf_cb0358a0 {
+    meta:
+        id = "cb0358a0-5303-4860-89ac-7dae037f5f0b"
+        fingerprint = "f97c96d457532f2af5fb0e1b40ad13dcfba2479c651266b4bdd1ab2a01c0360f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ddostf"
+        reference_sample = "1015b9aef1f749dfc31eb33528c4a4169035b6d73542e068b617965d3e948ef2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 66 C7 45 F2 00 00 8D 45 F2 8B 55 E4 0F B6 12 88 10 0F B7 45 F2 0F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Dnsamp.yar b/yara/rules/Linux_Trojan_Dnsamp.yar
new file mode 100644
index 00000000..51ba54de
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Dnsamp.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Dnsamp_c31eebd4 {
+    meta:
+        id = "c31eebd4-7709-440d-95d1-f9a3071cc5ca"
+        fingerprint = "220b656a51b3041ede4ffe8f509657c393ff100c88b401c802079aae5804dacd"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Dnsamp"
+        reference_sample = "4b86de97819a49a90961d59f9c3ab9f8e57e19add9fe1237d2a2948b4ff22de6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 F8 8B 40 14 48 63 D0 48 8D 45 E0 48 8D 70 04 48 8B 45 F8 48 8B }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Dofloo.yar b/yara/rules/Linux_Trojan_Dofloo.yar
new file mode 100644
index 00000000..87b02898
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Dofloo.yar
@@ -0,0 +1,76 @@
+rule Linux_Trojan_Dofloo_be1973ed {
+    meta:
+        id = "be1973ed-a0ee-41ca-a752-fb5f990e2096"
+        fingerprint = "f032f072fd5da9ec4d8d3953bea0f2a236219b99ecfa67e3fac44f2e73f33e9c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Dofloo"
+        reference_sample = "88d826bac06c29e1b9024baaf90783e15d87d2a5c8c97426cbd5a70ae0f99461"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { A8 8B 45 A8 89 45 A4 83 7D A4 00 79 04 83 45 A4 03 8B 45 A4 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Dofloo_1d057993 {
+    meta:
+        id = "1d057993-0a46-4014-8ab6-aa9e9d93dfa1"
+        fingerprint = "c4bb948b85777b1f5df89fafba0674bc245bbda1962c576abaf0752f49c747d0"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Dofloo"
+        reference_sample = "88d826bac06c29e1b9024baaf90783e15d87d2a5c8c97426cbd5a70ae0f99461"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 88 45 DB 83 EC 04 8B 45 F8 83 C0 03 89 45 D4 8B 45 D4 89 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Dofloo_29c12775 {
+    meta:
+        id = "29c12775-b7e5-417d-9789-90b9bd4529dd"
+        fingerprint = "fbf49f0904e22c4d788f151096f9b1d80aa8c739b31705e6046d17029a6a7a4f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Dofloo"
+        reference_sample = "88d826bac06c29e1b9024baaf90783e15d87d2a5c8c97426cbd5a70ae0f99461"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 2F 7E 49 00 64 80 49 00 34 7F 49 00 04 7F 49 00 24 80 49 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Dofloo_ac3333d1 {
+    meta:
+        id = "ac3333d1-df88-459b-a411-00b4fc947f3f"
+        fingerprint = "a8f360e2a545e65b5f9f2273715c1a5008a0fe4f88f6e14becd6e69158aab409"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Dofloo"
+        reference = "04664dc5ea14ddff5301e66c46d6795f1582c148b5cb621248424d015245c95e"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 76 77 78 95 5C C9 95 79 7A C9 95 5C C9 41 42 43 5C C9 95 5C 44 45 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Dropperl.yar b/yara/rules/Linux_Trojan_Dropperl.yar
new file mode 100644
index 00000000..ead28d3e
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Dropperl.yar
@@ -0,0 +1,133 @@
+rule Linux_Trojan_Dropperl_b97baf37 {
+    meta:
+        id = "b97baf37-48db-4eb7-85c7-08e75054bea7"
+        fingerprint = "0852f1afa6162d14b076a3fc1f56e4d365b5d0e8932bae6ab055000cca7d1fba"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Dropperl"
+        reference_sample = "aff94f915fc81d5a2649ebd7c21ec8a4c2fc0d622ec9b790b43cc49f7feb83da"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 12 48 89 10 83 45 DC 01 83 45 D8 01 8B 45 D8 3B 45 BC 7C CF 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Dropperl_e2443be5 {
+    meta:
+        id = "e2443be5-da15-4af2-b090-bf5accf2a844"
+        fingerprint = "e49acaa476bd669b40ccc82a7d3a01e9c421e6709ecbfe8d0e24219677c96339"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Dropperl"
+        reference_sample = "aff94f915fc81d5a2649ebd7c21ec8a4c2fc0d622ec9b790b43cc49f7feb83da"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 F0 75 DB EB 17 48 8B 45 F8 48 83 C0 08 48 8B 10 48 8B 45 F8 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Dropperl_683c2ba1 {
+    meta:
+        id = "683c2ba1-fe4a-44e4-b176-8d5d5788e1a4"
+        fingerprint = "42dcea472417140d0f7768e8189ac3a8a46aaeff039be1efd36f8d50f81e347c"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Dropperl"
+        reference_sample = "a02e166fbf002dd4217c012f24bb3a8dbe310a9f0b0635eb20a7d315049367e1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 95 FB FF FF 83 7D D4 00 79 0A B8 ?? ?? 60 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Dropperl_8bca73f6 {
+    meta:
+        id = "8bca73f6-c3ec-45a3-a5ae-67c871aaf9df"
+        fingerprint = "36df2fd9746da80697ef675f84f47efb3cb90e9757677e4f565a7576966eb169"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Dropperl"
+        reference_sample = "e7c17b7916b38494b9a07c249acb99499808959ba67125c29afec194ca4ae36c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 95 FB FF FF 83 7D D4 00 79 0A B8 ?? ?? 62 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Dropperl_c4018572 {
+    meta:
+        id = "c4018572-a8af-4204-bc19-284a2a27dfdd"
+        fingerprint = "f2ede50ea639af593211c9ef03ee2847a32cf3eb155db4e2ca302f3508bf2a45"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Dropperl"
+        reference_sample = "c1515b3a7a91650948af7577b613ee019166f116729b7ff6309b218047141f6d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 97 FB FF FF 83 7D D4 00 79 0A B8 ?? ?? 60 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Dropperl_733c0330 {
+    meta:
+        id = "733c0330-3163-48f3-a780-49be80a3387f"
+        fingerprint = "ee233c875dd3879b4973953a1f2074cd77abf86382019eeb72da069e1fd03e1c"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Dropperl"
+        reference_sample = "b303f241a2687dba8d7b4987b7a46b5569bd2272e2da3e0c5e597b342d4561b6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 A0 FB FF FF 83 7D DC 00 79 0A B8 ?? ?? 60 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Dropperl_39f4cd0d {
+    meta:
+        id = "39f4cd0d-4261-4d62-a527-f403edadbd0c"
+        fingerprint = "e1cdd678a1f46a3c6d26d53dd96ba6c6a45f97e743765c534f644af7c6450f8e"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Dropperl"
+        reference_sample = "c08e1347877dc77ad73c1e017f928c69c8c78a0e3c16ac5455668d2ad22500f3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 ?? FA FF FF 83 7D D4 00 79 0A B8 ?? ?? 60 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Ebury.yar b/yara/rules/Linux_Trojan_Ebury.yar
new file mode 100644
index 00000000..e6153a1d
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Ebury.yar
@@ -0,0 +1,18 @@
+rule Linux_Trojan_Ebury_7b13e9b6 {
+    meta:
+        id = "7b13e9b6-ce96-4bd3-8196-83420280bd1f"
+        fingerprint = "a891724ce36e86637540f722bc13b44984771f709219976168f12fe782f08306"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ebury"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8B 44 24 10 4C 8B 54 24 18 4C 8B 5C 24 20 8B 5C 24 28 74 04 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Gafgyt.yar b/yara/rules/Linux_Trojan_Gafgyt.yar
new file mode 100644
index 00000000..ddf4745b
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Gafgyt.yar
@@ -0,0 +1,1297 @@
+rule Linux_Trojan_Gafgyt_83715433 {
+    meta:
+        id = "83715433-3dff-4238-8cdb-c51279565e05"
+        fingerprint = "25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8B 45 08 88 10 FF 45 08 8B 45 08 0F B6 00 84 C0 75 DB C9 C3 55 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_28a2fe0c {
+    meta:
+        id = "28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd"
+        fingerprint = "a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_eb96cc26 {
+    meta:
+        id = "eb96cc26-e6d6-4388-a5da-2501e6e2ea32"
+        fingerprint = "73967a3499d5dce61735aa2d352c1db48bb1d965b2934bb924209d729b5eb162"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "440318179ba2419cfa34ea199b49ee6bdecd076883d26329bbca6dca9d39c500"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 49 6E 66 6F 3A 20 0A 00 5E 6A 02 5F 6A 01 58 0F 05 6A 7F 5F }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_5008aee6 {
+    meta:
+        id = "5008aee6-3866-4f0a-89bf-bde740baee5c"
+        fingerprint = "6876a6c1333993c4349e459d4d13c11be1b0f78311274c0f778e65d0fabeeaa7"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "b32cd71fcfda0a2fcddad49d8c5ba8d4d68867b2ff2cb3b49d1a0e358346620c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 50 16 B4 87 58 83 00 21 84 51 FD 13 4E 79 28 57 C3 8B 30 55 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_6321b565 {
+    meta:
+        id = "6321b565-ed25-4bf2-be4f-3ffa0e643085"
+        fingerprint = "c1d286e82426cbf19fc52836ef9a6b88c1f6e144967f43760df93cf1ab497d07"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "cd48addd392e7912ab15a5464c710055f696990fab564f29f13121e7a5e93730"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D8 89 D0 01 C0 01 D0 C1 E0 03 8B 04 08 83 E0 1F 0F AB 84 9D 58 FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_a6a2adb9 {
+    meta:
+        id = "a6a2adb9-9d54-42d4-abed-5b30d8062e97"
+        fingerprint = "cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_c573932b {
+    meta:
+        id = "c573932b-9b3f-4ab7-a6b6-32dcc7473790"
+        fingerprint = "18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_a10161ce {
+    meta:
+        id = "a10161ce-62e0-4f60-9de7-bd8caf8618be"
+        fingerprint = "77e89011a67a539954358118d41ad3dabde0e69bac2bbb2b2da18eaad427d935"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 B0 8B 45 BC 48 63 D0 48 89 D0 48 C1 E0 02 48 8D 14 10 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_ae01d978 {
+    meta:
+        id = "ae01d978-d07d-4813-a22b-5d172c477d08"
+        fingerprint = "2d937c6009cfd53e11af52482a7418546ae87b047deabcebf3759e257cd89ce1"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 2C 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_9e9530a7 {
+    meta:
+        id = "9e9530a7-ad4d-4a44-b764-437b7621052f"
+        fingerprint = "d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_5bf62ce4 {
+    meta:
+        id = "5bf62ce4-619b-4d46-b221-c5bf552474bb"
+        fingerprint = "3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_f3d83a74 {
+    meta:
+        id = "f3d83a74-2888-435a-9a3c-b7de25084e9a"
+        fingerprint = "1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_807911a2 {
+    meta:
+        id = "807911a2-f6ec-4e65-924f-61cb065dafc6"
+        fingerprint = "f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_9c18716c {
+    meta:
+        id = "9c18716c-e5cd-4b4f-98e2-0daed77f34cd"
+        fingerprint = "351772d2936ec1a14ee7e2f2b79a8fde62d02097ae6a5304c67e00ad1b11085a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FC 80 F6 FE 59 21 EC 75 10 26 CF DC 7B 5A 5B 4D 24 C9 C0 F3 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_fbed4652 {
+    meta:
+        id = "fbed4652-2c68-45c6-8116-e3fe7d0a28b8"
+        fingerprint = "a08bcc7d0999562b4ef2d8e0bdcfa111fe0f76fc0d3b14d42c8e93b7b90abdca"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "2ea21358205612f5dc0d5f417c498b236c070509531621650b8c215c98c49467"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 02 00 00 2B 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_94a44aa5 {
+    meta:
+        id = "94a44aa5-6c8b-40b9-8aac-d18cf4a76a19"
+        fingerprint = "daf7e0382dd4a566eb5a4aac8c5d9defd208f332d8e327637d47b50b9ef271f9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "a7694202f9c32a9d73a571a30a9e4a431d5dfd7032a500084756ba9a48055dba"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 00 83 F8 FF 0F 45 C2 48 8B 4C 24 08 64 48 33 0C 25 28 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_e0673a90 {
+    meta:
+        id = "e0673a90-165e-4347-a965-e8d14fdf684b"
+        fingerprint = "6834f65d54bbfb926f986fe2dd72cd30bf9804ed65fcc71c2c848e72350f386a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 E8 0F B6 00 84 C0 74 17 48 8B 75 E8 48 FF C6 48 8B 7D F0 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_821173df {
+    meta:
+        id = "821173df-6835-41e1-a662-a432abf23431"
+        fingerprint = "c311789e1370227f7be1d87da0c370a905b7f5b4c55cdee0f0474060cc0fc5e4"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "de7d1aff222c7d474e1a42b2368885ef16317e8da1ca3a63009bf06376026163"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D0 48 FF C8 48 03 45 F8 48 FF C8 C6 00 00 48 8B 45 F8 48 C7 C1 FF FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_31796a40 {
+    meta:
+        id = "31796a40-1cbe-4d0c-a785-d16f40765f4a"
+        fingerprint = "0a6c56eeed58a1a100c9b981157bb864904ffddb3a0c4cb61ec4cc0d770d68ae"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "227c7f13f7bdadf6a14cc85e8d2106b9d69ab80abe6fc0056af5edef3621d4fb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 14 48 63 D0 48 8D 45 C0 48 8D 70 04 48 8B 45 E8 48 8B 40 18 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_750fe002 {
+    meta:
+        id = "750fe002-cac1-4832-94d2-212aa5ec17e3"
+        fingerprint = "f51347158a6477b0da4ed4df3374fbad92b6ac137aa4775f83035d1e30cba7dc"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 8B 45 0C 40 8A 00 3C FC 75 06 C6 45 FF FE EB 50 8B 45 0C 40 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_6122acdf {
+    meta:
+        id = "6122acdf-1eef-45ea-83ea-699d21c2dc20"
+        fingerprint = "283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_a0a4de11 {
+    meta:
+        id = "a0a4de11-fe65-449f-a990-ad5f18ac66f0"
+        fingerprint = "891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_a473dcb6 {
+    meta:
+        id = "a473dcb6-887e-4a9a-a1f2-df094f1575b9"
+        fingerprint = "6119a43aa5c9f61249083290293f15696b54b012cdf92553fd49736d40c433f9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "7ba74e3cb0d633de0e8dbe6cfc49d4fc77dd0c02a5f1867cc4a1f1d575def97d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 49 56 04 0B 1E 46 1E B0 EB 10 18 38 38 D7 80 4D 2D 03 29 62 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_30444846 {
+    meta:
+        id = "30444846-439f-41e1-b0b4-c12da774a228"
+        fingerprint = "3c74db508de7c8c1c190d5569e0a2c2b806f72045e7b74d44bfbaed20ecb956b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "c84b81d79d437bb9b8a6bad3646aef646f2a8e1f1554501139648d2f9de561da"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 64 20 2B 78 20 74 66 74 70 31 2E 73 68 3B 20 73 68 20 74 66 74 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_ea92cca8 {
+    meta:
+        id = "ea92cca8-bba7-4a1c-9b88-a2d051ad0021"
+        fingerprint = "aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_d4227dbf {
+    meta:
+        id = "d4227dbf-6ab4-4637-a6ba-0e604acaafb4"
+        fingerprint = "58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_09c3070e {
+    meta:
+        id = "09c3070e-4b71-45a0-aa62-0cc6e496644a"
+        fingerprint = "84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_fa19b8fc {
+    meta:
+        id = "fa19b8fc-6035-4415-842f-4993411ab43e"
+        fingerprint = "4f213d5d1b4a0b832ed7a6fac91bef7c29117259b775b85409e9e4c8aec2ad10"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "a7cfc16ec33ec633cbdcbff3c4cefeed84d7cbe9ca1f4e2a3b3e43d39291cd6b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 02 63 10 01 0F 4B 85 14 36 B0 60 53 03 4F 0D B2 05 76 02 B7 00 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_eaa9a668 {
+    meta:
+        id = "eaa9a668-e3b9-4657-81bf-1c6456e2053a"
+        fingerprint = "bee2744457164e5747575a101026c7862474154d82f52151ac0d77fb278d9405"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "409c55110d392aed1a9ec98a6598fb8da86ab415534c8754aa48e3949e7c4b62"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 C0 0F B6 00 3C 2F 76 0B 48 8B 45 C0 0F B6 00 3C 39 76 C7 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_46eec778 {
+    meta:
+        id = "46eec778-7342-4ef7-adac-35bc0cdb9867"
+        fingerprint = "2602371a40171870b1cf024f262e95a2853de53de39c3a6cd3de811e81dd3518"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_f51c5ac3 {
+    meta:
+        id = "f51c5ac3-ade9-4d01-b578-3473a2b116db"
+        fingerprint = "34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_71e487ea {
+    meta:
+        id = "71e487ea-a592-469c-a03e-0c64d2549e74"
+        fingerprint = "8df69968ddfec5821500949015192b6cdbc188c74f785a272effd7bc9707f661"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "b8d044f2de21d20c7e4b43a2baf5d8cdb97fba95c3b99816848c0f214515295b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E0 8B 45 D8 8B 04 D0 8D 50 01 83 EC 0C 8D 85 40 FF FF FF 50 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_6620ec67 {
+    meta:
+        id = "6620ec67-8f12-435b-963c-b44a02f43ef1"
+        fingerprint = "9d68db5b3779bb5abe078f9e36dd9a09d4d3ad9274a3a50bdfa0e444a7e46623"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "b91eb196605c155c98f824abf8afe122f113d1fed254074117652f93d0c9d6b2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { AF 93 64 1A D8 0B 48 93 64 0B 48 A3 64 11 D1 0B 41 05 E4 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_d996d335 {
+    meta:
+        id = "d996d335-e049-4052-bf36-6cd07c911a8b"
+        fingerprint = "e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_d0c57a2e {
+    meta:
+        id = "d0c57a2e-c10c-436c-be13-50a269326cf2"
+        fingerprint = "3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_751acb94 {
+    meta:
+        id = "751acb94-cb23-4949-a4dd-87985c47379e"
+        fingerprint = "dbdfdb455868332e9fbadd36c084d0927a3dd8ab844f0b1866e914914084cd4b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 20 54 6F 20 43 6F 6E 6E 65 63 74 21 20 00 53 75 63 63 65 73 66 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_656bf077 {
+    meta:
+        id = "656bf077-ca0c-4d28-9daa-eb6baafaf467"
+        fingerprint = "3ea8ed60190198d5887bb7093975d648a9fd78234827d648a8258008c965b1c1"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 74 28 48 8B 45 E8 0F B6 00 84 C0 74 14 48 8B 75 E8 48 FF C6 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_e6d75e6f {
+    meta:
+        id = "e6d75e6f-aa04-4767-8730-6909958044a7"
+        fingerprint = "e99805e8917d6526031270b6da5c2f3cc1c8235fed1d47134835a107d0df497c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "48b15093f33c18778724c48c34199a420be4beb0d794e36034097806e1521eb8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 00 CD 80 C3 8B 54 24 04 8B 4C 24 08 87 D3 B8 5B 00 00 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_7167d08f {
+    meta:
+        id = "7167d08f-bfeb-4d78-9783-3a1df2ef0ed3"
+        fingerprint = "b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_27de1106 {
+    meta:
+        id = "27de1106-497d-40a0-8fc4-929f7a927628"
+        fingerprint = "9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0C 0F B6 00 84 C0 74 18 8B 45 0C 40 8B 55 08 42 89 44 24 04 89 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_148b91a2 {
+    meta:
+        id = "148b91a2-ed51-4c2d-9d15-6a48d9ea3e0a"
+        fingerprint = "0f75090ed840f4601df4e43a2f49f2b32585213f3d86d19fb255d79c21086ba3"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C6 45 DB FC EB 04 C6 45 DB FE 0F B6 45 DB 88 45 FF 48 8D 75 FF 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_20f5e74f {
+    meta:
+        id = "20f5e74f-9f94-431b-877c-9b0d78a1d4eb"
+        fingerprint = "070fe0d678612b4ec8447a07ead0990a0abd908ce714388720e7fd7055bf1175"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "9084b00f9bb71524987dc000fb2bc6f38e722e2be2832589ca4bb1671e852f5b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D8 8B 45 D0 8B 04 D0 8D 50 01 83 EC 0C 8D 85 38 FF FF FF 50 8D 85 40 FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_1b2e2a3a {
+    meta:
+        id = "1b2e2a3a-1302-41c7-be99-43edb5563294"
+        fingerprint = "6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_620087b9 {
+    meta:
+        id = "620087b9-c87d-4752-89e8-ca1c16486b28"
+        fingerprint = "06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_dd0d6173 {
+    meta:
+        id = "dd0d6173-b863-45cf-9348-3375a4e624cf"
+        fingerprint = "5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_779e142f {
+    meta:
+        id = "779e142f-b867-46e6-b1fb-9105976f42fd"
+        fingerprint = "83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_cf84c9f2 {
+    meta:
+        id = "cf84c9f2-7435-4faf-8c5f-d14945ffad7a"
+        fingerprint = "bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_0cd591cd {
+    meta:
+        id = "0cd591cd-c348-4c3a-a895-2063cf892cda"
+        fingerprint = "96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_859042a0 {
+    meta:
+        id = "859042a0-a424-4c83-944b-ed182b342998"
+        fingerprint = "a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_33b4111a {
+    meta:
+        id = "33b4111a-e59e-48db-9d74-34ca44fcd9f5"
+        fingerprint = "9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_4f43b164 {
+    meta:
+        id = "4f43b164-686d-4b73-b532-45e2df992b33"
+        fingerprint = "35a885850a06e7991c3a8612bbcdfc279b87e4ca549723192d3011a1e0a81640"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "f0fdb3de75f85e199766bbb39722865cac578cde754afa2d2f065ef028eec788"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 46 00 4B 49 4C 4C 53 55 42 00 4B 49 4C 4C 53 55 42 20 3C 73 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_e4a1982b {
+    meta:
+        id = "e4a1982b-928a-4da5-b497-cedc1d26e845"
+        fingerprint = "d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_862c4e0e {
+    meta:
+        id = "862c4e0e-83a4-458b-8c00-f2f3cf0bf9db"
+        fingerprint = "2a6b4f8d8fb4703ed26bdcfbbb5c539dc451c8b90649bee80015c164eae4c281"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_9127f7be {
+    meta:
+        id = "9127f7be-6e82-46a1-9f11-0b3570b0cd76"
+        fingerprint = "72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_0e03b7d3 {
+    meta:
+        id = "0e03b7d3-a6b0-46a0-920e-c15ee7e723f7"
+        fingerprint = "1bf1f271005328669b3eb4940e2b75eff9fc47208d79a12196fd7ce04bc4dbe8"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F5 74 84 32 63 29 5A B2 78 FF F7 FA 0E 51 B3 2F CD 7F 10 FA }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_32eb0c81 {
+    meta:
+        id = "32eb0c81-25af-4670-ab77-07ea7ce1874a"
+        fingerprint = "7c50ed29e2dd75a6a85afc43f8452794cb787ecd2061f4bf415d7038c14c523f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D4 48 FF 45 F0 48 8B 45 F0 0F B6 00 84 C0 75 DB EB 12 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_9abf7e0c {
+    meta:
+        id = "9abf7e0c-5076-4881-a488-f0f62810f843"
+        fingerprint = "7d02513aaef250091a58db58435a1381974e55c2ed695c194b6b7b83c235f848"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 E0 0F B6 42 0D 83 C8 01 88 42 0D 48 8B 55 E0 0F B6 42 0D 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_33801844 {
+    meta:
+        id = "33801844-50b1-4968-a1b7-d106f16519ee"
+        fingerprint = "36218345b9ce4aaf50b5df1642c00ac5caa744069e952eb6008a9a57a37dbbdc"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "2ceff60e88c30c02c1c7b12a224aba1895669aad7316a40b575579275b3edbb3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 F8 48 83 E8 01 0F B6 00 3C 0D 75 0B 48 8B 45 F8 0F B6 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_a33a8363 {
+    meta:
+        id = "a33a8363-5511-4fe1-a0d8-75156b9ccfc7"
+        fingerprint = "74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_9a62845f {
+    meta:
+        id = "9a62845f-6311-49ae-beac-f446b2909d9c"
+        fingerprint = "2ccc813c5efed35308eb2422239b5b83d051eca64b7c785e66d602b13f8bd9b4"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "f67f8566beab9d7494350923aceb0e76cd28173bdf2c4256e9d45eff7fc8cb41"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 83 F8 20 7F 1E 83 7D 08 07 75 33 8B 45 0C 83 C0 18 8B 00 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_4d81ad42 {
+    meta:
+        id = "4d81ad42-bf08-48a9-9a93-85cb491257b3"
+        fingerprint = "f285683c3b145990e1b6d31d3c9d09177ebf76f183d0fa336e8df3dbcba24366"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference_sample = "3021a861e6f03df3e7e3919e6255bdae6e48163b9a8ba4f1a5c5dced3e3e368b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0F 44 C8 07 0B BF F1 1B 7E 83 CD FF 31 DB 2E 22 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_6a510422 {
+    meta:
+        id = "6a510422-3662-4fdb-9c03-0101f16e87cd"
+        fingerprint = "8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_d2953f92 {
+    meta:
+        id = "d2953f92-62ee-428d-88c5-723914c88c6e"
+        fingerprint = "276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_6ae4b580 {
+    meta:
+        id = "6ae4b580-f7cf-4318-b584-7ea15f10f5ea"
+        fingerprint = "279e344d6da518980631e70d7b1ded4ff1b034d24e4b4fe01b36ed62f5c1176c"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 30 0B E5 3C 20 1B E5 6C 32 1B E5 03 00 52 E1 01 00 00 DA 6C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_d608cf3b {
+    meta:
+        id = "d608cf3b-c255-4a8d-9bf1-66f92eacd751"
+        fingerprint = "3825aa1c9cddb46fdef6abc0503b42acbca8744dd89b981a3eea8db2f86a8a76"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FF 2F E1 7E 03 00 00 78 D8 00 00 24 00 00 00 28 00 00 00 4C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_3f8cf56e {
+    meta:
+        id = "3f8cf56e-a8cb-4c03-8829-f1daa3dc64a8"
+        fingerprint = "77306f0610515434371f70f2b42c895cdc5bbae2ef6919cf835b3cfe2e4e4976"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference = "1878f0783085cc6beb2b81cfda304ec983374264ce54b6b98a51c09aea9f750d"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 2F DA E8 E9 CC E4 F4 39 55 E2 9E 33 0E C0 F0 FB 26 93 31 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_fb14e81f {
+    meta:
+        id = "fb14e81f-be2a-4428-9877-958e394a7ae2"
+        fingerprint = "12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference = "0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_e09726dc {
+    meta:
+        id = "e09726dc-4e6d-4115-b178-d20375c09e04"
+        fingerprint = "614d54b3346835cd5c2a36a54cae917299b1a1ae0d057e3fa1bb7dddefc1490f"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference = "1e64187b5e3b5fe71d34ea555ff31961404adad83f8e0bd1ce0aad056a878d73"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 48 83 EC 08 48 83 C4 08 C3 00 00 00 01 00 02 00 50 49 4E 47 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gafgyt_ad12b9b6 {
+    meta:
+        id = "ad12b9b6-2e66-4647-8bf3-0300f2124a97"
+        fingerprint = "46d86406f7fb25f0e240abc13e86291c56eb7468d0128fdff181f28d4f978058"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Gafgyt"
+        reference = "f0411131acfddb40ac8069164ce2808e9c8928709898d3fb5dc88036003fe9c8"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4C 52 46 00 4B 45 46 31 4A 43 53 00 4B 45 46 31 51 45 42 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Ganiw.yar b/yara/rules/Linux_Trojan_Ganiw.yar
new file mode 100644
index 00000000..8268aa58
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Ganiw.yar
@@ -0,0 +1,37 @@
+rule Linux_Trojan_Ganiw_99349371 {
+    meta:
+        id = "99349371-644e-4954-9b7d-f2f579922565"
+        fingerprint = "6b0cbea419915567c2ecd84bfcb2c7f7301435ee953f16c6dcba826802637551"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ganiw"
+        reference_sample = "e8dbb246fdd1a50226a36c407ac90eb44b0cf5e92bf0b92c89218f474f9c2afb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 66 89 43 02 8B 5D FC C9 C3 55 89 E5 53 83 EC 04 8B 45 14 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ganiw_b9f045aa {
+    meta:
+        id = "b9f045aa-99fa-47e9-b179-ac62158b3fe2"
+        fingerprint = "0aaec92ca1c622df848bba80a2f1e4646252625d58e28269965b13d65158f238"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ganiw"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E5 57 8B 55 0C 85 D2 74 21 FC 31 C0 8B 7D 08 AB AB AB AB AB AB }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Generic.yar b/yara/rules/Linux_Trojan_Generic.yar
new file mode 100644
index 00000000..7f2b137b
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Generic.yar
@@ -0,0 +1,304 @@
+rule Linux_Trojan_Generic_402be6c5 {
+    meta:
+        id = "402be6c5-a1d8-4d7a-88ba-b852e0db1098"
+        fingerprint = "1e906f5a06f688084edf537ead0b7e887bd9e0fcc39990c976ea8c136dc52624"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "d30a8f5971763831f92d9a6dd4720f52a1638054672a74fdb59357ae1c9e6deb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C0 52 4C 95 42 11 01 64 E9 D7 39 E4 89 34 FA 48 01 02 C1 3B 39 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_5420d3e7 {
+    meta:
+        id = "5420d3e7-012f-4ce0-bb13-9e5221efa73e"
+        fingerprint = "e81615b5756c2789b9be8fb10420461d5260914e16ba320cbab552d654bbbd8a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "103b8fced0aebd73cb8ba9eff1a55e6b6fa13bb0a099c9234521f298ee8d2f9f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 63 00 5F 5A 4E 34 41 52 43 34 37 65 6E 63 72 79 70 74 45 50 63 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_4f4cc3ea {
+    meta:
+        id = "4f4cc3ea-a906-4fce-a482-d762ab8995b8"
+        fingerprint = "d85dac2bd81925f5d8c90c11047c631c1046767cb6649cd266c3a143353b6c12"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "32e25641360dbfd50125c43754cd327cf024f1b3bfd75b617cdf8a17024e2da5"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4A 4E 49 20 55 4E 50 41 43 4B 20 44 45 58 20 53 54 41 52 54 20 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_703a0258 {
+    meta:
+        id = "703a0258-8d28-483e-a679-21d9ef1917b4"
+        fingerprint = "796c2283eb14057081409800480b74ab684413f8f63a9db8704f5057026fb556"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "b086d0119042fc960fe540c23d0a274dd0fb6f3570607823895c9158d4f75974"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C2 F7 89 76 7E 86 87 F6 2B A3 2C 94 61 36 BE B6 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_378765e4 {
+    meta:
+        id = "378765e4-c0f2-42ad-a42b-b992d3b866f4"
+        fingerprint = "60f259ba5ffe607b594c2744b9b30c35beab9683f4cd83c2e31556a387138923"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "1ed42910e09e88777ae9958439d14176cb77271edf110053e1a29372fce21ec1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 ?? FB FF FF 83 7D D4 00 79 0A B8 ?? 22 60 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_f657fb4f {
+    meta:
+        id = "f657fb4f-a065-4d51-bead-fd28f8053418"
+        fingerprint = "8c15d5e53b95002f569d63c91db7858c4ca8f26c441cb348a1b34f3b26d02468"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "1ed42910e09e88777ae9958439d14176cb77271edf110053e1a29372fce21ec1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 ?? FB FF FF 83 7D D4 00 79 0A B8 ?? ?? 60 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_be1757ef {
+    meta:
+        id = "be1757ef-cf45-4c00-8d6c-dbb0f44f6efb"
+        fingerprint = "0af6b01197b63259d9ecbc24f95b183abe7c60e3bf37ca6ac1b9bc25696aae77"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "f3e4e2b5af9d0c72aae83cec57e5c091a95c549f826e8f13559aaf7d300f6e13"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 20 54 68 75 20 4D 61 72 20 31 20 31 34 3A 34 34 3A 30 38 20 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_7a95ef79 {
+    meta:
+        id = "7a95ef79-3df5-4f7a-a8ba-00577473b288"
+        fingerprint = "aadec0fa964f94afb725a568dacf21e80b80d359cc5dfdd8d028aaece04c7012"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "f59340a740af8f7f4b96e3ea46d38dbe81f2b776820b6f53b7028119c5db4355"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 1C 8B 54 24 20 8B 74 24 24 CD 80 5E 5A 59 5B C3 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_1c5e42b7 {
+    meta:
+        id = "1c5e42b7-b873-443e-a30c-66a75fc39b21"
+        fingerprint = "b64284e1220ec9abc9b233e513020f8b486c76f91e4c3f2a0a6fb003330c2535"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "b078a02963610475217682e6e1d6ae0b30935273ed98743e47cc2553fbfd068f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 C0 89 45 F4 83 7D F4 FF 75 1C 83 EC 0C 68 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_8ca4b663 {
+    meta:
+        id = "8ca4b663-b282-4322-833a-4c0143f63634"
+        fingerprint = "34e04e32ee493643cc37ff0cfb94dcbc91202f651bc2560e9c259b53a9d6acfc"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "1ddf479e504867dfa27a2f23809e6255089fa0e2e7dcf31b6ce7d08f8d88947e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 28 60 DF F2 FB B7 E7 EB 96 D1 E6 96 88 12 96 EB 8C 94 EB C7 4E }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_d3fe3fae {
+    meta:
+        id = "d3fe3fae-f7ec-48d5-8b17-9ab11a5b689f"
+        fingerprint = "1773a3e22cb44fe0b3e68d343a92939a955027e735c60b48cf3b7312ce3a6415"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "2a2542142adb05bff753e0652e119c1d49232d61c49134f13192425653332dc3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 47 53 45 54 2C 20 70 69 64 2C 20 4E 54 5F 50 52 53 54 41 54 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_5e981634 {
+    meta:
+        id = "5e981634-e34e-4943-bf8f-86cfd9fffc85"
+        fingerprint = "57f1e8fa41f6577f41a73e3460ef0c6c5b0a65567ae0962b080dfc8ab18364f5"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "448e8d71e335cabf5c4e9e8d2d31e6b52f620dbf408d8cc9a6232a81c051441b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 74 1D 8B 44 24 68 89 84 24 A4 00 00 00 8B 44 24 6C 89 84 24 A8 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_d8953ca0 {
+    meta:
+        id = "d8953ca0-f1f1-4d76-8c80-06f16998ba03"
+        fingerprint = "16ab55f99be8ed2a47618978a335a8c68369563c0a4d0a7ff716b5d4c9e0785c"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "552753661c3cc7b3a4326721789808482a4591cb662bc813ee50d95f101a3501"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 5B 9C 9C 9C 9C 5C 5D 5E 5F 9C 9C 9C 9C B1 B2 B3 B4 9C 9C 9C 9C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_7b82a21c {
+    meta:
+        id = "7b82a21c-1e55-4f15-9ace-71dc01b8a04a"
+        fingerprint = "25b3b6f63fc6d444cde0eba07b3d8eb3522ef3771bcd03b26bfc48ce1a7ce77d"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C3 55 48 89 E5 48 83 EC 30 89 7D DC 89 F0 66 89 45 D8 48 8D }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_f75f9023 {
+    meta:
+        id = "f75f9023-23d0-41d8-84a0-a0b28056918d"
+        fingerprint = "bf3acb578ea7838168f2dedb7b4e47dd39f48bb16ac9fe744e2ed472fa0dd554"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 3F BB 01 00 00 00 48 89 DE 48 D3 E6 48 89 F1 48 09 C8 48 89 84 D5 40 FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Generic_181054af {
+    meta:
+        id = "181054af-dc05-4981-8a57-ea17ffd6241f"
+        fingerprint = "8ef033ac0fccd10cdf2e66446461b7c8b29574e5869440a1972dbe4bb5fbed89"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Generic"
+        reference_sample = "e677f1eed0dbb4c680549e0bf86d92b0a28a85c6d571417baaba0d0719da5f93"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6D 6F 64 00 73 65 74 75 74 78 65 6E 74 00 67 6D 74 69 6D 65 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Getshell.yar b/yara/rules/Linux_Trojan_Getshell.yar
new file mode 100644
index 00000000..95f60226
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Getshell.yar
@@ -0,0 +1,76 @@
+rule Linux_Trojan_Getshell_98d002bf {
+    meta:
+        id = "98d002bf-63b7-4d11-98ef-c3127e68d59c"
+        fingerprint = "b7bfec0a3cfc05b87fefac6b10673491b611400edacf9519cbcc1a71842e9fa3"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Getshell"
+        reference_sample = "97b7650ab083f7ba23417e6d5d9c1d133b9158e2c10427d1f1e50dfe6c0e7541"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { B2 6A B0 03 CD 80 85 C0 78 02 FF E1 B8 01 00 00 00 BB 01 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Getshell_213d4d69 {
+    meta:
+        id = "213d4d69-5660-468d-a98c-ff3eef604b1e"
+        fingerprint = "60e385e4c5eb189785bc14d39bf8a22c179e4be861ce3453fbcf4d367fc87c90"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Getshell"
+        reference = "05fc4dcce9e9e1e627ebf051a190bd1f73bc83d876c78c6b3d86fc97b0dfd8e8"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { EC 01 00 00 00 EB 3C 8B 45 EC 48 98 48 C1 E0 03 48 03 45 D0 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Getshell_3cf5480b {
+    meta:
+        id = "3cf5480b-bb21-4a6e-a078-4b145d22c79f"
+        fingerprint = "3ef0817445c54994d5a6792ec0e6c93f8a51689030b368eb482f5ffab4761dd2"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Getshell"
+        reference = "0e41c0d6286fb7cd3288892286548eaebf67c16f1a50a69924f39127eb73ff38"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { B2 24 B0 03 CD 80 85 C0 78 02 FF E1 B8 01 00 00 00 BB 01 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Getshell_8a79b859 {
+    meta:
+        id = "8a79b859-654c-4082-8cfc-61a143671457"
+        fingerprint = "5a95d1df94791c8484d783da975bec984fb11653d1f81f6397efd734a042272b"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Getshell"
+        reference = "1154ba394176730e51c7c7094ff3274e9f68aaa2ed323040a94e1c6f7fb976a2"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0A 00 89 E1 6A 1C 51 56 89 E1 43 6A 66 58 CD 80 B0 66 B3 04 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Godlua.yar b/yara/rules/Linux_Trojan_Godlua.yar
new file mode 100644
index 00000000..810493aa
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Godlua.yar
@@ -0,0 +1,18 @@
+rule Linux_Trojan_Godlua_ed8e6228 {
+    meta:
+        id = "ed8e6228-d5be-4b8e-8dc2-7072b1236bfa"
+        fingerprint = "9b73c2bbbe1bc43ae692f03b19cd23ad701f0120dff0201dd2a6722c44ea51ed"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Godlua"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C0 18 48 89 45 E8 EB 60 48 8B 85 58 FF FF FF 48 83 C0 20 48 89 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Godropper.yar b/yara/rules/Linux_Trojan_Godropper.yar
new file mode 100644
index 00000000..1456afe1
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Godropper.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Godropper_bae099bd {
+    meta:
+        id = "bae099bd-c19a-4893-96e8-63132dabce39"
+        fingerprint = "5a7b0906ebc47130aefa868643e1e0a40508fe7a25bc55e5c41ff284ca2751e5"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Godropper"
+        reference_sample = "704643f3fd11cda1d52260285bf2a03bccafe59cfba4466427646c1baf93881e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FF FF FF FF 88 DB A2 31 03 A3 5A 5C 9A 19 0E DB }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Gognt.yar b/yara/rules/Linux_Trojan_Gognt.yar
new file mode 100644
index 00000000..cc028781
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Gognt.yar
@@ -0,0 +1,38 @@
+rule Linux_Trojan_Gognt_50c3d9da {
+    meta:
+        id = "50c3d9da-0392-4379-aafe-cfe63ade3314"
+        fingerprint = "a4b7e0c7c2f1b0634f82106ec0625bcdde02296b3e72c9c3aa9c16e40d770b43"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gognt"
+        reference_sample = "79602bc786edda7017c5f576814b683fba41e4cb4cf3f837e963c6d0d42c50ee"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 00 47 6F 00 00 51 76 46 5F 6F 30 59 36 55 72 5F 6C 63 44 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Gognt_05b10f4b {
+    meta:
+        id = "05b10f4b-7434-457a-9e8e-d898bb839dce"
+        fingerprint = "fdf7b65f812c17c7f30b3095f237173475cdfb0c10a4b187f751c0599f6b5729"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Gognt"
+        reference_sample = "e43aaf2345dbb5c303d5a5e53cd2e2e84338d12f69ad809865f20fd1a5c2716f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 7C 24 78 4C 89 84 24 A8 00 00 00 48 29 D7 49 89 F9 48 F7 DF 48 C1 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Hiddad.yar b/yara/rules/Linux_Trojan_Hiddad.yar
new file mode 100644
index 00000000..b52906e9
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Hiddad.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Hiddad_e35bff7b {
+    meta:
+        id = "e35bff7b-1a93-4cfd-a4b6-1e994c0afa98"
+        fingerprint = "0ed46ca8a8bd567acf59d8a15a9597d7087975e608f42af57d36c31e777bb816"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Hiddad"
+        reference_sample = "22a418e660b5a7a2e0cc1c1f3fe1d150831d75c4fedeed9817a221194522efcf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 3C 14 48 63 CF 89 FE 48 69 C9 81 80 80 80 C1 FE 1F 48 C1 E9 20 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Ipstorm.yar b/yara/rules/Linux_Trojan_Ipstorm.yar
new file mode 100644
index 00000000..fc88bd6a
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Ipstorm.yar
@@ -0,0 +1,57 @@
+rule Linux_Trojan_Ipstorm_3c43d4a7 {
+    meta:
+        id = "3c43d4a7-185a-468b-a73d-82f579de98c1"
+        fingerprint = "cf6812f8f0ee7951a70bec3839b798a574d536baae4cf37cda6eebf570cab0be"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ipstorm"
+        reference_sample = "5103133574615fb49f6a94607540644689be017740d17005bc08b26be9485aa7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 48 8D 54 24 58 31 F6 EB 11 48 8B 84 24 88 00 00 00 48 89 F1 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ipstorm_f9269f00 {
+    meta:
+        id = "f9269f00-4664-47a4-9148-fa74e2cfee7c"
+        fingerprint = "509de41454bcc60dad0d96448592aa20fb997ce46ad8fed5d4bbdbe2ede588d6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ipstorm"
+        reference_sample = "5103133574615fb49f6a94607540644689be017740d17005bc08b26be9485aa7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { EC C0 00 00 00 48 89 AC 24 B8 00 00 00 48 8D AC 24 B8 00 00 00 B8 69 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ipstorm_08bcf61c {
+    meta:
+        id = "08bcf61c-baef-4320-885c-8f8949684dde"
+        fingerprint = "348295602b1582839f6acc603832f09e9afab71731bc21742d1a638e41df6e7c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ipstorm"
+        reference_sample = "503f293d84de4f2c826f81a68180ad869e0d1448ea6c0dbf09a7b23801e1a9b9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8C 24 98 00 00 00 31 D2 31 DB EB 04 48 83 C1 18 48 8B 31 48 83 79 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Ircbot.yar b/yara/rules/Linux_Trojan_Ircbot.yar
new file mode 100644
index 00000000..daa87ab6
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Ircbot.yar
@@ -0,0 +1,38 @@
+rule Linux_Trojan_Ircbot_bb204b81 {
+    meta:
+        id = "bb204b81-db58-434f-b834-672cdc25e56c"
+        fingerprint = "66f9a8a31653a5e480f427d2d6a25b934c2c53752308eedb57eaa7b7cb7dde2e"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ircbot"
+        reference_sample = "6147481d083c707dc98905a1286827a6e7009e08490e7d7c280ed5a6356527ad"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0F 44 C8 4C 5E F8 8D EF 80 83 CD FF 31 DB 30 22 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ircbot_7c60454d {
+    meta:
+        id = "7c60454d-8290-4e91-9b0a-2392aebe1bec"
+        fingerprint = "4f14dcca5704c2ef32caaed1c048a5fb14095f31be8630676c07cbc8b22e6c4d"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Ircbot"
+        reference_sample = "14eeff3516de6d2cb11d6ada4026e3dcee1402940e3a0fb4fa224a5c030049d8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 49 89 F0 41 54 55 48 89 CD 53 48 89 FB 48 83 EC 58 48 85 D2 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Iroffer.yar b/yara/rules/Linux_Trojan_Iroffer.yar
new file mode 100644
index 00000000..dddcf3a9
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Iroffer.yar
@@ -0,0 +1,95 @@
+rule Linux_Trojan_Iroffer_53692410 {
+    meta:
+        id = "53692410-4213-4550-890e-4c62867937bc"
+        fingerprint = "f070ee35ad42d9d30021cc2796cfd2859007201c638f98f42fdbec25c53194fb"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Iroffer"
+        reference_sample = "e76508141970efb3e4709bcff83772da9b10169c599e13e58432257a7bb2defa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 69 6E 67 20 55 6E 6B 6E 6F 77 6E 20 4D 73 67 6C 6F 67 20 54 61 67 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Iroffer_013e07de {
+    meta:
+        id = "013e07de-95bd-4774-a14f-0a10f911a2dd"
+        fingerprint = "92dde62076acec29a637b63a35f00c35f706df84d6ee9cabda0c6f63d01a13c4"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Iroffer"
+        reference_sample = "e76508141970efb3e4709bcff83772da9b10169c599e13e58432257a7bb2defa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 49 67 6E 6F 72 69 6E 67 20 42 61 64 20 58 44 43 43 20 4E 6F }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Iroffer_0de95cab {
+    meta:
+        id = "0de95cab-c671-44f0-a85e-5a5634e906f7"
+        fingerprint = "42c1ab8af313ec3c475535151ee67cac93ab6a25252b52b1e09c166065fb2760"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Iroffer"
+        reference_sample = "717bea3902109d1b1d57e57c26b81442c0705af774139cd73105b2994ab89514"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 41 52 52 45 43 4F 52 44 53 00 53 68 6F 77 20 49 6E 66 6F }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Iroffer_711259e4 {
+    meta:
+        id = "711259e4-f081-4d81-8257-60ba733354c5"
+        fingerprint = "aca63ef57ab6cb5579a2a5fea6095d88a3a4fb8347353febb3d02cc88a241b78"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Iroffer"
+        reference_sample = "e76508141970efb3e4709bcff83772da9b10169c599e13e58432257a7bb2defa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 03 7E 2B 8B 45 C8 3D FF 00 00 00 77 21 8B 55 CC 81 FA FF 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Iroffer_7478ddd9 {
+    meta:
+        id = "7478ddd9-ebb6-4bd4-a1ad-d0bf8f99ab1d"
+        fingerprint = "b497ee116b77e2ba1fedfad90894d956806a2ffa19cadc33a916513199b0a381"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Iroffer"
+        reference_sample = "20e1509c23d7ef14b15823e4c56b9a590e70c5b7960a04e94b662fc34152266c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 80 FA 0F 74 10 80 FA 16 74 0B 80 FA 1F 74 06 C6 04 1E 2E 89 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Kaiji.yar b/yara/rules/Linux_Trojan_Kaiji.yar
new file mode 100644
index 00000000..b6cd90bf
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Kaiji.yar
@@ -0,0 +1,38 @@
+rule Linux_Trojan_Kaiji_253c44de {
+    meta:
+        id = "253c44de-3f48-49f9-998d-1dec2981108c"
+        fingerprint = "f390a16ca4270dc38ce1a52bbdc1ac57155f369a74005ff2a4e46c6d043b869e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Kaiji"
+        reference_sample = "e31eb8880bb084b4c642eba127e64ce99435ea8299a98c183a63a2e6a139d926"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { EB 27 0F B6 1C 10 48 8B 74 24 40 48 8B BC 24 90 00 00 00 88 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Kaiji_535f07ac {
+    meta:
+        id = "535f07ac-d727-4866-aaed-74d297a1092c"
+        fingerprint = "8853b2a1d5852e436cab2e3402a5ca13839b3cae6fbb56a74b047234b8c1233b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Kaiji"
+        reference_sample = "28b2993d7c8c1d8dfce9cd2206b4a3971d0705fd797b9fde05211686297f6bb0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 44 24 10 48 8B 4C 24 08 48 83 7C 24 18 00 74 26 C6 44 24 57 00 48 8B 84 24 98 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Kinsing.yar b/yara/rules/Linux_Trojan_Kinsing.yar
new file mode 100644
index 00000000..033fba97
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Kinsing.yar
@@ -0,0 +1,75 @@
+rule Linux_Trojan_Kinsing_196523fa {
+    meta:
+        id = "196523fa-2bb5-4ada-b929-ddc3d5505b73"
+        fingerprint = "29fa6e4fe5cbcd5c927e6b065f3354e4e9015e65814400687b2361fc9a951c74"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Kinsing"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 64 65 38 5F 00 64 48 8B 0C 25 F8 FF FF FF 48 3B 61 10 76 35 48 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Kinsing_7cdbe9fa {
+    meta:
+        id = "7cdbe9fa-39a3-43a0-853a-16f41e20f304"
+        fingerprint = "2452c2821b4ca104a18d3733ee8f6744a738aca197aa35392c480e224a5f8175"
+        creation_date = "2021-12-13"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Kinsing"
+        reference_sample = "b3527e3d03a30fcf1fdaa73a1b3743866da6db088fbfa5f51964f519e22d05e6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 73 2E 72 75 22 20 7C 20 61 77 6B 20 27 7B 70 72 69 6E 74 20 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Kinsing_2c1ffe78 {
+    meta:
+        id = "2c1ffe78-a965-4a70-8a9c-2cad705f8be7"
+        fingerprint = "6701b007ee14a022525301d53af0f4254bc26fdfbe27d3d5cebc2d40e8536ed6"
+        creation_date = "2021-12-13"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Kinsing"
+        reference_sample = "b3527e3d03a30fcf1fdaa73a1b3743866da6db088fbfa5f51964f519e22d05e6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 73 74 73 20 22 24 42 49 4E 5F 46 55 4C 4C 5F 50 41 54 48 22 20 22 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Kinsing_85276fb4 {
+    meta:
+        id = "85276fb4-11f4-4265-9533-a96b42247f96"
+        fingerprint = "966d53d8fc0e241250a861107317266ad87205d25466a4e6cdb27c3e4e613d92"
+        creation_date = "2021-12-13"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Kinsing"
+        reference_sample = "b3527e3d03a30fcf1fdaa73a1b3743866da6db088fbfa5f51964f519e22d05e6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 65 5F 76 00 64 48 8B 0C 25 F8 FF FF FF 48 3B 61 10 76 38 48 83 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Ladvix.yar b/yara/rules/Linux_Trojan_Ladvix.yar
new file mode 100644
index 00000000..e88e1771
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Ladvix.yar
@@ -0,0 +1,75 @@
+rule Linux_Trojan_Ladvix_db41f9d2 {
+    meta:
+        id = "db41f9d2-aa5c-4d26-b8ba-cece44eddca8"
+        fingerprint = "d0aaa680e81f44cc555bf7799d33fce66f172563788afb2ad0fb16d3e460e8c6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ladvix"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C0 49 89 C4 74 45 45 85 ED 7E 26 48 89 C3 41 8D 45 FF 4D 8D 7C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ladvix_77d184fd {
+    meta:
+        id = "77d184fd-a15e-40e5-ac7e-0d914cc009fe"
+        fingerprint = "21361ca7c26c98903626d1167747c6fd11a5ae0d6298d2ef86430ce5be0ecd1a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ladvix"
+        reference_sample = "1bb44b567b3c82f7ee0e08b16f7326d1af57efe77d608a96b2df43aab5faa9f7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 40 10 48 89 45 80 8B 85 64 FF FF FF 48 89 E2 48 89 D3 48 63 D0 48 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ladvix_c9888edb {
+    meta:
+        id = "c9888edb-0f82-4c7a-b501-4e4d3c9c64e3"
+        fingerprint = "e0e0d75a6de7a11b2391f4a8610a6d7c385df64d43fa1741d7fe14b279e1a29a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ladvix"
+        reference_sample = "1d798e9f15645de89d73e2c9d142189d2eaf81f94ecf247876b0b865be081dca"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 01 83 45 E4 01 8B 45 E4 83 F8 57 76 B5 83 45 EC 01 8B 45 EC 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ladvix_81fccd74 {
+    meta:
+        id = "81fccd74-465d-4f2e-b879-987bc47828dd"
+        fingerprint = "0e983107f38a6b2a739a44ab4d37c35c5a7d8217713b280a1786511089084a95"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ladvix"
+        reference = "2a183f613fca5ec30dfd82c9abf72ab88a2c57d2dd6f6483375913f81aa1c5af"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 EA 00 00 48 8D 45 EA 48 8B 55 F0 0F B6 12 88 10 0F B7 45 EA 0F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Lady.yar b/yara/rules/Linux_Trojan_Lady.yar
new file mode 100644
index 00000000..e4c10fc1
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Lady.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Lady_75f6392c {
+    meta:
+        id = "75f6392c-fc13-4abb-a391-b5f1ea1039d8"
+        fingerprint = "da6d4dff230120eed94e04b0e6060713c2bc17da54c098e9a9f3ec7a8200b9bf"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Lady"
+        reference_sample = "c257ac7bd3a9639e0d67a7db603d5bc8d8505f6f2107a26c2615c5838cf11826"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 57 72 69 00 49 3B 66 10 76 38 48 83 EC 18 48 89 6C 24 10 48 8D 6C }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Lala.yar b/yara/rules/Linux_Trojan_Lala.yar
new file mode 100644
index 00000000..4d2d6d5d
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Lala.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Lala_51deb1f9 {
+    meta:
+        id = "51deb1f9-2d5f-4c41-99f3-138c15c35804"
+        fingerprint = "220bcaa4f18b9474ddd3da921e1189d17330f0eb98fa55a193127413492fb604"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Lala"
+        reference_sample = "f3af65d3307fbdc2e8ce6e1358d1413ebff5eeb5dbedc051394377a4dabffa82"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D9 7C F3 89 D8 83 7D FC 00 7D 02 F7 D8 8B 55 08 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Malxmr.yar b/yara/rules/Linux_Trojan_Malxmr.yar
new file mode 100644
index 00000000..8835228b
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Malxmr.yar
@@ -0,0 +1,38 @@
+rule Linux_Trojan_Malxmr_7054a0d0 {
+    meta:
+        id = "7054a0d0-11d4-4671-a88d-ea933e73fe11"
+        fingerprint = "9661cc2b7a1d7b882ca39307adc927f5fb73d59f3771a8b456c2cf2ff3d801e9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Malxmr"
+        reference_sample = "3a6b3552ffac13aa70e24fef72b69f683ac221105415efb294fb9a2fc81c260a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6E 64 47 56 7A 64 48 52 6C 63 33 52 30 5A 58 4E 30 64 47 56 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Malxmr_144994a5 {
+    meta:
+        id = "144994a5-1e37-4913-b7aa-deed638b1a79"
+        fingerprint = "473e686a74e76bb879b3e34eb207d966171f3e11cf68bde364316c2ae5cd3dc3"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Malxmr"
+        reference_sample = "07db41a4ddaac802b04df5e5bbae0881fead30cb8f6fa53a8a2e1edf14f2d36b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 78 71 51 58 5A 5A 4D 31 5A 35 59 6B 4D 78 61 47 4A 58 55 54 4A }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Marut.yar b/yara/rules/Linux_Trojan_Marut.yar
new file mode 100644
index 00000000..35f1c6bd
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Marut.yar
@@ -0,0 +1,18 @@
+rule Linux_Trojan_Marut_47af730d {
+    meta:
+        id = "47af730d-1e03-4d27-9661-84fb12b593bd"
+        fingerprint = "4429ef9925aff797ab973f9a5b0efc160a516f425e3b024f22e5a5ddad26c341"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Marut"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 20 89 34 24 FF D1 8B 44 24 0C 0F B6 4C 24 04 8B 54 24 08 85 D2 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Masan.yar b/yara/rules/Linux_Trojan_Masan.yar
new file mode 100644
index 00000000..81785164
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Masan.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Masan_5369c678 {
+    meta:
+        id = "5369c678-9a74-42fe-a4b3-b4d48126bb22"
+        fingerprint = "5fd243bf05cafd7db33d6c0167f77148ae53983906e917e174978130ae08062a"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Masan"
+        reference_sample = "f2de9f39ca3910d5b383c245d8ca3c1bdf98e2309553599e0283062e0aeff17f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 C0 89 45 E4 83 7D E4 FF 75 ?? 68 ?? 90 04 08 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Mech.yar b/yara/rules/Linux_Trojan_Mech.yar
new file mode 100644
index 00000000..46dff896
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Mech.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Mech_d30ec0a0 {
+    meta:
+        id = "d30ec0a0-3fd6-4d83-ad29-9d45704bc8ce"
+        fingerprint = "061e9f1aade510132674d87ab5981e5b6b0ae3a2782a97d8cc6c2be7b26c6454"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mech"
+        reference_sample = "710d1a0a8c7eecc6d793933c8a97cec66d284b3687efee7655a2dc31d15c0593"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6E 63 20 2D 20 4C 69 6E 75 78 20 32 2E 32 2E 31 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Mechbot.yar b/yara/rules/Linux_Trojan_Mechbot.yar
new file mode 100644
index 00000000..a8a97add
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Mechbot.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Mechbot_f2e1c5aa {
+    meta:
+        id = "f2e1c5aa-3318-4665-bee4-34a4afcf60bd"
+        fingerprint = "4b663b0756f2ae9b43eae29cd0225ad75517ef345982e8fdafa61f3c3db2d9f5"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mechbot"
+        reference_sample = "5f8e80e6877ff2de09a12135ee1fc17bee8eb6d811a65495bcbcddf14ecb44a3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 52 56 45 52 00 42 41 4E 4C 49 53 54 00 42 4F 4F 54 00 42 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Merlin.yar b/yara/rules/Linux_Trojan_Merlin.yar
new file mode 100644
index 00000000..460aeaa2
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Merlin.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Merlin_55beddd3 {
+    meta:
+        id = "55beddd3-735b-4e0c-a387-e6a981cd42a3"
+        fingerprint = "54e03337930d74568a91e797cfda3b7bfbce3aad29be2543ed58c51728d8e185"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Merlin"
+        reference_sample = "15ccdf2b948fe6bd3d3a7f5370e72cf3badec83f0ec7f47cdf116990fb551adf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { AF F0 4C 01 F1 4C 8B B4 24 A8 00 00 00 4D 0F AF F4 4C 01 F1 4C 8B B4 24 B0 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Meterpreter.yar b/yara/rules/Linux_Trojan_Meterpreter.yar
new file mode 100644
index 00000000..b3d53135
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Meterpreter.yar
@@ -0,0 +1,73 @@
+rule Linux_Trojan_Meterpreter_a82f5d21 {
+    meta:
+        id = "a82f5d21-3b01-4a05-a34a-6985c1f3b460"
+        fingerprint = "b0adb928731dc489a615fa86e46cc19de05e251eef2e02eb02f478ed1ca01ec5"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Meterpreter"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F8 02 74 22 77 08 66 83 F8 01 74 20 EB 24 66 83 F8 03 74 0C 66 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Meterpreter_383c6708 {
+    meta:
+        id = "383c6708-0861-4089-93c3-4320bc1e7cfc"
+        fingerprint = "6e9da04c91b5846b3b1109f9d907d9afa917fb7dfe9f77780e745d17b799b540"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Meterpreter"
+        reference_sample = "d9d607f0bbc101f7f6dc0f16328bdd8f6ddb8ae83107b7eee34e1cc02072cb15"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 99 B6 10 48 89 D6 4D 31 C9 6A 22 41 5A B2 07 0F 05 48 96 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Meterpreter_621054fe {
+    meta:
+        id = "621054fe-bbdf-445c-a503-ccba82b88243"
+        fingerprint = "13cb03783b1d5f14cadfaa9b938646d5edb30ea83702991a81cc4ca82e4637dc"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Meterpreter"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 28 85 D2 75 0A 8B 50 2C 83 C8 FF 85 D2 74 03 8B 42 64 5D C3 55 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Meterpreter_1bda891e {
+    meta:
+        id = "1bda891e-a031-4254-9d0b-dc590023d436"
+        fingerprint = "fc3f5afb9b90bbf3b61f144f90b02ff712f60fbf62fb0c79c5eaa808627aa0a1"
+        creation_date = "2021-12-13"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Meterpreter"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 11 62 08 F2 0F 5E D0 F2 0F 58 CB F2 0F 11 5A 10 F2 44 0F 5E C0 F2 0F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Mirai.yar b/yara/rules/Linux_Trojan_Mirai.yar
new file mode 100644
index 00000000..9c261cfd
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Mirai.yar
@@ -0,0 +1,1786 @@
+rule Linux_Trojan_Mirai_268aac0b {
+    meta:
+        id = "268aac0b-c5c7-4035-8381-4e182de91e32"
+        fingerprint = "9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_d5f2abe2 {
+    meta:
+        id = "d5f2abe2-511f-474d-9292-39060bbf6feb"
+        fingerprint = "475a1c92c0a938196a5a4bca708b338a62119a2adf36cabf7bc99893fee49f2a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "c490586fbf90d360cf3b2f9e2dc943809441df3dfd64dadad27fc9f5ee96ec74"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 41 56 41 89 FE 40 0F B6 FF 41 55 49 89 F5 BE 08 00 00 00 41 54 41 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_1cb033f3 {
+    meta:
+        id = "1cb033f3-68c1-4fe5-9cd1-b5d066c1d86e"
+        fingerprint = "49201ab37ff0b5cdfa9b0b34b6faa170bd25f04df51c24b0b558b7534fecc358"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C3 EB 06 8A 46 FF 88 47 FF FF CA 48 FF C7 48 FF C6 83 FA FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_fa3ad9d0 {
+    meta:
+        id = "fa3ad9d0-7c55-4621-90fc-6b154c44a67b"
+        fingerprint = "fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_0cb1699c {
+    meta:
+        id = "0cb1699c-9a08-4885-aa7f-0f1ee2543cac"
+        fingerprint = "6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_6f021787 {
+    meta:
+        id = "6f021787-9c2d-4536-bd90-5230c85a8718"
+        fingerprint = "33ba39b77e55b1a2624e7846e06b2a820de9a8a581a7eec57e35b3a1636b8b0d"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "88183d71359c16d91a3252085ad5a270ad3e196fe431e3019b0810ecfd85ae10"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 D4 66 89 14 01 0F B6 45 D0 48 63 D0 48 89 D0 48 01 C0 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_1e0c5ce0 {
+    meta:
+        id = "1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79"
+        fingerprint = "8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4C 24 54 31 F6 41 B8 04 00 00 00 BA 03 00 00 00 C7 44 24 54 01 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_22965a6d {
+    meta:
+        id = "22965a6d-85d3-4f7c-be4a-581044581b77"
+        fingerprint = "a34bcba23cde4a2a49ef8192fa2283ce03c75b2d1d08f1fea477932d4b9f5135"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "09c821aa8977f67878f8769f717c792d69436a951bb5ac06ce5052f46da80a48"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E6 4A 64 2B E4 82 D1 E3 F6 5E 88 34 DA 36 30 CE 4E 83 EC F1 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_4032ade1 {
+    meta:
+        id = "4032ade1-4864-4637-ae73-867cd5fb7378"
+        fingerprint = "2b150a6571f5a2475d0b4a2ddb75623d6fa1c861f5385a5c42af24db77573480"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "6150fbbefb916583a0e888dee8ed3df8ec197ba7c04f89fb24f31de50226e688"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F8 0C 67 56 55 4C 06 87 DE B2 C0 79 AE 88 73 79 0C 7E F8 87 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_b14f4c5d {
+    meta:
+        id = "b14f4c5d-054f-46e6-9fa8-3588f1ef68b7"
+        fingerprint = "a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_c8385b81 {
+    meta:
+        id = "c8385b81-0f5b-41c3-94bb-265ede946a84"
+        fingerprint = "dfdbd4dbfe16bcf779adb16352d5e57e3950e449e96c10bf33a91efee7c085e5"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "3d27736caccdd3199a14ce29d91b1812d1d597a4fa8472698e6df6ef716f5ce9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8D 74 26 00 89 C2 83 ED 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_122ff2e6 {
+    meta:
+        id = "122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80"
+        fingerprint = "3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_26cba88c {
+    meta:
+        id = "26cba88c-7bd4-4fac-b395-04c4745fee43"
+        fingerprint = "358dd5d916fec3e1407c490ce0289886985be8fabee49581afbc01dcf941733e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "4b4758bff3dcaa5640e340d27abba5c2e2b02c3c4a582374e183986375e49be8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F6 41 00 42 00 43 00 44 00 45 00 46 00 47 00 48 00 49 00 4A 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_93fc3657 {
+    meta:
+        id = "93fc3657-fd21-4e93-a728-c084fc0a6a4a"
+        fingerprint = "d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_7c88acbc {
+    meta:
+        id = "7c88acbc-8b98-4508-ac53-ab8af858660d"
+        fingerprint = "e2ef1c60e21f18e54694bcfc874094a941e5f61fa6144c5a0e44548dafa315be"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = "[Cobalt][%s][%s][%s][%s]"
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_804f8e7c {
+    meta:
+        id = "804f8e7c-4786-42bc-92e4-c68c24ca530e"
+        fingerprint = "1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_ba0e23b7 {
+    meta:
+        id = "ba0e23b7-13b6-4c13-9646-99cbd257ee37"
+        fingerprint = "5df89d161185fda5fcb791754a9f515dbcc4bdb16f1c9a246918b538f6f9ec29"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "753f22b82aa53702ad3a9531390b4a9fba29a292ae28bf2352c07cd0fe02c3d8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 48 FF C6 48 FF C0 EB F0 C3 31 C9 0F B6 04 0F 0F B6 14 0E 38 D0 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_a2d2e15a {
+    meta:
+        id = "a2d2e15a-a2eb-43c6-a43d-094ee9739749"
+        fingerprint = "0e57d17f5c0cd876248a32d4c9cbe69b5103899af36e72e4ec3119fa48e68de2"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "567c3ce9bbbda760be81c286bfb2252418f551a64ba1189f6c0ec8ec059cee49"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 42 F0 41 83 F8 01 76 5F 44 0F B7 41 10 4C 01 C0 44 8D 42 EE 41 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_5946f41b {
+    meta:
+        id = "5946f41b-594c-4fde-827c-616a99f6fc1b"
+        fingerprint = "f28b9b311296fc587eced94ca0d80fc60ee22344e5c38520ab161d9f1273e328"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "f0b6bf8a683f8692973ea8291129c9764269a6739650ec3f9ee50d222df0a38a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 59 08 AA 3A 4C D3 6C 2E 6E F7 24 54 32 7C 61 39 65 21 66 74 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_da4aa3b3 {
+    meta:
+        id = "da4aa3b3-521d-4fde-b1be-c381d28c701c"
+        fingerprint = "8b004abc37f47de6e4ed35284c23db0f6617eec037a71ce92c10aa8efc3bdca5"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "dbc246032d432318f23a4c1e5b6fcd787df29da3bf418613f588f758dcd80617"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 01 D0 C1 E0 03 89 C2 8B 45 A0 01 D0 0F B6 40 14 3C 1F 77 65 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_70ef58f1 {
+    meta:
+        id = "70ef58f1-ac74-4e33-ae03-e68d1d5a4379"
+        fingerprint = "c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_ea584243 {
+    meta:
+        id = "ea584243-6ead-4b96-9a5c-5b5dee12fd57"
+        fingerprint = "cbcabf4cba48152b3599570ef84503bfb8486db022a2b10df7544d4384023355"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "f363d9bd2132d969cd41e79f29c53ef403da64ca8afc4643084cc50076ddfb47"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A 3C 81 FA }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_564b8eda {
+    meta:
+        id = "564b8eda-6f0e-45b8-bef6-d61b0f090a36"
+        fingerprint = "63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_7e9f85fb {
+    meta:
+        id = "7e9f85fb-bfc4-4af6-9315-f6e43fefc4ff"
+        fingerprint = "ef420ec934e3fd07d5c154a727ed5c4689648eb9ccef494056fed1dea7aa5f9c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "4333e80fd311b28c948bab7fb3f5efb40adda766f1ea4bed96a8db5fe0d80ea1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 85 50 FF FF FF 0F B6 40 04 3C 07 75 79 48 8B 85 50 FF FF FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_3a85a418 {
+    meta:
+        id = "3a85a418-2bd9-445a-86cb-657ca7edf566"
+        fingerprint = "554aff5770bfe8fdeae94f5f5a0fd7f7786340a95633433d8e686af1c25b8cec"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "86a43b39b157f47ab12e9dc1013b4eec0e1792092d4cef2772a21a9bf4fc518a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 01 D8 66 C1 C8 08 C1 C8 10 66 C1 C8 08 66 83 7C 24 2C FF 89 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_24c5b7d6 {
+    meta:
+        id = "24c5b7d6-1aa8-4d8e-9983-c7234f57c3de"
+        fingerprint = "3411b624f02dd1c7a0e663f1f119c8d5e47a81892bb7c445b7695c605b0b8ee2"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "7c2f8ba2d6f1e67d1b4a3a737a449429c322d945d49dafb9e8c66608ab2154c4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 54 38 1C 80 FA 3E 74 25 80 FA 3A 74 20 80 FA 24 74 1B 80 FA 23 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_99d78950 {
+    meta:
+        id = "99d78950-ea23-4166-a85a-7a029209f5b1"
+        fingerprint = "3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_3fe3c668 {
+    meta:
+        id = "3fe3c668-89f4-4601-a167-f41bbd984ae5"
+        fingerprint = "2a79caea707eb0ecd740106ea4bed2918e7592c1e5ad6050f6f0992cf31ba5ec"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 84 C0 0F 95 C0 48 FF 45 E8 84 C0 75 E9 8B 45 FC C9 C3 55 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_eedfbfc6 {
+    meta:
+        id = "eedfbfc6-98a4-4817-a0d6-dcb065307f5c"
+        fingerprint = "c79058b4a40630cb4142493062318cdfda881259ac95b70d977816f85b82bb36"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "b7342f7437a3a16805a7a8d4a667e0e018584f9a99591413650e05d21d3e6da6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 7C 39 57 52 AC 57 A8 CE A8 8C FC 53 A8 A8 0E 33 C2 AA 38 14 FB 29 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_6d96ae91 {
+    meta:
+        id = "6d96ae91-9d5c-48f1-928b-1562b120a74d"
+        fingerprint = "fdbeaae0a96f3950d19aed497fae3e7a5517db141f53a1a6315b38b1d53d678b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "e3a1d92df6fb566e09c389cfb085126d2ea0f51a776ec099afb8913ef5e96f9b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 01 00 00 C1 00 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_d8779a57 {
+    meta:
+        id = "d8779a57-c6ee-4627-9eb0-ab9305bd2454"
+        fingerprint = "6c7a18cc03cacef5186d4c1f6ce05203cf8914c09798e345b41ce0dcee1ca9a6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "c490586fbf90d360cf3b2f9e2dc943809441df3dfd64dadad27fc9f5ee96ec74"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { B6 FF 41 89 D0 85 FF 74 29 38 56 08 74 28 48 83 C6 10 31 D2 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_3e72e107 {
+    meta:
+        id = "3e72e107-3647-4afd-a556-3c49dae7eb0c"
+        fingerprint = "3bca41fd44e5e9d8cdfb806fbfcaab3cc18baa268985b95e2f6d06ecdb58741a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "57d04035b68950246dd152054e949008dafb810f3705710d09911876cd44aec7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 85 C0 BA FF FF FF FF 74 14 8D 65 F4 5B 5E 5F 89 D0 5D C3 8D }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_5c62e6b2 {
+    meta:
+        id = "5c62e6b2-9f6a-4c6d-b3fc-c6cbc8cf0b4b"
+        fingerprint = "39501003c45c89d6a08f71fbf9c442bcc952afc5f1a1eb7b5af2d4b7633698a8"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FF C1 83 F9 05 7F 14 48 63 C1 48 89 94 C4 00 01 00 00 FF C6 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_c5430ff9 {
+    meta:
+        id = "c5430ff9-af40-4653-94c3-4651a5e9331e"
+        fingerprint = "a19dcb00fc5553d41978184cc53ef93c36eb9541ea19c6c50496b4e346aaf240"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "5676773882a84d0efc220dd7595c4594bc824cbe3eeddfadc00ac3c8e899aa77"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 00 FC F3 A6 0F 97 C2 0F 92 C0 38 C2 75 29 83 EC 08 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_402adc45 {
+    meta:
+        id = "402adc45-6279-44a6-b766-24706b0328fe"
+        fingerprint = "01b88411c40abc65c24d7a335027888c0cf48ad190dd3fa1b8e17d086a9b80a0"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "1ae0cd7e5bac967e31771873b4b41a1887abddfcdfcc76fa9149bb2054b03ca4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C3 EB DF 5A 5B 5D 41 5C 41 5D C3 41 57 41 56 41 55 41 54 55 53 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_a39dfaa7 {
+    meta:
+        id = "a39dfaa7-7d2c-4d40-bea5-bbebad522fa4"
+        fingerprint = "95d12cb127c088d55fb0090a1cb0af8e0a02944ff56fd18bcb0834b148c17ad7"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 6C 72 00 00 50 E8 4E 0C 00 00 EB 0E 5A 58 59 97 60 8A 54 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_e3e6d768 {
+    meta:
+        id = "e3e6d768-6510-4eb2-a5ec-8cb8eead13f2"
+        fingerprint = "ce11f9c038c31440bcdf7f9d194d1a82be5d283b875cc6170a140c398747ff8c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "b505cb26d3ead5a0ef82d2c87a9b352cc0268ef0571f5e28defca7131065545e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 7E 14 48 89 DF 48 63 C8 4C 89 E6 FC F3 A4 41 01 C5 48 89 FB }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_520deeb8 {
+    meta:
+        id = "520deeb8-cbc0-4225-8d23-adba5e040471"
+        fingerprint = "f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_77137320 {
+    meta:
+        id = "77137320-6c7e-4bb8-81a4-bd422049c309"
+        fingerprint = "afeedf7fb287320c70a2889f43bc36a3047528204e1de45c4ac07898187d136b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 54 24 01 89 C7 31 F6 31 C9 48 89 A4 24 00 01 00 00 EB 1D 80 7A }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_a6a81f9c {
+    meta:
+        id = "a6a81f9c-b43b-4ec3-8b0b-94c1cfee4f08"
+        fingerprint = "e1ec5725b75e4bb3eefe34a17ced900a16af9329a07a99f18f88aaef2678bfc1"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 41 57 00 54 43 50 00 47 52 45 00 4B 54 00 73 68 65 6C 6C 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_485c4b13 {
+    meta:
+        id = "485c4b13-3c7c-47a7-b926-8237cb759ad7"
+        fingerprint = "28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_7146e518 {
+    meta:
+        id = "7146e518-f6f4-425d-bac8-b31edc0ac559"
+        fingerprint = "334ef623a8dadd33594e86caca1c95db060361c65bf366bacb9bc3d93ba90c4f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 85 82 11 79 AF 20 C2 7A 9E 18 6C A9 00 21 E2 6A C6 D5 59 B4 E8 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_6a77af0f {
+    meta:
+        id = "6a77af0f-31fa-4793-82aa-10b065ba1ec0"
+        fingerprint = "4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_5f7b67b8 {
+    meta:
+        id = "5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e"
+        fingerprint = "6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_a3cedc45 {
+    meta:
+        id = "a3cedc45-962d-44b5-bf0e-67166fa6c1a4"
+        fingerprint = "8335e540adfeacdf8f45c9cb36b08fea7a06017bb69aa264dc29647e7ca4a541"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "1ae0cd7e5bac967e31771873b4b41a1887abddfcdfcc76fa9149bb2054b03ca4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 74 2C 48 8B 03 48 83 E0 FE 48 29 C3 48 8B 43 08 48 83 E0 FE 4A 8D }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_7d05725e {
+    meta:
+        id = "7d05725e-db59-42a7-99aa-99de79728126"
+        fingerprint = "7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_fa48b592 {
+    meta:
+        id = "fa48b592-8d80-45af-a3e4-232695b8f5dd"
+        fingerprint = "8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_b9a9d04b {
+    meta:
+        id = "b9a9d04b-a997-46c4-b893-e89a3813efd3"
+        fingerprint = "874249d8ad391be97466c0259ae020cc0564788a6770bb0f07dd0653721f48b1"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = "nexuszetaisacrackaddict"
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_d2205527 {
+    meta:
+        id = "d2205527-0545-462b-b3c9-3bf2bdc44c6c"
+        fingerprint = "01d937fe8823e5f4764dea9dfe2d8d789187dcd6592413ea48e13f41943d67fd"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "e4f584d1f75f0d7c98b325adc55025304d55907e8eb77b328c007600180d6f06"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { CA B8 37 00 00 00 0F 05 48 3D 01 F0 FF FF 73 01 C3 48 C7 C1 C0 FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_ab073861 {
+    meta:
+        id = "ab073861-38df-4a39-ab81-8451b6fab30c"
+        fingerprint = "37ab5e3ccc9a91c885bff2b1b612efbde06999e83ff5c5cd330bd3a709a831f5"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "175444a9c9ca78565de4b2eabe341f51b55e59dec00090574ee0f1875422cbac"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { AC 00 00 00 54 60 00 00 50 E8 4E 0C 00 00 EB 0E 5A 58 59 97 60 8A 54 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_637f2c04 {
+    meta:
+        id = "637f2c04-98e4-45aa-b60a-14a96c6cebb7"
+        fingerprint = "7af3d573af8b7f8252590a53adda52ecf53bdaf9a86b52ef50702f048e08ba8c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 48 8B 45 E0 0F B6 00 38 C2 0F 95 C0 48 FF 45 E8 48 FF 45 E0 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_aa39fb02 {
+    meta:
+        id = "aa39fb02-ca7e-4809-ab5d-00e92763f7ec"
+        fingerprint = "b136ba6496816ba9737a3eb0e633c28a337511a97505f06e52f37b38599587cb"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 74 DE 8D 40 F1 3C 01 76 D7 80 FA 38 74 D2 80 FA 0A 74 CD 80 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_0bce98a2 {
+    meta:
+        id = "0bce98a2-113e-41e1-95c9-9e1852b26142"
+        fingerprint = "993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_3a56423b {
+    meta:
+        id = "3a56423b-c0cf-4483-87e3-552beb40563a"
+        fingerprint = "117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_d18b3463 {
+    meta:
+        id = "d18b3463-1b5e-49e1-9ae8-1d63a10a1ccc"
+        fingerprint = "4b3d3bb65db2cdb768d91c50928081780f206208e952c74f191d8bc481ce19c6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "cd86534d709877ec737ceb016b2a5889d2e3562ffa45a278bc615838c2e9ebc3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { DF 77 95 8D 42 FA 3C 01 76 8E 80 FA 0B 74 89 80 FA 15 74 84 80 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_fe721dc5 {
+    meta:
+        id = "fe721dc5-c2bc-4fa6-bdbc-589c6e033e6b"
+        fingerprint = "ab7f571a3a3f6b50b9e120612b3cc34d654fc824429a2971054ca0d078ecb983"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 18 EB E1 57 83 EC 08 8B 7C 24 10 8B 4C 24 14 8B 54 24 18 53 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_575f5bc8 {
+    meta:
+        id = "575f5bc8-b848-4db4-a99c-132d4d2bc8a4"
+        fingerprint = "58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_449937aa {
+    meta:
+        id = "449937aa-682a-4906-89ab-80d7127e461e"
+        fingerprint = "cf2c6b86830099f039b41aeaafbffedfb8294a1124c499e99a11f48a06cd1dfd"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "6f27766534445cffb097c7c52db1fca53b2210c1b10b75594f77c34dc8b994fe"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 5B 72 65 73 6F 6C 76 5D 20 46 6F 75 6E 64 20 49 50 20 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_2e3f67a9 {
+    meta:
+        id = "2e3f67a9-6fd5-4457-a626-3a9015bdb401"
+        fingerprint = "6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_01e4a728 {
+    meta:
+        id = "01e4a728-7c1c-479b-aed0-cb76d64dbb02"
+        fingerprint = "d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_64d5cde2 {
+    meta:
+        id = "64d5cde2-e4b1-425b-8af3-314a5bf519a9"
+        fingerprint = "1a69f91b096816973ce0c2e775bcf2a54734fa8fbbe6ea1ffcf634ce2be41767"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "caf2a8c199156db2f39dbb0a303db56040f615c4410e074ef56be2662752ca9d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0F 35 7E B3 02 00 D0 02 00 00 07 01 00 00 0E 00 00 00 18 03 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_0d73971c {
+    meta:
+        id = "0d73971c-4253-4e7d-b1e1-20b031197f9e"
+        fingerprint = "95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_82c361d4 {
+    meta:
+        id = "82c361d4-2adf-48f2-a9be-677676d7451f"
+        fingerprint = "a8a4252c6f7006181bdb328d496e0e29522f87e55229147bc6cf4d496f5828fb"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "f8dbcf0fc52f0c717c8680cb5171a8c6c395f14fd40a2af75efc9ba5684a5b49"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 23 CB 67 4C 94 11 6E 75 EC A6 76 98 23 CC 80 CF AE 3E A6 0C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_ec591e81 {
+    meta:
+        id = "ec591e81-8594-4317-89b0-0fb4d43e14c1"
+        fingerprint = "fe3d305202ca5376be7103d0b40f746fc26f8e442f8337a1e7c6d658b00fc4aa"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "7d45a4a128c25f317020b5d042ab893e9875b6ff0ef17482b984f5b3fe87e451"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 22 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A 3C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_0eba3f5a {
+    meta:
+        id = "0eba3f5a-1aa8-4dc8-9f63-01bc4959792a"
+        fingerprint = "c0f4f9a93672bce63c9e3cfc389c73922c1c24a2db7728ad7ebc1d69b4db150f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "2e4f89c76dfefd4b2bfd1cf0467ac0324026355723950d12d7ed51195fd998cf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C3 55 48 89 E5 48 83 EC 40 48 89 7D C8 89 F0 66 89 45 C4 C7 45 DC 01 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_e43a8744 {
+    meta:
+        id = "e43a8744-1c52-4f95-bd16-be6722bc4d1a"
+        fingerprint = "e7ead3d1a51f0d7435a6964293a45cb8fadd739afb23dc48c1d81fbc593b23ef"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "f363d9bd2132d969cd41e79f29c53ef403da64ca8afc4643084cc50076ddfb47"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 23 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A 3C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_6e8e9257 {
+    meta:
+        id = "6e8e9257-a6d5-407a-a584-4656816a3ddc"
+        fingerprint = "4bad14aebb0b8c7aa414f38866baaf1f4b350b2026735de24bcf2014ff4b0a6a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 53 83 EC 04 8B 5C 24 18 8B 7C 24 20 8A 44 24 14 8A 54 24 1C 88 54 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_ac253e4f {
+    meta:
+        id = "ac253e4f-b628-4dd0-91f1-f19099286992"
+        fingerprint = "e2eee1f72b8c2dbf68e57b721c481a5cd85296e844059decc3548e7a6dc28fea"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 31 C9 EB 0A 6B C1 0A 0F BE D2 8D 4C 02 D0 8A 17 48 FF C7 8D }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_994535c4 {
+    meta:
+        id = "994535c4-77a6-4cc6-b673-ce120be8d0f4"
+        fingerprint = "a3753e29ecf64bef21e062b8dec96ba9066f665919d60976657b0991c55b827b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "376a2771a2a973628e22379b3dbb9a8015c828505bbe18a0c027b5d513c9e90d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 20 74 07 31 C0 48 FF C3 EB EA FF C0 83 F8 08 75 F4 48 8D 73 03 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_a68e498c {
+    meta:
+        id = "a68e498c-0768-4321-ab65-42dd6ef85323"
+        fingerprint = "951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_88de437f {
+    meta:
+        id = "88de437f-9c98-4e1d-96c0-7b433c99886a"
+        fingerprint = "c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_95e0056c {
+    meta:
+        id = "95e0056c-bc07-42cf-89ab-6c0cde3ccc8a"
+        fingerprint = "a2550fdd2625f85050cfe53159858207a79e8337412872aaa7b4627b13cb6c94"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "45f67d4c18abc1bad9a9cc6305983abf3234cd955d2177f1a72c146ced50a380"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 50 46 00 13 10 11 16 17 00 57 51 47 50 00 52 43 51 51 00 43 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_b548632d {
+    meta:
+        id = "b548632d-7916-444a-aa68-4b3e38251905"
+        fingerprint = "8b355e9c1150d43f52e6e9e052eda87ba158041f7b645f4f67c32dd549c09f28"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "639d9d6da22e84fb6b6fc676a1c4cfd74a8ed546ce8661500ab2ef971242df07"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 0B 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_e0cf29e2 {
+    meta:
+        id = "e0cf29e2-88d7-4aa4-b60a-c24626f2b246"
+        fingerprint = "3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_1754b331 {
+    meta:
+        id = "1754b331-5704-43c1-91be-89c7a0dd29a4"
+        fingerprint = "35db945d116a4c9264af44a9947a5e831ea655044728dc78770085c7959a678e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "0d89fc59d0de2584af0e4614a1561d1d343faa766edfef27d1ea96790ac7014b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { CF 07 66 5F 10 F0 EB 0C 42 0B 2F 0B 0B 43 C1 42 E4 C2 7C 85 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_3278f1b8 {
+    meta:
+        id = "3278f1b8-f208-42c8-a851-d22413f74dea"
+        fingerprint = "7e9fc284c9c920ac2752911d6aacbc3c2bf1b053aa35c22d83bab0089290778d"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D2 0F B6 C3 C1 E0 10 0F B6 C9 C1 E2 18 09 C2 0F B6 44 24 40 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_ab804bb7 {
+    meta:
+        id = "ab804bb7-57ab-48db-85cc-a6d88de0c84a"
+        fingerprint = "b9716aa7be1b0e4c966a25a40521114e33c21c7ec3c4468afc1bf8378dd11932"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "8f0cc764729498b4cb9c5446f1a84cde54e828e913dc78faf537004a7df21b20"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4A 75 05 0F BE 11 01 D0 89 C2 0F B7 C0 C1 FA 10 01 C2 89 D0 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_dca3b9b4 {
+    meta:
+        id = "dca3b9b4-62f3-41ed-a3b3-80dd0990f8c5"
+        fingerprint = "b0471831229be1bcbcf6834e2d1a5b85ed66fb612868c2c207fe009ae2a0e799"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "a839437deba6d30e7a22104561e38f60776729199a96a71da3a88a7c7990246a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 83 45 F4 01 8B 45 F4 3B 45 F0 75 11 48 8B 45 F8 48 2B 45 D8 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_ae9d0fa6 {
+    meta:
+        id = "ae9d0fa6-be06-4656-9b13-8edfc0ee9e71"
+        fingerprint = "ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_612b407c {
+    meta:
+        id = "612b407c-fceb-4a19-8905-2f5b822f62cc"
+        fingerprint = "c48c26b1052ef832d4d6a106db186bf20c503bdf38392a1661eb2d3c3ec010cd"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "7833bc89778461a9f46cc47a78c67dda48b498ee40b09a80a21e67cb70c6add1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 11 B2 73 45 2B 7A 57 E2 F9 77 A2 23 EC 7C 0C 29 FE 3F B2 DE 28 6C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_d5da717f {
+    meta:
+        id = "d5da717f-3344-41a8-884e-8944172ea370"
+        fingerprint = "c3674075a435ef1cd9e568486daa2960450aa7ffa8e5dbf440a50e01803ea2f3"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "1f6bcdfc7d1c56228897cd7548266bb0b9a41b913be354036816643ac21b6f66"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 66 83 7C 24 34 FF 66 89 46 2C 0F 85 C2 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_d33095d4 {
+    meta:
+        id = "d33095d4-ea02-4588-9852-7493f6781bb4"
+        fingerprint = "20c0faab6aef6e0f15fd34f9bd173547f3195c096eb34c4316144b19d2ab1dc4"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "72326a3a9160e9481dd6fc87159f7ebf8a358f52bf0c17fbc3df80217d032635"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 66 83 7C 24 54 FF 66 89 46 04 0F 85 CB }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_4e2246fb {
+    meta:
+        id = "4e2246fb-5f9a-4dea-8041-51758920d0b9"
+        fingerprint = "23b0cfabc2db26153c02a7dc81e2006b28bfc9667526185b2071b34d2fb073c4"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "1f6bcdfc7d1c56228897cd7548266bb0b9a41b913be354036816643ac21b6f66"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 B8 01 00 00 00 31 DB CD 80 EB FA 8D 8B 10 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_d5981806 {
+    meta:
+        id = "d5981806-0db8-4422-ad57-5d1c0f7464c3"
+        fingerprint = "b0fd8632505252315ba551bb3680fa8dc51038be17609018bf9d92c3e1c43ede"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "784f2005853b5375efaf3995208e4611b81b8c52f67b6dc139fd9fec7b49d9dc"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 3F 00 00 66 83 7C 24 38 FF 66 89 46 04 0F 85 EA }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_c6055dc9 {
+    meta:
+        id = "c6055dc9-316b-478d-9997-1dbf455cafcc"
+        fingerprint = "b95f582edf2504089ddd29ef1a0daf30644b364f3d90ede413a2aa777c205070"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "c1718d7fdeef886caa33951e75cbd9139467fa1724605fdf76c8cdb1ec20e024"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 83 7F 43 80 77 39 CF 7E 09 83 C8 FF 5A 5D 8A 0E }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_3b9675fd {
+    meta:
+        id = "3b9675fd-1fa1-4e15-9472-64cb93315d63"
+        fingerprint = "40a154bafa72c5aa0c085ac2b92b5777d1acecfd28d28b15c7229ba5c59435f2"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "4ec4bc88156bd51451fdaf0550c21c799c6adacbfc654c8ec634ebca3383bd66"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 78 10 85 C9 75 65 48 8B 8C 24 A0 00 00 00 48 89 48 10 0F B6 4C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_1c0d246d {
+    meta:
+        id = "1c0d246d-dc23-48d6-accb-1e1db1eba49b"
+        fingerprint = "b6b6991e016419b1ddf22822ce76401370471f852866f0da25c7b0f4bec530ee"
+        creation_date = "2021-04-13"
+        last_modified = "2021-09-16"
+        description = "Based off community provided sample"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "211cfe9d158c8a6840a53f2d1db2bf94ae689946fffb791eed3acceef7f0e3dd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E7 C0 00 51 78 0F 1B FF 8A 7C 18 27 83 2F 85 2E CB 14 50 2E }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_ad337d2f {
+    meta:
+        id = "ad337d2f-d4ac-42a7-9d2e-576fe633fa16"
+        fingerprint = "67cbcb8288fe319c3b8f961210748f7cea49c2f64fc2f1f55614d7ed97a86238"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference = "012b717909a8b251ec1e0c284b3c795865a32a1f4b79706d2254a4eb289c30a7"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 01 75 14 80 78 FF 2F 48 8D 40 FF 0F 94 C2 48 39 D8 77 EB 84 D2 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_88a1b067 {
+    meta:
+        id = "88a1b067-11d5-4128-b763-2d1747c95eef"
+        fingerprint = "b32b42975297aed7cef72668ee272a5cfb753dce7813583f0c3ec91e52f8601f"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference = "1a62db02343edda916cbbf463d8e07ec2ad4509fd0f15a5f6946d0ec6c332dd9"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 00 55 89 E5 0F B6 55 08 0F B6 45 0C C1 E2 18 C1 E0 10 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_76bbc4ca {
+    meta:
+        id = "76bbc4ca-e6da-40f7-8ba6-139ec8393f35"
+        fingerprint = "4206c56b538eb1dd97e8ba58c5bab6e21ad22a0f8c11a72f82493c619d22d9b7"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mirai"
+        reference = "1a9ff86a66d417678c387102932a71fd879972173901c04f3462de0e519c3b51"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 40 2D E9 00 40 A0 E1 28 20 84 E2 0C 00 92 E8 3B F1 FF EB }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_0bfc17bd {
+    meta:
+        id = "0bfc17bd-49bb-4721-9653-0920b631b1de"
+        fingerprint = "d67e4e12e74cbd31037fae52cf7bad8d8d5b4240d79449fa1ebf9a271af008e1"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "1cdd94f2a1cb2b93134646c171d947e325a498f7a13db021e88c05a4cbb68903"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 54 24 64 0F CD 48 8D 14 52 41 0F B6 4C D7 14 D3 E8 01 C5 83 7C 24 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_dab39a25 {
+    meta:
+        id = "dab39a25-852b-441f-86ab-23d945daa62c"
+        fingerprint = "5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0E 75 20 50 6A 00 6A 00 6A 00 53 6A 0E FF 74 24 48 68 DD 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_389ee3e9 {
+    meta:
+        id = "389ee3e9-70c1-4c93-a999-292cf6ff1652"
+        fingerprint = "59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_cc93863b {
+    meta:
+        id = "cc93863b-1050-40ba-9d02-5ec9ce6a3a28"
+        fingerprint = "f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mirai_8aa7b5d3 {
+    meta:
+        id = "8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9"
+        fingerprint = "02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Mirai"
+        reference_sample = "5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Mobidash.yar b/yara/rules/Linux_Trojan_Mobidash.yar
new file mode 100644
index 00000000..ac74ae79
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Mobidash.yar
@@ -0,0 +1,243 @@
+rule Linux_Trojan_Mobidash_52a15a93 {
+    meta:
+        id = "52a15a93-0574-44bb-83c9-793558432553"
+        fingerprint = "a7ceff3bbd61929ab000d18ffdf2e8d1753ecea123e26cd626e3af64341effe6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mobidash"
+        reference_sample = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 41 89 CE 41 55 41 54 49 89 F4 55 48 89 D5 53 48 89 FB 48 8B 07 FF 90 F8 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mobidash_d0ad9c82 {
+    meta:
+        id = "d0ad9c82-718f-43d1-a764-9be83893f9b8"
+        fingerprint = "ef6b2f9383c137eb4adfe0a6322a0e5d71cb4a5712f1be26fe687144933cbbc8"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mobidash"
+        reference_sample = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 41 54 49 89 CC 55 48 89 D5 53 48 89 FB 48 8D 64 24 F8 48 8B 07 FF 90 F8 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mobidash_e2c89606 {
+    meta:
+        id = "e2c89606-511c-403a-a4eb-d18dc7aca444"
+        fingerprint = "91c51f6af18389f2efb0032e0b775df68f34b66795c05623dccb67266c04214b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mobidash"
+        reference_sample = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 13 49 89 C7 4C 89 E6 48 89 DF FF 92 B8 00 00 00 31 C9 4C 89 FA 4C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mobidash_82b4e3f3 {
+    meta:
+        id = "82b4e3f3-a9ba-477c-8eef-6010767be52f"
+        fingerprint = "a01f5ba8b3e8e82ff46cb748fd90a103009318a25f8532fb014722c96f0392db"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mobidash"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 C6 74 2E 89 44 24 0C 8B 44 24 24 C7 44 24 08 01 00 00 00 89 7C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mobidash_601352dc {
+    meta:
+        id = "601352dc-13b6-4c3f-a013-c54a50e46820"
+        fingerprint = "acfca9259360641018d2bf9ba454fd5b65224361933557e007ab5cfb12186cd7"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mobidash"
+        reference_sample = "5714e130075f4780e025fb3810f58a63e618659ac34d12abe211a1b6f2f80269"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F6 74 14 48 8B BC 24 D0 00 00 00 48 8B 07 48 8B 80 B8 00 00 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mobidash_ddca1181 {
+    meta:
+        id = "ddca1181-91ca-4e5d-953f-be85838d3cb9"
+        fingerprint = "c8374ff2a85f90f153bcd2451109a65d3757eb7cef21abef69f7c6a4f214b051"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mobidash"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 84 C0 75 1E 8B 44 24 2C 89 7C 24 04 89 34 24 89 44 24 0C 8B 44 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mobidash_65e666c0 {
+    meta:
+        id = "65e666c0-4eb7-4411-8743-053b6c0ec1d6"
+        fingerprint = "92b7de293a7e368d0e92a6e2061e9277e7b285851322357808a04f8c203b20d0"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mobidash"
+        reference_sample = "19f9b5382d3e8e604be321aefd47cb72c2337a170403613b853307c266d065dd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4C 8B 44 24 08 48 89 DF 48 8B 14 24 48 8D 64 24 18 5B 4C 89 E6 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mobidash_494d5b0f {
+    meta:
+        id = "494d5b0f-09c7-4fcb-90e9-1efc57c45082"
+        fingerprint = "e3316257592dc9654a5e63cf33c862ea1298af7a893e9175e1a15c7aaa595f6a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mobidash"
+        reference_sample = "7e08df5279f4d22f1f27553946b0dadd60bb8242d522a8dceb45ab7636433c2f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 18 00 00 00 40 04 00 00 01 5B 00 00 00 3A 00 00 00 54 04 00 00 05 A1 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mobidash_bb4f7f39 {
+    meta:
+        id = "bb4f7f39-1f1c-4a2d-a480-3e1d2b6967b7"
+        fingerprint = "b7e96ff17a19ffcbfc87cdba3f86216271ff01c460ff7564f6af6b40c21a530b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mobidash"
+        reference_sample = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 75 1F 48 8D 64 24 08 48 89 DF 5B 48 89 EA 4C 89 E1 4C 89 EE 5D }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mobidash_8679e1cb {
+    meta:
+        id = "8679e1cb-407e-4554-8ef5-ece5110735c6"
+        fingerprint = "7e517bf9e036410acf696c85bd39c720234b64aab8c5b329920a64f910c72c92"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mobidash"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 1C 89 F0 5B 5E 5F 5D C3 8D 76 00 8B 44 24 34 83 C6 01 8D 7C }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mobidash_29b86e6a {
+    meta:
+        id = "29b86e6a-fcad-49ac-ae78-ce28987f7363"
+        fingerprint = "5d7d930f39e435fc22921571fe96db912eed79ec630d4ed60da6f007073b7362"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mobidash"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 2E 10 73 2E 10 02 47 2E 10 56 2E 10 5C 2E 10 4E 2E 10 49 2E 10 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mobidash_e3086563 {
+    meta:
+        id = "e3086563-346d-43f1-89eb-42693dc17195"
+        fingerprint = "8fc223f3850994479a70358da66fb31b610e00c9cbc3a94fd7323780383d738e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mobidash"
+        reference_sample = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 48 8B 4C 24 08 49 8B 55 00 48 39 D1 75 16 48 8D 64 24 10 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Mobidash_2f114992 {
+    meta:
+        id = "2f114992-36a7-430c-8bd9-5661814d95a8"
+        fingerprint = "2371fc5ba1e279a77496328d3a39342408609f04f1a8947e84e734d28d874416"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mobidash"
+        reference_sample = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { DF 4C 89 F6 48 8B 80 B8 00 00 00 48 8D 64 24 58 5B 5D 41 5C }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Morpes.yar b/yara/rules/Linux_Trojan_Morpes.yar
new file mode 100644
index 00000000..7268abb5
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Morpes.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Morpes_d2ae1edf {
+    meta:
+        id = "d2ae1edf-7dd3-4506-96e0-039c8f00d688"
+        fingerprint = "a4cedb0ef6c9c5121ee63c0c8f6bb8072f62b5866c916c7000d94999cd61b9b5"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Morpes"
+        reference_sample = "14c4c297388afe4be47be091146aea6c6230880e9ea43759ef29fc1471c4b86b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 64 B0 05 00 00 B0 05 00 00 B0 05 00 00 3C 00 00 00 3C 00 00 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Mumblehard.yar b/yara/rules/Linux_Trojan_Mumblehard.yar
new file mode 100644
index 00000000..c63dee57
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Mumblehard.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Mumblehard_523450aa {
+    meta:
+        id = "523450aa-6bb4-4863-9656-81a6e6cb7d88"
+        fingerprint = "783f07e4f4625c061309af2d89e9ece0ba4a8ce21a7d93ce19cd32bcd6ad38e9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Mumblehard"
+        reference_sample = "a637ea8f070e1edf2c9c81450e83934c177696171b24b4dff32dfb23cefa56d3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 09 75 05 89 03 89 53 04 B8 02 00 00 00 50 80 F9 09 75 0B CD 80 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Neshta.yar b/yara/rules/Linux_Trojan_Neshta.yar
new file mode 100644
index 00000000..b9bc4618
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Neshta.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Neshta_e856e9fb {
+    meta:
+        id = "e856e9fb-24b6-47bc-9e38-db50ff091aa9"
+        fingerprint = "be36444e7cf3911d52960e28f83a04979b4669f56bc9fa7129ab852a1f17739b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Neshta"
+        reference_sample = "d69378cbb14d524f38a9b33ceeff22cfeb74ed481ffffa8aa279713d050588ae"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6F 66 20 70 72 6F 63 65 73 73 65 73 20 28 72 65 63 6F 6D 6D }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Ngioweb.yar b/yara/rules/Linux_Trojan_Ngioweb.yar
new file mode 100644
index 00000000..dc85bd71
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Ngioweb.yar
@@ -0,0 +1,170 @@
+rule Linux_Trojan_Ngioweb_8bd3002c {
+    meta:
+        id = "8bd3002c-d9c7-4f93-b7f0-4cb9ba131338"
+        fingerprint = "2ee5432cf6ead4eca3aad70e40fac7e182bdcc74dc22dc91a12946ae4182f1ab"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ngioweb"
+        reference_sample = "5480bc02aeebd3062e6d19e50a5540536ce140d950327cce937ff7e71ebd15e2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 18 67 8A 09 84 C9 74 0D 80 F9 2E 75 02 FF C0 FF 44 24 18 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ngioweb_a592a280 {
+    meta:
+        id = "a592a280-053f-47bc-8d74-3fa5d74bd072"
+        fingerprint = "60f5ddd115fa1abac804d2978bbb8d70572de0df9da80686b5652520c03bd1ee"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ngioweb"
+        reference_sample = "5480bc02aeebd3062e6d19e50a5540536ce140d950327cce937ff7e71ebd15e2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 75 06 8B 7C 24 2C EB 2C 83 FD 01 75 06 8B 7C 24 3C EB 21 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ngioweb_d57aa841 {
+    meta:
+        id = "d57aa841-8eb5-4765-9434-233ab119015f"
+        fingerprint = "83a4eb7c8ac42097d3483bcf918823105b4ea4291a566b4184eacc2a0f3aa3a4"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ngioweb"
+        reference_sample = "555d60bd863caff231700c5f606d0034d5aa8362862d1fd0c816615d59f582f7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 0C 48 89 4C 24 10 4C 89 44 24 18 66 83 F8 02 74 10 BB 10 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ngioweb_b97e0253 {
+    meta:
+        id = "b97e0253-497f-4c2c-9d4c-ad89af64847f"
+        fingerprint = "859f29acec8bb05b8a8e827af91e927db0b2390410179a0f5b03e7f71af64949"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ngioweb"
+        reference_sample = "5480bc02aeebd3062e6d19e50a5540536ce140d950327cce937ff7e71ebd15e2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 41 5C 41 5D 41 5E 41 5F C3 67 0F BE 17 39 F2 74 12 84 D2 74 04 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ngioweb_66c465a0 {
+    meta:
+        id = "66c465a0-821d-43ea-82f5-fe787720bfbf"
+        fingerprint = "e26071afff71506236b261a44e8f1903d348dd33b95597458649f377710492f4"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ngioweb"
+        reference_sample = "7454ee074812d7fa49044de8190e17b5034b3f08625f547d1b04aae4054fd81a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 75 E6 B2 07 FE C0 EB DE 83 EC 10 6A 00 6A 00 6A 00 6A 00 FF 74 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ngioweb_d8573802 {
+    meta:
+        id = "d8573802-f141-4fd1-b06a-605451a72465"
+        fingerprint = "0052566dda66ae0dfa54d68f4ce03b5a2e2a442c4a18d70f16fd02303a446e66"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ngioweb"
+        reference_sample = "7454ee074812d7fa49044de8190e17b5034b3f08625f547d1b04aae4054fd81a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 40 74 38 51 51 6A 02 FF 74 24 18 FF 93 C8 00 00 00 83 C4 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ngioweb_7926bc8e {
+    meta:
+        id = "7926bc8e-110f-4b8a-8cc5-003732b6fcfd"
+        fingerprint = "246e06d73a3a61ade6ac5634378489890a5585e84be086e0a81eb7586802e98f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ngioweb"
+        reference_sample = "555d60bd863caff231700c5f606d0034d5aa8362862d1fd0c816615d59f582f7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { ED 74 31 48 8B 5B 10 4A 8D 6C 3B FC 48 39 EB 77 23 8B 3B 48 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ngioweb_e2377400 {
+    meta:
+        id = "e2377400-8884-42fb-b524-9cdf836dac3a"
+        fingerprint = "531a8fcb1c097f72cb9876a35ada622dd1129f90515d84b4c245920602419698"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ngioweb"
+        reference_sample = "b88daf00a0e890b6750e691856b0fe7428d90d417d9503f62a917053e340228b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { EC 08 8B 5C 24 10 8B 43 20 85 C0 74 72 83 7B 28 00 74 6C 83 7B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Ngioweb_994f1e97 {
+    meta:
+        id = "994f1e97-c370-4eb2-ac93-b5ebf112f55d"
+        fingerprint = "6cc0ace6beb6c1bf4e10f9781bb551c10f48cc23efe9529d92b432b0ff88f245"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Ngioweb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C6 44 24 16 68 C6 44 24 15 63 C6 44 24 14 74 C6 44 24 13 61 C6 44 24 12 77 C6 44 24 11 2F C6 44 24 10 76 C6 44 24 0F 65 C6 44 24 0E 64 C6 44 24 0D 2F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Nuker.yar b/yara/rules/Linux_Trojan_Nuker.yar
new file mode 100644
index 00000000..542698d5
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Nuker.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Nuker_12f26779 {
+    meta:
+        id = "12f26779-bda5-45b1-925f-75c620d7d840"
+        fingerprint = "9093a96321ad912f2bb953cce460d0945c1c4e5aacd8431f343498203b85bb9b"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Nuker"
+        reference_sample = "440105a62c75dea5575a1660fe217c9104dc19fb5a9238707fe40803715392bf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C4 18 89 45 D8 83 7D D8 FF 75 17 68 ?? ?? 04 08 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Patpooty.yar b/yara/rules/Linux_Trojan_Patpooty.yar
new file mode 100644
index 00000000..673169dc
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Patpooty.yar
@@ -0,0 +1,38 @@
+rule Linux_Trojan_Patpooty_e2e0dff1 {
+    meta:
+        id = "e2e0dff1-bb01-437e-b138-7da3954dc473"
+        fingerprint = "275ff92c5de2d2183ea8870b7353d24f026f358dc7d30d1a35d508a158787719"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Patpooty"
+        reference_sample = "d38b9e76cbc863f69b29fc47262ceafd26ac476b0ae6283d3fa50985f93bedf3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F0 8B 45 E4 8B 34 88 8D 7E 01 FC 31 C0 83 C9 FF F2 AE F7 D1 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Patpooty_f90c7e43 {
+    meta:
+        id = "f90c7e43-0c32-487f-a7c2-8290b341019c"
+        fingerprint = "b0b0fd8da224bcd1c048c5578ed487d119f9bff4fb465f77d3043cf77d904f3d"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Patpooty"
+        reference_sample = "79475a66be8741d9884bc60f593c81a44bdb212592cd1a7b6130166a724cb3d3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C2 48 39 C2 75 F1 C7 43 58 01 00 00 00 C7 43 54 01 00 00 00 C7 43 50 01 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Pidief.yar b/yara/rules/Linux_Trojan_Pidief.yar
new file mode 100644
index 00000000..21ea85b9
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Pidief.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Pidief_635667d1 {
+    meta:
+        id = "635667d1-4b51-4e18-9e6b-5873194ce4f1"
+        fingerprint = "29e1795f941990ca18fbe61154d3cfe23d43d13af298e763cd40fb9c40d7204e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Pidief"
+        reference_sample = "e27ad676ae12188de7a04a3781aa487c11bab01d7848705bac5010d2735b19cf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 06 4C 89 F7 FF 50 10 48 8B 45 00 48 89 EF FF 50 10 85 DB 75 15 4D }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Pnscan.yar b/yara/rules/Linux_Trojan_Pnscan.yar
new file mode 100644
index 00000000..e328e078
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Pnscan.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Pnscan_20e34e35 {
+    meta:
+        id = "20e34e35-8639-4a0d-bfe3-6bfa1570f14d"
+        fingerprint = "07678bd23ae697d42e2c7337675f7a50034b10ec7a749a8802820904a943641a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Pnscan"
+        reference_sample = "7dbd5b709f16296ba7dac66dc35b9c3373cf88452396d79d0c92d7502c1b0005"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4C 00 54 45 4C 20 3A 20 00 3C 49 41 43 3E 00 3C 44 4F 4E 54 3E 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Pornoasset.yar b/yara/rules/Linux_Trojan_Pornoasset.yar
new file mode 100644
index 00000000..955cdc80
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Pornoasset.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Pornoasset_927f314f {
+    meta:
+        id = "927f314f-2cbb-4f87-b75c-9aa5ef758599"
+        fingerprint = "7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Pornoasset"
+        reference_sample = "d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Psybnc.yar b/yara/rules/Linux_Trojan_Psybnc.yar
new file mode 100644
index 00000000..7e24bad2
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Psybnc.yar
@@ -0,0 +1,57 @@
+rule Linux_Trojan_Psybnc_563ecb11 {
+    meta:
+        id = "563ecb11-e215-411f-8583-7cb7b2956252"
+        fingerprint = "1e7a2a6240d6f7396505cc2203c03d4ae93a7ef0c0c956cef7a390b4303a2cbe"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Psybnc"
+        reference_sample = "f77216b169e8d12f22ef84e625159f3a51346c2b6777a1fcfb71268d17b06d39"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 5F 65 6E 00 6B 6F 5F 65 6E 00 72 75 5F 65 6E 00 65 73 5F 65 6E 00 44 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Psybnc_ab3396d5 {
+    meta:
+        id = "ab3396d5-388b-4730-9a55-581c327a2769"
+        fingerprint = "1180e02d3516466457f48dc614611a6949a4bf21f6a294f6384892db30dc4171"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Psybnc"
+        reference_sample = "c5ec84e7cc891af25d6319abb07b1cedd90b04cbb6c8656c60bcb07e60f0b620"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 53 54 00 55 53 45 52 4F 4E 00 30 00 50 25 64 00 58 30 31 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Psybnc_f07357f1 {
+    meta:
+        id = "f07357f1-1a92-4bd7-a43d-7a75fb90ac83"
+        fingerprint = "f0f1008fec444ce25d80f9878a04d9ebe9a76f792f4be8747292ee7b133ea05c"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Psybnc"
+        reference_sample = "f77216b169e8d12f22ef84e625159f3a51346c2b6777a1fcfb71268d17b06d39"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F7 EA 89 D0 C1 F8 02 89 CF C1 FF 1F 29 F8 8D 04 80 01 C0 29 C1 8D }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Rbot.yar b/yara/rules/Linux_Trojan_Rbot.yar
new file mode 100644
index 00000000..82c627c4
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Rbot.yar
@@ -0,0 +1,57 @@
+rule Linux_Trojan_Rbot_c69475e3 {
+    meta:
+        id = "c69475e3-59eb-4d3c-9ee6-01ae7a3973d3"
+        fingerprint = "593ff388ba10d66b97b5dfc9220bbda6b1584fe73d6bf7c1aa0f5391bb87e939"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Rbot"
+        reference_sample = "9d97c69b65d2900c39ca012fe0486e6a6abceebb890cbb6d2e091bb90f6b9690"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 56 8B 76 20 03 F5 33 C9 49 41 AD 33 DB 36 0F BE 14 28 38 F2 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Rbot_96625c8c {
+    meta:
+        id = "96625c8c-897c-4bf0-97e7-0dc04595cb94"
+        fingerprint = "5dfabf693c87742ffa212573dded84a2c341628b79c7d11c16be493957c71a69"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Rbot"
+        reference_sample = "a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Rbot_366f1599 {
+    meta:
+        id = "366f1599-a287-44e6-bc2c-d835b2c2c024"
+        fingerprint = "27166c9dab20d40c10a4f0ea5d0084be63fef48748395dd55c7a13ab6468e16d"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Rbot"
+        reference_sample = "5553d154a0e02e7f97415299eeae78e5bb0ecfbf5454e3933d6fd9675d78b3eb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Rekoobe.yar b/yara/rules/Linux_Trojan_Rekoobe.yar
new file mode 100644
index 00000000..9f2200e7
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Rekoobe.yar
@@ -0,0 +1,114 @@
+rule Linux_Trojan_Rekoobe_e75472fa {
+    meta:
+        id = "e75472fa-0263-4a47-a3bd-2d1bb14df177"
+        fingerprint = "4e7605685ba7ba53afeafdef7e46bdca76109bd4d8b9116a93c301edeff606ee"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Rekoobe"
+        reference_sample = "8d2a9e363752839a09001a9e3044ab7919daffd9d9aee42d936bc97394164a88"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 00 83 F8 01 74 1F 89 D0 48 8B 4C 24 08 64 48 33 0C 25 28 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Rekoobe_52462fe8 {
+    meta:
+        id = "52462fe8-a40c-4620-b539-d0c1f9d2ceee"
+        fingerprint = "e09e8e023b3142610844bf7783c5472a32f63c77f9a46edc028e860da63e6eeb"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Rekoobe"
+        reference_sample = "c1d8c64105caecbd90c6e19cf89301a4dc091c44ab108e780bdc8791a94caaad"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 1C D8 48 8B 5A E8 4A 33 0C DE 48 89 4A E0 89 D9 C1 E9 18 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Rekoobe_de9e7bdf {
+    meta:
+        id = "de9e7bdf-c515-4af8-957a-e489b7cb9716"
+        fingerprint = "ab3f0b9179a136f7c1df43234ba3635284663dee89f4e48d9dfc762fb762f0db"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Rekoobe"
+        reference_sample = "447da7bee72c98c2202f1919561543e54ec1b9b67bd67e639b9fb6e42172d951"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F5 48 89 D6 48 C1 EE 18 40 0F B6 F6 48 33 2C F1 48 89 D6 48 C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Rekoobe_b41f70c2 {
+    meta:
+        id = "b41f70c2-abe4-425a-952f-5e0c9e572a76"
+        fingerprint = "396fcb4333abe90f4c228d06c20eeff40f91e25fde312cc7760d999da0aa1027"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Rekoobe"
+        reference_sample = "19c1a54279be1710724fc75a112741575936fe70379d166effc557420da714cd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E2 10 4D 31 D1 0F B6 D6 48 8B 14 D1 48 C1 E2 08 4C 31 CA 48 89 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Rekoobe_1d307d7c {
+    meta:
+        id = "1d307d7c-cc84-44e5-8fa0-eda9fffb3964"
+        fingerprint = "11b1474dbdc376830bca50dbeea7f7f786c8a9b2ac51a139c4e06bed7c867121"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Rekoobe"
+        reference_sample = "00bc669f79b2903c5d9e6412050655486111647c646698f9a789e481a7c98662"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F8 01 75 56 83 7C 24 3C 10 75 1C BE ?? ?? 60 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Rekoobe_7f7aba78 {
+    meta:
+        id = "7f7aba78-6e64-41c4-a542-088a8270a941"
+        fingerprint = "acb8f0fb7a7b0c5329afeadb70fc46ab72a7704cdeef64e7575fbf2c2dd3dbe2"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Rekoobe"
+        reference_sample = "50b73742726b0b7e00856e288e758412c74371ea2f0eaf75b957d73dfb396fd7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F0 89 D0 31 D8 21 F0 31 D8 03 45 F0 89 CF C1 CF 1B 01 F8 C1 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Roopre.yar b/yara/rules/Linux_Trojan_Roopre.yar
new file mode 100644
index 00000000..50b490dd
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Roopre.yar
@@ -0,0 +1,38 @@
+rule Linux_Trojan_Roopre_b6b9e71d {
+    meta:
+        id = "b6b9e71d-7f1c-4827-b659-f9dad5667d69"
+        fingerprint = "1a87cccd06b99e0375ffef17d4b3c5fd8957013ab8de7507e9b8d1174573a6cf"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Roopre"
+        reference_sample = "36ae2bf773135fdb0ead7fbbd46f90fd41d6f973569de1941c8723158fc6cfcc"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 54 24 08 48 C7 C6 18 FC FF FF 49 8B 4A 08 48 89 C8 48 99 48 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Roopre_05f7f237 {
+    meta:
+        id = "05f7f237-dcc5-4f0d-8baa-290137eea9c5"
+        fingerprint = "2f1d7fd2d0104be63180003ae225eafa95f9d967154d3972782502742bbedf43"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Roopre"
+        reference_sample = "36ae2bf773135fdb0ead7fbbd46f90fd41d6f973569de1941c8723158fc6cfcc"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 01 3A 74 06 80 7F 02 5C 75 1F 48 83 C7 03 B2 5C EB E8 38 D1 48 8D }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Rooter.yar b/yara/rules/Linux_Trojan_Rooter.yar
new file mode 100644
index 00000000..3d85a9f7
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Rooter.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Rooter_c8d08d3a {
+    meta:
+        id = "c8d08d3a-ff9c-4545-9f09-45fbe5b534f3"
+        fingerprint = "2a09f9fabfefcf44c71ee17b823396991940bedd7a481198683ee3e88979edf4"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Rooter"
+        reference_sample = "f55e3aa4d875d8322cdd7caa17aa56e620473fe73c9b5ae0e18da5fbc602a6ba"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D8 DC 04 08 BB 44 C3 04 08 CD 80 C7 05 48 FB 04 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Rotajakiro.yar b/yara/rules/Linux_Trojan_Rotajakiro.yar
new file mode 100644
index 00000000..c1856681
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Rotajakiro.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Rotajakiro_fb24f399 {
+    meta:
+        id = "fb24f399-d2bc-4cca-a3b8-4d924f11c83e"
+        fingerprint = "6b19a49c93a0d3eb380c78ca21ce4f4d2991c35e68d2b75e173dc25118ba2c20"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Rotajakiro"
+        reference = "023a7f9ed082d9dd7be6eba5942bfa77f8e618c2d15a8bc384d85223c5b91a0c"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 41 56 41 55 41 54 49 89 FD 55 53 48 63 DE 48 83 EC 08 0F B6 17 80 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Rozena.yar b/yara/rules/Linux_Trojan_Rozena.yar
new file mode 100644
index 00000000..13bc5ec2
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Rozena.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Rozena_56651c1d {
+    meta:
+        id = "56651c1d-548e-4a51-8f1c-e4add55ec14f"
+        fingerprint = "a86abe550b5c698a244e1c0721cded8df17d2c9ed0ee764d6dea36acf62393de"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Rozena"
+        reference_sample = "997684fb438af3f5530b0066d2c9e0d066263ca9da269d6a7e160fa757a51e04"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 E1 95 68 A4 1A 70 C7 57 FF D6 6A 10 51 55 FF D0 68 A4 AD }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Sambashell.yar b/yara/rules/Linux_Trojan_Sambashell.yar
new file mode 100644
index 00000000..7027c5ac
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Sambashell.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Sambashell_f423755d {
+    meta:
+        id = "f423755d-60ec-4442-beb1-0820df0fe00b"
+        fingerprint = "ea13320c358cadc8187592de73ceb260a00f28907567002d4f093be21f111f74"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Sambashell"
+        reference_sample = "bd8a3728a59afbf433799578ef597b9a7211c8d62e87a25209398814851a77ea"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 01 00 00 00 FC 0E 00 00 FC 1E 00 00 FC 1E 00 00 74 28 00 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Sckit.yar b/yara/rules/Linux_Trojan_Sckit.yar
new file mode 100644
index 00000000..2e7f8ec7
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Sckit.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Sckit_a244328f {
+    meta:
+        id = "a244328f-1e12-4ae6-b583-ecf14a4b9d82"
+        fingerprint = "eca152c730ecabbc9fe49173273199cb37b343d038084965ad880ddba3173f50"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Sckit"
+        reference_sample = "685da66303a007322d235b7808190c3ea78a828679277e8e03e6d8d511df0a30"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 34 D0 04 08 BB 24 C3 04 08 CD 80 C7 05 A0 EE 04 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Sdbot.yar b/yara/rules/Linux_Trojan_Sdbot.yar
new file mode 100644
index 00000000..575615b3
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Sdbot.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Sdbot_98628ea1 {
+    meta:
+        id = "98628ea1-40d8-4a05-835f-a5a5f83637cb"
+        fingerprint = "15cf6b916dd87915738f3aa05a2955c78a357935a183c0f88092d808535625a5"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Sdbot"
+        reference_sample = "5568ae1f8a1eb879eb4705db5b3820e36c5ecea41eb54a8eef5b742f477cbdd8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 54 00 3C 08 54 00 02 00 26 00 00 40 4D 08 00 5C 00 50 00 49 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Setag.yar b/yara/rules/Linux_Trojan_Setag.yar
new file mode 100644
index 00000000..9114f9bc
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Setag.yar
@@ -0,0 +1,37 @@
+rule Linux_Trojan_Setag_351eeb76 {
+    meta:
+        id = "351eeb76-ccca-40d5-8ee3-e8daf6494dda"
+        fingerprint = "c6edc7ae898831e9cc3c92fcdce4cd5b4412de061575e6da2f4e07776e0885f5"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Setag"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 04 8B 45 F8 C1 E0 02 01 C2 8B 45 EC 89 02 8D 45 F8 FF 00 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Setag_01e2f79b {
+    meta:
+        id = "01e2f79b-fcbc-41d0-a68b-3a692b893f26"
+        fingerprint = "4ea87a6ccf907babdebbbb07b9bc32a5437d0213f1580ea4b4b3f44ce543a5bd"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Setag"
+        reference_sample = "5b5e8486174026491341a750f6367959999bbacd3689215f59a62dbb13a45fcc"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0C 8B 45 EC 89 45 FC 8D 55 E8 83 EC 04 8D 45 F8 50 8D 45 FC }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Sfloost.yar b/yara/rules/Linux_Trojan_Sfloost.yar
new file mode 100644
index 00000000..538893e2
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Sfloost.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Sfloost_69a5343a {
+    meta:
+        id = "69a5343a-4885-4d88-9eaf-ddfcc95e1f39"
+        fingerprint = "c19368bf04e4b67537a8573b5beba56bab8bcfdf870640ef5bd46d40735ee539"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Sfloost"
+        reference_sample = "c0cd73db5165671c7bbd9493c34d693d25b845a9a21706081e1bf44bf0312ef9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 0F 83 C8 50 88 43 0C 0F B6 45 F0 66 C7 43 10 00 00 66 C7 43 12 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Shark.yar b/yara/rules/Linux_Trojan_Shark.yar
new file mode 100644
index 00000000..ef6d7936
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Shark.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Shark_b918ab75 {
+    meta:
+        id = "b918ab75-0701-4865-b798-521fdd2ffc28"
+        fingerprint = "15205d58af99b8eae14de2d5762fdc710ef682839967dd56f6d65bd3deaa7981"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Shark"
+        reference_sample = "8b6fe9f496996784e42b75fb42702aa47aefe32eac6f63dd16a0eb55358b6054"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 26 00 C7 46 14 0A 00 00 00 C7 46 18 15 00 00 00 EB 30 C7 46 14 04 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Shellbot.yar b/yara/rules/Linux_Trojan_Shellbot.yar
new file mode 100644
index 00000000..d694ee3d
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Shellbot.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Shellbot_65aa6568 {
+    meta:
+        id = "65aa6568-491a-4a51-b921-c6c228cfca11"
+        fingerprint = "2cd606ecaf17322788a5ee3b6bd663bed376cef131e768bbf623c402664e9270"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Shellbot"
+        reference_sample = "457d1f4e1db41a9bdbfad78a6815f42e45da16ad0252673b9a2b5dcefc02c47b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 72 00 73 74 72 63 6D 70 00 70 61 6D 5F 70 72 6F 6D 70 74 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Skidmap.yar b/yara/rules/Linux_Trojan_Skidmap.yar
new file mode 100644
index 00000000..2f1d251d
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Skidmap.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Skidmap_aa7b661d {
+    meta:
+        id = "aa7b661d-0ecc-4171-a0c2-a6c0c91b6d27"
+        fingerprint = "0bd6bec14d4b0205b04c6b4f34988ad95161f954a1f0319dd33513cb2c7e5f59"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Skidmap"
+        reference_sample = "4282ba9b7bee69d42bfff129fff45494fb8f7db0e1897fc5aa1e4265cb6831d9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E8 41 41 80 F8 1A 41 0F 43 C1 88 04 0E 48 83 C1 01 0F B6 04 0F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Snessik.yar b/yara/rules/Linux_Trojan_Snessik.yar
new file mode 100644
index 00000000..243b483f
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Snessik.yar
@@ -0,0 +1,38 @@
+rule Linux_Trojan_Snessik_d166f98c {
+    meta:
+        id = "d166f98c-0fa3-4a1b-a6d2-7fbe4e338fc7"
+        fingerprint = "6247d59326ea71426862e1b242c7354ee369fbe6ea766e40736e2f5a6410c8d7"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Snessik"
+        reference_sample = "f3ececc2edfff2f92d80ed3a5140af55b6bebf7cae8642a0d46843162eeddddd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { D2 74 3B 83 CA FF F0 0F C1 57 10 85 D2 7F 9F 48 8D 74 24 2E 89 44 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Snessik_e435a79c {
+    meta:
+        id = "e435a79c-4b8e-42de-8d78-51b684eba178"
+        fingerprint = "bd9f81d03812e49323b86b2ea59bf5f08021d0b43f7629eb4d59e75eccb7dcf1"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Snessik"
+        reference_sample = "e24749b07f824a4839b462ec4e086a4064b29069e7224c24564e2ad7028d5d60"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C6 75 38 31 C0 48 8B 5C 24 68 48 8B 6C 24 70 4C 8B 64 24 78 4C 8B AC 24 80 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Sqlexp.yar b/yara/rules/Linux_Trojan_Sqlexp.yar
new file mode 100644
index 00000000..b3aaeb9d
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Sqlexp.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Sqlexp_1aa5001e {
+    meta:
+        id = "1aa5001e-0609-4830-9c6f-675985fa50cf"
+        fingerprint = "afce33f5bf064afcbd8b1639755733c99171074457272bf08f0c948d67427808"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Sqlexp"
+        reference_sample = "714a520fc69c54bcd422e75f4c3b71ce636cfae7fcec3c5c413d1294747d2dd6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 E3 52 53 89 E1 B0 0B CD 80 00 00 ?? 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Sshdkit.yar b/yara/rules/Linux_Trojan_Sshdkit.yar
new file mode 100644
index 00000000..cdc47efc
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Sshdkit.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Sshdkit_18a0b82a {
+    meta:
+        id = "18a0b82a-94ff-4328-bfa7-25034f170522"
+        fingerprint = "9bd28a490607b75848611389b39cf77229cfdd1e885f23c5439d49773924ce16"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Sshdkit"
+        reference_sample = "003245047359e17706e4504f8988905a219fcb48865afea934e6aafa7f97cef6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 06 2A CA 37 F2 31 18 0E 2F 47 CD 87 9D 16 3F 6D }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Sshdoor.yar b/yara/rules/Linux_Trojan_Sshdoor.yar
new file mode 100644
index 00000000..5efb721e
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Sshdoor.yar
@@ -0,0 +1,114 @@
+rule Linux_Trojan_Sshdoor_97f92ff7 {
+    meta:
+        id = "97f92ff7-b14f-4cdf-aef7-d1ca3e46ae48"
+        fingerprint = "4ad5b6b259655bf1bf58d662cf3daf3fec6ba61fcff36e24e8d239e99a8bd36f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Sshdoor"
+        reference_sample = "2e1d909e4a6ba843194f9912826728bd2639b0f34ee512e0c3c9e5ce4d27828e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C0 75 C3 48 8B 44 24 08 64 48 33 04 25 28 00 00 00 75 07 48 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Sshdoor_5b78aa01 {
+    meta:
+        id = "5b78aa01-c5d4-4281-9a2e-e3f0d3df31d3"
+        fingerprint = "19369c825bc8052bfc234a457ee4029cf48bf3b5b9a008a1a6c2680b97ae6284"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Sshdoor"
+        reference_sample = "2e1d909e4a6ba843194f9912826728bd2639b0f34ee512e0c3c9e5ce4d27828e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 11 75 39 41 0F B6 77 01 4C 89 E2 40 84 F6 74 2C 40 80 FE 5A }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Sshdoor_1b443a9b {
+    meta:
+        id = "1b443a9b-2bd2-4b63-baaa-d66ca43ba521"
+        fingerprint = "ff44d7b3c8db5cd0d12a99c2aafb1831f63c6253fe0e63fb7d2503bc74e6fca9"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Sshdoor"
+        reference_sample = "a33112daa5a7d31ea1a1ca9b910475843b7d8c84d4658ccc00bafee044382709"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 10 44 39 F8 7F B4 3B 44 24 04 7C AE 3B 44 24 0C 7E 10 41 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Sshdoor_7c36d3dd {
+    meta:
+        id = "7c36d3dd-734f-4485-85c5-906c5ecade77"
+        fingerprint = "a644708905c97c784f394ebbd0020dd3b20b52b4f536c844ca860dabea36ceb7"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Sshdoor"
+        reference_sample = "def4de838d58c70f9f0ae026cdad3bf09b711a55af97ed20804fa1e34e7b59e9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 20 48 89 E7 C1 EE 03 83 E6 01 FF D3 8B 54 24 20 31 C0 BE 20 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Sshdoor_3e81b1b7 {
+    meta:
+        id = "3e81b1b7-71bd-4876-a616-ca49ce73c2da"
+        fingerprint = "7849bb7283adb25c2ee492efd8d9b2c63de7ae701a69e1892cdc25175996b227"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Sshdoor"
+        reference_sample = "def4de838d58c70f9f0ae026cdad3bf09b711a55af97ed20804fa1e34e7b59e9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 24 48 89 E7 C1 EE 05 83 E6 01 FF D3 8B 54 24 28 31 C0 BE 5A 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Sshdoor_cde7cfd4 {
+    meta:
+        id = "cde7cfd4-a664-481d-8865-d44332c7f243"
+        fingerprint = "65bf31705755b19b1c01bd2bcc00525469c8cd35eaeff51d546a1d0667d8a615"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Sshdoor"
+        reference_sample = "cd646a1d59c99b9e038098b91cdb63c3fe9b35bb10583bef0ab07260dbd4d23d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 75 CC 8B 73 08 48 8B 54 24 08 48 83 C4 18 5B 5D 41 5C 41 5D 4C }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Subsevux.yar b/yara/rules/Linux_Trojan_Subsevux.yar
new file mode 100644
index 00000000..40816382
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Subsevux.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Subsevux_e9e80c1e {
+    meta:
+        id = "e9e80c1e-c064-47cf-91f2-0561dd5c9bcd"
+        fingerprint = "bbd7a2d80e545d0cae7705a53600f6b729918a3d655bc86b2db83f15d4e550e3"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Subsevux"
+        reference_sample = "a4ccd399ea99d4e31fbf2bbf8017c5368d29e630dc2985e90f07c10c980fa084"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 C0 89 45 F4 83 7D F4 00 79 1C 83 EC 0C 68 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Swrort.yar b/yara/rules/Linux_Trojan_Swrort.yar
new file mode 100644
index 00000000..e0f00951
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Swrort.yar
@@ -0,0 +1,57 @@
+rule Linux_Trojan_Swrort_5ad1a4f9 {
+    meta:
+        id = "5ad1a4f9-bfe5-4e5f-94e9-4983c93a1c1f"
+        fingerprint = "a91458dd4bcd082506c554ca8479e1b0d23598e0e9a0e44ae1afb2651ce38dce"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Swrort"
+        reference_sample = "fa5695c355a6dc1f368a4b36a45e8f18958dacdbe0eac80c618fbec976bac8fe"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 53 57 68 B7 E9 38 FF FF D5 53 53 57 68 74 EC 3B E1 FF D5 57 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Swrort_4cb5b116 {
+    meta:
+        id = "4cb5b116-5e90-4e5f-a62f-bfe616cab5db"
+        fingerprint = "cb783f69b4074264a75894dd85459529a172404a6901a1f5753a2f9197bfca58"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Swrort"
+        reference_sample = "703c16d4fcc6f815f540d50d8408ea00b4cf8060cc5f6f3ba21be047e32758e0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6A 00 6A 00 6A 00 6A 00 6A 00 6A 00 6A 04 6A 10 89 E1 6A 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Swrort_22c2d6b6 {
+    meta:
+        id = "22c2d6b6-d100-4310-87c4-3912a86bdd40"
+        fingerprint = "d2b16da002cb708cb82f8b96c7d31f15c9afca69e89502b1970758294e91f9a4"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Swrort"
+        reference_sample = "6df073767f48dd79f98e60aa1079f3ab0b89e4f13eedc1af3c2c073e5e235bbc"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 31 DB F7 E3 53 43 53 6A 02 89 E1 B0 66 CD 80 51 6A 04 54 6A 02 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Sysrv.yar b/yara/rules/Linux_Trojan_Sysrv.yar
new file mode 100644
index 00000000..39649200
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Sysrv.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Sysrv_85097f24 {
+    meta:
+        id = "85097f24-2e2e-41e4-8769-dca7451649cc"
+        fingerprint = "1cad651c92a163238f8d60d2e3670f229b4aafd6509892b9dcefe014b39c6f7d"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Sysrv"
+        reference = "17fbc8e10dea69b29093fcf2aa018be4d58fe5462c5a0363a0adde60f448fb26"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 32 26 02 0F 80 0C 0A FF 0B 02 02 22 04 2B 02 16 02 1C 01 0C 09 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Torii.yar b/yara/rules/Linux_Trojan_Torii.yar
new file mode 100644
index 00000000..667b27c0
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Torii.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Torii_fa253f2a {
+    meta:
+        id = "fa253f2a-d1a5-48b0-a3d6-aba06231e1ed"
+        fingerprint = "fddf2a12f09add31fffc6b11bb3fe9e0666dae57ac8cef4dbbdee58f66df2c0a"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Torii"
+        reference_sample = "19004f250b578b3b53273e8426285df2030fac0aee3227ef98e7fcbf2a8acb86"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 69 6D 65 00 47 4C 49 42 43 5F 32 2E 31 34 00 47 4C 49 42 43 5F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Truncpx.yar b/yara/rules/Linux_Trojan_Truncpx.yar
new file mode 100644
index 00000000..94c5944e
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Truncpx.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Truncpx_894d60f8 {
+    meta:
+        id = "894d60f8-bea6-4b09-b8ab-526308575a01"
+        fingerprint = "440ce5902642aeef56b6989df4462d01faadc479f1362c0ed90d1011e8737bc3"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Truncpx"
+        reference_sample = "2f09f2884fd5d3f5193bfc392656005bce6b935c12b3049ac8eb96862e4645ba"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { B9 51 FE 88 63 A1 08 08 09 C5 1A FF D3 AB B2 28 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Tsunami.yar b/yara/rules/Linux_Trojan_Tsunami.yar
new file mode 100644
index 00000000..b613865e
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Tsunami.yar
@@ -0,0 +1,531 @@
+rule Linux_Trojan_Tsunami_d9e6b88e {
+    meta:
+        id = "d9e6b88e-256c-4e9d-a411-60b477b70446"
+        fingerprint = "8fc61c0754d1a8b44cefaf2dbd937ffa0bb177d98b071347d2f9022181555b7a"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "a4ac275275e7be694a200fe6c5c5746256398c109cf54f45220637fe5d9e26ba"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 04 02 01 20 03 20 02 C9 07 40 4E 00 60 01 C0 04 17 B6 92 07 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_30c039e2 {
+    meta:
+        id = "30c039e2-1c51-4309-9165-e3f2ce79cd6e"
+        fingerprint = "4c97fed719ecfc68e7d67268f19aff545447b4447a69814470fe676d4178c0ed"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "b494ca3b7bae2ab9a5197b81e928baae5b8eac77dfdc7fe1223fee8f27024772"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 E0 0F B6 00 84 C0 74 1F 48 8B 45 E0 48 8D 50 01 48 8B 45 E8 48 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_c94eec37 {
+    meta:
+        id = "c94eec37-8ae1-48d2-8c75-36f2582a2742"
+        fingerprint = "c692073af446327f739e1c81f4e3b56d812c00c556e882fe77bfdff522082db4"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "294fcdd57fc0a53e2d63b620e85fa65c00942db2163921719d052d341aa2dc30"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 05 88 10 8B 45 E4 0F B6 10 83 E2 0F 83 CA 40 88 10 8B 45 E4 C6 40 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_f806d5d9 {
+    meta:
+        id = "f806d5d9-0bf6-4da7-80fb-b1612f2ddd5b"
+        fingerprint = "f4f838fcd1fe7f85e435225f3e34b77b848246b2b9618b47125a611c8d282347"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "5259495788f730a2a3bad7478c1873c8a6296506a778f18bc68e39ce48b979da"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 41 54 45 48 54 54 50 20 3C 68 6F 73 74 3E 20 3C 73 72 63 3A }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_0fa3a6e9 {
+    meta:
+        id = "0fa3a6e9-89f3-4bc8-8dc1-e9ccbeeb836d"
+        fingerprint = "fed796c5275e2e91c75dcdbf73d0c0ab37591115989312c6f6c5adcd138bc91f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "40a15a186373a062bfb476b37a73c61e1ba84e5fa57282a7f9ec0481860f372a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_36a98405 {
+    meta:
+        id = "36a98405-8b95-49cb-98c5-df4a445d9d39"
+        fingerprint = "c76ca23eece4c2d4ec6656ffb40d6e6ea7777d8a904f4775913fe60ebd606cd6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "a57de6cd3468f55b4bfded5f1eed610fdb2cbffbb584660ae000c20663d5b304"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 05 88 85 50 FF FF FF 0F B6 85 50 FF FF FF 83 E0 0F 83 C8 40 88 85 50 FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_0c6686b8 {
+    meta:
+        id = "0c6686b8-8880-4a2c-ba70-9a9840a618b0"
+        fingerprint = "7bab1c0cf4fb79c50369f991373178ef3b5d3f7afd765dac06e86ac0c27e0c83"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "409c55110d392aed1a9ec98a6598fb8da86ab415534c8754aa48e3949e7c4b62"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 F8 31 C0 48 8B 45 C8 0F B7 40 02 66 89 45 D0 48 8B 45 C8 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_9ce5b69f {
+    meta:
+        id = "9ce5b69f-4938-4576-89da-8dcd492708ed"
+        fingerprint = "90fece6c2950467d78c8a9f1d72054adf854f19cdb33e71db0234a7b0aebef47"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "ad63fbd15b7de4da0db1b38609b7481253c100e3028c19831a5d5c1926351829"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F4 8B 54 85 B4 8B 45 E4 8D 04 02 C6 00 00 FF 45 F4 8B 45 E4 01 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_55a80ab6 {
+    meta:
+        id = "55a80ab6-3de4-48e1-a9de-28dc3edaa104"
+        fingerprint = "2fe3a9e1115d8c2269fe090c57ee3d5b2cd52b4ba1d020cec0135e2f8bbcb50e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "5259495788f730a2a3bad7478c1873c8a6296506a778f18bc68e39ce48b979da"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 74 68 65 20 63 75 72 72 65 6E 74 20 73 70 6F 6F 66 69 6E 67 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_e98b83ee {
+    meta:
+        id = "e98b83ee-0533-481a-9947-538bd2f99b6b"
+        fingerprint = "b5440c783bc18e23f27a3131ccce4629f8d0ceea031971cbcdb69370ab52e935"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 45 FE 00 00 EB 16 48 8B 55 D8 0F B7 02 0F B7 C0 01 45 E0 48 83 45 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_8a11f9be {
+    meta:
+        id = "8a11f9be-dc85-4695-9f38-80ca0304780e"
+        fingerprint = "91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_2462067e {
+    meta:
+        id = "2462067e-06cf-409c-8184-86bd7a772690"
+        fingerprint = "f84d62ad2d6f907a47ea9ff565619648564b7003003dc8f20e28a582a8331e6b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "3847f1c7c15ce771613079419de3d5e8adc07208e1fefa23f7dd416b532853a1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8B 45 F4 8B 40 0C 89 C1 8B 45 F4 8B 40 10 8B 10 8D 45 E4 89 C7 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_0a028640 {
+    meta:
+        id = "0a028640-581f-4183-9313-e36c5812e217"
+        fingerprint = "1b296e8baffbe3e0e49aee23632afbfab75147f31561d73eb0c82f909c5ec718"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "e36081f0dbd6d523c9378cdd312e117642b0359b545b29a61d8f9027d8c0f2f0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 10 85 C0 74 2D 8B 45 0C 0F B6 00 84 C0 74 19 8B 45 0C 83 C0 01 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_47f93be2 {
+    meta:
+        id = "47f93be2-687c-42d2-9627-29f114beb234"
+        fingerprint = "f4a2262cfa0f0db37e15149cf33e639fd2cd6d58f4b89efe7860f73014b47c4e"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "2e4f89c76dfefd4b2bfd1cf0467ac0324026355723950d12d7ed51195fd998cf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FA 48 63 C6 48 89 94 C5 70 FF FF FF 8B 85 5C FF FF FF 8D 78 01 48 8D 95 60 FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_6b3974b2 {
+    meta:
+        id = "6b3974b2-fd7f-4ebf-8aba-217761e7b846"
+        fingerprint = "942a35f7acacf1d07577fe159a34dc7b04e5d07ff32ea13be975cfeea23e34be"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "2216776ba5c6495d86a13f6a3ce61b655b72a328ca05b3678d1abb7a20829d04"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F4 89 45 EC 8B 45 EC C9 C3 55 89 E5 57 83 EC 0C EB 1F 8B 45 08 B9 FF FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_87bcb848 {
+    meta:
+        id = "87bcb848-cd8b-478c-87de-5df8c457024c"
+        fingerprint = "ffd1a95ba4801bb51ce9b688bdb9787d4a8e3bc3a60ad0f52073f5c531bc6df7"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "575b0dc887d132aa3983e5712b8f642b03762b0685fbd5a32c104bca72871857"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 65 6D 6F 74 65 00 52 65 6D 6F 74 65 20 49 52 43 20 42 6F 74 00 23 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_ad60d7e8 {
+    meta:
+        id = "ad60d7e8-0823-4bfa-b823-681c554bf297"
+        fingerprint = "e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_22646c0d {
+    meta:
+        id = "22646c0d-785c-4cf2-b8c8-289189ae14d0"
+        fingerprint = "0b1dce4e74536d4d06430aefd0127c740574dcc9a0e5ada42f3d51d97437720f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "20439a8fc21a94c194888725fbbb7a7fbeef5faf4b0f704559d89f1cd2e57d9d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { CB 01 00 00 55 53 51 52 48 01 FE 56 48 89 FE 48 89 D7 31 DB }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_0e52c842 {
+    meta:
+        id = "0e52c842-f65e-4c77-8081-ae2f160e35f4"
+        fingerprint = "70fdfb7aa5d1eff98e4e216e7a60ed1ba4d75ed1f47a57bf40eeaf35a92c88e4"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 48 89 E5 53 48 83 EC 38 89 7D E4 48 89 75 D8 89 55 D4 48 89 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_019f0e75 {
+    meta:
+        id = "019f0e75-a766-4778-8337-c5bce478ecd9"
+        fingerprint = "3b66dcdd89ce564cf81689ace33ee91682972421a9926efa1985118cefebdddc"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "575b0dc887d132aa3983e5712b8f642b03762b0685fbd5a32c104bca72871857"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 2E 0A 00 2B 73 74 64 00 2B 73 74 6F 70 00 2B 75 6E 6B 6E 6F }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_7c545abf {
+    meta:
+        id = "7c545abf-822d-44bb-8ac9-1b7e4f27698d"
+        fingerprint = "4141069d6c41c0c26b53a8a86fd675f09982ca6e99757a04ef95b9ad0b8efefa"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "95691c7ad1d80f7f1b5541e1d1a1dbeba30a26702a4080d256f14edb75851c5d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 03 FC DF 40 9C B8 20 07 09 20 35 15 11 03 20 85 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_32c0b950 {
+    meta:
+        id = "32c0b950-0636-42bb-bc67-1b727985625f"
+        fingerprint = "e438287517c3492fa87115a3aa5402fd05f9745b7aed8e251fb3ed9d653984bb"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "214c1caf20ceae579476d3bf97f489484df4c5f1c0c44d37ff9b9066072cd83c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 05 20 BC F8 41 B8 20 07 09 20 35 15 11 03 20 85 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_cbf50d9c {
+    meta:
+        id = "cbf50d9c-2893-48c9-a2a9-45053f0a174b"
+        fingerprint = "acb32177d07df40112d99ed0a2b7ed01fbca63df1f63387cf939caa4cf1cf83b"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "b64d0cf4fc4149aa4f63900e61b6739e154d328ea1eb31f4c231016679fc4aa5"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 07 F8 BF 81 9C B8 20 07 09 20 35 15 11 03 20 85 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_40c25a06 {
+    meta:
+        id = "40c25a06-5f3c-42c1-9a8c-5c4a1568ff9a"
+        fingerprint = "b45d666e2e7d571e95806a1a2c8e01cd5cd0d71160cbb06b268110d459ee252d"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "61af6bb7be25465e7d469953763be5671f33c197d4b005e4a78227da11ae91e9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 20 74 13 9C B8 20 07 09 20 35 15 11 03 20 85 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_35806adc {
+    meta:
+        id = "35806adc-9bac-4481-80c8-a673730d5179"
+        fingerprint = "f0b4686087ddda1070b62ade7ad7eb69d712e15f5645aaba24c0f5b124a283ac"
+        creation_date = "2021-12-13"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "15e7942ebf88a51346d3a5975bb1c2d87996799e6255db9e92aed798d279b36b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 85 3C 93 48 1F 03 36 84 C0 4B 28 7F 18 86 13 08 10 1F EC B0 73 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_d74d7f0c {
+    meta:
+        id = "d74d7f0c-70f8-4dd7-aaf4-fd5ab94bb8b2"
+        fingerprint = "0a175d0ff64186d35b64277381f47dfafe559a42a3296a162a951f1b2add1344"
+        creation_date = "2021-12-13"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "b0a8b2259c00d563aa387d7e1a1f1527405da19bf4741053f5822071699795e2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 20 79 6F 2C 0A 59 6A 02 5B 6A 04 58 CD 80 B3 7F 6A 01 58 CD }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_71d31510 {
+    meta:
+        id = "71d31510-cd2c-4b61-b2cf-975d5ed70c93"
+        fingerprint = "6c9f3f31e9dcdcd4b414e79e06f0ae633e50ef3e19a437c1b964b40cc74a57cb"
+        creation_date = "2021-12-13"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "33dd6c0af99455a0ca3908c0117e16a513b39fabbf9c52ba24c7b09226ad8626"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 5C B3 C0 19 17 5E 7B 8B 22 16 17 E0 DE 6E 21 46 FB DD 17 67 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Tsunami_97288af8 {
+    meta:
+        id = "97288af8-f447-48ba-9df3-4e90f1420249"
+        fingerprint = "a1e20b699822b47359c8585ff01da06f585b9d7187a433fe0151394b16aa8113"
+        creation_date = "2021-12-13"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Tsunami"
+        reference_sample = "c39eb055c5f71ebfd6881ff04e876f49495c0be5560687586fc47bf5faee0c84"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 61 6E 64 65 6D 6F 20 73 68 69 72 61 6E 61 69 20 77 61 20 79 6F 2C }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Winnti.yar b/yara/rules/Linux_Trojan_Winnti.yar
new file mode 100644
index 00000000..39cc6f7d
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Winnti.yar
@@ -0,0 +1,95 @@
+rule Linux_Trojan_Winnti_61215d98 {
+    meta:
+        id = "61215d98-f52d-45d3-afa2-4bd25270aa99"
+        fingerprint = "20ee92147edbf91447cca2ee0c47768a50ec9c7aa7d081698953d3bdc2a25320"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Winnti"
+        reference_sample = "cc1455e3a479602581c1c7dc86a0e02605a3c14916b86817960397d5a2f41c31"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { FF FF FF C9 C3 55 48 89 E5 48 83 EC 30 89 F8 66 89 45 DC C7 45 FC FF FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Winnti_2a2d0b81 {
+    meta:
+        id = "2a2d0b81-9055-4b78-bbcf-c9f43598bf1a"
+        fingerprint = "6a775740f8816c7c684515bc776cd82cee541d2a850633ac1dbd9b719df97c57"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Winnti"
+        reference_sample = "cc1455e3a479602581c1c7dc86a0e02605a3c14916b86817960397d5a2f41c31"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 48 89 E5 48 83 EC 20 C7 45 FC FF FF FF FF C7 45 F8 FF FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Winnti_4c5a1865 {
+    meta:
+        id = "4c5a1865-ff41-445b-8616-c83b87498c2b"
+        fingerprint = "685fe603e04ff123b3472293d3d83e2dc833effd1a7e6c616ff17ed61df0004c"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Winnti"
+        reference = "0d963a713093fc8e5928141f5747640c9b43f3aadc8a5478c949f7ec364b28ad"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C1 E8 1F 84 C0 75 7B 85 D2 89 D5 7E 75 8B 47 0C 39 C6 7D 6E 44 8D }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Winnti_6f4ca425 {
+    meta:
+        id = "6f4ca425-5cd2-4c22-b017-b5fc02b3abc2"
+        fingerprint = "dec25af33fc004de3a1f53e0c3006ff052f7c51c95f90be323b281590da7d924"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Winnti"
+        reference = "161af780209aa24845863f7a8120aa982aa811f16ec04bcd797ed165955a09c1"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 E5 48 89 7D D8 48 8B 45 D8 0F B6 40 27 0F BE C0 89 45 F8 48 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Winnti_de4b0f6e {
+    meta:
+        id = "de4b0f6e-0183-4ea8-9c03-f716a25f1884"
+        fingerprint = "c72eddc2d72ea979ad4f680d060aac129f1cd61dbdf3b0b5a74f5d35a9fe69d7"
+        creation_date = "2022-01-05"
+        last_modified = "2022-01-26"
+        threat_name = "Linux.Trojan.Winnti"
+        reference = "a6b9b3ea19eaddd4d90e58c372c10bbe37dbfced638d167182be2c940e615710"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 85 30 FF FF FF 02 00 48 8D 85 30 FF FF FF 48 8D 50 02 0F B7 85 28 FF }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Xhide.yar b/yara/rules/Linux_Trojan_Xhide.yar
new file mode 100644
index 00000000..97cc28f7
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Xhide.yar
@@ -0,0 +1,57 @@
+rule Linux_Trojan_Xhide_7f0a131b {
+    meta:
+        id = "7f0a131b-c305-4a08-91cc-ac2de4d95b19"
+        fingerprint = "767f2ea258cccc9f9b6673219d83e74da1d59f6847161791c9be04845f17d8cb"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Xhide"
+        reference_sample = "0dc35f1a1fe1c59e454cd5645f3a6220b7d85661437253a3e627eed04eca2560"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8B 85 68 FF FF FF 83 E0 40 85 C0 75 1A 8B 85 68 FF FF FF 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Xhide_cd8489f7 {
+    meta:
+        id = "cd8489f7-795f-4fd5-b9a6-03ddd0f3bad4"
+        fingerprint = "30b2e0a8ad2fdaa040d748d8660477ae93a6ebc89a186029ff20392f6c968578"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Xhide"
+        reference_sample = "0dc35f1a1fe1c59e454cd5645f3a6220b7d85661437253a3e627eed04eca2560"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 6F 74 2E 63 6F 6E 66 0A 0A 00 46 75 6C 6C 20 70 61 74 68 20 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Xhide_840b27c7 {
+    meta:
+        id = "840b27c7-191f-4d31-9b46-f22be634b2af"
+        fingerprint = "f1281db9a49986e23ef1fd9a97785d3bd7c9b3b855cf7e51744487242dd395a3"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Xhide"
+        reference_sample = "0dc35f1a1fe1c59e454cd5645f3a6220b7d85661437253a3e627eed04eca2560"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8B 45 98 83 E0 40 85 C0 75 16 8B 45 98 83 E0 08 85 C0 75 0C 8B }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Xorddos.yar b/yara/rules/Linux_Trojan_Xorddos.yar
new file mode 100644
index 00000000..585fba8c
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Xorddos.yar
@@ -0,0 +1,129 @@
+rule Linux_Trojan_Xorddos_2aef46a6 {
+    meta:
+        id = "2aef46a6-6daf-4f02-b1b4-e512cea12e53"
+        fingerprint = "e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Xorddos"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 25 64 2D 2D 25 73 5F 25 64 3A 25 73 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Xorddos_a6572d63 {
+    meta:
+        id = "a6572d63-f9f3-4dfb-87e6-3b0bafd68a79"
+        fingerprint = "fd32a773785f847cdd59d41786a8d8a7ba800a71d40d804aca51286d9bb1e1f0"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Xorddos"
+        reference_sample = "2ff33adb421a166895c3816d506a63dff4e1e8fa91f2ac8fb763dc6e8df59d6e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { C8 0F B6 46 04 0F B6 56 05 C1 E0 08 09 D0 89 45 CC 0F B6 46 06 0F B6 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Xorddos_e41143e1 {
+    meta:
+        id = "e41143e1-52d9-45c7-b19f-a5475b18a510"
+        fingerprint = "f621a2e8c289772990093762f371bb6d5736085695881e728a0d2c013c2ad1d4"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Xorddos"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 73 1E 80 3C 06 00 8D 14 30 8D 4C 37 FF 74 0D EB 36 0F B6 42 01 83 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Xorddos_0eb147ca {
+    meta:
+        id = "0eb147ca-ec6d-4a6d-b807-4de8c1eff875"
+        fingerprint = "6a1667f585a7bee05d5aece397a22e376562d2b264d3f287874e5a1843e67955"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Xorddos"
+        reference_sample = "45f25d2ffa2fc2566ed0eab6bdaf6989006315bbbbc591288be39b65abf2410b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 83 45 F0 01 8B 45 F0 89 45 E8 8B 45 E8 83 C4 18 5F 5D C3 55 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Xorddos_884cab60 {
+    meta:
+        id = "884cab60-214f-4879-aa51-c00de1a5ffc4"
+        fingerprint = "47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Xorddos"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Xorddos_ba961ed2 {
+    meta:
+        id = "ba961ed2-b410-4da5-8452-a03cf5f59808"
+        fingerprint = "fff4804164fb9ff1f667d619b6078b00a782b81716e217ad2c11df80cb8677aa"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Xorddos"
+        reference_sample = "45f25d2ffa2fc2566ed0eab6bdaf6989006315bbbbc591288be39b65abf2410b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { F8 C9 C3 55 89 E5 83 EC 38 C7 45 F8 FF FF FF FF C7 45 FC FF FF }
+    condition:
+        all of them
+}
+
+rule Linux_Trojan_Xorddos_2084099a {
+    meta:
+        id = "2084099a-1df6-4481-9d13-3a5bd6a53817"
+        fingerprint = "dfb813a5713f0e7bdb5afd500f1e84c6f042c8b1a1d27dd6511dca7f2107c13b"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Xorddos"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 8B 45 FC 8B 50 18 8B 45 08 89 50 18 8B 45 FC 8B 40 08 85 C0 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Xpmmap.yar b/yara/rules/Linux_Trojan_Xpmmap.yar
new file mode 100644
index 00000000..31337a83
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Xpmmap.yar
@@ -0,0 +1,19 @@
+rule Linux_Trojan_Xpmmap_7dcc3534 {
+    meta:
+        id = "7dcc3534-e94c-4c92-ac9b-a82b00fb045b"
+        fingerprint = "397618543390fb8fd8b198f63034fe88b640408d75b769fb337433138dafcf66"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Xpmmap"
+        reference_sample = "765546a981921187a4a2bed9904fbc2ccb2a5876e0d45c72e79f04a517c1bda3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 48 89 45 F8 48 83 7D F8 FF 75 14 BF 10 0C 40 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Trojan_Zpevdo.yar b/yara/rules/Linux_Trojan_Zpevdo.yar
new file mode 100644
index 00000000..233f2ab5
--- /dev/null
+++ b/yara/rules/Linux_Trojan_Zpevdo.yar
@@ -0,0 +1,18 @@
+rule Linux_Trojan_Zpevdo_7f563544 {
+    meta:
+        id = "7f563544-4ef3-460f-9a36-23d086f9c421"
+        fingerprint = "a2113b38c27ee7e22313bd0ffbcabadfbf7f3f33d241a97db2dc86299775afd6"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Trojan.Zpevdo"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 55 48 89 E5 48 83 EC 20 89 7D EC 48 89 75 E0 BE 01 00 00 00 BF 11 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Virus_Gmon.yar b/yara/rules/Linux_Virus_Gmon.yar
new file mode 100644
index 00000000..15756e49
--- /dev/null
+++ b/yara/rules/Linux_Virus_Gmon.yar
@@ -0,0 +1,38 @@
+rule Linux_Virus_Gmon_e544d891 {
+    meta:
+        id = "e544d891-3f6d-4da2-be86-e4ab58c66465"
+        fingerprint = "269f0777f846f9fc8fe56ea7436bddb155cde8c9a4bf9070f46db0081caef718"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Virus.Gmon"
+        reference_sample = "d0fe377664aa0bc0d1fd3a307650f211dd3ef2e2f04597abee465e836e6a6f32"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E5 53 51 52 8B 44 24 14 8B 5C 24 18 8B 4C 24 1C 8B 54 24 20 }
+    condition:
+        all of them
+}
+
+rule Linux_Virus_Gmon_192bd9b3 {
+    meta:
+        id = "192bd9b3-230a-4f07-b4f9-06213a6b6f47"
+        fingerprint = "532055052554ed9a38b16f764d3fbae0efd333f5b2254b9a1e3f6d656d77f1e4"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Virus.Gmon"
+        reference_sample = "d0fe377664aa0bc0d1fd3a307650f211dd3ef2e2f04597abee465e836e6a6f32"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E5 56 53 8B 75 08 8B 5D 0C 8B 4D 10 31 D2 39 CA 7D 11 8A 04 1A 38 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Virus_Rst.yar b/yara/rules/Linux_Virus_Rst.yar
new file mode 100644
index 00000000..0afd13e6
--- /dev/null
+++ b/yara/rules/Linux_Virus_Rst.yar
@@ -0,0 +1,19 @@
+rule Linux_Virus_Rst_1214e2ae {
+    meta:
+        id = "1214e2ae-90e4-425e-b47f-0a0981623236"
+        fingerprint = "a13a9825815a417be991db57f80dac4d0c541e303e4a4e6bd03c46ece73703ea"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Virus.Rst"
+        reference_sample = "b0e4f44d2456960bb6b20cb468c4ca1390338b83774b7af783c3d03e49eebe44"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 00 00 00 53 89 F3 CD 80 5B 58 5F 5E 5A 59 5B C3 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Virus_Staffcounter.yar b/yara/rules/Linux_Virus_Staffcounter.yar
new file mode 100644
index 00000000..51487810
--- /dev/null
+++ b/yara/rules/Linux_Virus_Staffcounter.yar
@@ -0,0 +1,19 @@
+rule Linux_Virus_Staffcounter_d2d608a8 {
+    meta:
+        id = "d2d608a8-2d65-4b10-be71-0a0a6a027920"
+        fingerprint = "a791024dc3064ed2e485e5c57d7ab77fc1ec14665c9302b8b572ac4d9d5d2f93"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Virus.Staffcounter"
+        reference = "06e562b54b7ee2ffee229c2410c9e2c42090e77f6211ce4b9fa26459ff310315"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 20 22 00 20 4C 69 6E 75 78 22 20 3C 00 54 6F 3A 20 22 00 20 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Virus_Thebe.yar b/yara/rules/Linux_Virus_Thebe.yar
new file mode 100644
index 00000000..379d22ae
--- /dev/null
+++ b/yara/rules/Linux_Virus_Thebe.yar
@@ -0,0 +1,19 @@
+rule Linux_Virus_Thebe_1eb5985a {
+    meta:
+        id = "1eb5985a-2b35-434f-81d9-f502dff25397"
+        fingerprint = "5cf9aa9a31c36028025d5038c98d56aef32c9e8952aa5cd4152fbd811231769e"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Virus.Thebe"
+        reference_sample = "30af289be070f4e0f8761f04fb44193a037ec1aab9cc029343a1a1f2a8d67670"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 42 31 C9 31 DB 31 F6 B0 1A CD 80 85 C0 0F 85 83 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Webshell_Generic.yar b/yara/rules/Linux_Webshell_Generic.yar
new file mode 100644
index 00000000..35da0fe6
--- /dev/null
+++ b/yara/rules/Linux_Webshell_Generic.yar
@@ -0,0 +1,38 @@
+rule Linux_Webshell_Generic_e80ff633 {
+    meta:
+        id = "e80ff633-990e-4e2e-ac80-2e61685ab8b0"
+        fingerprint = "dcca52dce2d50b0aa6cf0132348ce9dc234b985ae683b896d9971d409f109849"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Webshell.Generic"
+        reference_sample = "7640ba6f2417931ef901044152d5bfe1b266219d13b5983d92ddbdf644de5818"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 A8 00 00 00 89 1C 24 83 3C 24 00 74 23 83 04 24 24 8D B4 24 AC 00 }
+    condition:
+        all of them
+}
+
+rule Linux_Webshell_Generic_41a5fa40 {
+    meta:
+        id = "41a5fa40-a4e7-4c97-a3b9-3700743265df"
+        fingerprint = "49e0d55579453ec37c6757ddb16143d8e86ad7c7c4634487a1bd2215cd22df83"
+        creation_date = "2021-06-28"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Webshell.Generic"
+        reference = "18ac7fbc3d8d3bb8581139a20a7fee8ea5b7fcfea4a9373e3d22c71bae3c9de0"
+        severity = "100"
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 5A 46 55 6C 73 6E 55 6B 56 52 56 55 56 54 56 46 39 56 55 6B 6B }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Linux_Worm_Generic.yar b/yara/rules/Linux_Worm_Generic.yar
new file mode 100644
index 00000000..8074af85
--- /dev/null
+++ b/yara/rules/Linux_Worm_Generic.yar
@@ -0,0 +1,76 @@
+rule Linux_Worm_Generic_920d273f {
+    meta:
+        id = "920d273f-5b2b-4eec-a2b3-8d411f2ea181"
+        fingerprint = "3d4dd13b715249710bc2a02b1628fb68bcccebab876ff6674cad713e93ac53d2"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Worm.Generic"
+        reference_sample = "04a65bc73fab91f654d448b2d7f8f15ac782965dcdeec586e20b5c7a8cc42d73"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { E9 E5 49 86 49 A4 1A 70 C7 A4 AD 2E E9 D9 09 F5 AD CB ED FC 3B }
+    condition:
+        all of them
+}
+
+rule Linux_Worm_Generic_98efcd38 {
+    meta:
+        id = "98efcd38-d579-46f7-a8f8-360f799a5078"
+        fingerprint = "d6cec73bb6093dbc6d26566c174d0d0f6448f431429edef0528c9ec1c83177fa"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Worm.Generic"
+        reference_sample = "87507f5cd73fffdb264d76db9b75f30fe21cc113bcf82c524c5386b5a380d4bb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 24 14 75 E1 8B 5A 24 01 EB 66 8B 0C 4B 8B 5A 1C 01 EB 8B 04 8B }
+    condition:
+        all of them
+}
+
+rule Linux_Worm_Generic_bd64472e {
+    meta:
+        id = "bd64472e-92a2-4d64-8008-b82d7ca33b1d"
+        fingerprint = "1978baa7ff5457e06433fd45db098aefd39ea53d3f29e541eef54890a25a9dce"
+        creation_date = "2021-04-06"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Worm.Generic"
+        reference_sample = "b3334a3b61b1a3fc14763dc3d590100ed5e85a97493c89b499b02b76f7a0a7d0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 89 C0 89 45 EC 83 7D EC FF 75 38 68 54 90 04 08 }
+    condition:
+        all of them
+}
+
+rule Linux_Worm_Generic_3ff8f75b {
+    meta:
+        id = "3ff8f75b-619e-4090-8ea4-aedc8bdf61a4"
+        fingerprint = "011f0cd72ebb428775305c84eac69c5ff4800de6e1d8b4d2110d5445b1aae10f"
+        creation_date = "2021-01-12"
+        last_modified = "2021-09-16"
+        threat_name = "Linux.Worm.Generic"
+        reference_sample = "991175a96b719982f3a846df4a66161a02225c21b12a879e233e19124e90bd35"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "linux"
+    strings:
+        $a = { 3A DF FE 00 66 0F 73 FB 04 66 0F 6F D3 66 0F EF D9 66 0F 6F EE 66 0F 70 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Backdoor_Applejeus.yar b/yara/rules/MacOS_Backdoor_Applejeus.yar
new file mode 100644
index 00000000..91ae030d
--- /dev/null
+++ b/yara/rules/MacOS_Backdoor_Applejeus.yar
@@ -0,0 +1,19 @@
+rule MacOS_Backdoor_Applejeus_31872ae2 {
+    meta:
+        id = "31872ae2-f6df-4079-89c2-866cb2e62ec8"
+        fingerprint = "24b78b736f691e6b84ba88b0bb47aaba84aad0c0e45cf70f2fa8c455291517df"
+        creation_date = "2021-10-18"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Backdoor.Applejeus"
+        reference_sample = "e352d6ea4da596abfdf51f617584611fc9321d5a6d1c22aff243aecdef8e7e55"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { FF CE 74 12 89 F0 31 C9 80 34 0F 63 48 FF C1 48 39 C8 75 F4 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Backdoor_Fakeflashlxk.yar b/yara/rules/MacOS_Backdoor_Fakeflashlxk.yar
new file mode 100644
index 00000000..39098e9d
--- /dev/null
+++ b/yara/rules/MacOS_Backdoor_Fakeflashlxk.yar
@@ -0,0 +1,21 @@
+rule MacOS_Backdoor_Fakeflashlxk_06fd8071 {
+    meta:
+        id = "06fd8071-0370-4ae8-819a-846fa0a79b3d"
+        fingerprint = "a0e6763428616b46536c6a4eb080bae0cc58ef27678616aa432eb43a3d9c77a1"
+        creation_date = "2021-11-11"
+        last_modified = "2022-07-22"
+        threat_name = "MacOS.Backdoor.Fakeflashlxk"
+        reference_sample = "107f844f19e638866d8249e6f735daf650168a48a322d39e39d5e36cfc1c8659"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $s1 = "/Users/lxk/Library/Developer/Xcode/DerivedData"
+        $s2 = "Desktop/SafariFlashActivity/SafariFlashActivity/SafariFlashActivity/"
+        $s3 = "/Debug/SafariFlashActivity.build/Objects-normal/x86_64/AppDelegate.o"
+    condition:
+        2 of them
+}
+
diff --git a/yara/rules/MacOS_Backdoor_Kagent.yar b/yara/rules/MacOS_Backdoor_Kagent.yar
new file mode 100644
index 00000000..f0707fbb
--- /dev/null
+++ b/yara/rules/MacOS_Backdoor_Kagent.yar
@@ -0,0 +1,25 @@
+rule MacOS_Backdoor_Kagent_64ca1865 {
+    meta:
+        id = "64ca1865-0a99-49dc-b138-02b17ed47f60"
+        fingerprint = "b8086b08a019a733bee38cebdc4e25cdae9d3c238cfe7b341d8f0cd4db204d27"
+        creation_date = "2021-11-11"
+        last_modified = "2022-07-22"
+        threat_name = "MacOS.Backdoor.Kagent"
+        reference_sample = "d599d7814adbab0f1442f5a10074e00f3a776ce183ea924abcd6154f0d068bb4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $s1 = "save saveCaptureInfo"
+        $s2 = "savephoto success screenCaptureInfo"
+        $s3 = "no auto bbbbbaaend:%d path %s"
+        $s4 = "../screencapture/screen_capture_thread.cpp"
+        $s5 = "%s:%d, m_autoScreenCaptureQueue: %x"
+        $s6 = "auto bbbbbaaend:%d path %s"
+        $s7 = "auto aaaaaaaastartTime:%d path %s"
+    condition:
+        4 of them
+}
+
diff --git a/yara/rules/MacOS_Backdoor_Keyboardrecord.yar b/yara/rules/MacOS_Backdoor_Keyboardrecord.yar
new file mode 100644
index 00000000..701b6342
--- /dev/null
+++ b/yara/rules/MacOS_Backdoor_Keyboardrecord.yar
@@ -0,0 +1,23 @@
+rule MacOS_Backdoor_Keyboardrecord_832f7bac {
+    meta:
+        id = "832f7bac-3896-4934-b05f-8215a41cca74"
+        fingerprint = "27aa4380bda0335c672e957ba2ce6fd1f42ccf0acd2eff757e30210c3b4fb2fa"
+        creation_date = "2021-11-11"
+        last_modified = "2022-07-22"
+        threat_name = "MacOS.Backdoor.Keyboardrecord"
+        reference_sample = "570cd76bf49cf52e0cb347a68bdcf0590b2eaece134e1b1eba7e8d66261bdbe6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $s1 = "com.ccc.keyboardrecord"
+        $s2 = "com.ccc.write_queue"
+        $s3 = "ps -p %s > /dev/null"
+        $s4 = "useage %s path useragentpid"
+        $s5 = "keyboardRecorderStartPKc"
+    condition:
+        3 of them
+}
+
diff --git a/yara/rules/MacOS_Backdoor_Useragent.yar b/yara/rules/MacOS_Backdoor_Useragent.yar
new file mode 100644
index 00000000..bc6d92a1
--- /dev/null
+++ b/yara/rules/MacOS_Backdoor_Useragent.yar
@@ -0,0 +1,23 @@
+rule MacOS_Backdoor_Useragent_1a02fc3a {
+    meta:
+        id = "1a02fc3a-a394-457b-8af5-99f7f22b0a3b"
+        fingerprint = "22afa14a3dc6f8053b93bf3e971d57808a9cc19e676f9ed358ba5f1db9292ba4"
+        creation_date = "2021-11-11"
+        last_modified = "2022-07-22"
+        threat_name = "MacOS.Backdoor.Useragent"
+        reference_sample = "623f99cbe20af8b79cbfea7f485d47d3462d927153d24cac4745d7043c15619a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $s1 = "/Library/LaunchAgents/com.UserAgent.va.plist"
+        $s2 = "this is not root"
+        $s3 = "rm -Rf "
+        $s4 = "/start.sh"
+        $s5 = ".killchecker_"
+    condition:
+        4 of them
+}
+
diff --git a/yara/rules/MacOS_Cryptominer_Generic.yar b/yara/rules/MacOS_Cryptominer_Generic.yar
new file mode 100644
index 00000000..5f5bff61
--- /dev/null
+++ b/yara/rules/MacOS_Cryptominer_Generic.yar
@@ -0,0 +1,78 @@
+rule MacOS_Cryptominer_Generic_d3f68e29 {
+    meta:
+        id = "d3f68e29-830d-4d40-a285-ac29aed732fa"
+        fingerprint = "733dadf5a09f4972629f331682fca167ebf9a438004cb686d032f69e32971bd4"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Cryptominer.Generic"
+        reference_sample = "d9c78c822dfd29a1d9b1909bf95cab2a9550903e8f5f178edeb7a5a80129fbdb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = "command line argument. See 'ethminer -H misc' for details." ascii fullword
+        $a2 = "Ethminer - GPU ethash miner" ascii fullword
+        $a3 = "StratumClient"
+    condition:
+        all of them
+}
+
+rule MacOS_Cryptominer_Generic_333129b7 {
+    meta:
+        id = "333129b7-8137-4641-bd86-ebcf62257d7b"
+        fingerprint = "baa9e777683d31c27170239752f162799a511bf40269a06a2eab8971fabb098a"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Cryptominer.Generic"
+        reference_sample = "bf47d27351d6b0be0ffe1d6844e87fe8f4f4d33ea17b85c11907266d36e4b827"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 6D BF 81 55 D4 4C D4 19 4C 81 18 24 3C 14 3C 30 14 18 26 79 5F 35 5F 4C 35 26 }
+    condition:
+        all of them
+}
+
+rule MacOS_Cryptominer_Generic_365ecbb9 {
+    meta:
+        id = "365ecbb9-586e-4962-a5a8-05e871f54eff"
+        fingerprint = "5ff82ab60f8d028c9e4d3dd95609f92cfec5f465c721d96947b490691d325484"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Cryptominer.Generic"
+        reference_sample = "e2562251058123f86c52437e82ea9ff32aae5f5227183638bc8aa2bc1b4fd9cf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 55 6E 6B 6E 6F 77 6E 20 6E 65 74 77 6F 72 6B 20 73 70 65 63 69 66 69 65 64 20 }
+    condition:
+        all of them
+}
+
+rule MacOS_Cryptominer_Generic_4e7d4488 {
+    meta:
+        id = "4e7d4488-2e0c-4c74-84f9-00da103e162a"
+        fingerprint = "4e7f22e8084734aeded9b1202c30e6a170a6a38f2e486098b4027e239ffed2f6"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Cryptominer.Generic"
+        reference_sample = "e2562251058123f86c52437e82ea9ff32aae5f5227183638bc8aa2bc1b4fd9cf"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 69 73 20 66 69 65 6C 64 20 74 6F 20 73 68 6F 77 20 6E 75 6D 62 65 72 20 6F 66 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Cryptominer_Xmrig.yar b/yara/rules/MacOS_Cryptominer_Xmrig.yar
new file mode 100644
index 00000000..f0c12796
--- /dev/null
+++ b/yara/rules/MacOS_Cryptominer_Xmrig.yar
@@ -0,0 +1,22 @@
+rule MacOS_Cryptominer_Xmrig_241780a1 {
+    meta:
+        id = "241780a1-ad50-4ded-b85a-26339ae5a632"
+        fingerprint = "be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Cryptominer.Xmrig"
+        reference_sample = "2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = "mining.set_target" ascii fullword
+        $a2 = "XMRIG_HOSTNAME" ascii fullword
+        $a3 = "Usage: xmrig [OPTIONS]" ascii fullword
+        $a4 = "XMRIG_VERSION" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Exploit_Log4j.yar b/yara/rules/MacOS_Exploit_Log4j.yar
new file mode 100644
index 00000000..1021e8e4
--- /dev/null
+++ b/yara/rules/MacOS_Exploit_Log4j.yar
@@ -0,0 +1,24 @@
+rule MacOS_Exploit_Log4j_75a13888 {
+    meta:
+        id = "75a13888-7650-4ef3-adec-15378c8479bd"
+        fingerprint = "cd06db6f5bebf0412d056017259b5451184d5ba5b2976efd18fa8f96dba6a159"
+        creation_date = "2021-12-13"
+        last_modified = "2022-07-22"
+        threat_name = "MacOS.Exploit.Log4j"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $jndi1 = "jndi.ldap.LdapCtx.c_lookup"
+        $jndi2 = "logging.log4j.core.lookup.JndiLookup.lookup"
+        $jndi3 = "com.sun.jndi.url.ldap.ldapURLContext.lookup"
+        $exp1 = "Basic/Command/Base64/"
+        $exp2 = "java.lang.ClassCastException: Exploit"
+        $exp3 = "WEB-INF/classes/Exploit"
+        $exp4 = "Exploit.java"
+    condition:
+        2 of ($jndi*) and 1 of ($exp*)
+}
+
diff --git a/yara/rules/MacOS_Hacktool_Bifrost.yar b/yara/rules/MacOS_Hacktool_Bifrost.yar
new file mode 100644
index 00000000..e348b9e2
--- /dev/null
+++ b/yara/rules/MacOS_Hacktool_Bifrost.yar
@@ -0,0 +1,27 @@
+rule MacOS_Hacktool_Bifrost_39bcbdf8 {
+    meta:
+        id = "39bcbdf8-86dc-480e-8822-dc9832bb9b55"
+        fingerprint = "e11f6f3a847817644d40fee863e168cd2a18e8e0452482c1e652c11fe8dd769e"
+        creation_date = "2021-10-12"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Hacktool.Bifrost"
+        reference_sample = "e2b64df0add316240b010db7d34d83fc9ac7001233259193e5a72b6e04aece46"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $s1 = "[dump | list | askhash | describe | asktgt | asktgs | s4u | ptt | remove | asklkdcdomain]" fullword
+        $s2 = "[-] Error in parseKirbi: %s"
+        $s3 = "[-] Error in parseTGSREP: %s"
+        $s4 = "genPasswordHashPassword:Length:Enc:Username:Domain:Pretty:"
+        $s5 = "storeLKDCConfDataFriendlyName:Hostname:Password:CCacheName:"
+        $s6 = "bifrostconsole-"
+        $s7 = "-kerberoast"
+        $s8 = "asklkdcdomain"
+        $s9 = "askhash"
+    condition:
+        3 of them
+}
+
diff --git a/yara/rules/MacOS_Hacktool_Swiftbelt.yar b/yara/rules/MacOS_Hacktool_Swiftbelt.yar
new file mode 100644
index 00000000..39c575c7
--- /dev/null
+++ b/yara/rules/MacOS_Hacktool_Swiftbelt.yar
@@ -0,0 +1,43 @@
+rule MacOS_Hacktool_Swiftbelt_bc62ede6 {
+    meta:
+        id = "bc62ede6-e6f1-4c9e-bff2-ef55a5d12ba1"
+        fingerprint = "98d14dba562ad68c8ecc00780ab7ee2ecbe912cd00603fff0eb887df1cd12fdb"
+        creation_date = "2021-10-12"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Hacktool.Swiftbelt"
+        reference_sample = "452c832a17436f61ad5f32ee1c97db05575160105ed1dcd0d3c6db9fb5a9aea1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $dbg1 = "SwiftBelt/Sources/SwiftBelt"
+        $dbg2 = "[-] Firefox places.sqlite database not found for user"
+        $dbg3 = "[-] No security products found"
+        $dbg4 = "SSH/AWS/gcloud Credentials Search:"
+        $dbg5 = "[-] Could not open the Slack Cookies database"
+        $sec1 = "[+] Malwarebytes A/V found on this host"
+        $sec2 = "[+] Cisco AMP for endpoints found"
+        $sec3 = "[+] SentinelOne agent running"
+        $sec4 = "[+] Crowdstrike Falcon agent found"
+        $sec5 = "[+] FireEye HX agent installed"
+        $sec6 = "[+] Little snitch firewall found"
+        $sec7 = "[+] ESET A/V installed"
+        $sec8 = "[+] Carbon Black OSX Sensor installed"
+        $sec9 = "/Library/Little Snitch"
+        $sec10 = "/Library/FireEye/xagt"
+        $sec11 = "/Library/CS/falcond"
+        $sec12 = "/Library/Logs/PaloAltoNetworks/GlobalProtect"
+        $sec13 = "/Library/Application Support/Malwarebytes"
+        $sec14 = "/usr/local/bin/osqueryi"
+        $sec15 = "/Library/Sophos Anti-Virus"
+        $sec16 = "/Library/Objective-See/Lulu"
+        $sec17 = "com.eset.remoteadministrator.agent"
+        $sec18 = "/Applications/CarbonBlack/CbOsxSensorService"
+        $sec19 = "/Applications/BlockBlock Helper.app"
+        $sec20 = "/Applications/KextViewr.app"
+    condition:
+        6 of them
+}
+
diff --git a/yara/rules/MacOS_Trojan_Adload.yar b/yara/rules/MacOS_Trojan_Adload.yar
new file mode 100644
index 00000000..d6c0a1d0
--- /dev/null
+++ b/yara/rules/MacOS_Trojan_Adload.yar
@@ -0,0 +1,57 @@
+rule MacOS_Trojan_Adload_4995469f {
+    meta:
+        id = "4995469f-9810-4c1f-b9bc-97e951fe9256"
+        fingerprint = "9b7e7c76177cc8ca727df5039a5748282f5914f2625ec1f54d67d444f92f0ee5"
+        creation_date = "2021-10-04"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Adload"
+        reference_sample = "6464ca7b36197cccf0dac00f21c43f0cb09f900006b1934e2b3667b367114de5"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 49 8B 77 08 49 8B 4F 20 48 BF 89 88 88 88 88 88 88 88 48 89 C8 48 F7 E7 48 C1 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Adload_9b9f86c7 {
+    meta:
+        id = "9b9f86c7-e74c-4fc2-bb64-f87473a4b820"
+        fingerprint = "7e70d5574907261e73d746a4ad0b7bce319a9bb3b39a7f1df326284960a7fa38"
+        creation_date = "2021-10-04"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Adload"
+        reference_sample = "952e6004ce164ba607ac7fddc1df3d0d6cac07d271d90be02d790c52e49cb73c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 44 65 6C 65 67 61 74 65 43 35 73 68 6F 77 6E 53 62 76 70 57 76 64 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Adload_f6b18a0a {
+    meta:
+        id = "f6b18a0a-7593-430f-904b-8d416861d165"
+        fingerprint = "f33275481b0bf4f4e57c7ad757f1e22d35742fc3d0ffa3983321f03170b5100e"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Adload"
+        reference_sample = "06f38bb811e6a6c38b5e2db708d4063f4aea27fcd193d57c60594f25a86488c8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 10 49 8B 4E 20 48 BE 89 88 88 88 88 88 88 88 48 89 C8 48 F7 E6 49 39 DC 0F 84 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Trojan_Amcleaner.yar b/yara/rules/MacOS_Trojan_Amcleaner.yar
new file mode 100644
index 00000000..ebc89543
--- /dev/null
+++ b/yara/rules/MacOS_Trojan_Amcleaner.yar
@@ -0,0 +1,57 @@
+rule MacOS_Trojan_Amcleaner_445bb666 {
+    meta:
+        id = "445bb666-1707-4ad9-a409-4a21de352957"
+        fingerprint = "355c7298a4148be3b80fd841b483421bde28085c21c00d5e4a42949fd8026f5b"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Amcleaner"
+        reference_sample = "c85bf71310882bc0c0cf9b74c9931fd19edad97600bc86ca51cf94ed85a78052"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 10 A0 5B 15 57 A8 8B 17 02 F9 A8 9B E8 D5 8C 96 A7 48 42 91 E5 EC 3D C8 AC 52 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Amcleaner_a91d3907 {
+    meta:
+        id = "a91d3907-5e24-46c0-90ef-ed7f46ad8792"
+        fingerprint = "c020567fde77a72d27c9c06f6ebb103f910321cc7a1c3b227e0965b079085b49"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Amcleaner"
+        reference_sample = "dc9c700f3f6a03ecb6e3f2801d4269599c32abce7bc5e6a1b7e6a64b0e025f58"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 40 22 4E 53 49 6D 61 67 65 56 69 65 77 22 2C 56 69 6E 6E 76 63 6A 76 64 69 5A }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Amcleaner_8ce3fea8 {
+    meta:
+        id = "8ce3fea8-3cc7-4c59-b07c-a6dda0bb6b85"
+        fingerprint = "e156d3c7a55cae84481df644569d1c5760e016ddcc7fd05d0f88fa8f9f9ffdae"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Amcleaner"
+        reference_sample = "c85bf71310882bc0c0cf9b74c9931fd19edad97600bc86ca51cf94ed85a78052"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 54 40 22 4E 53 54 61 62 6C 65 56 69 65 77 22 2C 56 69 6E 6E 76 63 6B 54 70 51 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Trojan_Aobokeylogger.yar b/yara/rules/MacOS_Trojan_Aobokeylogger.yar
new file mode 100644
index 00000000..ed9c2a53
--- /dev/null
+++ b/yara/rules/MacOS_Trojan_Aobokeylogger.yar
@@ -0,0 +1,19 @@
+rule MacOS_Trojan_Aobokeylogger_bd960f34 {
+    meta:
+        id = "bd960f34-1932-41be-ac0a-f45ada22c560"
+        fingerprint = "ae26a03d1973669cbeaabade8f3fd09ef2842b9617fa38e7b66dc4726b992a81"
+        creation_date = "2021-10-18"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Aobokeylogger"
+        reference_sample = "2b50146c20621741642d039f1e3218ff68e5dbfde8bb9edaa0a560ca890f0970"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 20 74 68 61 6E 20 32 30 30 20 6B 65 79 73 74 72 6F 6B 65 73 20 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Trojan_Bundlore.yar b/yara/rules/MacOS_Trojan_Bundlore.yar
new file mode 100644
index 00000000..6955acba
--- /dev/null
+++ b/yara/rules/MacOS_Trojan_Bundlore.yar
@@ -0,0 +1,209 @@
+rule MacOS_Trojan_Bundlore_28b13e67 {
+    meta:
+        id = "28b13e67-e01c-45eb-aae6-ecd02b017a44"
+        fingerprint = "1e85be4432b87214d61e675174f117e36baa8ab949701ee1d980ad5dd8454bac"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Bundlore"
+        reference_sample = "0b50a38749ea8faf571169ebcfce3dfd668eaefeb9a91d25a96e6b3881e4a3e8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 05 A5 A3 A9 37 D2 05 13 E9 3E D6 EA 6A EC 9B DC 36 E5 76 A7 53 B3 0F 06 46 D1 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Bundlore_75c8cb4e {
+    meta:
+        id = "75c8cb4e-f8bd-4a2c-8a5e-8500e12a9030"
+        fingerprint = "db68c315dba62f81168579aead9c5827f7bf1df4a3c2e557b920fa8fbbd6f3c2"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Bundlore"
+        reference_sample = "3d69912e19758958e1ebdef5e12c70c705d7911c3b9df03348c5d02dd06ebe4e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 35 EE 19 00 00 EA 80 35 E8 19 00 00 3B 80 35 E2 19 00 00 A4 80 35 DC 19 00 00 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Bundlore_17b564b4 {
+    meta:
+        id = "17b564b4-7452-473f-873f-f907b5b8ebc4"
+        fingerprint = "7701fab23d59b8c0db381a1140c4e350e2ce24b8114adbdbf3c382c6d82ea531"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Bundlore"
+        reference_sample = "94f6e5ee6eb3a191faaf332ea948301bbb919f4ec6725b258e4f8e07b6a7881d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 35 D9 11 00 00 05 80 35 D3 11 00 00 2B 80 35 CD 11 00 00 F6 80 35 C7 11 00 00 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Bundlore_c90c088a {
+    meta:
+        id = "c90c088a-abf5-4e52-a69e-5a4fd4b5cf15"
+        fingerprint = "c2300895f8ff5ae13bc0ed93653afc69b30d1d01f5ce882bd20f2b65426ecb47"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Bundlore"
+        reference_sample = "875513f4ebeb63b9e4d82fb5bff2b2dc75b69c0bfa5dd8d2895f22eaa783f372"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 35 E1 11 00 00 92 80 35 DB 11 00 00 2A 80 35 D5 11 00 00 7F 80 35 CF 11 00 00 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Bundlore_3965578d {
+    meta:
+        id = "3965578d-3180-48e4-b5be-532e880b1df9"
+        fingerprint = "e41f08618db822ba5185e5dc3f932a72e1070fbb424ff2c097cab5e58ad9e2db"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Bundlore"
+        reference_sample = "d72543505e36db40e0ccbf14f4ce3853b1022a8aeadd96d173d84e068b4f68fa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 35 33 2A 00 00 60 80 35 2D 2A 00 00 D0 80 35 27 2A 00 00 54 80 35 21 2A 00 00 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Bundlore_00d9d0e9 {
+    meta:
+        id = "00d9d0e9-28d8-4c32-bc6f-52008ee69b07"
+        fingerprint = "7dcc6b124d631767c259101f36b4bbd6b9d27b2da474d90e31447ea03a2711a6"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Bundlore"
+        reference_sample = "73069b34e513ff1b742b03fed427dc947c22681f30cf46288a08ca545fc7d7dd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 35 8E 11 00 00 55 80 35 88 11 00 00 BC 80 35 82 11 00 00 72 80 35 7C 11 00 00 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Bundlore_650b8ff4 {
+    meta:
+        id = "650b8ff4-6cc8-4bfc-ba01-ac9c86410ecc"
+        fingerprint = "4f4691f6830684a71e7b3ab322bf6ec4638bf0035adf3177dbd0f02e54b3fd80"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Bundlore"
+        reference_sample = "78fd2c4afd7e810d93d91811888172c4788a0a2af0b88008573ce8b6b819ae5a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 35 8B 11 00 00 60 80 35 85 11 00 00 12 80 35 7F 11 00 00 8C 80 35 79 11 00 00 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Bundlore_c8ad7edd {
+    meta:
+        id = "c8ad7edd-4233-44ce-a4e5-96dfc3504f8a"
+        fingerprint = "c6a8a1d9951863d4277d297dd6ff8ad7b758ca2dfe16740265456bb7bb0fd7d0"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Bundlore"
+        reference_sample = "d4915473e1096a82afdaee405189a0d0ae961bd11a9e5e9adc420dd64cb48c24"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 35 74 11 00 00 D5 80 35 6E 11 00 00 57 80 35 68 11 00 00 4C 80 35 62 11 00 00 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Bundlore_cb7344eb {
+    meta:
+        id = "cb7344eb-51e6-4f17-a5d4-eea98938945b"
+        fingerprint = "6041c50c9eefe9cafb8768141cd7692540f6af2cdd6e0a763b7d7e50b8586999"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Bundlore"
+        reference_sample = "53373668d8c5dc17f58768bf59fb5ab6d261a62d0950037f0605f289102e3e56"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 35 ED 09 00 00 92 80 35 E7 09 00 00 93 80 35 E1 09 00 00 16 80 35 DB 09 00 00 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Bundlore_753e5738 {
+    meta:
+        id = "753e5738-0c72-4178-9396-d1950e868104"
+        fingerprint = "c0a41a8bc7fbf994d3f5a5d6c836db3596b1401b0e209a081354af2190fcb3c2"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Bundlore"
+        reference_sample = "42aeea232b28724d1fa6e30b1aeb8f8b8c22e1bc8afd1bbb4f90e445e31bdfe9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 35 9A 11 00 00 96 80 35 94 11 00 00 68 80 35 8E 11 00 00 38 80 35 88 11 00 00 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Bundlore_7b9f0c28 {
+    meta:
+        id = "7b9f0c28-181d-4fdc-8a57-467d5105129a"
+        fingerprint = "dde16fdd37a16fa4dae24324283cd4b36ed2eb78f486cedd1a6c7bef7cde7370"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Bundlore"
+        reference_sample = "fc4da125fed359d3e1740dafaa06f4db1ffc91dbf22fd5e7993acf8597c4c283"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 35 B6 15 00 00 81 80 35 B0 15 00 00 14 80 35 AA 15 00 00 BC 80 35 A4 15 00 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Trojan_Eggshell.yar b/yara/rules/MacOS_Trojan_Eggshell.yar
new file mode 100644
index 00000000..99215ed5
--- /dev/null
+++ b/yara/rules/MacOS_Trojan_Eggshell.yar
@@ -0,0 +1,23 @@
+rule MacOS_Trojan_Eggshell_ddacf7b9 {
+    meta:
+        id = "ddacf7b9-8479-47ef-9df2-17060578a8e5"
+        fingerprint = "2e6284c8e44809d5f88781dcf7779d1e24ce3aedd5e8db8598e49c01da63fe62"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Eggshell"
+        reference_sample = "6d93a714dd008746569c0fbd00fadccbd5f15eef06b200a4e831df0dc8f3d05b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = "ScreenshotThread" ascii fullword
+        $a2 = "KeylogThread" ascii fullword
+        $a3 = "GetClipboardThread" ascii fullword
+        $a4 = "_uploadProgress" ascii fullword
+        $a5 = "killTask:" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Trojan_Electrorat.yar b/yara/rules/MacOS_Trojan_Electrorat.yar
new file mode 100644
index 00000000..4f438a92
--- /dev/null
+++ b/yara/rules/MacOS_Trojan_Electrorat.yar
@@ -0,0 +1,22 @@
+rule MacOS_Trojan_Electrorat_b4dbfd1d {
+    meta:
+        id = "b4dbfd1d-4968-4121-a4c2-5935b7f76fc1"
+        fingerprint = "fa65fc0a8f5b1f63957c586e6ca8e8fbdb811970f25a378a4ff6edf5e5c44da7"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Electrorat"
+        reference_sample = "b1028b38fcce0d54f2013c89a9c0605ccb316c36c27faf3a35adf435837025a4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = "_TtC9Keylogger9Keylogger" ascii fullword
+        $a2 = "_TtC9Keylogger17CallBackFunctions" ascii fullword
+        $a3 = "\\DELETE-FORWARD" ascii fullword
+        $a4 = "\\CAPSLOCK" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Trojan_Fplayer.yar b/yara/rules/MacOS_Trojan_Fplayer.yar
new file mode 100644
index 00000000..4bc5517d
--- /dev/null
+++ b/yara/rules/MacOS_Trojan_Fplayer.yar
@@ -0,0 +1,19 @@
+rule MacOS_Trojan_Fplayer_1c1fae37 {
+    meta:
+        id = "1c1fae37-8d19-4129-a715-b78163f93fd2"
+        fingerprint = "abeb3cd51c0ff2e3173739c423778defb9a77bc49b30ea8442e6ec93a2d2d8d2"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Fplayer"
+        reference_sample = "f57e651088dee2236328d09705cef5e98461e97d1eb2150c372d00ca7c685725"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 56 41 55 41 54 53 48 83 EC 48 4D 89 C4 48 89 C8 48 89 D1 49 89 F6 49 89 FD 49 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Trojan_Generic.yar b/yara/rules/MacOS_Trojan_Generic.yar
new file mode 100644
index 00000000..14810952
--- /dev/null
+++ b/yara/rules/MacOS_Trojan_Generic.yar
@@ -0,0 +1,19 @@
+rule MacOS_Trojan_Generic_a829d361 {
+    meta:
+        id = "a829d361-ac57-4615-b8e9-16089c44d7af"
+        fingerprint = "5dba43dbc5f4d5ee295e65d66dd4e7adbdb7953232faf630b602e6d093f69584"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Generic"
+        reference_sample = "5b2a1cd801ae68a890b40dbd1601cdfeb5085574637ae8658417d0975be8acb5"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { E7 81 6A 12 EA A8 56 6C 86 94 ED F6 E8 D7 35 E1 EC 65 47 BA 8E 46 2C A6 14 5F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Trojan_Genieo.yar b/yara/rules/MacOS_Trojan_Genieo.yar
new file mode 100644
index 00000000..f297a551
--- /dev/null
+++ b/yara/rules/MacOS_Trojan_Genieo.yar
@@ -0,0 +1,76 @@
+rule MacOS_Trojan_Genieo_5e0f8980 {
+    meta:
+        id = "5e0f8980-1789-4763-9e41-a521bdb3ff34"
+        fingerprint = "f0b5198ce85d19889052a7e33fb7cf32a7725c4fdb384ffa7d60d209a7157092"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Genieo"
+        reference_sample = "6c698bac178892dfe03624905256a7d9abe468121163d7507cade48cf2131170"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 00 CD 01 1E 68 57 58 D7 56 7C 62 C9 27 3C C6 15 A9 3D 01 02 2F E1 69 B5 4A 11 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Genieo_37878473 {
+    meta:
+        id = "37878473-b6f8-4cbe-ba70-31ecddf41c82"
+        fingerprint = "e9760bda6da453f75e543c919c260a4560989f62f3332f28296283d4c01b62a2"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Genieo"
+        reference_sample = "0fadd926f8d763f7f15e64f857e77f44a492dcf5dc82ae965d3ddf80cd9c7a0d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 65 72 6E 61 6C 44 6F 77 6E 4C 6F 61 64 55 72 6C 46 6F 72 42 72 61 6E 64 3A 5D }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Genieo_0d003634 {
+    meta:
+        id = "0d003634-8b17-4e26-b4a2-4bfce2e64dde"
+        fingerprint = "6f38b7fc403184482449957aff51d54ac9ea431190c6f42c7a5420efbfdb8f7d"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Genieo"
+        reference_sample = "bcd391b58338efec4769e876bd510d0c4b156a7830bab56c3b56585974435d70"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 75 69 6C 64 2F 41 6E 61 62 65 6C 50 61 63 6B 61 67 65 2F 62 75 69 6C 64 2F 73 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Genieo_9e178c0b {
+    meta:
+        id = "9e178c0b-02ca-499b-93d1-2b6951d41435"
+        fingerprint = "b00bffbdac79c5022648bf8ca5a238db7e71f3865a309f07d068ee80ba283b82"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Genieo"
+        reference_sample = "b7760e73195c3ea8566f3ff0427d85d6f35c6eec7ee9184f3aceab06da8845d8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 4D 49 70 67 41 59 4B 6B 42 5A 59 53 65 4D 6B 61 70 41 42 48 4D 5A 43 63 44 44 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Trojan_Getshell.yar b/yara/rules/MacOS_Trojan_Getshell.yar
new file mode 100644
index 00000000..3a5b25a5
--- /dev/null
+++ b/yara/rules/MacOS_Trojan_Getshell.yar
@@ -0,0 +1,19 @@
+rule MacOS_Trojan_Getshell_f339d74c {
+    meta:
+        id = "f339d74c-36f1-46e5-bf7d-22f49a0948a5"
+        fingerprint = "fad5ca4f345c2c01a3d222f59bac8d5dacf818d4e018c8d411d86266a481a1a1"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Getshell"
+        reference_sample = "b2199c15500728a522c04320aee000938f7eb69d751a55d7e51a2806d8cd0fe7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 00 00 FF E0 E8 00 00 00 00 58 8B 80 4B 22 00 00 FF E0 55 89 E5 53 83 EC 04 E8 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Trojan_Mackeeper.yar b/yara/rules/MacOS_Trojan_Mackeeper.yar
new file mode 100644
index 00000000..7593696b
--- /dev/null
+++ b/yara/rules/MacOS_Trojan_Mackeeper.yar
@@ -0,0 +1,114 @@
+rule MacOS_Trojan_Mackeeper_deeb80ec {
+    meta:
+        id = "deeb80ec-1789-49dc-abf5-55d4fa29f46c"
+        fingerprint = "3e26ff2d385eb030f4047047317191423d773178a8267bedf9eff1e8c895c0d1"
+        creation_date = "2021-10-04"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Mackeeper"
+        reference_sample = "78a49bd58ee1b694e7b7b72caa7c5efe88d4f0293b024706baefa3a640a5adad"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 46 74 AE FC 63 16 F3 3C 2F D4 88 F7 E5 90 66 C9 77 9A 9A 5E BA 15 31 E0 FA 27 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Mackeeper_1a65c456 {
+    meta:
+        id = "1a65c456-dd4b-46e0-aeb6-a0a78fb34d2f"
+        fingerprint = "3e1fa8ca471019ffd5aea646dd64722fc271d74c2298348a3447faa889d1dd4d"
+        creation_date = "2021-10-04"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Mackeeper"
+        reference_sample = "97bf4a37f4ae991927ba570757f211362d24ed61077704c1af6507ae9764ad0e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 65 64 52 6F 77 49 6E 64 65 78 65 73 46 72 6F 6D 44 69 63 74 69 6F 6E 61 72 79 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Mackeeper_b88f92c1 {
+    meta:
+        id = "b88f92c1-4eeb-4f23-aea2-5df7c144c550"
+        fingerprint = "1d3670bd9208556c9a463a04bc77210f85a07f230121def562bf088a78b2f8da"
+        creation_date = "2021-10-04"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Mackeeper"
+        reference_sample = "e9bc75f86f696fcb1425299b3dc634d549e911176c6f23708184cbb11e0a54f4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { B6 79 35 47 1C 86 96 D9 D1 93 31 64 2C 86 75 53 3A 08 83 77 54 A7 A6 5D EF AD }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Mackeeper_90d56403 {
+    meta:
+        id = "90d56403-138a-4db0-8564-d98ce87b06bc"
+        fingerprint = "9ed2a39a49cc2c4f94cde46d7da66427161bf25881b4f74a746b04f60d560dfc"
+        creation_date = "2021-10-04"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Mackeeper"
+        reference_sample = "86117af4b9b01e2c897ded6ec1084496a4370fd3ad7e18187c306e7a8595863a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 4E CF 96 0B A4 C0 52 9B 52 B3 EA 80 97 AF C1 4B 06 9A 46 D3 5D 14 1C A0 1E 5B }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Mackeeper_20fd2933 {
+    meta:
+        id = "20fd2933-a896-4997-ac62-3921db103cdf"
+        fingerprint = "5905e09c97924bc7f96e15a302588b4cb232785302a174ced2046e6decc56d3d"
+        creation_date = "2021-10-04"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Mackeeper"
+        reference_sample = "0cebec8e4367f715208b52fc4048dc83d334069515765d5bd8a4bc412acda143"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 46 6F 6E 74 53 63 61 6C 65 55 70 44 6F 77 6E 4B 65 79 00 5F 6B 5A }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Mackeeper_8088dc7c {
+    meta:
+        id = "8088dc7c-eff8-43f6-8a0c-1eb79489fe3c"
+        fingerprint = "1fcb5c2a6c524f4ca6904650df92dc1c2888e93856d8a1004bbfe2c268d82643"
+        creation_date = "2021-10-04"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Mackeeper"
+        reference_sample = "f41a616a1bf90b7f2b61c5bd015bb0ac64391aad515ce52bf62fc92f05fe3a07"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 6B 5A 42 55 46 6F 6E 74 53 63 61 6C 65 55 70 44 6F 77 6E 4B 65 79 00 5F 6B 5A }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Trojan_Metasploit.yar b/yara/rules/MacOS_Trojan_Metasploit.yar
new file mode 100644
index 00000000..cbf860f4
--- /dev/null
+++ b/yara/rules/MacOS_Trojan_Metasploit.yar
@@ -0,0 +1,261 @@
+rule MacOS_Trojan_Metasploit_6cab0ec0 {
+    meta:
+        id = "6cab0ec0-0ac5-4f43-8a10-1f46822a152b"
+        fingerprint = "e13c605d8f16b2b2e65c717a4716c25b3adaec069926385aff88b37e3db6e767"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Metasploit"
+        reference_sample = "7ab5490dca314b442181f9a603252ad7985b719c8aa35ddb4c3aa4b26dcc8a42"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = "mettlesploit! " ascii fullword
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Metasploit_293bfea9 {
+    meta:
+        id = "293bfea9-c5cf-4711-bec0-17a02ddae6f2"
+        fingerprint = "d47e8083268190465124585412aaa2b30da126083f26f3eda4620682afd1d66e"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Metasploit"
+        reference_sample = "7ab5490dca314b442181f9a603252ad7985b719c8aa35ddb4c3aa4b26dcc8a42"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = "_webcam_get_frame" ascii fullword
+        $a2 = "_get_process_info" ascii fullword
+        $a3 = "process_new: got %zd byte executable to run in memory" ascii fullword
+        $a4 = "Dumping cert info:" ascii fullword
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Metasploit_448fa81d {
+    meta:
+        id = "448fa81d-14c7-479b-8d1e-c245ee261ef6"
+        fingerprint = "ff040211f664f3f35cd4f4da0e5eb607ae3e490aae75ee97a8fb3cb0b08ecc1f"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Metasploit"
+        reference_sample = "7ab5490dca314b442181f9a603252ad7985b719c8aa35ddb4c3aa4b26dcc8a42"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = "/Users/vagrant/mettle/mettle/src/process.c" ascii fullword
+        $a2 = "/Users/vagrant/mettle/mettle/src/c2_http.c" ascii fullword
+        $a3 = "/Users/vagrant/mettle/mettle/src/mettle.c" ascii fullword
+    condition:
+        any of them
+}
+
+rule MacOS_Trojan_Metasploit_768df39d {
+    meta:
+        id = "768df39d-7ee9-454e-82f8-5c7bd733c61a"
+        fingerprint = "d45230c1111bda417228e193c8657d2318b1d2cddfbd01c5c6f2ea1d0be27a46"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        description = "Byte sequence based on Metasploit shell_reverse_tcp.rb"
+        threat_name = "MacOS.Trojan.Metasploit"
+        reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/shell_reverse_tcp.rb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = { FF 4F E8 79 F6 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 50 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Metasploit_7ce0b709 {
+    meta:
+        id = "7ce0b709-1d96-407c-8eca-6af64e5bdeef"
+        fingerprint = "3eb7f78d2671e16c16a6d9783995ebb32e748612d32ed4f2442e9f9c1efc1698"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        description = "Byte sequence based on Metasploit shell_bind_tcp.rb"
+        threat_name = "MacOS.Trojan.Metasploit"
+        reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/shell_bind_tcp.rb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = { FF 4F E4 79 F6 50 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 50 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Metasploit_f11ccdac {
+    meta:
+        id = "f11ccdac-be75-4ba8-800a-179297a40792"
+        fingerprint = "fbc1a5b77ed485706ae38f996cd086253ea1d43d963cb497446e5b0f3d0f3f11"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        description = "Byte sequence based on Metasploit shell_find_port.rb"
+        threat_name = "MacOS.Trojan.Metasploit"
+        reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/shell_find_port.rb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = { 50 6A 1F 58 CD 80 66 81 7F 02 04 D2 75 EE 50 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Metasploit_d9b16f4c {
+    meta:
+        id = "d9b16f4c-8cc9-42ce-95fa-8db06df9d582"
+        fingerprint = "cf5cfc372008ae98a0958722a7b23f576d6be3b5b07214d21594a48a87d92fca"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        description = "Byte sequence based on Metasploit vforkshell_bind_tcp.rb"
+        threat_name = "MacOS.Trojan.Metasploit"
+        reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/vforkshell_bind_tcp.rb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = { 31 C0 99 50 40 50 40 50 52 B0 61 CD 80 0F 82 7E 00 00 00 89 C6 52 52 52 68 00 02 34 12 89 E3 6A }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Metasploit_2992b917 {
+    meta:
+        id = "2992b917-32bd-4fd8-8221-0d061239673d"
+        fingerprint = "055129bc7931d0334928be00134c109ab36825997b2877958e0ca9006b55575e"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        description = "Byte sequence based on Metasploit vforkshell_reverse_tcp.rb"
+        threat_name = "MacOS.Trojan.Metasploit"
+        reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/vforkshell_reverse_tcp.rb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = { 31 C0 99 50 40 50 40 50 52 B0 61 CD 80 72 6D 89 C7 52 52 68 7F 00 00 01 68 00 02 34 12 89 E3 6A }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Metasploit_27d409f1 {
+    meta:
+        id = "27d409f1-80fd-4d07-815a-4741c48e0bf6"
+        fingerprint = "43be41784449fc414c3e3bc7f4ca5827190fa10ac4cdd8500517e2aa6cce2a56"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        description = "Byte sequence based on Metasploit x64 shell_bind_tcp.rb"
+        threat_name = "MacOS.Trojan.Metasploit"
+        reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x64/shell_bind_tcp.rb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = { B8 61 00 00 02 6A 02 5F 6A 01 5E 48 31 D2 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Metasploit_65a2394b {
+    meta:
+        id = "65a2394b-0e66-4cb5-b6aa-3909120f0a94"
+        fingerprint = "082da76eb8da9315d495b79466366367f19170f93c0a29966858cb92145e38d7"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        description = "Byte sequence based on Metasploit stages vforkshell.rb"
+        threat_name = "MacOS.Trojan.Metasploit"
+        reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stages/osx/x86/vforkshell.rb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = { 31 DB 83 EB 01 43 53 57 53 B0 5A CD 80 72 43 83 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Metasploit_c7b7a90b {
+    meta:
+        id = "c7b7a90b-aaf2-482d-bb95-dee20a75379e"
+        fingerprint = "c4b2711417f5616ca462149882a7f33ce53dd1b8947be62fe0b818c51e4f4b2f"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        description = "Byte sequence based on Metasploit stager reverse_tcp.rb"
+        threat_name = "MacOS.Trojan.Metasploit"
+        reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/osx/x86/reverse_tcp.rb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = { 31 C0 99 50 40 50 40 50 52 B0 61 CD 80 72 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Metasploit_4bd6aaca {
+    meta:
+        id = "4bd6aaca-f519-4d20-b3af-d376e0322a7e"
+        fingerprint = "f4957b565d2b86c79281a0d3b2515b9a0c72f9c9c7b03dae18a3619d7e2fc3dc"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        description = "Byte sequence based on Metasploit stager x86 bind_tcp.rb"
+        threat_name = "MacOS.Trojan.Metasploit"
+        reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/osx/x86/bind_tcp.rb"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = { 31 C0 99 50 40 50 40 50 52 B0 61 CD 80 0F 82 7D }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Metasploit_5e5b685f {
+    meta:
+        id = "5e5b685f-1b6b-4102-b54d-91318e418c6c"
+        fingerprint = "52c41d4fc4d195e702523dd2b65e4078dd967f9c4e4b1c081bc04d88c9e4804f"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Metasploit"
+        reference_sample = "cdf0a3c07ef1479b53d49b8f22a9f93adcedeea3b869ef954cc043e54f65c3d0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = { 00 00 F4 90 90 90 90 55 48 89 E5 48 81 EC 60 20 00 00 89 F8 48 8B 0D 74 23 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Trojan_Thiefquest.yar b/yara/rules/MacOS_Trojan_Thiefquest.yar
new file mode 100644
index 00000000..e1e98ebc
--- /dev/null
+++ b/yara/rules/MacOS_Trojan_Thiefquest.yar
@@ -0,0 +1,117 @@
+rule MacOS_Trojan_Thiefquest_9130c0f3 {
+    meta:
+        id = "9130c0f3-5926-4153-87d8-85a591eed929"
+        fingerprint = "38916235c68a329eea6d41dbfba466367ecc9aad2b8ae324da682a9970ec4930"
+        creation_date = "2021-09-30"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Thiefquest"
+        reference_sample = "bed3561210e44c290cd410adadcdc58462816a03c15d20b5be45d227cd7dca6b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a1 = "heck_if_targeted" ascii fullword
+        $a2 = "check_command" ascii fullword
+        $a3 = "askroot" ascii fullword
+        $a4 = "iv_rescue_data" ascii fullword
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Thiefquest_fc2e1271 {
+    meta:
+        id = "fc2e1271-3c96-4c93-9e3d-212782928e6e"
+        fingerprint = "195e8f65e4ea722f0e1ba171f2ad4ded97d4bc97da38ef8ac8e54b8719e4c5ae"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Thiefquest"
+        reference_sample = "12fb0eca3903a3b39ecc3c2aa6c04fe5faa1f43a3d271154d14731d1eb196923"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 77 47 72 33 31 30 50 6D 72 7A 30 30 30 30 30 37 33 00 30 30 30 42 67 7B 30 30 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Thiefquest_86f9ef0c {
+    meta:
+        id = "86f9ef0c-832e-4e4a-bd39-c80c1d064dbe"
+        fingerprint = "e8849628ee5449c461f1170c07b6d2ebf4f75d48136f26b52bee9bcf4e164d5b"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Thiefquest"
+        reference_sample = "59fb018e338908eb69be72ab11837baebf8d96cdb289757f1f4977228e7640a0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 6C 65 31 6A 6F 57 4E 33 30 30 30 30 30 33 33 00 30 72 7A 41 43 47 33 57 72 7C }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Thiefquest_40f9c1c3 {
+    meta:
+        id = "40f9c1c3-29f8-4699-8f66-9b7ddb08f92d"
+        fingerprint = "27ec200781541d5b1abc96ffbb54c428b773bffa0744551bbacd605c745b6657"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Thiefquest"
+        reference_sample = "e402063ca317867de71e8e3189de67988e2be28d5d773bbaf75618202e80f9f6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 77 47 72 33 31 30 50 6D 72 7A 30 30 30 30 30 37 33 00 33 7C 49 56 7C 6A 30 30 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Thiefquest_0f9fe37c {
+    meta:
+        id = "0f9fe37c-77df-4d3d-be8a-c62ea0f6863c"
+        fingerprint = "2e809d95981f0ff813947f3be22ab3d3c000a0d348131d5d6c8522447818196d"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Thiefquest"
+        reference_sample = "12fb0eca3903a3b39ecc3c2aa6c04fe5faa1f43a3d271154d14731d1eb196923"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 77 47 72 33 31 30 50 6D 72 7A 30 30 30 30 30 37 33 00 33 71 6B 6E 6C 55 30 55 }
+    condition:
+        all of them
+}
+
+rule MacOS_Trojan_Thiefquest_1f4bac78 {
+    meta:
+        id = "1f4bac78-ef2b-49cd-8852-e84d792f6e57"
+        fingerprint = "e7d1e2009ff9b33d2d237068e2af41a8aa9bd44a446a2840c34955594f060120"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Trojan.Thiefquest"
+        reference_sample = "12fb0eca3903a3b39ecc3c2aa6c04fe5faa1f43a3d271154d14731d1eb196923"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 77 47 72 33 31 30 50 6D 72 7A 30 30 30 30 30 37 33 00 32 33 4F 65 49 66 31 68 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Virus_Maxofferdeal.yar b/yara/rules/MacOS_Virus_Maxofferdeal.yar
new file mode 100644
index 00000000..70c99770
--- /dev/null
+++ b/yara/rules/MacOS_Virus_Maxofferdeal.yar
@@ -0,0 +1,76 @@
+rule MacOS_Virus_Maxofferdeal_53df500f {
+    meta:
+        id = "53df500f-3add-4d3d-aec3-35b7b5aa5b35"
+        fingerprint = "2f41de7b8e55ef8db39bf84c0f01f8d34d67b087769b84381f2ccc3778e13b08"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Virus.Maxofferdeal"
+        reference_sample = "ecd62ef880da057726ca55c6826ce4e1584ec6fc3afaabed7f66154fc39ffef8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { BF BF BF E6 AF A7 A7 AF A4 AD E6 AB A7 A5 C8 AC AD AE A9 BD A4 BC 97 }
+    condition:
+        all of them
+}
+
+rule MacOS_Virus_Maxofferdeal_f4681eba {
+    meta:
+        id = "f4681eba-20f5-4e92-9f99-00cd57412c45"
+        fingerprint = "b6663c326e9504510b804bd9ff0e8ace5d98826af2bb2fa2429b37171b7f399d"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Virus.Maxofferdeal"
+        reference_sample = "ecd62ef880da057726ca55c6826ce4e1584ec6fc3afaabed7f66154fc39ffef8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { BA A4 C8 BF BF BF E6 AF A7 A7 AF A4 AD E6 AB A7 A5 C8 AC AD AE A9 BD A4 BC 97 }
+    condition:
+        all of them
+}
+
+rule MacOS_Virus_Maxofferdeal_4091e373 {
+    meta:
+        id = "4091e373-c3a9-41c8-a1d8-3a77585ff850"
+        fingerprint = "3d8e7db6c39286d9626c6be8bfb5da177a6a4f8ffcec83975a644aaac164a8c7"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Virus.Maxofferdeal"
+        reference_sample = "c38c4bdd3c1fa16fd32db06d44d0db1b25bb099462f8d2936dbdd42af325b37c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { B8 F2 E7 E7 BF BF BF E6 AF A7 A7 AF A4 AD E6 AB A7 A5 C8 8B 8E 8A BD A6 AC A4 }
+    condition:
+        all of them
+}
+
+rule MacOS_Virus_Maxofferdeal_20a0091e {
+    meta:
+        id = "20a0091e-a3ef-4a13-ba92-700f3583e06d"
+        fingerprint = "1629b34b424816040066122592e56e317b204f3d5de2f5e7f68114c7a48d99cb"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Virus.Maxofferdeal"
+        reference_sample = "b00a61c908cd06dbc26bee059ba290e7ce2ad6b66c453ea272c7287ffa29c5ab"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { F2 E7 E7 BF BF BF E6 AF A7 A7 AF A4 AD E6 AB A7 A5 C8 A0 BC BC B8 F2 E7 E7 BF }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Virus_Pirrit.yar b/yara/rules/MacOS_Virus_Pirrit.yar
new file mode 100644
index 00000000..144ac3ad
--- /dev/null
+++ b/yara/rules/MacOS_Virus_Pirrit.yar
@@ -0,0 +1,19 @@
+rule MacOS_Virus_Pirrit_271b8ed0 {
+    meta:
+        id = "271b8ed0-937a-4be6-aecb-62535b5aeda7"
+        fingerprint = "12b09b2e3a43905db2cfe96d0fd0e735cfc7784ee7b03586c5d437d7c6a1b422"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Virus.Pirrit"
+        reference_sample = "7feda05d41b09c06a08c167c7f4dde597ac775c54bf0d74a82aa533644035177"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 35 4A 6A 00 00 32 80 35 44 6A 00 00 75 80 35 3E 6A 00 00 1F 80 35 38 6A 00 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/MacOS_Virus_Vsearch.yar b/yara/rules/MacOS_Virus_Vsearch.yar
new file mode 100644
index 00000000..1000f396
--- /dev/null
+++ b/yara/rules/MacOS_Virus_Vsearch.yar
@@ -0,0 +1,36 @@
+rule MacOS_Virus_Vsearch_0dd3ec6f {
+    meta:
+        id = "0dd3ec6f-815f-40e1-bd53-495e0eae8196"
+        fingerprint = "8adbd06894e81dc09e46d8257d4e5fcd99e714f54ffb36d5a8d6268ea25d0bd6"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Virus.Vsearch"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 2F 00 56 53 44 6F 77 6E 6C 6F 61 64 65 72 2E 6D 00 2F 4D 61 63 69 6E 74 6F 73 }
+    condition:
+        all of them
+}
+
+rule MacOS_Virus_Vsearch_2a0419f8 {
+    meta:
+        id = "2a0419f8-95b2-4f87-a37a-ee0b65e344e9"
+        fingerprint = "2da9f0fc05bc8e23feb33b27142f46fb437af77766e39889a02ea843d52d17eb"
+        creation_date = "2021-10-05"
+        last_modified = "2021-10-25"
+        threat_name = "MacOS.Virus.Vsearch"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "macos"
+    strings:
+        $a = { 6F 72 6D 61 6C 2F 69 33 38 36 2F 56 53 44 6F 77 6E 6C 6F 61 64 65 72 2E 6F 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Multi_EICAR.yar b/yara/rules/Multi_EICAR.yar
new file mode 100644
index 00000000..896a0303
--- /dev/null
+++ b/yara/rules/Multi_EICAR.yar
@@ -0,0 +1,18 @@
+rule Multi_EICAR_ac8f42d6 {
+    meta:
+        id = "ac8f42d6-52da-46ec-8db1-5a5f69222a38"
+        fingerprint = "bb0e0bdf70ec65d98f652e2428e3567013d5413f2725a2905b372fd18da8b9dd"
+        creation_date = "2021-01-21"
+        last_modified = "2022-01-13"
+        threat_name = "Multi.EICAR.Not-a-virus"
+        severity = 1
+        arch_context = "x86, arm64"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "multi"
+    strings:
+        $a = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Multi_Trojan_Bishopsliver.yar b/yara/rules/Multi_Trojan_Bishopsliver.yar
new file mode 100644
index 00000000..d3732915
--- /dev/null
+++ b/yara/rules/Multi_Trojan_Bishopsliver.yar
@@ -0,0 +1,25 @@
+rule Multi_Trojan_Bishopsliver_42298c4a {
+    meta:
+        id = "42298c4a-fcea-4c5a-b213-32db00e4eb5a"
+        fingerprint = "0734b090ea10abedef4d9ed48d45c834dd5cf8e424886a5be98e484f69c5e12a"
+        creation_date = "2021-10-20"
+        last_modified = "2022-01-14"
+        threat_name = "Multi.Trojan.Bishopsliver"
+        reference_sample = "3b45aae401ac64c055982b5f3782a3c4c892bdb9f9a5531657d50c27497c8007"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "multi"
+    strings:
+        $a1 = ").RequestResend"
+        $a2 = ").GetPrivInfo"
+        $a3 = ").GetReconnectIntervalSeconds"
+        $a4 = ").GetPivotID"
+        $a5 = "name=PrivInfo"
+        $a6 = "name=ReconnectIntervalSeconds"
+        $a7 = "name=PivotID"
+    condition:
+        2 of them
+}
+
diff --git a/yara/rules/Windows_AttackSimulation_Hovercraft.yar b/yara/rules/Windows_AttackSimulation_Hovercraft.yar
new file mode 100644
index 00000000..866acb51
--- /dev/null
+++ b/yara/rules/Windows_AttackSimulation_Hovercraft.yar
@@ -0,0 +1,20 @@
+rule Windows_AttackSimulation_Hovercraft_f5c7178f {
+    meta:
+        id = "f5c7178f-9a3f-463d-96a7-0a82cbed9ba2"
+        fingerprint = "8965ab173fd09582c9e77e7c54c9722b91b71ecbe42c4f8a8cc87d9a780ffe8c"
+        creation_date = "2022-05-23"
+        last_modified = "2022-07-18"
+        threat_name = "Windows.AttackSimulation.Hovercraft"
+        reference = "046645b2a646c83b4434a893a0876ea9bd51ae05e70d4e72f2ccc648b0f18cb6"
+        severity = 1
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "MyHovercraftIsFullOfEels" wide fullword
+        $a2 = "WinHttp.dll" fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Backdoor_Goldbackdoor.yar b/yara/rules/Windows_Backdoor_Goldbackdoor.yar
new file mode 100644
index 00000000..11a614de
--- /dev/null
+++ b/yara/rules/Windows_Backdoor_Goldbackdoor.yar
@@ -0,0 +1,50 @@
+rule Windows_Backdoor_Goldbackdoor_91902940 {
+    meta:
+        id = "91902940-a291-4fc6-81c5-2cde2328e8d9"
+        fingerprint = "83a404a24e54bd05319d3df3a830f1ffe51d30f71ca55d63ca152d5169511df4"
+        creation_date = "2022-04-29"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Backdoor.Goldbackdoor"
+        reference_sample = "485246b411ef5ea9e903397a5490d106946a8323aaf79e6041bdf94763a0c028"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $pdf = "D:\\Development\\GOLD-BACKDOOR\\"
+        $agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.3112.113 Safari/537.36"
+        $str0 = "client_id"
+        $str1 = "client_secret"
+        $str2 = "redirect_uri"
+        $str3 = "refresh_token"
+        $a = { 56 57 8B 7D 08 8B F1 6A 00 6A 00 6A 00 6A 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 46 30 85 C0 75 ?? 33 C0 5F 5E }
+        $b = { 66 8B 02 83 C2 02 66 85 C0 75 ?? 2B D1 D1 FA 75 ?? 33 C0 E9 ?? ?? ?? ?? 6A 40 8D 45 ?? 6A 00 50 E8 }
+    condition:
+        ($pdf and $agent) or (all of ($str*) and $a and $b)
+}
+
+rule Windows_Backdoor_Goldbackdoor_f11d57df {
+    meta:
+        id = "f11d57df-8dd4-481c-a557-f83ae05d53fe"
+        fingerprint = "fed0317d43910d962908604812c2cd1aff6e67f7e245c82b39f2ac6dc14b6edb"
+        creation_date = "2022-04-29"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Backdoor.Goldbackdoor"
+        reference_sample = "45ece107409194f5f1ec2fbd902d041f055a914e664f8ed2aa1f90e223339039"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { C7 45 ?? 64 69 72 25 C7 45 ?? 5C 53 79 73 C7 45 ?? 74 65 6D 33 C7 45 ?? 32 5C 00 00 C7 45 ?? 2A 2E 65 78 C7 45 ?? 65 00 00 00 E8 ?? ?? ?? ?? FF D0 }
+        $b = { B9 18 48 24 9D E8 ?? ?? ?? ?? FF D0 }
+        $c = { B9 F8 92 FA 98 E8 ?? ?? ?? ?? FF D0 }
+        $a1 = { 64 A1 30 00 00 00 53 55 56 }
+        $b1 = { B9 76 DB 7A AA 6A 40 68 00 30 00 00 FF 75 ?? 50 E8 ?? ?? ?? ?? FF D0 }
+        $c1 = { B9 91 51 13 EE 50 68 80 00 00 00 6A 04 50 50 ?? ?? ?? ?? ?? ?? ?? 6A 04 50 E8 ?? ?? ?? ?? FF D0 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Cryptominer_Generic.yar b/yara/rules/Windows_Cryptominer_Generic.yar
new file mode 100644
index 00000000..0b4fa605
--- /dev/null
+++ b/yara/rules/Windows_Cryptominer_Generic.yar
@@ -0,0 +1,19 @@
+rule Windows_Cryptominer_Generic_dd1e4d1a {
+    meta:
+        id = "dd1e4d1a-2e2f-4af0-bd66-2e12367dd064"
+        fingerprint = "a00e3e08e11d10a7a4bf1110a5110e4d0a4d2acf0974aca9dfc1ad5f21c80df7"
+        creation_date = "2021-01-12"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Cryptominer.Generic"
+        reference_sample = "7ac1d7b6107307fb2442522604c8fa56010d931392d606ac74dcea6b7125954b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { EF F9 66 0F EF FA 66 0F FE FE 66 0F 6F B0 B0 00 00 00 66 0F }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Exploit_Dcom.yar b/yara/rules/Windows_Exploit_Dcom.yar
new file mode 100644
index 00000000..ed814214
--- /dev/null
+++ b/yara/rules/Windows_Exploit_Dcom.yar
@@ -0,0 +1,19 @@
+rule Windows_Exploit_Dcom_7a1bcec7 {
+    meta:
+        id = "7a1bcec7-e177-4adf-97a7-0d876bf65abc"
+        fingerprint = "0abae84599e490056412d5a5ce1868ea118551243377d59cbb6ebd83701769b8"
+        creation_date = "2021-01-12"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Exploit.Dcom"
+        reference_sample = "84073caf71d0e0523adeb96169c85b8f0bfea09e7ef3bf677bfc19d3b536d8a5"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 20 62 79 20 46 6C 61 73 68 53 6B 79 20 61 6E 64 20 42 65 6E }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Exploit_Eternalblue.yar b/yara/rules/Windows_Exploit_Eternalblue.yar
new file mode 100644
index 00000000..2e75f114
--- /dev/null
+++ b/yara/rules/Windows_Exploit_Eternalblue.yar
@@ -0,0 +1,19 @@
+rule Windows_Exploit_Eternalblue_ead33bf8 {
+    meta:
+        id = "ead33bf8-1870-4d01-a223-edcbe262542f"
+        fingerprint = "9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd"
+        creation_date = "2021-01-12"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Exploit.Eternalblue"
+        reference_sample = "a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Exploit_Log4j.yar b/yara/rules/Windows_Exploit_Log4j.yar
new file mode 100644
index 00000000..247517e8
--- /dev/null
+++ b/yara/rules/Windows_Exploit_Log4j.yar
@@ -0,0 +1,24 @@
+rule Windows_Exploit_Log4j_dbac7698 {
+    meta:
+        id = "dbac7698-906c-44a2-9795-f04ec07d7fcc"
+        fingerprint = "cd06db6f5bebf0412d056017259b5451184d5ba5b2976efd18fa8f96dba6a159"
+        creation_date = "2021-12-13"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Exploit.Log4j"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $jndi1 = "jndi.ldap.LdapCtx.c_lookup"
+        $jndi2 = "logging.log4j.core.lookup.JndiLookup.lookup"
+        $jndi3 = "com.sun.jndi.url.ldap.ldapURLContext.lookup"
+        $exp1 = "Basic/Command/Base64/"
+        $exp2 = "java.lang.ClassCastException: Exploit"
+        $exp3 = "WEB-INF/classes/Exploit"
+        $exp4 = "Exploit.java"
+    condition:
+        2 of ($jndi*) and 1 of ($exp*)
+}
+
diff --git a/yara/rules/Windows_Hacktool_Dcsyncer.yar b/yara/rules/Windows_Hacktool_Dcsyncer.yar
new file mode 100644
index 00000000..8c6c845a
--- /dev/null
+++ b/yara/rules/Windows_Hacktool_Dcsyncer.yar
@@ -0,0 +1,23 @@
+rule Windows_Hacktool_Dcsyncer_425579c5 {
+    meta:
+        id = "425579c5-496f-4e08-a7e3-bf56e622aa21"
+        fingerprint = "f6a0c028323be41f6ec90af8a7ea8587fee6985ddefdbcdd24351cb615f756a2"
+        creation_date = "2021-09-15"
+        last_modified = "2022-01-13"
+        description = "MGIxY2/05+FBDTur++++0OUs"
+        threat_name = "Windows.Hacktool.Dcsyncer"
+        reference_sample = "af7dbc84efeb186006d75d095f54a266f59e6b2348d0c20591da16ae7b7d509a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "[x] dcsync: Error in ProcessGetNCChangesReply" wide fullword
+        $a2 = "[x] getDCBind: RPC Exception 0x%08x (%u)" wide fullword
+        $a3 = "[x] getDomainAndUserInfos: DomainControllerInfo: 0x%08x (%u)" wide fullword
+        $a4 = "[x] ProcessGetNCChangesReply_decrypt: Checksums don't match (C:0x%08x - R:0x%08x)" wide fullword
+    condition:
+        any of them
+}
+
diff --git a/yara/rules/Windows_Hacktool_Mimikatz.yar b/yara/rules/Windows_Hacktool_Mimikatz.yar
new file mode 100644
index 00000000..cf6e211c
--- /dev/null
+++ b/yara/rules/Windows_Hacktool_Mimikatz.yar
@@ -0,0 +1,110 @@
+rule Windows_Hacktool_Mimikatz_1388212a {
+    meta:
+        id = "1388212a-2146-4565-b93d-4555a110364f"
+        fingerprint = "dbbdc492c07e3b95d677044751ee4365ec39244e300db9047ac224029dfe6ab7"
+        creation_date = "2021-04-13"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Hacktool.Mimikatz"
+        reference_sample = "66b4a0681cae02c302a9b6f1d611ac2df8c519d6024abdb506b4b166b93f636a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "   Password: %s" wide fullword
+        $a2 = "  * Session Key   : 0x%08x - %s" wide fullword
+        $a3 = "   * Injecting ticket : " wide fullword
+        $a4 = " ## / \\ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )" wide fullword
+        $a5 = "Remove mimikatz driver (mimidrv)" wide fullword
+        $a6 = "mimikatz(commandline) # %s" wide fullword
+        $a7 = "  Password: %s" wide fullword
+        $a8 = " - SCardControl(FEATURE_CCID_ESC_COMMAND)" wide fullword
+        $a9 = " * to 0 will take all 'cmd' and 'mimikatz' process" wide fullword
+        $a10 = "** Pass The Ticket **" wide fullword
+        $a11 = "-> Ticket : %s" wide fullword
+        $a12 = "Busylight Lync model (with bootloader)" wide fullword
+        $a13 = "mimikatz.log" wide fullword
+        $a14 = "Log mimikatz input/output to file" wide fullword
+        $a15 = "ERROR kuhl_m_dpapi_masterkey ; kull_m_dpapi_unprotect_domainkey_with_key" wide fullword
+        $a16 = "ERROR kuhl_m_lsadump_dcshadow ; unable to start the server: %08x" wide fullword
+        $a17 = "ERROR kuhl_m_sekurlsa_pth ; GetTokenInformation (0x%08x)" wide fullword
+        $a18 = "ERROR mimikatz_doLocal ; \"%s\" module not found !" wide fullword
+        $a19 = "Install and/or start mimikatz driver (mimidrv)" wide fullword
+        $a20 = "Target: %hhu (0x%02x - %s)" wide fullword
+        $a21 = "mimikatz Ho, hey! I'm a DC :)" wide fullword
+        $a22 = "mimikatz service (mimikatzsvc)" wide fullword
+        $a23 = "[masterkey] with DPAPI_SYSTEM (machine, then user): " wide fullword
+        $a24 = "$http://blog.gentilkiwi.com/mimikatz 0" ascii fullword
+        $a25 = " * Username : %wZ" wide fullword
+    condition:
+        3 of ($a*)
+}
+
+rule Windows_Hacktool_Mimikatz_674fd079 {
+    meta:
+        id = "674fd079-f7fe-4d89-87e7-ac11aa21c9ed"
+        fingerprint = "b8f71996180e5f03c10e39eb36b2084ecaff78d7af34bd3d0d75225d2cfad765"
+        creation_date = "2021-04-14"
+        last_modified = "2021-08-23"
+        description = "Detection for default mimikatz memssp module"
+        threat_name = "Windows.Hacktool.Mimikatz"
+        reference_sample = "66b4a0681cae02c302a9b6f1d611ac2df8c519d6024abdb506b4b166b93f636a"
+        severity = 99
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 44 30 00 38 00 }
+        $a2 = { 48 78 00 3A 00 }
+        $a3 = { 4C 25 00 30 00 }
+        $a4 = { 50 38 00 78 00 }
+        $a5 = { 54 5D 00 20 00 }
+        $a6 = { 58 25 00 77 00 }
+        $a7 = { 5C 5A 00 5C 00 }
+        $a8 = { 60 25 00 77 00 }
+        $a9 = { 64 5A 00 09 00 }
+        $a10 = { 6C 5A 00 0A 00 }
+        $a11 = { 68 25 00 77 00 }
+        $a12 = { 68 25 00 77 00 }
+        $a13 = { 6C 5A 00 0A 00 }
+        $b1 = { 6D 69 6D 69 C7 84 24 8C 00 00 00 6C 73 61 2E C7 84 24 90 00 00 00 6C 6F 67 }
+    condition:
+        all of ($a*) or $b1
+}
+
+rule Windows_Hacktool_Mimikatz_355d5d3a {
+    meta:
+        id = "355d5d3a-e50e-4614-9a84-0da668c40852"
+        fingerprint = "9a23845ec9852d2490171af111612dc257a6b21ad7fdfd8bf22d343dc301d135"
+        creation_date = "2021-04-14"
+        last_modified = "2021-08-23"
+        description = "Detection for Invoke-Mimikatz"
+        threat_name = "Windows.Hacktool.Mimikatz"
+        reference_sample = "945245ca795e0a3575ee4fdc174df9d377a598476c2bf4bf0cdb0cde4286af96"
+        severity = 90
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "$PEBytes32 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwc"
+        $a2 = "$PEBytes64 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwc"
+        $b1 = "Write-BytesToMemory -Bytes $Shellcode"
+        $b2 = "-MemoryAddress $GetCommandLineWAddrTemp"
+        $b3 = "-MemoryAddress $GetCommandLineAAddrTemp"
+        $c1 = "Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword
+        $c2 = "Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs) -ComputerNam"
+        $c3 = "at: http://blog.gentilkiwi.com"
+        $c4 = "on the local computer to dump certificates."
+        $c5 = "Throw \"Unable to write shellcode to remote process memory.\"" fullword
+        $c6 = "-Command \"privilege::debug exit\" -ComputerName \"computer1\""
+        $c7 = "dump credentials without"
+        $c8 = "#The shellcode writes the DLL address to memory in the remote process at address $LoadLibraryARetMem, read this memory" fullword
+        $c9 = "two remote computers to dump credentials."
+        $c10 = "#If a remote process to inject in to is specified, get a handle to it" fullword
+    condition:
+        (1 of ($a*) or 2 of ($b*)) or 5 of ($c*)
+}
+
diff --git a/yara/rules/Windows_Ransomware_Avoslocker.yar b/yara/rules/Windows_Ransomware_Avoslocker.yar
new file mode 100644
index 00000000..a81a87c4
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Avoslocker.yar
@@ -0,0 +1,23 @@
+rule Windows_Ransomware_Avoslocker_7ae4d4f2 {
+    meta:
+        id = "7ae4d4f2-be5f-4aad-baaa-4182ff9cf996"
+        fingerprint = "0e5ff268ed2b62f9d31df41192135145094849a4e6891407568c3ea27ebf66bb"
+        creation_date = "2021-07-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Ransomware.Avoslocker"
+        reference_sample = "43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "drive %s took %f seconds" ascii fullword
+        $a2 = "client_rsa_priv: %s" ascii fullword
+        $a3 = "drive: %s" ascii fullword
+        $a4 = "Map: %s" ascii fullword
+        $a5 = "encrypting %ls failed" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Bitpaymer.yar b/yara/rules/Windows_Ransomware_Bitpaymer.yar
new file mode 100644
index 00000000..a90537f5
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Bitpaymer.yar
@@ -0,0 +1,47 @@
+rule Windows_Ransomware_Bitpaymer_d74273b3 : beta {
+    meta:
+        id = "d74273b3-d109-4b5d-beff-dffee9a984b1"
+        fingerprint = "4f913f06f7c7decbeb78187c566674f91ebbf929ad7057641659bb756cf2991b"
+        creation_date = "2020-06-25"
+        last_modified = "2021-08-23"
+        description = "Identifies BITPAYMER ransomware"
+        threat_name = "Windows.Ransomware.Bitpaymer"
+        reference = "https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $b1 = { 24 E8 00 00 00 29 F0 19 F9 89 8C 24 88 00 00 00 89 84 24 84 00 }
+    condition:
+        1 of ($b*)
+}
+
+rule Windows_Ransomware_Bitpaymer_bca25ac6 : beta {
+    meta:
+        id = "bca25ac6-e351-4823-be75-b0661c89588a"
+        fingerprint = "2ecc7884d47ca7dbba30ba171b632859914d6152601ea7b463c0f52be79ebb8c"
+        creation_date = "2020-06-25"
+        last_modified = "2021-08-23"
+        description = "Identifies BITPAYMER ransomware"
+        threat_name = "Windows.Ransomware.Bitpaymer"
+        reference = "https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "RWKGGE.PDB" fullword
+        $a2 = "*Qf69@+mESRA.RY7*+6XEF#NH.pdb" fullword
+        $a3 = "04QuURX.pdb" fullword
+        $a4 = "9nuhuNN.PDB" fullword
+        $a5 = "mHtXGC.PDB" fullword
+        $a6 = "S:\\Work\\_bin\\Release-Win32\\wp_encrypt_new.pdb" fullword
+        $a7 = "C:\\Work\\_bin\\Release-Win32\\wp_encrypt.pdb" fullword
+        $a8 = "k:\\softcare\\release\\h2O.pdb" fullword
+    condition:
+        1 of ($a*)
+}
+
diff --git a/yara/rules/Windows_Ransomware_Blackmatter.yar b/yara/rules/Windows_Ransomware_Blackmatter.yar
new file mode 100644
index 00000000..4159ffc4
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Blackmatter.yar
@@ -0,0 +1,38 @@
+rule Windows_Ransomware_Blackmatter_b548d151 {
+    meta:
+        id = "b548d151-5dde-459b-9d4a-b4a48c1b5545"
+        fingerprint = "351658f8fe3f9c956634e3cf7a03b272c55359f069c5200e948d817c6b554c87"
+        creation_date = "2021-08-03"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Blackmatter"
+        reference_sample = "072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 93 F0 DA 07 E7 F0 DA 07 E0 5B 99 65 47 38 96 6C 75 91 65 46 5A D0 B0 25 DA 90 42 CE F1 73 10 B1 14 BD 3C EC FD 7C AF 9B 8D 86 89 A5 FF C0 3F 78 57 8E E2 AD 2E 3A 2F 74 79 B1 FE 27 69 6B 9F 97 CE C8 67 88 1A 0B 01 F1 B7 76 35 18 E8 FF E1 D7 66 8C 41 03 EB F8 64 E5 7E F1 06 73 AB BF 6B 1D 6A B9 B6 BA 41 A2 91 49 5E 85 51 A0 83 23 46 D6 E0 E5 0F C2 53 89 2A 35 94 AF FC 87 A0 D8 08 E7 B8 DB 08 E7 78 22 E5 7E AE BB EF 16 87 08 3C 47 F0 49 1E 0D 2D 9A 1B 55 54 05 14 69 A3 1B 9C 7A 97 7B CF 85 2B 09 F9 DC 2C EB A6 55 F1 A0 07 B4 AA 80 EA ED 26 87 C0 }
+    condition:
+        any of them
+}
+
+rule Windows_Ransomware_Blackmatter_8394f6d5 {
+    meta:
+        id = "8394f6d5-4761-4df6-974d-eaa0a25353da"
+        fingerprint = "3825f59ffe9b2adc1f9dd175f4d57c9aa3dd6ff176616ecbe7c673b5b4d414f8"
+        creation_date = "2021-08-03"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Blackmatter"
+        reference_sample = "072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { FF E1 D7 66 8C 41 03 EB F8 64 E5 7E F1 06 73 AB BF 6B 1D 6A B9 B6 BA 41 A2 91 49 5E 85 51 A0 83 23 }
+    condition:
+        any of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Clop.yar b/yara/rules/Windows_Ransomware_Clop.yar
new file mode 100644
index 00000000..44fdbd4a
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Clop.yar
@@ -0,0 +1,89 @@
+rule Windows_Ransomware_Clop_6a1670aa : beta {
+    meta:
+        id = "6a1670aa-7f78-455b-9e28-f39ed4c6476e"
+        fingerprint = "7c24cc6a519922635a519dad412d1a07728317b91f90a120ccc1c7e7e2c8a002"
+        creation_date = "2020-05-03"
+        last_modified = "2021-08-23"
+        description = "Identifies CLOP ransomware in unpacked state"
+        threat_name = "Windows.Ransomware.Clop"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $b1 = { FF 15 04 E1 40 00 83 F8 03 74 0A 83 F8 02 }
+    condition:
+        1 of ($b*)
+}
+
+rule Windows_Ransomware_Clop_e04959b5 : beta {
+    meta:
+        id = "e04959b5-f3da-428d-8b56-8a9817fdebe0"
+        fingerprint = "7367b90772ce6db0d639835a0a54a994ef8ed351b6dadff42517ed5fbc3d0d1a"
+        creation_date = "2020-05-03"
+        last_modified = "2021-08-23"
+        description = "Identifies CLOP ransomware in unpacked state"
+        threat_name = "Windows.Ransomware.Clop"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "-%s\\CIopReadMe.txt" wide fullword
+        $a2 = "CIopReadMe.txt" wide fullword
+        $a3 = "%s-CIop^_" wide fullword
+        $a4 = "%s%s.CIop" wide fullword
+        $a5 = "BestChangeT0p^_-666" ascii fullword
+        $a6 = ".CIop" wide fullword
+        $a7 = "A%s\\ClopReadMe.txt" wide fullword
+        $a8 = "%s%s.Clop" wide fullword
+        $a9 = "CLOP#666" wide fullword
+        $a10 = "MoneyP#666" wide fullword
+    condition:
+        1 of ($a*)
+}
+
+rule Windows_Ransomware_Clop_9ac9ea3e : beta {
+    meta:
+        id = "9ac9ea3e-72e1-4151-a2f8-87869f5f98e3"
+        fingerprint = "1cb0adb36e94ef8f8d74862250205436ed3694ed7719d8e639cfdd0c8632fd6c"
+        creation_date = "2020-05-03"
+        last_modified = "2021-08-23"
+        description = "Identifies CLOP ransomware in unpacked state"
+        threat_name = "Windows.Ransomware.Clop"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $c1 = { 8B 1D D8 E0 40 00 33 F6 8B 3D BC E0 40 00 }
+    condition:
+        1 of ($c*)
+}
+
+rule Windows_Ransomware_Clop_606020e7 : beta {
+    meta:
+        id = "606020e7-ce1a-4a48-b801-100fd22b3791"
+        fingerprint = "5ec4e00ddf2cb1315ec7d62dd228eee0d9c15fafe4712933d42e868f83f13569"
+        creation_date = "2020-05-03"
+        last_modified = "2021-08-23"
+        description = "Identifies CLOP ransomware in unpacked state"
+        threat_name = "Windows.Ransomware.Clop"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $d1 = { B8 E1 83 0F 3E F7 E6 8B C6 C1 EA 04 8B CA C1 E1 05 03 CA }
+    condition:
+        1 of ($d*)
+}
+
diff --git a/yara/rules/Windows_Ransomware_Conti.yar b/yara/rules/Windows_Ransomware_Conti.yar
new file mode 100644
index 00000000..29738ee0
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Conti.yar
@@ -0,0 +1,19 @@
+rule Windows_Ransomware_Conti_89f3f6fa {
+    meta:
+        id = "89f3f6fa-492c-40e3-a4aa-a526004197b2"
+        fingerprint = "a82331eba3cbd52deb4bed5e11035ac1e519ec27931507f582f2985865c0fb1a"
+        creation_date = "2021-08-05"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Conti"
+        reference_sample = "eae876886f19ba384f55778634a35a1d975414e83f22f6111e3e792f706301fe"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { F7 FE 88 57 FF 83 EB 01 75 DA 8B 45 FC 5F 5B 40 5E 8B E5 5D C3 8D }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Cuba.yar b/yara/rules/Windows_Ransomware_Cuba.yar
new file mode 100644
index 00000000..c5930e83
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Cuba.yar
@@ -0,0 +1,41 @@
+rule Windows_Ransomware_Cuba_e64a16b1 {
+    meta:
+        id = "e64a16b1-262c-4835-bd95-4dde89dd75f4"
+        fingerprint = "840f2ebe2664db9a0918acf7d408ca8060ee0d3c330ad08b36e5be7f7e2cf069"
+        creation_date = "2021-08-04"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Cuba"
+        reference_sample = "33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 45 EC 8B F9 8B 45 14 89 45 F0 8D 45 E4 50 8D 45 F8 66 0F 13 }
+        $HeaderCheck = { 8B 06 81 38 46 49 44 45 75 ?? 81 78 04 4C 2E 43 41 74 }
+    condition:
+        any of them
+}
+
+rule Windows_Ransomware_Cuba_95a98e69 {
+    meta:
+        id = "95a98e69-ce6c-40c6-a05b-2366c663ad6e"
+        fingerprint = "05cfd7803692149a55d9ced84828422b66e8b301c8c2aae9ca33c6b68e29bcf8"
+        creation_date = "2021-08-04"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Cuba"
+        reference_sample = "00f18713f860dc8394fb23a1a2b6280d1eb2f20a487c175433a7b495a1ba408d"
+        severity = 90
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "We also inform that your databases, ftp server and file server were downloaded by us to our servers." ascii fullword
+        $a2 = "Good day. All your files are encrypted. For decryption contact us." ascii fullword
+        $a3 = ".cuba" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Darkside.yar b/yara/rules/Windows_Ransomware_Darkside.yar
new file mode 100644
index 00000000..5b0931a3
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Darkside.yar
@@ -0,0 +1,38 @@
+rule Windows_Ransomware_Darkside_d7fc4594 {
+    meta:
+        id = "d7fc4594-185c-4afb-986e-5718c0beabf1"
+        fingerprint = "90444cd2d3a38296b4979f91345a9999b0032f6c0abee6ff7c15d149b59e5e88"
+        creation_date = "2021-05-20"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Darkside"
+        reference_sample = "bfb31c96f9e6285f5bb60433f2e45898b8a7183a2591157dc1d766be16c29893"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 5F 30 55 56 BD 0A 00 00 00 8B 07 8B 5F 10 8B 4F 20 8B 57 30 }
+    condition:
+        any of them
+}
+
+rule Windows_Ransomware_Darkside_aceac5d9 {
+    meta:
+        id = "aceac5d9-fb38-4dca-ab1f-44ee40005d37"
+        fingerprint = "521b0f574b27151ad03fc7693fd692e1a13e81a28e39d04d3f7ea149a0da59b9"
+        creation_date = "2021-05-20"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Darkside"
+        reference_sample = "bfb31c96f9e6285f5bb60433f2e45898b8a7183a2591157dc1d766be16c29893"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 41 54 55 53 48 83 EC 28 48 8B 1F 4C 8B 66 08 48 8D 7C 24 10 4C }
+    condition:
+        any of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Dharma.yar b/yara/rules/Windows_Ransomware_Dharma.yar
new file mode 100644
index 00000000..ad030841
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Dharma.yar
@@ -0,0 +1,83 @@
+rule Windows_Ransomware_Dharma_aa5eefed : beta {
+    meta:
+        id = "aa5eefed-7212-42c9-b51d-2c58c65b53e5"
+        fingerprint = "d3baf3474b450931b594322d190b243bdd813156ad80f04abcadde0db3bfe149"
+        creation_date = "2020-06-25"
+        last_modified = "2021-08-23"
+        description = "Identifies DHARMA ransomware"
+        threat_name = "Windows.Ransomware.Dharma"
+        reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $c1 = { 4D F0 51 8B 55 E8 52 E8 CD 10 00 00 83 C4 08 89 45 E8 8A 45 F9 04 01 88 45 F9 0F B6 4D F9 8B 55 E4 8A 04 0A 88 45 FB 0F B6 4D FB 0F B6 55 FA 03 D1 88 55 FA 0F B6 45 FA 8B 4D E4 8A 14 01 88 55 EF 0F B6 45 F9 8B 4D E4 8A 55 EF 88 14 01 0F B6 45 FA 8B 4D E4 8A 55 FB 88 14 01 8B 45 0C 03 45 F4 0F B6 08 0F B6 55 FB 0F B6 45 EF 03 D0 0F B6 D2 8B 45 E4 0F B6 14 10 33 CA 8B 45 E8 03 45 F4 88 08 }
+        $c2 = { 21 0C 7D 01 02 04 08 10 20 40 80 1B 36 6C D8 AB 4D 9A 2F 5E BC 63 C6 97 35 6A D4 B3 7D FA EF C5 91 00 00 A5 63 63 C6 84 7C 7C F8 99 77 77 EE 8D 7B 7B F6 0D F2 F2 FF BD 6B 6B D6 B1 6F 6F DE 54 C5 C5 91 50 30 30 60 03 01 01 02 A9 67 67 CE 7D 2B 2B 56 }
+    condition:
+        1 of ($c*)
+}
+
+rule Windows_Ransomware_Dharma_b31cac3f : beta {
+    meta:
+        id = "b31cac3f-6e04-48b2-9d16-1a6b66fa8012"
+        fingerprint = "25d23d045c57758dbb14092cff3cc190755ceb3a21c8a80505bd316a430e21fc"
+        creation_date = "2020-06-25"
+        last_modified = "2021-08-23"
+        description = "Identifies DHARMA ransomware"
+        threat_name = "Windows.Ransomware.Dharma"
+        reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $b1 = "sssssbsss" ascii fullword
+        $b2 = "sssssbs" ascii fullword
+        $b3 = "RSDS%~m" ascii fullword
+    condition:
+        3 of ($b*)
+}
+
+rule Windows_Ransomware_Dharma_e9319e4a : beta {
+    meta:
+        id = "e9319e4a-3850-4bad-9579-4b73199a0963"
+        fingerprint = "4a4f3aebe4c9726cf62dde454f01cbf6dcb09bf3ef1b230d548fe255f01254aa"
+        creation_date = "2020-06-25"
+        last_modified = "2021-08-23"
+        description = "Identifies DHARMA ransomware"
+        threat_name = "Windows.Ransomware.Dharma"
+        reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $d = { 08 8B 51 24 8B 45 08 8B 48 18 0F B7 14 51 85 D2 74 47 8B 45 08 8B }
+    condition:
+        1 of ($d*)
+}
+
+rule Windows_Ransomware_Dharma_942142e3 : beta {
+    meta:
+        id = "942142e3-9197-41c4-86cc-66121c8a9ab5"
+        fingerprint = "e8ee60d53f92dd1ade8cc956c13a5de38f9be9050131ba727f2fab41dde619a8"
+        creation_date = "2020-06-25"
+        last_modified = "2021-08-23"
+        description = "Identifies DHARMA ransomware"
+        threat_name = "Windows.Ransomware.Dharma"
+        reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "C:\\crysis\\Release\\PDB\\payload.pdb" ascii fullword
+    condition:
+        1 of ($a*)
+}
+
diff --git a/yara/rules/Windows_Ransomware_Doppelpaymer.yar b/yara/rules/Windows_Ransomware_Doppelpaymer.yar
new file mode 100644
index 00000000..4f47a457
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Doppelpaymer.yar
@@ -0,0 +1,81 @@
+rule Windows_Ransomware_Doppelpaymer_6660d29f : beta {
+    meta:
+        id = "6660d29f-aca9-4156-90a0-ce64fded281a"
+        fingerprint = "8bf4d098b8ce9da99a2ca13fa0759a7185ade1b3ab3b281cd15749d68546d130"
+        creation_date = "2020-06-28"
+        last_modified = "2021-08-23"
+        description = "Identifies DOPPELPAYMER ransomware"
+        threat_name = "Windows.Ransomware.Doppelpaymer"
+        reference = "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Setup run" wide fullword
+        $a2 = "RtlComputeCrc32" ascii fullword
+    condition:
+        2 of ($a*)
+}
+
+rule Windows_Ransomware_Doppelpaymer_0b9b75b5 : beta {
+    meta:
+        id = "0b9b75b5-f521-4414-8216-cde5de6b8ff7"
+        fingerprint = "4fe2f648afa0031c2a4807ae882ddf19302ce6a6d26b04341950e84dbf6c1374"
+        creation_date = "2020-06-28"
+        last_modified = "2021-08-23"
+        description = "Identifies DOPPELPAYMER ransomware"
+        threat_name = "Windows.Ransomware.Doppelpaymer"
+        reference = "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $b1 = { 8B D8 BA FF FF FF 7F 8B 4B }
+    condition:
+        1 of ($b*)
+}
+
+rule Windows_Ransomware_Doppelpaymer_6ab188da : beta {
+    meta:
+        id = "6ab188da-4e73-4669-816c-554b2f04ee65"
+        fingerprint = "6c33e09e66b337064a1feae5c162f72dc5f6caecaa9829e4ad9fffb10ef3e576"
+        creation_date = "2020-06-28"
+        last_modified = "2021-08-23"
+        description = "Identifies DOPPELPAYMER ransomware"
+        threat_name = "Windows.Ransomware.Doppelpaymer"
+        reference = "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $d1 = { 56 55 55 55 F7 EF B8 56 55 55 55 8B EA F7 E9 8B C2 8B D1 C1 FA 1F 2B C2 C1 FF 1F 2B EF 8D 14 40 B8 F3 1A CA 6B 2B CA 03 E9 F7 ED 8B CD C1 FA 05 C1 F9 1F 2B D1 6B CA B4 03 CD 74 1C 81 E1 03 00 00 80 7D 07 83 E9 01 83 C9 FC 41 8B C1 F7 D8 85 C9 8D 7C 05 04 0F 45 EF 8D 44 55 02 5D 5F C3 }
+    condition:
+        1 of ($d*)
+}
+
+rule Windows_Ransomware_Doppelpaymer_4fb1a155 : beta {
+    meta:
+        id = "4fb1a155-6448-41e9-829a-e765b7c2570e"
+        fingerprint = "f7c1bb3e9d1ad02e7c4edf8accf326330331f92a0f1184bbc19c5bde7505e545"
+        creation_date = "2020-06-28"
+        last_modified = "2021-08-23"
+        description = "Identifies DOPPELPAYMER ransomware"
+        threat_name = "Windows.Ransomware.Doppelpaymer"
+        reference = "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $c1 = { 83 EC 64 8B E9 8B 44 24 ?? 8B 00 0F B7 10 83 FA 5C 75 }
+    condition:
+        1 of ($c*)
+}
+
diff --git a/yara/rules/Windows_Ransomware_Egregor.yar b/yara/rules/Windows_Ransomware_Egregor.yar
new file mode 100644
index 00000000..aadd9412
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Egregor.yar
@@ -0,0 +1,47 @@
+rule Windows_Ransomware_Egregor_f24023f3 : beta {
+    meta:
+        id = "f24023f3-c887-42fc-8927-cdbd04b5f84f"
+        fingerprint = "3a82a548658e0823678ec9d633774018ddc6588f5e2fbce74826a46ce9c43c40"
+        creation_date = "2020-10-15"
+        last_modified = "2021-08-23"
+        description = "Identifies EGREGOR (Sekhemt) ransomware"
+        threat_name = "Windows.Ransomware.Egregor"
+        reference = "https://www.bankinfosecurity.com/egregor-ransomware-adds-to-data-leak-trend-a-15110"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "M:\\sc\\p\\testbuild.pdb" ascii fullword
+        $a2 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" wide fullword
+        $a3 = "nIcG`]/h3kpJ0QEAC5OJC|<eT}}\\5K|h\\\\v<=lKfHKO~01=Lo0C03icERjo0J|/+|=P0<UeN|e2F@GpTe]|wpMP`AG+IFVCVbAErvTeBRgUN1vQHNp5FVtc1WVi/G"
+        $a4 = "pVrGRgJui@6ejnOu@4KgacOarSh|firCToW1LoF]7BtmQ@2j|hup2owUHQ6W}\\U3gwV6OwSPTMQVq2|G=GKrHpjOqk~`Ba<qu\\2]r0RKkf/HGngsK7LhtvtJiR}+4J"
+        $a5 = "Your network was ATTACKED, your computers and servers were LOCKED," ascii wide
+        $a6 = "Do not redact this special technical block, we need this to authorize you." ascii wide
+    condition:
+        2 of ($a*)
+}
+
+rule Windows_Ransomware_Egregor_4ec2b90c : beta {
+    meta:
+        id = "4ec2b90c-b2de-463d-a9c6-478c255c2352"
+        fingerprint = "6ae13632f50af11626250c30f570370da23deb265ff6c1fefd2e294c8c170998"
+        creation_date = "2020-10-15"
+        last_modified = "2021-08-23"
+        description = "Identifies EGREGOR (Sekhemt) ransomware"
+        threat_name = "Windows.Ransomware.Egregor"
+        reference = "https://www.bankinfosecurity.com/egregor-ransomware-adds-to-data-leak-trend-a-15110"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $b1 = { 18 F5 46 E0 5C 94 28 B3 5C 94 28 B3 5C 94 28 B3 E8 08 D9 B3 55 94 28 B3 E8 08 DB B3 29 94 28 B3 E8 08 DA B3 44 94 28 B3 67 CA 2B B2 4D 94 28 B3 67 CA 2D B2 47 94 28 B3 67 CA 2C B2 4C 94 28 B3 81 6B E3 B3 5F 94 28 B3 5C 94 29 B3 02 94 28 B3 5C 94 28 B3 5F 94 28 B3 CE CA 28 B2 5D 94 28 B3 CE CA 2A B2 5D 94 28 B3 }
+        $b2 = { 34 4F 51 46 33 5C 45 6A 75 5E 7E 4E 37 53 49 7C 49 50 4B 32 73 43 47 5E 68 43 42 4E 7C 42 30 48 62 4C 34 6D 3C 2F 36 76 3D 43 5D 6B 4F 30 32 6E 60 35 68 40 33 60 4B 47 6F 33 55 36 71 56 4A 3D 40 5C 6A 69 4B 4A 60 5C 35 2B 6B 40 33 31 5C 63 7D 4A 47 42 51 5D 70 54 68 7D 62 32 4B 72 6A 57 3C 71 }
+        $b3 = { BB 05 10 D4 BB 05 10 E0 BB 05 10 EC BB 05 10 F8 BB 05 10 04 BC 05 10 10 BC 05 10 1C BC 05 10 2C BC 05 10 3C BC 05 10 50 BC 05 10 68 BC 05 10 80 BC 05 10 90 BC 05 10 A8 BC 05 10 B4 BC 05 10 C0 }
+    condition:
+        1 of ($b*)
+}
+
diff --git a/yara/rules/Windows_Ransomware_Generic.yar b/yara/rules/Windows_Ransomware_Generic.yar
new file mode 100644
index 00000000..622e2056
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Generic.yar
@@ -0,0 +1,22 @@
+rule Windows_Ransomware_Generic_99f5a632 {
+    meta:
+        id = "99f5a632-8562-4321-b707-c5f583b14511"
+        fingerprint = "84ab8d177e50bce1a3eceb99befcf05c7a73ebde2f7ea4010617bf4908257fdb"
+        creation_date = "2022-02-24"
+        last_modified = "2022-02-24"
+        threat_name = "Windows.Ransomware.Generic"
+        reference_sample = "4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "stephanie.jones2024@protonmail.com"
+        $a2 = "_/C_/projects/403forBiden/wHiteHousE.init" ascii fullword
+        $a3 = "All your files, documents, photoes, videos, databases etc. have been successfully encrypted" ascii fullword
+        $a4 = "<p>Do not try to decrypt then by yourself - it's impossible" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Grief.yar b/yara/rules/Windows_Ransomware_Grief.yar
new file mode 100644
index 00000000..48139763
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Grief.yar
@@ -0,0 +1,19 @@
+rule Windows_Ransomware_Grief_9953339a {
+    meta:
+        id = "9953339a-2c67-4ebd-be51-d1055e341abc"
+        fingerprint = "d7d70c3681c4d4103d9ff52c3bdd174ccbdb49343c34407e90abb5a83a8422f4"
+        creation_date = "2021-08-04"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Grief"
+        reference_sample = "0864575d4f487e52a1479c61c2c4ad16742d92e16d0c10f5ed2b40506bbc6ca0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 65 64 73 63 6F 72 70 69 6F 71 65 6E 61 62 6C 65 54 72 61 6E 73 6C 61 74 65 2E 41 64 65 65 6D 65 64 59 00 5A 41 70 70 6C 69 63 61 74 69 6F 6E 65 69 74 68 65 72 33 34 2E 30 28 39 39 25 6D 65 6D 6F 72 79 2C 77 69 74 68 6F 75 74 00 66 6F 72 47 6F 6F 67 6C 65 6C 74 68 65 6D 6F 72 65 6D 77 61 73 00 39 32 41 6E 69 6E 65 74 68 65 75 48 73 74 61 62 6C 65 73 6F 66 66 69 63 69 61 6C 00 43 4B 76 65 72 73 69 6F 6E 46 71 74 68 65 63 6F 6D 70 61 6E 79 2C 74 6F 6E 2E 35 30 37 00 6E 69 6E 2D 70 61 67 65 44 73 63 61 6E 6E 69 6E 67 61 63 63 65 73 73 48 69 63 6F 6E 72 65 6D }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Haron.yar b/yara/rules/Windows_Ransomware_Haron.yar
new file mode 100644
index 00000000..50359fa7
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Haron.yar
@@ -0,0 +1,40 @@
+rule Windows_Ransomware_Haron_a1c12e7e {
+    meta:
+        id = "a1c12e7e-a740-4d26-a0ed-310a2b03fe50"
+        fingerprint = "c6abe96bd2848bb489f856373356dbad3fca273e9d71394ec22960070557ad11"
+        creation_date = "2021-08-03"
+        last_modified = "2021-10-04"
+        description = "Direct overlap with Thanos/Avaddon"
+        threat_name = "Windows.Ransomware.Haron"
+        reference_sample = "6e6b78a1df17d6718daa857827a2a364b7627d9bfd6672406ad72b276014209c"
+        severity = 90
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 00 04 28 0E 00 00 0A 06 FE 06 2A 00 00 06 73 0F 00 00 0A 28 }
+    condition:
+        any of them
+}
+
+rule Windows_Ransomware_Haron_23b76cb7 {
+    meta:
+        id = "23b76cb7-6f96-4012-ad66-2e4e4ae744a9"
+        fingerprint = "9dc91a56ef17873f3e833d85fa947facde741d80a574ae911261e553a40a2731"
+        creation_date = "2021-08-03"
+        last_modified = "2021-10-04"
+        description = "Direct overlap with Thanos/Avaddon"
+        threat_name = "Windows.Ransomware.Haron"
+        reference_sample = "6e6b78a1df17d6718daa857827a2a364b7627d9bfd6672406ad72b276014209c"
+        severity = 90
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 0A 28 06 00 00 06 26 DE 0A 08 2C 06 08 6F 48 00 00 0A DC DE }
+    condition:
+        any of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Hellokitty.yar b/yara/rules/Windows_Ransomware_Hellokitty.yar
new file mode 100644
index 00000000..80b8890d
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Hellokitty.yar
@@ -0,0 +1,80 @@
+rule Windows_Ransomware_Hellokitty_8859e8e8 {
+    meta:
+        id = "8859e8e8-f94c-4853-b296-1fc801486c57"
+        fingerprint = "f9791409d2a058dd68dc09df5e4b597c6c6a1f0da9801d7ab9e678577b621730"
+        creation_date = "2021-05-03"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Ransomware.Hellokitty"
+        reference_sample = "3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "HelloKittyMutex" wide fullword
+        $a2 = "%s\\read_me_lkd.txt" wide fullword
+        $a3 = "Win32_ShadowCopy.ID='%s'" wide fullword
+        $a4 = "Trying to decrypt or modify the files with programs other than our decryptor can lead to permanent loss of data!" wide fullword
+        $a5 = "%s/secret/%S" wide fullword
+        $a6 = "DECRYPT_NOTE.txt" wide fullword
+        $a7 = "Some data has been stored in our servers and ready for publish." wide fullword
+        $a9 = "To contact with us you have ONE week from the encryption time, after decryption keys and your personal contact link will be dele" wide
+        $a10 = "In case of your disregard, we reserve the right to dispose of the dumped data at our discretion including publishing." wide fullword
+        $a11 = "IMPORTANT: Don't modify encrypted files or you can damage them and decryption will be impossible!" wide fullword
+        $b1 = "/f /im \"%s\"" wide fullword
+        $b2 = "stop \"%s\"" wide fullword
+        $b3 = "/f /im %s" wide fullword
+        $b4 = "stop %s" wide fullword
+    condition:
+        (2 of ($a*) and 2 of ($b*)) or (5 of ($a*))
+}
+
+rule Windows_Ransomware_Hellokitty_4b668121 {
+    meta:
+        id = "4b668121-cc21-4f0b-b0fc-c2b5b4cb53e8"
+        fingerprint = "834316ce0f3225b1654b3c4bccb673c9ad815e422276f61e929d5440ca51a9fa"
+        creation_date = "2021-05-03"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Ransomware.Hellokitty"
+        reference_sample = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "(%d) [%d] %s: STOP DOUBLE PROCESS RUN" ascii fullword
+        $a2 = "(%d) [%d] %s: Looking for folder from cmd: %S" ascii fullword
+        $a3 = "(%d) [%d] %s: ERROR: Failed to encrypt AES block" ascii fullword
+        $a4 = "gHelloKittyMutex" wide fullword
+        $a5 = "/C ping 127.0.0.1 & del %s" wide fullword
+        $a6 = "Trying to decrypt or modify the files with programs other than our decryptor can lead to permanent loss of data!"
+        $a7 = "read_me_lkdtt.txt" wide fullword
+        $a8 = "If you want to get it, you must pay us some money and we will help you." wide fullword
+    condition:
+        5 of them
+}
+
+rule Windows_Ransomware_Hellokitty_d9391a1a {
+    meta:
+        id = "d9391a1a-78d3-4ae6-8e45-630ceec8bade"
+        fingerprint = "4b9c96561163f925df6b2300c9e34c9572c1fe14ec3a55da4d4876ce467f6d6e"
+        creation_date = "2021-05-03"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Ransomware.Hellokitty"
+        reference_sample = "10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 83 6D 08 01 75 DF 89 47 FC 8B 45 F8 5F 5E 5B 8B E5 5D C3 89 }
+        $a2 = { 8D 76 04 03 D0 3B D0 1B C0 03 14 BB F7 D8 3B 14 BB 89 56 FC }
+        $a3 = { 83 C4 04 85 DB 75 12 0F 10 45 D4 83 C7 10 0F 11 06 83 C6 10 83 }
+        $a4 = { 89 45 F8 3B 5D F4 75 25 3B C6 75 21 6A FF FF 75 14 8B D1 83 }
+    condition:
+        any of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Helloxd.yar b/yara/rules/Windows_Ransomware_Helloxd.yar
new file mode 100644
index 00000000..354b4e6d
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Helloxd.yar
@@ -0,0 +1,26 @@
+rule Windows_Ransomware_Helloxd_0c50f01b {
+    meta:
+        id = "0c50f01b-5f3d-4112-9930-ca1150fc12fa"
+        fingerprint = "462d8c231d608e28e66d810b811f9fdf82d0b3770d21267a4375669a26bbaafd"
+        creation_date = "2022-06-14"
+        last_modified = "2022-07-18"
+        threat_name = "Windows.Ransomware.Helloxd"
+        reference_sample = "435781ab608ff908123d9f4758132fa45d459956755d27027a52b8c9e61f9589"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $mutex = "With best wishes And good intentions..."
+        $ransomnote0 = ":: our TOX below >:)"
+        $ransomnote1 = "You can download TOX here"
+        $ransomnote2 = "...!XD ::"
+        $productname = "HelloXD" ascii wide
+        $legalcopyright = "uKn0w" ascii wide
+        $description = "VhlamAV" ascii wide
+        $companyname = "MicloZ0ft" ascii wide
+    condition:
+        ($mutex and all of ($ransomnote*)) or (3 of ($productname, $legalcopyright, $description, $companyname))
+}
+
diff --git a/yara/rules/Windows_Ransomware_Hive.yar b/yara/rules/Windows_Ransomware_Hive.yar
new file mode 100644
index 00000000..4451ad4c
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Hive.yar
@@ -0,0 +1,63 @@
+rule Windows_Ransomware_Hive_55619cd0 {
+    meta:
+        id = "55619cd0-6013-45e2-b15e-0dceff9571ab"
+        fingerprint = "04df3169c50fbab4e2b495de5500c62ddf5e76aa8b4a7fc8435f39526f69c52b"
+        creation_date = "2021-08-26"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Ransomware.Hive"
+        reference_sample = "50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "google.com/encryptor.(*App).KillProcesses" ascii fullword
+        $a2 = "- Do not shutdown or reboot your computers, unmount external storages." ascii fullword
+        $a3 = "hive"
+    condition:
+        all of them
+}
+
+rule Windows_Ransomware_Hive_3ed67fe6 {
+    meta:
+        id = "3ed67fe6-6347-4aef-898d-4cb267bcbfc7"
+        fingerprint = "a15acde0841f08fc44fdc1fea01c140e9e8af6275a65bec4a7b762494c9e6185"
+        creation_date = "2021-08-26"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Ransomware.Hive"
+        reference_sample = "50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "bmr|sql|oracle|postgres|redis|vss|backup|sstp"
+        $a2 = "key.hive"
+        $a3 = "Killing processes"
+        $a4 = "Stopping services"
+        $a5 = "Removing itself"
+    condition:
+        all of them
+}
+
+rule Windows_Ransomware_Hive_b97ec33b {
+    meta:
+        id = "b97ec33b-d4cf-4b70-8ce8-8a5d20448643"
+        fingerprint = "7f2c2d299942390d953599b180ed191d9db999275545a7ba29059fd49b858087"
+        creation_date = "2021-08-26"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Ransomware.Hive"
+        reference_sample = "50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 74 C3 8B 44 24 78 8B 08 8B 50 04 8B 40 08 89 0C 24 89 54 24 04 89 44 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Lockbit.yar b/yara/rules/Windows_Ransomware_Lockbit.yar
new file mode 100644
index 00000000..0853328a
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Lockbit.yar
@@ -0,0 +1,65 @@
+rule Windows_Ransomware_Lockbit_89e64044 {
+    meta:
+        id = "89e64044-74e4-4679-b6ad-bfb9b264330c"
+        fingerprint = "ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49"
+        creation_date = "2021-08-06"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Lockbit"
+        reference_sample = "0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "\\LockBit_Ransomware.hta" wide fullword
+        $a2 = "\\Registry\\Machine\\Software\\Classes\\Lockbit\\shell" wide fullword
+        $a3 = "%s\\%02X%02X%02X%02X.lock" wide fullword
+    condition:
+        all of them
+}
+
+rule Windows_Ransomware_Lockbit_a1c60939 {
+    meta:
+        id = "a1c60939-e257-420d-87ed-f31f30f2fc2a"
+        fingerprint = "a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf"
+        creation_date = "2021-08-06"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Lockbit"
+        reference_sample = "0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 }
+    condition:
+        all of them
+}
+
+rule Windows_Ransomware_Lockbit_369e1e94 {
+    meta:
+        id = "369e1e94-3fbb-4828-bb78-89d26e008105"
+        fingerprint = "9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2"
+        creation_date = "2022-07-05"
+        last_modified = "2022-07-18"
+        threat_name = "Windows.Ransomware.Lockbit"
+        reference_sample = "d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 66 83 F8 61 72 ?? 66 83 F8 66 77 ?? 66 83 E8 57 EB ?? 66 83 F8 30 72 ?? 66 83 F8 39 77 ?? 66 83 E8 30 EB ?? }
+        $a2 = { 8B EC 53 56 57 33 C0 8B 5D ?? 33 C9 33 D2 8B 75 ?? 8B 7D ?? 85 F6 74 ?? 55 8B 6D ?? 8A 54 0D ?? 02 D3 8A 5C 15 ?? 8A 54 1D ?? }
+        $a3 = { 53 51 6A ?? 58 0F A2 F7 C1 ?? ?? ?? ?? 0F 95 C0 84 C0 74 ?? 0F C7 F0 0F C7 F2 59 5B C3 6A ?? 58 33 C9 0F A2 F7 C3 ?? ?? ?? ?? 0F 95 C0 84 C0 74 ?? 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ?? 0F 31 8B D0 C1 C2 ?? 8B C1 59 5B C3 }
+        $b1 = { 6D 00 73 00 65 00 78 00 63 00 68 00 61 00 6E 00 67 00 65 00 00 00 73 00 6F 00 70 00 68 00 6F 00 73 00 }
+        $b2 = "LockBit 3.0 the world's fastest and most stable ransomware from 2019" ascii fullword
+        $b3 = "http://lockbit"
+        $b4 = "Warning! Do not delete or modify encrypted files, it will lead to problems with decryption of files!" ascii fullword
+    condition:
+        2 of ($a*) or all of ($b*)
+}
+
diff --git a/yara/rules/Windows_Ransomware_Lockfile.yar b/yara/rules/Windows_Ransomware_Lockfile.yar
new file mode 100644
index 00000000..9dafb5cb
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Lockfile.yar
@@ -0,0 +1,22 @@
+rule Windows_Ransomware_Lockfile_74185716 {
+    meta:
+        id = "74185716-e79d-4d63-b6ae-9480f24dcd4f"
+        fingerprint = "849a0fb5a2e08b2d32db839a7fdbde03a184a48726678e65e7f8452b354a3ca8"
+        creation_date = "2021-08-31"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Ransomware.Lockfile"
+        reference_sample = "bf315c9c064b887ee3276e1342d43637d8c0e067260946db45942f39b970d7ce"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "LOCKFILE-README"
+        $a2 = "wmic process where \"name  like '%virtualbox%'\" call terminate"
+        $a3 = "</computername>"
+        $a4 = ".lockfile"
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Magniber.yar b/yara/rules/Windows_Ransomware_Magniber.yar
new file mode 100644
index 00000000..7baaba83
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Magniber.yar
@@ -0,0 +1,38 @@
+rule Windows_Ransomware_Magniber_ea0140a1 {
+    meta:
+        id = "ea0140a1-b745-47f1-871f-5b703174a049"
+        fingerprint = "b3c17024097af846f800a843da404dccb6d33eebb90a8524f2f2ec8a5c5df776"
+        creation_date = "2021-08-03"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Magniber"
+        reference_sample = "a2448b93d7c50801056052fb429d04bcf94a478a0a012191d60e595fed63eec4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 58 C0 FF 24 4C 8B F0 48 89 45 18 E8 E2 F5 FF FF B9 A1 BD D1 CF 48 89 45 B8 E8 D4 F5 FF FF B9 52 C6 D7 0E 48 89 45 F8 E8 C6 F5 FF FF B9 43 AC 95 0E 48 89 45 B0 E8 B8 F5 FF FF B9 78 D4 33 27 4C 8B F8 48 89 45 D0 E8 A7 F5 FF FF B9 FE 36 04 DE 48 89 44 24 50 E8 98 F5 FF FF B9 51 23 2E F2 48 89 45 10 E8 8A F5 FF FF B9 DA F6 8A 50 48 89 45 08 E8 7C F5 FF FF B9 AD 9E 5F BB 48 89 45 20 E8 6E F5 FF FF B9 2D 57 AE 5B 48 89 45 A0 E8 60 F5 FF FF B9 C6 96 87 52 48 89 45 C8 E8 52 F5 FF FF B9 F6 76 0F 52 48 89 45 A8 E8 44 F5 FF FF B9 A3 FC 62 AA 48 8B F0 48 89 45 98 E8 33 F5 }
+    condition:
+        any of them
+}
+
+rule Windows_Ransomware_Magniber_97d7575b {
+    meta:
+        id = "97d7575b-8fc7-4c6b-8371-b62842d90613"
+        fingerprint = "78253be69d9715892ec725918c3c856040323b83aeab8b84c4aac47355876207"
+        creation_date = "2021-08-03"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Magniber"
+        reference_sample = "a2448b93d7c50801056052fb429d04bcf94a478a0a012191d60e595fed63eec4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 00 4C 00 4C 00 20 00 59 00 4F 00 55 00 52 00 20 00 44 00 4F 00 43 00 55 00 4D 00 45 00 4E 00 54 00 53 00 20 00 50 00 48 00 4F 00 54 00 4F 00 53 00 20 00 44 00 41 00 54 00 41 00 42 00 41 00 53 00 45 00 53 00 20 00 41 00 4E 00 44 00 20 00 4F 00 54 00 48 00 45 00 52 00 20 00 49 00 4D 00 50 00 4F 00 52 00 54 00 41 00 4E 00 54 00 20 00 46 00 49 00 4C 00 45 00 53 00 20 00 48 00 41 00 56 00 45 00 20 00 42 00 45 00 45 00 4E 00 20 00 45 00 4E 00 43 00 52 00 59 00 50 00 54 00 45 00 44 00 21 00 0D }
+    condition:
+        any of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Makop.yar b/yara/rules/Windows_Ransomware_Makop.yar
new file mode 100644
index 00000000..addf6333
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Makop.yar
@@ -0,0 +1,43 @@
+rule Windows_Ransomware_Makop_3ac2c13c {
+    meta:
+        id = "3ac2c13c-45f0-4108-81fb-e57c3cc0e622"
+        fingerprint = "4658a5b34ecb2a7432b7ab48041cc064d917b88a4673f21aa6c3c44b115c9b8c"
+        creation_date = "2021-08-05"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Makop"
+        reference_sample = "854226fc4f5388d40cd9e7312797dd63739444d69a67e4126ef60817fa6972ad"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 20 00 75 15 8B 44 24 10 8B 4C 24 08 8B 54 24 0C 89 46 20 89 }
+    condition:
+        all of them
+}
+
+rule Windows_Ransomware_Makop_3e388338 {
+    meta:
+        id = "3e388338-83c7-453c-b865-13f3bd059515"
+        fingerprint = "7920469120a69fed191c5068739ed922dcf67aa26d68e44708a1d63dc0931bc3"
+        creation_date = "2021-08-05"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Makop"
+        reference_sample = "854226fc4f5388d40cd9e7312797dd63739444d69a67e4126ef60817fa6972ad"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "MPR.dll" ascii fullword
+        $a2 = "\"%s\" n%u" wide fullword
+        $a3 = "\\\\.\\%c:" wide fullword
+        $a4 = "%s\\%s\\%s" wide fullword
+        $a5 = "%s\\%s" wide fullword
+        $a6 = "Start folder" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Maui.yar b/yara/rules/Windows_Ransomware_Maui.yar
new file mode 100644
index 00000000..b3dd8622
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Maui.yar
@@ -0,0 +1,29 @@
+rule Windows_Ransomware_Maui_266dea64 {
+    meta:
+        id = "266dea64-2ed2-4bfc-977b-5ddb68ab05ac"
+        fingerprint = "6f6451b7a972924b2efe339b8793c30409123df37d3d64802037a5af8cb4b5f3"
+        creation_date = "2022-07-08"
+        last_modified = "2022-07-18"
+        threat_name = "Windows.Ransomware.Maui"
+        reference_sample = "5b7ecf7e9d0715f1122baf4ce745c5fcd769dee48150616753fec4d6da16e99e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Please append it by <Godhead> using -maui option." wide fullword
+        $a2 = "Please overwrite it by <Godhead> using -maui option." wide fullword
+        $a3 = "maui.log" wide fullword
+        $a4 = "maui.key" wide fullword
+        $a5 = "maui.evd" wide fullword
+        $a6 = "Encrypt[%s]: %s" wide fullword
+        $a7 = "PROCESS_GOINGON[%d%% / %d%%]: %s" wide fullword
+        $a8 = "PROCESS_REPLACECONFIRM: %s" wide fullword
+        $seq_encrypt_priv_key = { 55 8B 6C 24 ?? 57 8B F9 85 DB 74 ?? 85 FF 74 ?? 85 ED 74 ?? 56 8D 87 ?? ?? ?? ?? 50 6A ?? E8 ?? ?? ?? ?? 8B 4D ?? 8B 51 ?? 6A ?? 52 8B F0 56 53 57 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 7F ?? E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 5E 5F 83 C8 ?? 5D C3 }
+        $seq_get_private_key = { 57 8B F8 85 FF 75 ?? 5F C3 56 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 80 7F ?? ?? 8B F0 74 ?? 8B 07 50 56 E8 ?? ?? ?? ?? EB ?? 8B 0F 51 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 F6 75 ?? 5E 33 C0 5F C3 }
+        $seq_get_pub_key = { B9 F4 FF FF FF 2B 4C 24 ?? 6A 02 51 53 E8 ?? ?? ?? ?? 8B 54 24 ?? 8B 07 53 6A ?? 52 50 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 32 DB 8B C7 E8 ?? ?? ?? ?? 89 46 28 8B 0F 51 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 83 C4 ?? 5F 8B C6 5E 5B 33 CC E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 }
+    condition:
+        5 of ($a*) or 2 of ($seq*)
+}
+
diff --git a/yara/rules/Windows_Ransomware_Maze.yar b/yara/rules/Windows_Ransomware_Maze.yar
new file mode 100644
index 00000000..c0d4ca89
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Maze.yar
@@ -0,0 +1,91 @@
+rule Windows_Ransomware_Maze_61254061 : beta {
+    meta:
+        id = "61254061-e8af-47ab-9cce-96debd99a80a"
+        fingerprint = "670d9abbdea153ca66f24ef6806f97e9af3efb73f621167e95606da285627d1b"
+        creation_date = "2020-04-18"
+        last_modified = "2021-08-23"
+        description = "Identifies MAZE ransomware"
+        threat_name = "Windows.Ransomware.Maze"
+        reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $c1 = { FC 8B 55 08 8B 44 8A 10 C1 E0 09 8B 4D FC 8B 55 08 8B 4C 8A 10 C1 }
+        $c2 = { 72 F0 0C 66 0F 72 D4 14 66 0F EB C4 66 0F 70 E0 39 66 0F FE E6 66 0F 70 }
+    condition:
+        1 of ($c*)
+}
+
+rule Windows_Ransomware_Maze_46f40c40 : beta {
+    meta:
+        id = "46f40c40-05a4-4163-a62d-675882149781"
+        fingerprint = "efe1e0d23fbfd72fd2843a9c8d5e62394ef8c75b9a7bd03fdbb36e2cf97bf12e"
+        creation_date = "2020-04-18"
+        last_modified = "2021-10-04"
+        description = "Identifies MAZE ransomware"
+        threat_name = "Windows.Ransomware.Maze"
+        reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $b1 = "Dear %s, your files have been encrypted by RSA-2048 and ChaCha algorithms" wide fullword
+        $b2 = "Maze Ransomware" wide fullword
+        $b3 = "%s! Alert! %s! Alert! Dear %s Your files have been encrypted by %s! Attention! %s" wide fullword
+    condition:
+        2 of ($b*)
+}
+
+rule Windows_Ransomware_Maze_20caee5b : beta {
+    meta:
+        id = "20caee5b-cf7f-4db7-8c3b-67baf63bfc32"
+        fingerprint = "47525839e0800f6edec6ad4580682a336e36f7d13bd9e7214eca0f16941016b8"
+        creation_date = "2020-04-18"
+        last_modified = "2021-08-23"
+        description = "Identifies MAZE ransomware"
+        threat_name = "Windows.Ransomware.Maze"
+        reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Win32_ShadowCopy.id='%s'" wide fullword
+        $a2 = "\"%s\" shadowcopy delete" wide fullword
+        $a3 = "%spagefile.sys" wide fullword
+        $a4 = "%sswapfile.sys" wide fullword
+        $a5 = "Global\\%s" wide fullword
+        $a6 = "DECRYPT-FILES.txt" wide fullword
+        $a7 = "process call create \"cmd /c start %s\"" wide fullword
+    condition:
+        4 of ($a*)
+}
+
+rule Windows_Ransomware_Maze_f88f136f : beta {
+    meta:
+        id = "f88f136f-755c-46d6-9dbe-243342ae315a"
+        fingerprint = "3fa065d28d864868e49b394e895207c8be2252a9e211ac4bacce10d9ff04607e"
+        creation_date = "2020-04-18"
+        last_modified = "2021-08-23"
+        description = "Identifies MAZE ransomware"
+        threat_name = "Windows.Ransomware.Maze"
+        reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $d1 = { 00 67 00 20 00 69 00 6E 00 73 00 74 00 72 00 75 00 63 00 74 00 69 00 6F 00 6E 00 73 00 20 00 69 00 6E 00 20 00 44 00 45 00 43 00 52 00 59 00 50 00 54 00 2D 00 46 00 49 00 4C 00 45 00 53 00 2E }
+        $d2 = { 70 C7 8B 75 6D 97 7E FC 19 2A 39 8C A4 AE AD 9C 62 05 B7 68 47 7D 02 F7 D3 0A DA 20 82 AE A8 E7 B2 26 E1 A0 5B 4E 17 09 A6 94 74 CA B6 0B 88 B0 5F 6E 11 E3 B0 EA 2F 40 D7 A2 AB 59 52 E0 F2 C2 19 24 14 95 01 7F CA }
+        $d3 = { 77 B3 50 3C B1 9B 5D D4 87 F5 17 DB E1 C7 42 D8 53 24 C2 E2 6A A8 9B 1E FB E5 48 EB 10 48 44 28 64 F8 B6 A1 41 44 D0 42 FA 85 6F 17 57 09 C4 66 93 D2 21 C5 19 71 3A A1 C5 68 2E 67 B1 02 DC D1 }
+    condition:
+        1 of ($d*)
+}
+
diff --git a/yara/rules/Windows_Ransomware_Mespinoza.yar b/yara/rules/Windows_Ransomware_Mespinoza.yar
new file mode 100644
index 00000000..05d56417
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Mespinoza.yar
@@ -0,0 +1,21 @@
+rule Windows_Ransomware_Mespinoza_3adb59f5 {
+    meta:
+        id = "3adb59f5-a4af-48f2-8029-874a62b23651"
+        fingerprint = "f44a79048427e79d339d3b0ccaeb85ba6731d5548256a2615f32970dcf67578f"
+        creation_date = "2021-08-05"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Mespinoza"
+        reference_sample = "6f3cd5f05ab4f404c78bab92f705c91d967b31a9b06017d910af312fa87ae3d6"
+        severity = 90
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Don't try to use backups because it were encrypted too." ascii fullword
+        $a2 = "Every byte on any types of your devices was encrypted." ascii fullword
+        $a3 = "n.pysa" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Mountlocker.yar b/yara/rules/Windows_Ransomware_Mountlocker.yar
new file mode 100644
index 00000000..e5d813fd
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Mountlocker.yar
@@ -0,0 +1,23 @@
+rule Windows_Ransomware_Mountlocker_126a76e2 {
+    meta:
+        id = "126a76e2-8a97-4347-ac36-9437a512e16c"
+        fingerprint = "08213f4474c7c8fd7a6e59c9ff139fb45f224109ad4e6162c12cff5ac85cb10c"
+        creation_date = "2021-06-10"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Ransomware.Mountlocker"
+        reference_sample = "4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "[SKIP] locker.dir.check > black_list name=%s" wide fullword
+        $a2 = "[OK] locker.dir.check > name=%s" wide fullword
+        $a3 = "[ERROR] locker.worm > execute pcname=%s" wide fullword
+        $a4 = "[INFO] locker.work.enum.net_drive > enum finish name=%s" wide fullword
+        $a5 = "[WARN] locker.work.enum.server_shares > logon on server error=%u pcname=%s" wide fullword
+    condition:
+        any of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Nightsky.yar b/yara/rules/Windows_Ransomware_Nightsky.yar
new file mode 100644
index 00000000..2f2c2abb
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Nightsky.yar
@@ -0,0 +1,41 @@
+rule Windows_Ransomware_Nightsky_a7f19411 {
+    meta:
+        id = "a7f19411-4c28-4cc7-b60c-ef51cb10b905"
+        fingerprint = "0f2aac3a538a921b78f7c2521adf65678830abab8ec8b360ac3dddae5fbc4756"
+        creation_date = "2022-01-11"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Ransomware.Nightsky"
+        reference_sample = "1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577"
+        severity = 90
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "\\NightSkyReadMe.hta" wide fullword
+        $a2 = ".nightsky" wide fullword
+        $a3 = "<h1 id=\"nightsky\"><center><span style=\"color: black; font-size: 48pt\">NIGHT SKY</span></center>" ascii fullword
+        $a4 = "URL:https://contact.nightsky.cyou" ascii fullword
+    condition:
+        2 of them
+}
+
+rule Windows_Ransomware_Nightsky_253c4d0d {
+    meta:
+        id = "253c4d0d-157f-4929-9f0e-5830ebc377dc"
+        fingerprint = "739529dfb1f8c8ab2a7f6a4b2b18b27dd2fcc38eda0f110897fc6cb5d64b1c92"
+        creation_date = "2022-03-14"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Ransomware.Nightsky"
+        reference_sample = "2c940a35025dd3847f7c954a282f65e9c2312d2ada28686f9d1dc73d1c500224"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 43 B8 48 2B D9 49 89 43 C0 4C 8B E2 49 89 43 C8 4C 8B F1 49 89 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Pandora.yar b/yara/rules/Windows_Ransomware_Pandora.yar
new file mode 100644
index 00000000..fabe15b2
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Pandora.yar
@@ -0,0 +1,21 @@
+rule Windows_Ransomware_Pandora_bca8ce23 {
+    meta:
+        id = "bca8ce23-6722-4cda-b5fa-623eda4fca1b"
+        fingerprint = "0da732f6bdf24f35dee3c1bf85435650a5ce9b5c6a93f01176659943c01ad711"
+        creation_date = "2022-03-14"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Ransomware.Pandora"
+        reference_sample = "2c940a35025dd3847f7c954a282f65e9c2312d2ada28686f9d1dc73d1c500224"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "/c vssadmin.exe delete shadows /all /quiet" wide fullword
+        $a2 = "\\Restore_My_Files.txt" wide fullword
+        $a3 = ".pandora" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Phobos.yar b/yara/rules/Windows_Ransomware_Phobos.yar
new file mode 100644
index 00000000..dfb31618
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Phobos.yar
@@ -0,0 +1,62 @@
+rule Windows_Ransomware_Phobos_a5420148 : beta {
+    meta:
+        id = "a5420148-2f80-4a14-8a0d-98943fcbe784"
+        fingerprint = "2b3937dbecb9a12e5e276c681eb40cb3884411a048175fcfe1bd4be3f7611aca"
+        creation_date = "2020-06-25"
+        last_modified = "2021-08-23"
+        description = "Identifies Phobos ransomware"
+        threat_name = "Windows.Ransomware.Phobos"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 61 00 63 00 75 00 74 00 65 00 00 00 61 00 63 00 74 00 69 00 6E 00 00 00 61 00 63 00 74 00 6F 00 6E 00 00 00 61 00 63 00 74 00 6F 00 72 00 00 00 61 00 63 00 75 00 66 00 66 00 00 }
+        $a2 = { 0C 6D 00 73 00 66 00 74 00 65 00 73 00 71 00 6C 00 2E 00 65 00 78 00 65 00 00 00 73 00 71 00 6C 00 61 00 67 00 65 00 6E 00 74 00 2E 00 65 00 78 00 65 00 00 00 73 00 71 00 6C 00 62 00 72 00 6F 00 77 00 73 00 65 00 72 00 2E 00 65 00 78 00 65 00 00 00 73 00 71 00 6C 00 73 00 65 00 72 00 76 00 72 00 2E 00 65 00 78 00 65 00 00 00 73 00 71 00 6C 00 77 00 72 00 69 00 74 00 65 00 72 00 2E 00 65 00 78 00 65 00 00 00 6F 00 72 00 61 00 63 00 6C 00 65 00 2E 00 65 00 78 00 }
+        $a3 = { 31 00 63 00 64 00 00 00 33 00 64 00 73 00 00 00 33 00 66 00 72 00 00 00 33 00 67 00 32 00 00 00 33 00 67 00 70 00 00 00 37 00 7A 00 00 00 61 00 63 00 63 00 64 00 61 00 00 00 61 00 63 00 63 00 64 00 62 00 00 00 61 00 63 00 63 00 64 00 63 00 00 00 61 00 63 00 63 00 64 00 65 00 00 00 61 00 63 00 63 00 64 00 74 00 00 00 61 00 63 00 63 00 64 00 77 00 00 00 61 00 64 00 62 00 00 00 61 00 64 00 70 00 00 00 61 00 69 00 00 00 61 00 69 00 33 00 00 00 61 00 69 00 34 00 00 00 61 00 69 00 35 00 00 00 61 00 69 00 36 00 00 00 61 00 69 00 37 00 00 00 61 00 69 00 38 00 00 00 61 00 6E 00 69 00 6D 00 00 00 61 00 72 00 77 00 00 00 61 00 73 00 00 00 61 00 73 00 61 00 00 00 61 00 73 00 63 00 00 00 61 00 73 00 63 00 78 00 00 00 61 00 73 00 6D 00 00 00 61 00 73 00 6D 00 78 00 00 00 61 00 73 00 70 00 00 00 61 00 73 00 70 00 78 00 00 00 61 00 73 00 72 00 00 00 61 00 73 00 78 00 00 00 61 00 76 00 69 00 00 00 61 00 76 00 73 00 00 00 62 00 61 00 63 00 6B 00 75 00 70 00 00 00 62 00 61 00 6B 00 00 00 62 00 61 00 79 00 00 00 62 00 64 00 00 00 62 00 69 00 6E 00 00 00 62 00 6D 00 70 00 00 00 }
+    condition:
+        2 of ($a*)
+}
+
+rule Windows_Ransomware_Phobos_ff55774d : beta {
+    meta:
+        id = "ff55774d-4425-4243-8156-ce029c1d5860"
+        fingerprint = "d8016c9be4a8e5b5ac32b7108542fee8426d65b4d37e2a9c5ad57284abb3781e"
+        creation_date = "2020-06-25"
+        last_modified = "2021-08-23"
+        description = "Identifies Phobos ransomware"
+        threat_name = "Windows.Ransomware.Phobos"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
+        severity = 90
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $c1 = { 24 18 83 C4 0C 8B 4F 0C 03 C6 50 8D 54 24 18 52 51 6A 00 6A 00 89 44 }
+    condition:
+        1 of ($c*)
+}
+
+rule Windows_Ransomware_Phobos_11ea7be5 : beta {
+    meta:
+        id = "11ea7be5-7aac-41d7-8d09-45131a9c656e"
+        fingerprint = "a264f93e085134e5114c5d72e1bf93e70935e33756a79f1021e9c1e71d6c8697"
+        creation_date = "2020-06-25"
+        last_modified = "2021-08-23"
+        description = "Identifies Phobos ransomware"
+        threat_name = "Windows.Ransomware.Phobos"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $b1 = { C0 74 30 33 C0 40 8B CE D3 E0 85 C7 74 19 66 8B 04 73 66 89 }
+    condition:
+        1 of ($b*)
+}
+
diff --git a/yara/rules/Windows_Ransomware_Ragnarok.yar b/yara/rules/Windows_Ransomware_Ragnarok.yar
new file mode 100644
index 00000000..8612c6f7
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Ragnarok.yar
@@ -0,0 +1,92 @@
+rule Windows_Ransomware_Ragnarok_1cab7ea1 : beta {
+    meta:
+        id = "1cab7ea1-8d26-4478-ab41-659c193b5baa"
+        fingerprint = "e2a8eabb08cb99c4999e05a06d0d0dce46d7e6375a72a6a5e69d718c3d54a3ad"
+        creation_date = "2020-05-03"
+        last_modified = "2021-08-23"
+        description = "Identifies RAGNAROK ransomware"
+        threat_name = "Windows.Ransomware.Ragnarok"
+        reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $c1 = ".ragnarok" ascii wide fullword
+    condition:
+        1 of ($c*)
+}
+
+rule Windows_Ransomware_Ragnarok_7e802f95 : beta {
+    meta:
+        id = "7e802f95-964e-4dd9-a5d1-13a6cd73d750"
+        fingerprint = "c62b3706a2024751f1346d0153381ac28057995cf95228e43affc3d1e4ad0fad"
+        creation_date = "2020-05-03"
+        last_modified = "2021-08-23"
+        description = "Identifies RAGNAROK ransomware"
+        threat_name = "Windows.Ransomware.Ragnarok"
+        reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $d1 = { 68 04 94 42 00 FF 35 A0 77 43 00 }
+        $d2 = { 68 90 94 42 00 FF 35 A0 77 43 00 E8 8F D6 00 00 8B 40 10 50 }
+    condition:
+        1 of ($d*)
+}
+
+rule Windows_Ransomware_Ragnarok_efafbe48 : beta {
+    meta:
+        id = "efafbe48-7740-4c21-b585-467f7ad76f8d"
+        fingerprint = "a1535bc01756ac9e986eb564d712b739df980ddd61cfde5a7b001849a6b07b57"
+        creation_date = "2020-05-03"
+        last_modified = "2021-08-23"
+        description = "Identifies RAGNAROK ransomware"
+        threat_name = "Windows.Ransomware.Ragnarok"
+        reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "cmd_firewall" ascii fullword
+        $a2 = "cmd_recovery" ascii fullword
+        $a3 = "cmd_boot" ascii fullword
+        $a4 = "cmd_shadow" ascii fullword
+        $a5 = "readme_content" ascii fullword
+        $a6 = "readme_name" ascii fullword
+        $a8 = "rg_path" ascii fullword
+        $a9 = "cometosee" ascii fullword
+        $a10 = "&prv_ip=" ascii fullword
+    condition:
+        6 of ($a*)
+}
+
+rule Windows_Ransomware_Ragnarok_5625d3f6 : beta {
+    meta:
+        id = "5625d3f6-7071-4a09-8ddf-faa2d081b539"
+        fingerprint = "5c0a4e2683991929ff6307855bf895e3f13a61bbcc6b3c4b47d895f818d25343"
+        creation_date = "2020-05-03"
+        last_modified = "2021-08-23"
+        description = "Identifies RAGNAROK ransomware"
+        threat_name = "Windows.Ransomware.Ragnarok"
+        reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $b1 = "prv_ip" ascii fullword
+        $b2 = "%i.%i.%i" ascii fullword
+        $b3 = "pub_ip" ascii fullword
+        $b4 = "cometosee" ascii fullword
+    condition:
+        all of ($b*)
+}
+
diff --git a/yara/rules/Windows_Ransomware_Ransomexx.yar b/yara/rules/Windows_Ransomware_Ransomexx.yar
new file mode 100644
index 00000000..cae9287c
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Ransomexx.yar
@@ -0,0 +1,22 @@
+rule Windows_Ransomware_Ransomexx_fabff49c {
+    meta:
+        id = "fabff49c-8e1a-4020-b081-2f432532e529"
+        fingerprint = "a7a1e6d5fafdddc7d4699710edf407653968ffd40747c50f26ef63a6cb623bbe"
+        creation_date = "2021-08-07"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Ransomware.Ransomexx"
+        reference_sample = "480af18104198ad3db1518501ee58f9c4aecd19dbbf2c5dd7694d1d87e9aeac7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "ransom.exx" ascii fullword
+        $a2 = "Infrastructure rebuild will cost you MUCH more." wide fullword
+        $a3 = "Your files are securely ENCRYPTED." wide fullword
+        $a4 = "delete catalog -quiet" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Rook.yar b/yara/rules/Windows_Ransomware_Rook.yar
new file mode 100644
index 00000000..36acfbb8
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Rook.yar
@@ -0,0 +1,19 @@
+rule Windows_Ransomware_Rook_ee21fa67 {
+    meta:
+        id = "ee21fa67-bd82-40fb-9c6d-bab5abfe14b3"
+        fingerprint = "8ef731590e73f79a13d04db39e58b03d0a29fd8e46a0584b0fcaf57ac0efe473"
+        creation_date = "2022-01-14"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Ransomware.Rook"
+        reference_sample = "c2d46d256b8f9490c9599eea11ecef19fde7d4fdd2dea93604cee3cea8e172ac"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 01 75 09 8B C3 FF C3 48 89 74 C5 F0 48 FF C7 48 83 FF 1A 7C DB }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Ryuk.yar b/yara/rules/Windows_Ransomware_Ryuk.yar
new file mode 100644
index 00000000..14b37748
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Ryuk.yar
@@ -0,0 +1,152 @@
+rule Windows_Ransomware_Ryuk_25d3c5ba : beta {
+    meta:
+        id = "25d3c5ba-8f80-4af0-8a5d-29c974fb016a"
+        fingerprint = "18e70599e3a187e77697844fa358dd150e7e25ac74060e8c7cf2707fb7304efd"
+        creation_date = "2020-04-30"
+        last_modified = "2021-08-23"
+        description = "Identifies RYUK ransomware"
+        threat_name = "Windows.Ransomware.Ryuk"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $g1 = { 41 8B C0 45 03 C7 99 F7 FE 48 63 C2 8A 4C 84 20 }
+    condition:
+        1 of ($g*)
+}
+
+rule Windows_Ransomware_Ryuk_878bae7e : beta {
+    meta:
+        id = "878bae7e-1e53-4648-93aa-b4075eef256d"
+        fingerprint = "93a501463bb2320a9ab824d70333da2b6f635eb5958d6f8de43fde3a21de2298"
+        creation_date = "2020-04-30"
+        last_modified = "2021-08-23"
+        description = "Identifies RYUK ransomware"
+        threat_name = "Windows.Ransomware.Ryuk"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $b2 = "RyukReadMe.html" wide fullword
+        $b3 = "RyukReadMe.txt" wide fullword
+    condition:
+        1 of ($b*)
+}
+
+rule Windows_Ransomware_Ryuk_6c726744 : beta {
+    meta:
+        id = "6c726744-acdb-443a-b683-b11f8b657f7a"
+        fingerprint = "d0a4608907e48d02d78ff40a59d47cad1b9258df31b7312dd1a85f8fee2a28d5"
+        creation_date = "2020-04-30"
+        last_modified = "2021-08-23"
+        description = "Identifies RYUK ransomware"
+        threat_name = "Windows.Ransomware.Ryuk"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "172.16." ascii fullword
+        $a2 = "192.168." ascii fullword
+        $a3 = "DEL /F" wide fullword
+        $a4 = "lsaas.exe" wide fullword
+        $a5 = "delete[]" ascii fullword
+    condition:
+        4 of ($a*)
+}
+
+rule Windows_Ransomware_Ryuk_1a4ad952 : beta {
+    meta:
+        id = "1a4ad952-cc99-4653-932b-290381e7c871"
+        fingerprint = "d8c5162850e758e27439e808e914df63f42756c0b8f7c2b5f9346c0731d3960c"
+        creation_date = "2020-04-30"
+        last_modified = "2021-08-23"
+        description = "Identifies RYUK ransomware"
+        threat_name = "Windows.Ransomware.Ryuk"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $e1 = { 8B 0A 41 8D 45 01 45 03 C1 48 8D 52 08 41 3B C9 41 0F 45 C5 44 8B E8 49 63 C0 48 3B C3 72 E1 }
+    condition:
+        1 of ($e*)
+}
+
+rule Windows_Ransomware_Ryuk_72b5fd9d : beta {
+    meta:
+        id = "72b5fd9d-23db-4f18-88d9-a849ec039135"
+        fingerprint = "7c394aa283336013b74a8aaeb56e8363033958b4a1bd8011f3b32cfe2d37e088"
+        creation_date = "2020-04-30"
+        last_modified = "2021-08-23"
+        description = "Identifies RYUK ransomware"
+        threat_name = "Windows.Ransomware.Ryuk"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $d1 = { 48 2B C3 33 DB 66 89 1C 46 48 83 FF FF 0F }
+    condition:
+        1 of ($d*)
+}
+
+rule Windows_Ransomware_Ryuk_8ba51798 : beta {
+    meta:
+        id = "8ba51798-15d7-4f02-97fa-1844465ae9d8"
+        fingerprint = "8e284bc6015502577a6ddd140b9cd110fd44d4d2cb55d0fdec5bebf3356fd7b3"
+        creation_date = "2020-04-30"
+        last_modified = "2021-08-23"
+        description = "Identifies RYUK ransomware"
+        threat_name = "Windows.Ransomware.Ryuk"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $c1 = "/v \"svchos\" /f" wide fullword
+        $c2 = "cmd /c \"WMIC.exe shadowcopy delet\"" ascii fullword
+        $c3 = "lsaas.exe" wide fullword
+        $c4 = "FA_Scheduler" wide fullword
+        $c5 = "ocautoupds" wide fullword
+        $c6 = "CNTAoSMgr" wide fullword
+        $c7 = "hrmlog" wide fullword
+        $c8 = "UNIQUE_ID_DO_NOT_REMOVE" wide fullword
+    condition:
+        3 of ($c*)
+}
+
+rule Windows_Ransomware_Ryuk_88daaf8e : beta {
+    meta:
+        id = "88daaf8e-0bfe-46c4-9a75-2527d0e10538"
+        fingerprint = "b1f218a9bc6bf5f3ec108a471de954988e7692de208e68d7d4ee205194cbbb40"
+        creation_date = "2020-04-30"
+        last_modified = "2021-08-23"
+        description = "Identifies RYUK ransomware"
+        threat_name = "Windows.Ransomware.Ryuk"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $f1 = { 48 8B CF E8 AB 25 00 00 85 C0 74 35 }
+    condition:
+        1 of ($f*)
+}
+
diff --git a/yara/rules/Windows_Ransomware_Snake.yar b/yara/rules/Windows_Ransomware_Snake.yar
new file mode 100644
index 00000000..d0189759
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Snake.yar
@@ -0,0 +1,86 @@
+rule Windows_Ransomware_Snake_550e0265 : beta {
+    meta:
+        id = "550e0265-fca9-46df-9d5a-cf3ef7efc7ff"
+        fingerprint = "f2796560ddc85ad98a5ef4f0d7323948d57116813c8a26ab902fdfde849704e0"
+        creation_date = "2020-06-30"
+        last_modified = "2021-08-23"
+        description = "Identifies SNAKE ransomware"
+        threat_name = "Windows.Ransomware.Snake"
+        reference = "https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Go build ID: \"X6lNEpDhc_qgQl56x4du/fgVJOqLlPCCIekQhFnHL/rkxe6tXCg56Ez88otHrz/Y-lXW-OhiIbzg3-ioGRz\"" ascii fullword
+        $a2 = "We breached your corporate network and encrypted the data on your computers."
+        $a3 = "c:\\users\\public\\desktop\\Fix-Your-Files.txt" nocase
+        $a4 = "%System Root%\\Fix-Your-Files.txt" nocase
+        $a5 = "%Desktop%\\Fix-Your-Files.txt" nocase
+    condition:
+        1 of ($a*)
+}
+
+rule Windows_Ransomware_Snake_119f9c83 : beta {
+    meta:
+        id = "119f9c83-4b55-47ce-8c0d-3799a7b46369"
+        fingerprint = "13ffd63c31df2cbaa6988abcaff3b0a3518437f1d37dcd872817b9cbdb61576f"
+        creation_date = "2020-06-30"
+        last_modified = "2021-08-23"
+        description = "Identifies SNAKE ransomware"
+        threat_name = "Windows.Ransomware.Snake"
+        reference = "https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $c1 = { 00 40 83 7C 00 40 9E 7C 00 60 75 7C 00 B0 6C 7C 00 B0 74 7C 00 D0 74 7C 00 B0 59 7C 00 D0 59 7C 00 F0 59 7C 00 10 5A 7C 00 30 5A 7C 00 50 5A 7C 00 70 5A 7C 00 90 5A 7C 00 B0 5A 7C 00 D0 5A 7C 00 D0 6C 7C 00 F0 5A 7C 00 30 5B 7C 00 50 5B 7C 00 70 5B 7C 00 90 5B 7C 00 D0 5E 7C 00 B0 5B 7C 00 D0 5B 7C 00 F0 5B 7C 00 50 60 7C 00 70 61 7C 00 10 5C 7C 00 30 5C 7C 00 50 5C 7C 00 10 63 7C 00 70 5C 7C 00 90 5C 7C 00 90 64 7C 00 B0 5C 7C 00 F0 5C 7C 00 10 5D 7C 00 F0 6C 7C 00 10 6D 7C 00 30 5D 7C 00 50 5D 7C 00 30 6D 7C 00 90 71 7C 00 70 5D 7C 00 90 5D 7C 00 B0 5D 7C 00 D0 5D 7C 00 70 6D 7C 00 F0 5D 7C 00 10 5E 7C 00 30 5E 7C 00 50 5E 7C 00 70 5E 7C 00 90 5E 7C 00 B0 5E 7C 00 F0 5E 7C 00 10 5F 7C 00 30 5F 7C 00 50 5F 7C 00 70 5F 7C 00 90 6D 7C 00 90 5F 7C 00 B0 6D 7C 00 D0 6D 7C 00 F0 6D 7C 00 10 6E 7C 00 B0 5F 7C 00 D0 5F 7C 00 F0 5F 7C 00 10 60 7C 00 30 60 7C 00 30 6E 7C 00 70 60 7C }
+        $c2 = { 00 30 64 7C 00 50 64 7C 00 70 64 7C 00 B0 64 7C 00 D0 64 7C 00 30 73 7C 00 F0 64 7C 00 90 71 7C 00 10 65 7C 00 30 65 7C 00 50 65 7C 00 90 72 7C 00 B0 72 7C 00 70 6E 7C 00 70 65 7C 00 B0 65 7C 00 D0 65 7C 00 F0 65 7C 00 10 66 7C 00 30 66 7C 00 50 66 7C 00 70 66 7C 00 90 66 7C 00 B0 66 7C 00 D0 66 7C 00 F0 66 7C 00 30 67 7C 00 90 6E 7C 00 B0 6E 7C 00 D0 6E 7C }
+    condition:
+        1 of ($c*)
+}
+
+rule Windows_Ransomware_Snake_0cfc8ef3 : beta {
+    meta:
+        id = "0cfc8ef3-d8cc-4fc0-9ca2-8e84dbcb45bd"
+        fingerprint = "4dd2565c42d52f20b9787a6ede9be24837f6df19dfbbd4e58e5208894741ba26"
+        creation_date = "2020-06-30"
+        last_modified = "2021-08-23"
+        description = "Identifies SNAKE ransomware"
+        threat_name = "Windows.Ransomware.Snake"
+        reference = "https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $d1 = { 96 88 44 2C 1E 96 45 }
+        $d2 = { 39 C5 7D ?? 0F B6 34 2B 39 D5 73 ?? 0F B6 3C 29 31 FE 83 FD 1A 72 }
+    condition:
+        1 of ($d*)
+}
+
+rule Windows_Ransomware_Snake_20bc5abc : beta {
+    meta:
+        id = "20bc5abc-c519-47d2-a6de-5108071a9144"
+        fingerprint = "e7f1be2bd7e1f39b79ac89cf58c90abdb537ff54cbf161192d997e054d3f0883"
+        creation_date = "2020-06-30"
+        last_modified = "2021-08-23"
+        description = "Identifies SNAKE ransomware"
+        threat_name = "Windows.Ransomware.Snake"
+        reference = "https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $b1 = { 57 12 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A }
+    condition:
+        1 of ($b*)
+}
+
diff --git a/yara/rules/Windows_Ransomware_Sodinokibi.yar b/yara/rules/Windows_Ransomware_Sodinokibi.yar
new file mode 100644
index 00000000..6bf3de96
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Sodinokibi.yar
@@ -0,0 +1,86 @@
+rule Windows_Ransomware_Sodinokibi_83f05fbe : beta {
+    meta:
+        id = "83f05fbe-65d1-423f-98df-21692167a1d6"
+        fingerprint = "8c32ca099c9117e394379c0cc4771a15e5e4cfb1a98210c288e743a6d9cc9967"
+        creation_date = "2020-06-18"
+        last_modified = "2021-08-23"
+        description = "Identifies SODINOKIBI/REvil ransomware"
+        threat_name = "Windows.Ransomware.Sodinokibi"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $d1 = { 03 C0 01 47 30 11 4F 34 01 57 30 8B 57 78 8B C2 11 77 34 8B 77 7C 8B CE 0F A4 C1 04 C1 E0 04 01 47 28 8B C2 11 4F 2C 8B CE 0F A4 C1 01 03 C0 01 47 28 11 4F 2C 01 57 28 8B 57 70 8B C2 11 77 2C 8B 77 74 8B CE 0F A4 C1 04 C1 E0 04 01 47 20 8B C2 11 4F 24 8B CE 0F A4 C1 01 03 C0 01 47 20 11 4F 24 01 57 20 8B 57 68 8B C2 11 77 24 8B 77 6C 8B CE 0F A4 C1 04 C1 E0 04 01 47 18 8B C2 11 4F 1C 8B CE 0F A4 C1 01 03 C0 01 47 18 11 4F 1C 01 57 18 8B 57 60 8B C2 11 77 1C 8B 77 64 }
+        $d2 = { 65 78 70 61 6E 64 20 33 32 2D 62 79 74 65 20 6B 65 78 70 61 6E 64 20 31 36 2D 62 79 74 65 20 6B }
+        $d3 = { F7 6F 38 03 C8 8B 43 48 13 F2 F7 6F 20 03 C8 8B 43 38 13 F2 F7 6F 30 03 C8 8B 43 40 13 F2 F7 6F 28 03 C8 8B 43 28 13 F2 F7 6F 40 03 C8 8B 45 08 13 F2 89 48 68 89 70 6C 8B 43 38 F7 6F 38 8B C8 8B F2 8B 43 28 F7 6F 48 03 C8 13 F2 8B 43 48 F7 6F 28 03 C8 8B 43 30 13 F2 F7 6F 40 0F A4 CE 01 03 C9 03 C8 8B 43 40 13 F2 F7 6F 30 03 C8 8B 45 08 13 F2 89 48 70 89 70 74 8B 43 38 F7 6F 40 8B C8 }
+        $d4 = { 33 C0 8B 5A 68 8B 52 6C 0F A4 FE 08 C1 E9 18 0B C6 C1 E7 08 8B 75 08 0B CF 89 4E 68 8B CA 89 46 6C 33 C0 8B 7E 60 8B 76 64 0F A4 DA 19 C1 E9 07 0B C2 C1 E3 19 8B 55 08 0B CB 89 4A 60 8B CF 89 42 64 33 C0 8B 5A 10 8B 52 14 0F AC F7 15 C1 E1 0B C1 EE 15 0B C7 0B CE 8B 75 }
+        $d5 = { C1 01 C1 EE 1F 0B D1 03 C0 0B F0 8B C2 33 43 24 8B CE 33 4B 20 33 4D E4 33 45 E0 89 4B 20 8B CB 8B 5D E0 89 41 24 8B CE 33 4D E4 8B C2 31 4F 48 33 C3 8B CF 31 41 4C 8B C7 8B CE 33 48 70 8B C2 33 47 74 33 4D E4 33 C3 89 4F 70 8B CF 89 41 74 8B }
+        $d6 = { 8B 43 40 F7 6F 08 03 C8 8B 03 13 F2 F7 6F 48 03 C8 8B 43 48 13 F2 F7 2F 03 C8 8B 43 08 13 F2 F7 6F 40 03 C8 8B 43 30 13 F2 F7 6F 18 03 C8 8B 43 18 13 F2 F7 6F 30 03 C8 8B 43 38 13 F2 F7 6F 10 03 C8 8B 43 10 13 F2 F7 6F 38 03 C8 8B 43 28 13 F2 }
+        $d7 = { 8B CE 33 4D F8 8B C2 33 C3 31 4F 18 8B CF 31 41 1C 8B C7 8B CE 33 48 40 8B C2 33 4D F8 33 47 44 89 4F 40 33 C3 8B CF 89 41 44 8B C7 8B CE 33 48 68 8B C2 33 47 6C 33 4D F8 33 C3 89 4F 68 8B CF 89 41 6C 8B CE 8B }
+        $d8 = { 36 7D 49 30 85 35 C2 C3 68 60 4B 4B 7A BE 83 53 AB E6 8E 42 F9 C6 62 A5 D0 6A AD C6 F1 7D F6 1D 79 CD 20 FC E7 3E E1 B8 1A 43 38 12 C1 56 28 1A 04 C9 22 55 E0 D7 08 BB 9F 0B 1F 1C B9 13 06 35 }
+        $d9 = { C2 C1 EE 03 8B 55 08 0B CE 89 4A 4C 8B CF 89 42 48 33 C0 8B 72 30 8B 52 34 C1 E9 0C 0F A4 DF 14 0B C7 C1 E3 14 8B 7D 08 0B CB 89 4F 30 8B CE 89 47 34 33 C0 C1 E1 0C 0F AC D6 14 0B C6 C1 EA 14 89 47 08 0B CA }
+        $d10 = { 8B F2 8B 43 38 F7 6F 28 03 C8 8B 43 18 13 F2 F7 6F 48 03 C8 8B 43 28 13 F2 F7 6F 38 03 C8 8B 43 40 13 F2 F7 6F 20 0F A4 CE 01 03 C9 03 C8 8B 43 20 13 F2 F7 6F 40 03 C8 8B 43 30 13 F2 F7 6F 30 03 C8 }
+        $d11 = { 33 45 FC 31 4B 28 8B CB 31 41 2C 8B CE 8B C3 33 48 50 8B C2 33 43 54 33 CF 33 45 FC 89 4B 50 8B CB 89 41 54 8B CE 8B C3 33 48 78 8B C2 33 43 7C 33 CF 33 45 FC 89 4B 78 8B CB 89 41 7C 33 B1 A0 }
+        $d12 = { 52 24 0F A4 FE 0E C1 E9 12 0B C6 C1 E7 0E 8B 75 08 0B CF 89 4E 20 8B CA 89 46 24 33 C0 8B 7E 78 8B 76 7C 0F A4 DA 1B C1 E9 05 0B C2 C1 E3 1B 8B 55 08 0B CB 89 4A 78 8B CF 89 42 7C 33 C0 8B 9A }
+        $d13 = { F2 8B 43 38 F7 6F 20 03 C8 8B 43 40 13 F2 F7 6F 18 03 C8 8B 43 10 13 F2 F7 6F 48 03 C8 8B 43 28 13 F2 F7 6F 30 03 C8 8B 43 20 13 F2 F7 6F 38 03 C8 8B 43 30 13 F2 F7 6F 28 03 C8 8B 43 48 13 F2 }
+        $d14 = { 8B 47 30 13 F2 F7 6F 40 03 C8 13 F2 0F A4 CE 01 89 73 74 03 C9 89 4B 70 8B 47 30 F7 6F 48 8B C8 8B F2 8B 47 38 F7 6F 40 03 C8 13 F2 0F A4 CE 01 89 73 7C 03 C9 89 4B 78 8B 47 38 F7 6F 48 8B C8 }
+    condition:
+        all of them
+}
+
+rule Windows_Ransomware_Sodinokibi_182b2cea : beta {
+    meta:
+        id = "182b2cea-5aae-443a-9a2e-b3121a0ac8c7"
+        fingerprint = "b71d862f6d45b388a106bf694e2bf5b4e4d78649c396e89bda46eab4206339fe"
+        creation_date = "2020-06-18"
+        last_modified = "2021-10-04"
+        description = "Identifies SODINOKIBI/REvil ransomware"
+        threat_name = "Windows.Ransomware.Sodinokibi"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "expand 32-byte kexpand 16-byte k" ascii fullword
+        $b1 = "ServicesActive" wide fullword
+        $b2 = "CreateThread" ascii fullword
+        $b3 = "GetExitCodeProcess" ascii fullword
+        $b4 = "CloseHandle" ascii fullword
+        $b5 = "SetErrorMode" ascii fullword
+        $b6 = ":!:(:/:6:C:\\:m:" ascii fullword
+    condition:
+        ($a1 and 6 of ($b*))
+}
+
+rule Windows_Ransomware_Sodinokibi_a282ba44 : beta {
+    meta:
+        id = "a282ba44-b8bf-4fcc-a1c4-795675a928de"
+        fingerprint = "07f1feb22f8b9de0ebd5c4649545eb4823a274b49b2c61a44d3eed4739ecd572"
+        creation_date = "2020-06-18"
+        last_modified = "2021-08-23"
+        description = "Identifies SODINOKIBI/REvil ransomware"
+        threat_name = "Windows.Ransomware.Sodinokibi"
+        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $c1 = { 59 59 85 F6 74 25 8B 55 08 83 66 04 00 89 3E 8B 0A 0B 4A 04 }
+        $c2 = { 8D 45 F8 89 75 FC 50 8D 45 FC 89 75 F8 50 56 56 6A 01 6A 30 }
+        $c3 = { 75 0C 72 D3 33 C0 40 5F 5E 5B 8B E5 5D C3 33 C0 EB F5 55 8B EC 83 }
+        $c4 = { 0C 8B 04 B0 83 78 04 05 75 1C FF 70 08 FF 70 0C FF 75 0C FF }
+        $c5 = { FB 8B 45 FC 50 8B 08 FF 51 08 5E 8B C7 5F 5B 8B E5 5D C3 55 }
+        $c6 = { BC 00 00 00 33 D2 8B 4D F4 8B F1 8B 45 F0 0F A4 C1 01 C1 EE 1F }
+        $c7 = { 54 8B CE F7 D1 8B C2 23 4D DC F7 D0 33 4D F4 23 C7 33 45 E8 89 }
+        $c8 = { 0C 89 46 0C 85 C0 75 2A 33 C0 EB 6C 8B 46 08 85 C0 74 62 6B }
+    condition:
+        (6 of ($c*))
+}
+
diff --git a/yara/rules/Windows_Ransomware_Stop.yar b/yara/rules/Windows_Ransomware_Stop.yar
new file mode 100644
index 00000000..4ad94239
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Stop.yar
@@ -0,0 +1,20 @@
+rule Windows_Ransomware_Stop_1e8d48ff {
+    meta:
+        id = "1e8d48ff-e0ab-478d-8268-a11f2e87ab79"
+        fingerprint = "715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb"
+        creation_date = "2021-06-10"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Ransomware.Stop"
+        reference_sample = "821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = "E:\\Doc\\My work (C++)\\_Git\\Encryption\\Release\\encrypt_win_api.pdb" ascii fullword
+        $b = { 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF }
+    condition:
+        any of them
+}
+
diff --git a/yara/rules/Windows_Ransomware_Thanos.yar b/yara/rules/Windows_Ransomware_Thanos.yar
new file mode 100644
index 00000000..da310e80
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_Thanos.yar
@@ -0,0 +1,75 @@
+rule Windows_Ransomware_Thanos_c3522fd0 : beta {
+    meta:
+        id = "c3522fd0-90e2-4dd9-82f1-4502689270dd"
+        fingerprint = "6d9d6131fd0e3a8585900f4966cb2d1b32e7f5d71b9a65b7a47d80e94bd9f89a"
+        creation_date = "2020-11-03"
+        last_modified = "2021-08-23"
+        description = "Identifies THANOS (Hakbit) ransomware"
+        threat_name = "Windows.Ransomware.Thanos"
+        reference = "https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $c1 = { 0C 89 45 F0 83 65 EC 00 EB 07 8B 45 EC 40 89 45 EC 83 7D EC 18 }
+        $c2 = { E8 C1 E0 04 8B 4D FC C6 44 01 09 00 8B 45 E8 C1 E0 04 8B 4D FC 83 64 01 }
+        $c3 = { 00 2F 00 18 46 00 54 00 50 00 20 00 55 00 73 00 65 00 72 00 4E 00 }
+    condition:
+        2 of ($c*)
+}
+
+rule Windows_Ransomware_Thanos_a6c09942 : beta {
+    meta:
+        id = "a6c09942-0733-40d7-87b7-eb44dd472a35"
+        fingerprint = "4abcf47243bebc281566ba4929b20950e3f1bfac8976ae5bc6b8ffda85468ec0"
+        creation_date = "2020-11-03"
+        last_modified = "2021-08-23"
+        description = "Identifies THANOS (Hakbit) ransomware"
+        threat_name = "Windows.Ransomware.Thanos"
+        reference = "https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $b1 = { 00 57 00 78 00 73 00 49 00 48 00 6C 00 76 00 64 00 58 00 49 00 67 00 5A 00 6D 00 6C 00 73 00 5A 00 58 00 4D 00 67 00 64 00 32 00 56 00 79 00 5A 00 53 00 42 00 6C 00 62 00 6D 00 4E 00 79 00 65 00 58 00 42 00 30 00 5A 00 57 00 51 00 73 00 49 00 47 00 6C 00 6D 00 49 00 48 00 6C 00 76 00 64 00 53 00 42 00 33 00 59 00 57 00 35 00 30 00 49 00 48 00 52 00 76 00 49 00 47 00 64 00 6C 00 64 00 43 00 42 00 30 00 61 00 47 00 56 00 74 00 49 00 47 00 46 00 73 00 62 00 43 00 42 00 69 00 59 00 57 00 4E 00 72 00 4C 00 43 00 42 00 77 00 62 00 47 00 56 00 68 00 63 00 32 00 55 00 67 00 59 00 32 00 46 00 79 00 5A 00 57 00 5A 00 31 00 62 00 47 00 78 00 35 00 49 00 48 00 4A 00 6C 00 59 00 57 00 51 00 67 00 64 00 47 00 68 00 6C 00 49 00 48 00 52 00 6C 00 65 00 48 00 51 00 67 00 62 00 6D 00 39 00 30 00 5A 00 53 00 42 00 73 00 62 00 32 00 4E 00 68 00 64 00 47 00 56 00 6B 00 49 00 47 00 6C 00 75 00 49 00 48 00 6C 00 76 00 64 00 58 00 49 00 67 00 5A 00 47 00 56 00 7A 00 61 00 33 00 52 00 76 00 63 00 43 00 34 00 75 00 4C 00 67 00 3D 00 3D }
+        $b2 = { 01 0E 0E 05 00 02 0E 0E 0E 04 00 01 01 0E 04 00 01 0E 0E 06 00 03 01 0E 0E 0E 80 90 55 00 30 00 39 00 47 00 56 00 46 00 64 00 42 00 55 00 6B 00 56 00 63 00 54 00 57 00 6C 00 6A 00 63 00 6D 00 39 00 7A 00 62 00 32 00 5A 00 30 00 58 00 46 00 64 00 70 00 62 00 6D 00 52 00 76 00 64 00 33 00 4D 00 67 00 54 00 6C 00 52 00 63 00 51 00 33 00 56 00 79 00 63 00 6D 00 56 00 75 00 64 00 46 00 5A 00 6C 00 63 00 6E 00 4E 00 70 00 62 00 32 00 35 00 63 00 56 00 32 00 6C 00 }
+    condition:
+        1 of ($b*)
+}
+
+rule Windows_Ransomware_Thanos_e19feca1 : beta {
+    meta:
+        id = "e19feca1-b131-4045-be0c-d69d55f9a83e"
+        fingerprint = "d6654d0b3155d9c64fd4e599ba34d51f110d9dfda6fa1520b686602d9f608f92"
+        creation_date = "2020-11-03"
+        last_modified = "2021-08-23"
+        description = "Identifies THANOS (Hakbit) ransomware"
+        threat_name = "Windows.Ransomware.Thanos"
+        reference = "https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "<GetIPInfo>b__"
+        $a2 = "<Killproc>b__"
+        $a3 = "<Crypt>b__"
+        $a4 = "<Encrypt2>b__"
+        $b1 = "Your files are encrypted."
+        $b2 = "I will treat you good if you treat me good too."
+        $b3 = "I don't want to loose your files too"
+        $b4 = "/c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin" wide fullword
+        $b5 = "\\HOW_TO_DECYPHER_FILES.txt" wide fullword
+        $b6 = "c3RvcCBTUUxURUxFTUVUUlkkRUNXREIyIC95" wide fullword
+        $b7 = "c3RvcCBNQkFNU2VydmljZSAveQ==" wide fullword
+        $b8 = "L0MgY2hvaWNlIC9DIFkgL04gL0QgWSAvVCAzICYgRGVsIA==" wide fullword
+        $b9 = "c3RvcCBjY0V2dE1nciAveQ==" wide fullword
+    condition:
+        (4 of ($a*)) or (3 of ($b*))
+}
+
diff --git a/yara/rules/Windows_Ransomware_WhisperGate.yar b/yara/rules/Windows_Ransomware_WhisperGate.yar
new file mode 100644
index 00000000..e4b23b32
--- /dev/null
+++ b/yara/rules/Windows_Ransomware_WhisperGate.yar
@@ -0,0 +1,42 @@
+rule Windows_Ransomware_WhisperGate_c80f3b4b {
+    meta:
+        id = "c80f3b4b-f91b-4b8d-908e-f64c2c5d4b30"
+        fingerprint = "e8ad6a7cfabf96387deee56f38b0f0ba6d8fe85e7be9f153ccf72d69ee5db1c9"
+        creation_date = "2022-01-17"
+        last_modified = "2022-01-17"
+        threat_name = "Windows.Ransomware.WhisperGate"
+        reference_sample = "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $buffer = { E8 ?? ?? ?? ?? BE 20 40 40 00 29 C4 8D BD E8 DF FF FF E8 ?? ?? ?? ?? B9 00 08 00 00 F3 A5 }
+        $note = { 59 6F 75 72 20 68 61 72 64 20 64 72 69 76 65 20 68 61 73 20 62 65 65 6E 20 63 6F 72 72 75 70 74 65 64 2E 0D 0A }
+    condition:
+        all of them
+}
+
+rule Windows_Ransomware_WhisperGate_3476008e {
+    meta:
+        id = "3476008e-1c98-4606-b60b-7fef0e360711"
+        fingerprint = "0b8caff8cf9342bd50053712bf4c9aeab68532e340cc5e6cf400105afc150e39"
+        creation_date = "2022-01-18"
+        last_modified = "2022-01-18"
+        threat_name = "Windows.Ransomware.WhisperGate"
+        reference_sample = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "cmd.exe /min /C ping 111.111.111.111 -n 5 -w 10 > Nul & Del /f /q \"%s\"" ascii fullword
+        $a2 = "%.*s.%x" wide fullword
+        $a3 = "A:\\Windows" wide fullword
+        $a4 = ".ONETOC2" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Rootkit_R77.yar b/yara/rules/Windows_Rootkit_R77.yar
new file mode 100644
index 00000000..d62803f5
--- /dev/null
+++ b/yara/rules/Windows_Rootkit_R77.yar
@@ -0,0 +1,19 @@
+rule Windows_Rootkit_R77_5bab748b {
+    meta:
+        id = "5bab748b-8576-4967-9b50-a3778db1dd71"
+        fingerprint = "2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa"
+        creation_date = "2022-03-04"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Rootkit.R77"
+        reference_sample = "cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Shellcode_Generic.yar b/yara/rules/Windows_Shellcode_Generic.yar
new file mode 100644
index 00000000..a72b97d0
--- /dev/null
+++ b/yara/rules/Windows_Shellcode_Generic.yar
@@ -0,0 +1,18 @@
+rule Windows_Shellcode_Generic_8c487e57 {
+    meta:
+        id = "8c487e57-4b8c-488e-a1d9-786ff935fd2c"
+        fingerprint = "834caf96192a513aa93ac48fb8d2f3326bf9f08acaf7a27659f688b26e3e57e4"
+        creation_date = "2022-05-23"
+        last_modified = "2022-07-18"
+        threat_name = "Windows.Shellcode.Generic"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_A310logger.yar b/yara/rules/Windows_Trojan_A310logger.yar
new file mode 100644
index 00000000..58809c6b
--- /dev/null
+++ b/yara/rules/Windows_Trojan_A310logger.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_A310logger_520cd7ec {
+    meta:
+        id = "520cd7ec-840c-4d45-961b-8bc5e329c52f"
+        fingerprint = "f4ee88e555b7bd0102403cc804372f5376debc59555e8e7b4a16e18b04d1b314"
+        creation_date = "2022-01-11"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.A310logger"
+        reference_sample = "60fb9597e5843c72d761525f73ca728409579d81901860981ebd84f7d153cfa3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "/dumps9taw" ascii fullword
+        $a2 = "/logstatus" ascii fullword
+        $a3 = "/checkprotection" ascii fullword
+        $a4 = "[CLIPBOARD]<<" wide fullword
+        $a5 = "&chat_id=" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_AgentTesla.yar b/yara/rules/Windows_Trojan_AgentTesla.yar
new file mode 100644
index 00000000..21898911
--- /dev/null
+++ b/yara/rules/Windows_Trojan_AgentTesla.yar
@@ -0,0 +1,95 @@
+rule Windows_Trojan_AgentTesla_d3ac2b2f {
+    meta:
+        id = "d3ac2b2f-14fc-4851-8a57-41032e386aeb"
+        fingerprint = "cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc"
+        creation_date = "2021-03-22"
+        last_modified = "2022-06-20"
+        threat_name = "Windows.Trojan.AgentTesla"
+        reference_sample = "65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "GetMozillaFromLogins" ascii fullword
+        $a2 = "AccountConfiguration+username" wide fullword
+        $a3 = "MailAccountConfiguration" ascii fullword
+        $a4 = "KillTorProcess" ascii fullword
+        $a5 = "SmtpAccountConfiguration" ascii fullword
+        $a6 = "GetMozillaFromSQLite" ascii fullword
+        $a7 = "Proxy-Agent: HToS5x" wide fullword
+        $a8 = "set_BindingAccountConfiguration" ascii fullword
+        $a9 = "doUsernamePasswordAuth" ascii fullword
+        $a10 = "SafariDecryptor" ascii fullword
+        $a11 = "get_securityProfile" ascii fullword
+        $a12 = "get_useSeparateFolderTree" ascii fullword
+        $a13 = "get_DnsResolver" ascii fullword
+        $a14 = "get_archivingScope" ascii fullword
+        $a15 = "get_providerName" ascii fullword
+        $a16 = "get_ClipboardHook" ascii fullword
+        $a17 = "get_priority" ascii fullword
+        $a18 = "get_advancedParameters" ascii fullword
+        $a19 = "get_disabledByRestriction" ascii fullword
+        $a20 = "get_LastAccessed" ascii fullword
+        $a21 = "get_avatarType" ascii fullword
+        $a22 = "get_signaturePresets" ascii fullword
+        $a23 = "get_enableLog" ascii fullword
+        $a24 = "TelegramLog" ascii fullword
+        $a25 = "generateKeyV75" ascii fullword
+        $a26 = "set_accountName" ascii fullword
+        $a27 = "set_InternalServerPort" ascii fullword
+        $a28 = "set_bindingConfigurationUID" ascii fullword
+        $a29 = "set_IdnAddress" ascii fullword
+        $a30 = "set_GuidMasterKey" ascii fullword
+        $a31 = "set_username" ascii fullword
+        $a32 = "set_version" ascii fullword
+        $a33 = "get_Clipboard" ascii fullword
+        $a34 = "get_Keyboard" ascii fullword
+        $a35 = "get_ShiftKeyDown" ascii fullword
+        $a36 = "get_AltKeyDown" ascii fullword
+        $a37 = "get_Password" ascii fullword
+        $a38 = "get_PasswordHash" ascii fullword
+        $a39 = "get_DefaultCredentials" ascii fullword
+    condition:
+        8 of ($a*)
+}
+
+rule Windows_Trojan_AgentTesla_e577e17e {
+    meta:
+        id = "e577e17e-5c42-4431-8c2d-0c1153128226"
+        fingerprint = "009cb27295a1aa0dde84d29ee49b8fa2e7a6cec75eccb7534fec3f5c89395a9d"
+        creation_date = "2022-03-11"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.AgentTesla"
+        reference_sample = "ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 20 4D 27 00 00 33 DB 19 0B 00 07 17 FE 01 2C 02 18 0B 00 07 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_AgentTesla_f2a90d14 {
+    meta:
+        id = "f2a90d14-7212-41a5-a2cd-a6a6dedce96e"
+        fingerprint = "829c827069846ba1e1378aba8ee6cdc801631d769dc3dce15ccaacd4068a88a6"
+        creation_date = "2022-03-11"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.AgentTesla"
+        reference_sample = "ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Amadey.yar b/yara/rules/Windows_Trojan_Amadey.yar
new file mode 100644
index 00000000..4b0c8f61
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Amadey.yar
@@ -0,0 +1,38 @@
+rule Windows_Trojan_Amadey_7abb059b {
+    meta:
+        id = "7abb059b-4001-4eec-8185-1e0497e15062"
+        fingerprint = "686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f"
+        creation_date = "2021-06-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Amadey"
+        reference_sample = "33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Amadey_c4df8d4a {
+    meta:
+        id = "c4df8d4a-01f4-466f-8225-7c7f462b29e7"
+        fingerprint = "4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c"
+        creation_date = "2021-06-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Amadey"
+        reference_sample = "9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "D:\\Mktmp\\NL1\\Release\\NL1.pdb" fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_ArkeiStealer.yar b/yara/rules/Windows_Trojan_ArkeiStealer.yar
new file mode 100644
index 00000000..fb02e493
--- /dev/null
+++ b/yara/rules/Windows_Trojan_ArkeiStealer.yar
@@ -0,0 +1,19 @@
+rule Windows_Trojan_ArkeiStealer_84c7086a {
+    meta:
+        id = "84c7086a-abc3-4b97-b325-46a078b90a95"
+        fingerprint = "f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d"
+        creation_date = "2022-02-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.ArkeiStealer"
+        reference_sample = "708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Asyncrat.yar b/yara/rules/Windows_Trojan_Asyncrat.yar
new file mode 100644
index 00000000..e8c28590
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Asyncrat.yar
@@ -0,0 +1,24 @@
+rule Windows_Trojan_Asyncrat_11a11ba1 {
+    meta:
+        id = "11a11ba1-c178-4415-9c09-45030b500f50"
+        fingerprint = "715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8"
+        creation_date = "2021-08-05"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Asyncrat"
+        reference_sample = "fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "/c schtasks /create /f /sc onlogon /rl highest /tn \"" wide fullword
+        $a2 = "Stub.exe" wide fullword
+        $a3 = "get_ActivatePong" ascii fullword
+        $a4 = "vmware" wide fullword
+        $a5 = "\\nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" wide fullword
+        $a6 = "get_SslClient" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_AveMaria.yar b/yara/rules/Windows_Trojan_AveMaria.yar
new file mode 100644
index 00000000..5d06f66a
--- /dev/null
+++ b/yara/rules/Windows_Trojan_AveMaria.yar
@@ -0,0 +1,31 @@
+rule Windows_Trojan_AveMaria_31d2bce9 {
+    meta:
+        id = "31d2bce9-3266-447b-9a2d-57cf11a0ff1f"
+        fingerprint = "8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0"
+        creation_date = "2021-05-30"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.AveMaria"
+        reference_sample = "5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q " ascii fullword
+        $a2 = "SMTP Password" wide fullword
+        $a3 = "select signon_realm, origin_url, username_value, password_value from logins" ascii fullword
+        $a4 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" wide fullword
+        $a5 = "for /F \"usebackq tokens=*\" %%A in (\"" wide fullword
+        $a6 = "\\Torch\\User Data\\Default\\Login Data" wide fullword
+        $a7 = "/n:%temp%\\ellocnak.xml" wide fullword
+        $a8 = "\"os_crypt\":{\"encrypted_key\":\"" wide fullword
+        $a9 = "Hey I'm Admin" wide fullword
+        $a10 = "\\logins.json" wide fullword
+        $a11 = "Accounts\\Account.rec0" ascii fullword
+        $a12 = "warzone160" ascii fullword
+        $a13 = "Ave_Maria Stealer OpenSource github Link: https://github.com/syohex/java-simple-mine-sweeper" wide fullword
+    condition:
+        8 of ($a*)
+}
+
diff --git a/yara/rules/Windows_Trojan_Azorult.yar b/yara/rules/Windows_Trojan_Azorult.yar
new file mode 100644
index 00000000..7260fbb8
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Azorult.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_Azorult_38fce9ea {
+    meta:
+        id = "38fce9ea-a94e-49d3-8eef-96fe06ad27f8"
+        fingerprint = "0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a"
+        creation_date = "2021-08-05"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Azorult"
+        reference_sample = "405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "/c %WINDIR%\\system32\\timeout.exe 3 & del \"" wide fullword
+        $a2 = "%APPDATA%\\.purple\\accounts.xml" wide fullword
+        $a3 = "%TEMP%\\curbuf.dat" wide fullword
+        $a4 = "PasswordsList.txt" ascii fullword
+        $a5 = "Software\\Valve\\Steam" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Babylonrat.yar b/yara/rules/Windows_Trojan_Babylonrat.yar
new file mode 100644
index 00000000..584f485f
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Babylonrat.yar
@@ -0,0 +1,22 @@
+rule Windows_Trojan_Babylonrat_0f66e73b {
+    meta:
+        id = "0f66e73b-7824-46b6-a9e6-5abf018c9ffa"
+        fingerprint = "3998824e381f51aaa2c81c12d4c05157c642d8aef39982e35fa3e124191640ea"
+        creation_date = "2021-09-02"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Babylonrat"
+        reference_sample = "4278064ec50f87bb0471053c068b13955ed9d599434e687a64bf2060438a7511"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "BabylonRAT" wide fullword
+        $a2 = "Babylon RAT Client" wide fullword
+        $a3 = "ping 0 & del \"" wide fullword
+        $a4 = "\\%Y %m %d - %I %M %p" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Bazar.yar b/yara/rules/Windows_Trojan_Bazar.yar
new file mode 100644
index 00000000..8f8308f8
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Bazar.yar
@@ -0,0 +1,76 @@
+rule Windows_Trojan_Bazar_711d59f6 {
+    meta:
+        id = "711d59f6-6e8a-485d-b362-4c1bf1bda66e"
+        fingerprint = "a9e78b4e39f4acaba86c2595db67fcdcd40d1af611d41a023bd5d8ca9804efa4"
+        creation_date = "2021-06-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Bazar"
+        reference_sample = "f29253139dab900b763ef436931213387dc92e860b9d3abb7dcd46040ac28a0e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 0F 94 C3 41 0F 95 C0 83 FA 0A 0F 9C C1 83 FA 09 0F 9F C2 31 C0 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Bazar_9dddea36 {
+    meta:
+        id = "9dddea36-1345-434b-8ce6-54d2eab39616"
+        fingerprint = "e322e36006cc017d5d5d9887c89b180c5070dbe5a9efd9fb7ae15cda5b726d6c"
+        creation_date = "2021-06-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Bazar"
+        reference_sample = "63df43daa61f9a0fbea2e5409b8f0063f7af3363b6bc8d6984ce7e90c264727d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { C4 10 5B 5F 5E C3 41 56 56 57 55 53 48 83 EC 18 48 89 C8 48 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Bazar_3a2cc53b {
+    meta:
+        id = "3a2cc53b-4f73-41f9-aabd-08b8755ba44c"
+        fingerprint = "f146d4fff29011acf595f2cba10ed7c3ce6ba07fbda0864d746f8e6355f91add"
+        creation_date = "2021-06-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Bazar"
+        reference_sample = "b057eb94e711995fd5fd6c57aa38a243575521b11b98734359658a7a9829b417"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 48 63 41 3C 45 33 ED 44 8B FA 48 8B F9 8B 9C 08 88 00 00 00 44 8B A4 08 8C 00 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Bazar_de8d625a {
+    meta:
+        id = "de8d625a-8f85-47b7-bcad-e3cc012e4654"
+        fingerprint = "17b2de5803589634fd7fb4643730fbebfa037c4d0b66be838a1c78af22da0228"
+        creation_date = "2022-01-14"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Bazar"
+        reference_sample = "1ad9ac4785b82c8bfa355c7343b9afc7b1f163471c41671ea2f9152a1b550f0c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 49 8B F0 48 8B FA 48 8B D9 48 85 D2 74 61 4D 85 C0 74 5C 48 39 11 75 06 4C 39 41 08 74 2B 48 8B 49 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Beam.yar b/yara/rules/Windows_Trojan_Beam.yar
new file mode 100644
index 00000000..1628845e
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Beam.yar
@@ -0,0 +1,41 @@
+rule Windows_Trojan_Beam_e41b243a {
+    meta:
+        id = "e41b243a-020f-485e-b4bc-4db9d593e7af"
+        fingerprint = "0863f858fcc03d9b5994e73ee3b9daf64b57b0eecd67b718eafa2ed162cf7878"
+        creation_date = "2021-12-07"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Beam"
+        reference_sample = "233a1f1dcbb679d31dab7744358b434cccabfc752baf53ba991388ced098f7c8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 69 70 22 3A 22 28 5B 30 2D 39 2E 5D 2B 29 }
+        $a2 = { 63 6F 75 6E 74 72 79 5F 63 6F 64 65 22 3A 22 28 5C 77 2A 29 }
+        $a3 = { 20 2F 66 20 26 20 65 72 61 73 65 20 }
+        $a4 = "\\BeamWinHTTP2\\Release\\BeamWinHTTP.pdb"
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Beam_5a951d13 {
+    meta:
+        id = "5a951d13-9568-4a5f-bda3-645143bc16a1"
+        fingerprint = "e3de6b47e563ebfd735cdd56f5b4077a8923026520ecca0628c5704272ea52bb"
+        creation_date = "2021-12-07"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Beam"
+        reference_sample = "233a1f1dcbb679d31dab7744358b434cccabfc752baf53ba991388ced098f7c8"
+        severity = 99
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 24 40 8B CE 2B C8 3B CA 0F 42 D1 83 FF 10 8D 4C 24 18 0F 43 CB }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Bitrat.yar b/yara/rules/Windows_Trojan_Bitrat.yar
new file mode 100644
index 00000000..a01a5719
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Bitrat.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_Bitrat_34bd6c83 {
+    meta:
+        id = "34bd6c83-9a71-43d5-b0b1-1646a8fb66e8"
+        fingerprint = "bc4a5fad1810ad971277a455030eed3377901a33068bb994e235346cfe5a524f"
+        creation_date = "2021-06-13"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Bitrat"
+        reference_sample = "37f70ae0e4e671c739d402c00f708761e98b155a1eefbedff1236637c4b7690a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "crd_logins_report" ascii fullword
+        $a2 = "drives_get" ascii fullword
+        $a3 = "files_get" ascii fullword
+        $a4 = "shell_stop" ascii fullword
+        $a5 = "hvnc_start_ie" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_BlackShades.yar b/yara/rules/Windows_Trojan_BlackShades.yar
new file mode 100644
index 00000000..57792081
--- /dev/null
+++ b/yara/rules/Windows_Trojan_BlackShades.yar
@@ -0,0 +1,45 @@
+rule Windows_Trojan_BlackShades_9d095c44 {
+    meta:
+        id = "9d095c44-5047-453e-8435-f30de94565e6"
+        fingerprint = "be7d4c8200c293c3c8046d9f87b0d127ff051679ae1caeab12c533ea4309a1fc"
+        creation_date = "2022-02-28"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.BlackShades"
+        reference_sample = "e58e352edaa8ae7f95ab840c53fcaf7f14eb640df9223475304788533713c722"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "*\\AD:\\Blackshades Project\\bs_net\\server\\server.vbp" wide fullword
+        $a2 = "@*\\AD:\\Blackshades Project\\bs_net\\server\\server.vbp" wide fullword
+        $a3 = "D:\\Blackshades Project\\bs_net\\loginserver\\msvbvm60.dll\\3" ascii fullword
+        $b1 = "modSniff" ascii fullword
+        $b2 = "UDPFlood" ascii fullword
+        $b3 = "\\nir_cmd.bss speak text " wide fullword
+        $b4 = "\\pws_chro.bss" wide fullword
+        $b5 = "tmrLiveLogger" ascii fullword
+    condition:
+        1 of ($a*) or all of ($b*)
+}
+
+rule Windows_Trojan_BlackShades_be382dac {
+    meta:
+        id = "be382dac-6a6f-43e4-86bb-c62f0db9b43a"
+        fingerprint = "e7031c42e51758358db32d8eba95f43be7dd5c4b57e6f9a76f0c3b925eae4e43"
+        creation_date = "2022-02-28"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.BlackShades"
+        reference_sample = "e58e352edaa8ae7f95ab840c53fcaf7f14eb640df9223475304788533713c722"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 09 0E 4C 09 10 54 09 0E 4C 09 10 54 09 0E 4C 09 10 54 09 10 54 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Blister.yar b/yara/rules/Windows_Trojan_Blister.yar
new file mode 100644
index 00000000..ce89524b
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Blister.yar
@@ -0,0 +1,41 @@
+rule Windows_Trojan_Blister_cb99a1df {
+    meta:
+        id = "cb99a1df-756b-46fe-b657-63b4be2c0664"
+        fingerprint = "7a7e189ed42019636ffccc06d61e18f2aa17bc3d43d08d50bb77c3258bc1a9a4"
+        creation_date = "2021-12-21"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Blister"
+        reference_sample = "0a7778cf6f9a1bd894e89f282f2e40f9d6c9cd4b72be97328e681fe32a1b1a00"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 8D 45 DC 89 5D EC 50 6A 04 8D 45 F0 50 8D 45 EC 50 6A FF FF D7 }
+        $a2 = { 75 F7 39 4D FC 0F 85 F3 00 00 00 64 A1 30 00 00 00 53 57 89 75 }
+        $b1 = { 78 03 C3 8B 48 20 8B 50 1C 03 CB 8B 78 24 03 D3 8B 40 18 03 FB 89 4D F8 89 55 E0 89 45 E4 85 C0 74 3E 8B 09 8B D6 03 CB 8A 01 84 C0 74 17 C1 C2 09 0F BE C0 03 D0 41 8A 01 84 C0 75 F1 81 FA B2 17 EB 41 74 27 8B 4D F8 83 C7 02 8B 45 F4 83 C1 04 40 89 4D F8 89 45 F4 0F B7 C0 3B 45 E4 72 C2 8B FE 8B 45 04 B9 }
+    condition:
+        any of them
+}
+
+rule Windows_Trojan_Blister_9d757838 {
+    meta:
+        id = "9d757838-ebaa-4ecf-b927-ac0f4848c9cb"
+        fingerprint = "4ef2e22d0006b127b253d02073cde0d805d22d8696562feabc94020e287e2eb2"
+        creation_date = "2022-04-26"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.Blister"
+        reference_sample = "863de84a39c9f741d8103db83b076695d0d10a7384e4e3ba319c05a6018d9737"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 65 48 8B 04 25 60 00 00 00 44 0F B7 DB 48 8B 48 ?? 48 8B 41 ?? C7 45 48 ?? ?? ?? ?? 4C 8B 40 ?? 49 63 40 ?? }
+        $a2 = { B9 FF FF FF 7F 89 5D 40 8B C1 44 8D 63 ?? F0 44 01 65 40 49 2B C4 75 ?? 39 4D 40 0F 85 ?? ?? ?? ?? 65 48 8B 04 25 60 00 00 00 44 0F B7 DB }
+    condition:
+        any of them
+}
+
diff --git a/yara/rules/Windows_Trojan_BruteRatel.yar b/yara/rules/Windows_Trojan_BruteRatel.yar
new file mode 100644
index 00000000..3c2b7682
--- /dev/null
+++ b/yara/rules/Windows_Trojan_BruteRatel.yar
@@ -0,0 +1,49 @@
+rule Windows_Trojan_BruteRatel_1916686d {
+    meta:
+        id = "1916686d-4821-4e5a-8290-58336d01997f"
+        fingerprint = "a9924347d324c3455d4e50cbbae940c5af36b41bcd2d9f28dd6b3af6d6489484"
+        creation_date = "2022-06-23"
+        last_modified = "2022-07-18"
+        threat_name = "Windows.Trojan.BruteRatel"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "[+] Spoofed PPID => %lu" wide fullword
+        $a2 = "[-] Child process not set" wide fullword
+        $a3 = "[+] Crisis Monitor: Already Running" wide fullword
+        $a4 = "[+] Screenshot downloaded: %S" wide fullword
+        $a5 = "s[-] Duplicate listener: %S" wide fullword
+        $a6 = "%02d%02d%d_%02d%02d%2d%02d.png" wide fullword
+        $b1 = { 48 83 EC ?? 48 8D 35 ?? ?? ?? ?? 4C 63 E2 31 D2 48 8D 7C 24 ?? 48 89 CB 4D 89 E0 4C 89 E5 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 A4 31 F6 BF ?? ?? ?? ?? 39 F5 7E ?? E8 ?? ?? ?? ?? 99 F7 FF 48 63 D2 8A 44 14 ?? 88 04 33 48 FF C6 EB ?? }
+    condition:
+        4 of ($a*) or 1 of ($b*)
+}
+
+rule Windows_Trojan_BruteRatel_9b267f96 {
+    meta:
+        id = "9b267f96-11b3-48e6-9d38-ecfd72cb7e3e"
+        fingerprint = "f20cbaf39dc68460a2612298a5df9efdf5bdb152159d38f4696aedf35862bbb6"
+        creation_date = "2022-06-23"
+        last_modified = "2022-07-18"
+        threat_name = "Windows.Trojan.BruteRatel"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "calAllocPH" ascii fullword
+        $a2 = "lizeCritPH" ascii fullword
+        $a3 = "BadgerPH" ascii fullword
+        $a4 = "VirtualPPH" ascii fullword
+        $a5 = "TerminatPH" ascii fullword
+        $a6 = "ickCountPH" ascii fullword
+        $a7 = "SeDebugPH" ascii fullword
+        $b1 = { 50 48 B8 E2 6A 15 64 56 22 0D 7E 50 48 B8 18 2C 05 7F BB 78 D7 27 50 48 B8 C9 EC BC 3D 84 54 9A 62 50 48 B8 A1 E1 3C 4E AF 2B F6 B1 50 48 B8 2E E6 7B A0 94 CA 9D F0 50 48 B8 61 52 80 AA 1A B6 4B 0E 50 48 B8 B2 13 11 5A 28 81 ED 60 50 48 B8 20 DE A9 34 89 08 C8 32 50 48 B8 9B DC C1 FF 79 CE 5B F5 50 48 B8 FD 57 3F 4C C7 D3 7A 21 50 48 B8 70 B8 63 0F AB 19 BF 1C 50 48 B8 48 F2 1B 72 1E 2A C6 8A 50 48 B8 E3 FA 38 E9 1D 76 E0 6F 50 48 B8 97 AD 75 }
+    condition:
+        3 of ($a*) or 1 of ($b*)
+}
+
diff --git a/yara/rules/Windows_Trojan_Buerloader.yar b/yara/rules/Windows_Trojan_Buerloader.yar
new file mode 100644
index 00000000..e6296a47
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Buerloader.yar
@@ -0,0 +1,24 @@
+rule Windows_Trojan_Buerloader_c8a60f46 {
+    meta:
+        id = "c8a60f46-d49a-4566-845b-675fb55c201c"
+        fingerprint = "346233f4b1306eb574b4063d3b47f90e65a81ad7fe1c74d2a68640d99d456c4c"
+        creation_date = "2021-08-16"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Buerloader"
+        reference_sample = "3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "User-Agent: Host:  HTTP/1.1" ascii fullword
+        $a2 = "ServerHelloPayloadrandom" ascii fullword
+        $a3 = "Bad JSON in payload" ascii fullword
+        $a4 = { 7B 22 68 65 6C 6C 6F 22 3A 20 22 77 6F 72 6C 64 22 7D 48 54 54 50 2F 31 2E 31 20 33 30 31 20 46 6F 75 6E 64 }
+        $a5 = "PayloadU24UnknownExtensiontyp" ascii fullword
+        $a6 = " NTDLL.DLL" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Bughatch.yar b/yara/rules/Windows_Trojan_Bughatch.yar
new file mode 100644
index 00000000..54847577
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Bughatch.yar
@@ -0,0 +1,48 @@
+rule Windows_Trojan_Bughatch_21269be4 {
+    meta:
+        id = "21269be4-cff1-42b9-be6b-f6a6bde40bff"
+        fingerprint = "1ff55288554133690d96161c05a047ffba47778ff27d32ff656b3a194d6c26e0"
+        creation_date = "2022-05-09"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.Bughatch"
+        reference_sample = "b495456a2239f3ba48e43ef295d6c00066473d6a7991051e1705a48746e8051f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 8B 45 ?? 33 D2 B9 A7 00 00 00 F7 F1 85 D2 75 ?? B8 01 00 00 00 EB 33 C0 }
+        $a2 = { 8B 45 ?? 0F B7 48 04 81 F9 64 86 00 00 75 3B 8B 55 ?? 0F B7 42 16 25 00 20 00 00 ?? ?? B8 06 00 00 00 EB ?? }
+        $b1 = { 69 4D 10 FD 43 03 00 81 C1 C3 9E 26 00 89 4D 10 8B 55 FC 8B 45 F8 0F B7 0C 50 8B 55 10 C1 EA 10 81 E2 FF FF 00 00 33 CA 8B 45 FC 8B 55 F8 66 89 0C 42 }
+    condition:
+        any of them
+}
+
+rule Windows_Trojan_Bughatch_98f3c0be {
+    meta:
+        id = "98f3c0be-1327-4ba2-9320-c1a9ce90b4a4"
+        fingerprint = "1ac6b1285e1925349e4e578de0b2f1cf8a008cddbb1a20eb8768b1fcc4b0c8d3"
+        creation_date = "2022-05-09"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.Bughatch"
+        reference_sample = "b495456a2239f3ba48e43ef295d6c00066473d6a7991051e1705a48746e8051f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "-windowstyle hidden -executionpolicy bypass -file"
+        $a2 = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"
+        $a3 = "ReflectiveLoader"
+        $a4 = "\\Sysnative\\"
+        $a5 = "TEMP%u.CMD"
+        $a6 = "TEMP%u.PS1"
+        $a7 = "\\TEMP%d.%s"
+        $a8 = "NtSetContextThread"
+        $a9 = "NtResumeThread"
+    condition:
+        6 of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Bumblebee.yar b/yara/rules/Windows_Trojan_Bumblebee.yar
new file mode 100644
index 00000000..fdc3a9e8
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Bumblebee.yar
@@ -0,0 +1,45 @@
+rule Windows_Trojan_Bumblebee_35f50bea {
+    meta:
+        id = "35f50bea-c497-4cc6-b915-8ad3aca7bee6"
+        fingerprint = "f2e07a9b7d143ca13852f723e7d0bd55365d6f8b5d9315b7e24b7f1101010820"
+        creation_date = "2022-04-28"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.Bumblebee"
+        reference_sample = "9fff05a5aa9cbbf7d37bc302d8411cbd63fb3a28dc6f5163798ae899b9edcda6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 43 28 45 33 D2 4D 8D 0C 00 44 88 54 24 20 66 48 0F 7E C9 66 0F }
+        $a2 = { 31 DA 48 31 C7 45 ?? C9 B9 E8 03 C7 45 ?? 00 00 BA 01 C7 45 ?? 00 00 00 48 C7 45 ?? B8 88 77 66 C7 45 ?? 55 44 33 22 C7 45 ?? 11 FF D0 EB C6 45 }
+    condition:
+        any of them
+}
+
+rule Windows_Trojan_Bumblebee_70bed4f3 {
+    meta:
+        id = "70bed4f3-f515-4186-ac6c-e9db72b8a95a"
+        fingerprint = "016477598ce022cc75f591d1c72535a3353ecc4e888642e72aa29476464a8c2f"
+        creation_date = "2022-04-28"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.Bumblebee"
+        reference_sample = "9fff05a5aa9cbbf7d37bc302d8411cbd63fb3a28dc6f5163798ae899b9edcda6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Checking Virtual PC processes %s " wide fullword
+        $a2 = "SELECT * FROM Win32_ComputerSystemProduct" ascii fullword
+        $a3 = "Injection-Date" ascii fullword
+        $a4 = " -Command \"Wait-Process -Id " ascii fullword
+        $a5 = "%WINDIR%\\System32\\wscript.exe" wide fullword
+        $a6 = "objShell.Run \"rundll32.exe my_application_path"
+        $a7 = "Checking reg key HARDWARE\\Description\\System - %s is set to %s" wide fullword
+    condition:
+        5 of them
+}
+
diff --git a/yara/rules/Windows_Trojan_CaesarKbd.yar b/yara/rules/Windows_Trojan_CaesarKbd.yar
new file mode 100644
index 00000000..aaed4b2a
--- /dev/null
+++ b/yara/rules/Windows_Trojan_CaesarKbd.yar
@@ -0,0 +1,19 @@
+rule Windows_Trojan_CaesarKbd_32bb198b {
+    meta:
+        id = "32bb198b-ec03-4628-8e9b-bc36c2525ec7"
+        fingerprint = "54ed92761bb619ae4dcec9c27127d6c2a74a575916249cd5db24b8deb2ee0588"
+        creation_date = "2022-04-04"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.CaesarKbd"
+        reference_sample = "d4335f4189240a3bcafa05fab01f0707cc8e3dd7a2998af734c24916d9e37ca8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $str1 = "CaesarKbd_IOCtrl"
+    condition:
+        int16(uint32(0x3C) + 0x5c) == 0x0001 and $str1
+}
+
diff --git a/yara/rules/Windows_Trojan_Carberp.yar b/yara/rules/Windows_Trojan_Carberp.yar
new file mode 100644
index 00000000..496ff94c
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Carberp.yar
@@ -0,0 +1,22 @@
+rule Windows_Trojan_Carberp_d6de82ae {
+    meta:
+        id = "d6de82ae-9846-40cb-925d-e0a371e1c44c"
+        fingerprint = "7ce34f1000749a938b78508c93371d3339cd49f73eeec36b25da13c9d129b85c"
+        creation_date = "2021-02-07"
+        last_modified = "2021-08-23"
+        description = "Identifies VNC module from the leaked Carberp source code. This could exist in other malware families."
+        threat_name = "Windows.Trojan.Carberp"
+        reference = "https://github.com/m0n0ph1/malware-1/blob/master/Carberp%20Botnet/source%20-%20absource/pro/all%20source/hvnc_dll/HVNC%20Lib/vnc/xvnc.h#L342"
+        reference_sample = "f98fadb6feab71930bd5c08e85153898d686cc96c84fe349c00bf6d482de9b53"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = ".NET CLR Networking_Perf_Library_Lock_PID_0" ascii wide fullword
+        $a2 = "FakeVNCWnd" ascii wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Clipbanker.yar b/yara/rules/Windows_Trojan_Clipbanker.yar
new file mode 100644
index 00000000..18f02300
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Clipbanker.yar
@@ -0,0 +1,84 @@
+rule Windows_Trojan_Clipbanker_7efaef9f {
+    meta:
+        id = "7efaef9f-51cd-4fea-a48d-fa9d39cb735e"
+        fingerprint = "fe0ec44f8707cd03f845dbea4ff5bb1b699db1b69b75f0365168a75cc8bb68a3"
+        creation_date = "2022-02-28"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Clipbanker"
+        reference_sample = "02b06acb113c31f5a2ac9c99f9614e0fab0f78afc5ae872e46bae139c2c9b1f6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "C:\\Users\\youar\\Desktop\\Allcome\\Source code\\Build\\Release\\Build.pdb" ascii fullword
+        $b1 = "https://steamcommunity.com/tradeoffer" ascii fullword
+        $b2 = "/Create /tn NvTmRep_CrashReport3_{B2FE1952-0186} /sc MINUTE /tr %s" ascii fullword
+        $b3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0" ascii fullword
+        $b4 = "ProcessHacker.exe" ascii fullword
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Clipbanker_b60a50b8 {
+    meta:
+        id = "b60a50b8-91a4-49a7-bd05-fa4cc1dee1ac"
+        fingerprint = "097bb88d8482a4915c19affc82750c7ee225b89f2611ea654cfc3c044aae0738"
+        creation_date = "2022-02-28"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Clipbanker"
+        reference_sample = "02b06acb113c31f5a2ac9c99f9614e0fab0f78afc5ae872e46bae139c2c9b1f6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 40 66 0F F8 C1 0F 11 40 A0 0F 10 84 15 08 FF FF FF 83 C2 40 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Clipbanker_f9f9e79d {
+    meta:
+        id = "f9f9e79d-ce71-4b6c-83e0-ac6e06252c25"
+        fingerprint = "ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd"
+        creation_date = "2022-04-23"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.Clipbanker"
+        reference_sample = "0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Clipbanker_787b130b {
+    meta:
+        id = "787b130b-6382-42f0-8822-fce457fa940d"
+        fingerprint = "15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699"
+        creation_date = "2022-04-24"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.Clipbanker"
+        reference_sample = "0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $mutex_setup = { 55 8B EC 83 EC ?? 53 56 57 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 6A ?? FF 15 ?? ?? ?? ?? }
+        $new_line_check = { 0F B7 C2 89 45 ?? 0F B7 C2 83 F8 0A 74 ?? BA 0D 0A 00 00 66 3B C2 74 ?? 83 F8 0D 74 ?? 83 F8 20 74 ?? 83 F8 09 74 ?? }
+        $regex1 = { 0F B7 C2 89 45 ?? 0F B7 C2 83 F8 0A 74 ?? BA 0D 0A 00 00 66 3B C2 74 ?? 83 F8 0D 74 ?? 83 F8 20 74 ?? 83 F8 09 74 ?? }
+        $regex2 = { 6A 34 59 66 39 0E 75 ?? 0F B7 46 ?? 6A 30 5A 83 F8 41 74 ?? 83 F8 42 74 ?? 66 3B C2 74 ?? 83 F8 31 74 ?? 83 F8 32 74 ?? 83 F8 33 74 ?? 66 3B C1 74 ?? 83 F8 35 74 ?? 83 F8 36 74 ?? 83 F8 37 74 ?? 83 F8 38 74 ?? 83 F8 39 75 ?? }
+        $regex3 = { 56 8B F1 56 FF 15 ?? ?? ?? ?? 83 F8 5F 0F 85 ?? ?? ?? ?? 6A 38 59 66 39 0E 75 ?? 0F B7 46 ?? 6A 30 5A 83 F8 41 74 ?? 83 F8 42 74 ?? 66 3B C2 74 ?? 83 F8 31 74 ?? 83 F8 32 74 ?? 83 F8 33 74 ?? 83 F8 34 74 ?? 83 F8 35 74 ?? 83 F8 36 74 ?? 83 F8 37 74 ?? 66 3B C1 74 ?? 83 F8 39 75 ?? }
+    condition:
+        any of them
+}
+
diff --git a/yara/rules/Windows_Trojan_CobaltStrike.yar b/yara/rules/Windows_Trojan_CobaltStrike.yar
new file mode 100644
index 00000000..08443ed9
--- /dev/null
+++ b/yara/rules/Windows_Trojan_CobaltStrike.yar
@@ -0,0 +1,961 @@
+rule Windows_Trojan_CobaltStrike_c851687a {
+    meta:
+        id = "c851687a-aac6-43e7-a0b6-6aed36dcf12e"
+        fingerprint = "70224e28a223d09f2211048936beb9e2d31c0312c97a80e22c85e445f1937c10"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies UAC Bypass module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "bypassuac.dll" ascii fullword
+        $a2 = "bypassuac.x64.dll" ascii fullword
+        $a3 = "\\\\.\\pipe\\bypassuac" ascii fullword
+        $b1 = "\\System32\\sysprep\\sysprep.exe" wide fullword
+        $b2 = "[-] Could not write temp DLL to '%S'" ascii fullword
+        $b3 = "[*] Cleanup successful" ascii fullword
+        $b4 = "\\System32\\cliconfg.exe" wide fullword
+        $b5 = "\\System32\\eventvwr.exe" wide fullword
+        $b6 = "[-] %S ran too long. Could not terminate the process." ascii fullword
+        $b7 = "[*] Wrote hijack DLL to '%S'" ascii fullword
+        $b8 = "\\System32\\sysprep\\" wide fullword
+        $b9 = "[-] COM initialization failed." ascii fullword
+        $b10 = "[-] Privileged file copy failed: %S" ascii fullword
+        $b11 = "[-] Failed to start %S: %d" ascii fullword
+        $b12 = "ReflectiveLoader"
+        $b13 = "[-] '%S' exists in DLL hijack location." ascii fullword
+        $b14 = "[-] Cleanup failed. Remove: %S" ascii fullword
+        $b15 = "[+] %S ran and exited." ascii fullword
+        $b16 = "[+] Privileged file copy success! %S" ascii fullword
+    condition:
+        2 of ($a*) or 10 of ($b*)
+}
+
+rule Windows_Trojan_CobaltStrike_0b58325e {
+    meta:
+        id = "0b58325e-2538-434d-9a2c-26e2c32db039"
+        fingerprint = "8ecd5bdce925ae5d4f90cecb9bc8c3901b54ba1c899a33354bcf529eeb2485d4"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Keylogger module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "keylogger.dll" ascii fullword
+        $a2 = "keylogger.x64.dll" ascii fullword
+        $a3 = "\\\\.\\pipe\\keylogger" ascii fullword
+        $a4 = "%cE=======%c" ascii fullword
+        $a5 = "[unknown: %02X]" ascii fullword
+        $b1 = "ReflectiveLoader"
+        $b2 = "%c2%s%c" ascii fullword
+        $b3 = "[numlock]" ascii fullword
+        $b4 = "%cC%s" ascii fullword
+        $b5 = "[backspace]" ascii fullword
+        $b6 = "[scroll lock]" ascii fullword
+        $b7 = "[control]" ascii fullword
+        $b8 = "[left]" ascii fullword
+        $b9 = "[page up]" ascii fullword
+        $b10 = "[page down]" ascii fullword
+        $b11 = "[prtscr]" ascii fullword
+        $b12 = "ZRich9" ascii fullword
+        $b13 = "[ctrl]" ascii fullword
+        $b14 = "[home]" ascii fullword
+        $b15 = "[pause]" ascii fullword
+        $b16 = "[clear]" ascii fullword
+    condition:
+        1 of ($a*) and 14 of ($b*)
+}
+
+rule Windows_Trojan_CobaltStrike_2b8cddf8 {
+    meta:
+        id = "2b8cddf8-ca7a-4f85-be9d-6d8534d0482e"
+        fingerprint = "0d7d28d79004ca61b0cfdcda29bd95e3333e6fc6e6646a3f6ba058aa01bee188"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies dll load module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\dllload.x64.o" ascii fullword
+        $a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\dllload.x86.o" ascii fullword
+        $b1 = "__imp_BeaconErrorDD" ascii fullword
+        $b2 = "__imp_BeaconErrorNA" ascii fullword
+        $b3 = "__imp_BeaconErrorD" ascii fullword
+        $b4 = "__imp_BeaconDataInt" ascii fullword
+        $b5 = "__imp_KERNEL32$WriteProcessMemory" ascii fullword
+        $b6 = "__imp_KERNEL32$OpenProcess" ascii fullword
+        $b7 = "__imp_KERNEL32$CreateRemoteThread" ascii fullword
+        $b8 = "__imp_KERNEL32$VirtualAllocEx" ascii fullword
+        $c1 = "__imp__BeaconErrorDD" ascii fullword
+        $c2 = "__imp__BeaconErrorNA" ascii fullword
+        $c3 = "__imp__BeaconErrorD" ascii fullword
+        $c4 = "__imp__BeaconDataInt" ascii fullword
+        $c5 = "__imp__KERNEL32$WriteProcessMemory" ascii fullword
+        $c6 = "__imp__KERNEL32$OpenProcess" ascii fullword
+        $c7 = "__imp__KERNEL32$CreateRemoteThread" ascii fullword
+        $c8 = "__imp__KERNEL32$VirtualAllocEx" ascii fullword
+    condition:
+        1 of ($a*) or 5 of ($b*) or 5 of ($c*)
+}
+
+rule Windows_Trojan_CobaltStrike_59b44767 {
+    meta:
+        id = "59b44767-c9a5-42c0-b177-7fe49afd7dfb"
+        fingerprint = "882886a282ec78623a0d3096be3d324a8a1b8a23bcb88ea0548df2fae5e27aa5"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies getsystem module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\getsystem.x86.o" ascii fullword
+        $a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\getsystem.x64.o" ascii fullword
+        $b1 = "getsystem failed." ascii fullword
+        $b2 = "_isSystemSID" ascii fullword
+        $b3 = "__imp__NTDLL$NtQuerySystemInformation@16" ascii fullword
+        $c1 = "getsystem failed." ascii fullword
+        $c2 = "$pdata$isSystemSID" ascii fullword
+        $c3 = "$unwind$isSystemSID" ascii fullword
+        $c4 = "__imp_NTDLL$NtQuerySystemInformation" ascii fullword
+    condition:
+        1 of ($a*) or 3 of ($b*) or 3 of ($c*)
+}
+
+rule Windows_Trojan_CobaltStrike_7efd3c3f {
+    meta:
+        id = "7efd3c3f-1104-4b46-9d1e-dc2c62381b8c"
+        fingerprint = "9e7c7c9a7436f5ee4c27fd46d6f06e7c88f4e4d1166759573cedc3ed666e1838"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Hashdump module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 70
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "hashdump.dll" ascii fullword
+        $a2 = "hashdump.x64.dll" ascii fullword
+        $a3 = "\\\\.\\pipe\\hashdump" ascii fullword
+        $a4 = "ReflectiveLoader"
+        $a5 = "Global\\SAM" ascii fullword
+        $a6 = "Global\\FREE" ascii fullword
+        $a7 = "[-] no results." ascii fullword
+    condition:
+        4 of ($a*)
+}
+
+rule Windows_Trojan_CobaltStrike_6e971281 {
+    meta:
+        id = "6e971281-3ee3-402f-8a72-745ec8fb91fb"
+        fingerprint = "62d97cf73618a1b4d773d5494b2761714be53d5cda774f9a96eaa512c8d5da12"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Interfaces module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\interfaces.x64.o" ascii fullword
+        $a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\interfaces.x86.o" ascii fullword
+        $b1 = "__imp_BeaconFormatAlloc" ascii fullword
+        $b2 = "__imp_BeaconFormatPrintf" ascii fullword
+        $b3 = "__imp_BeaconOutput" ascii fullword
+        $b4 = "__imp_KERNEL32$LocalAlloc" ascii fullword
+        $b5 = "__imp_KERNEL32$LocalFree" ascii fullword
+        $b6 = "__imp_LoadLibraryA" ascii fullword
+        $c1 = "__imp__BeaconFormatAlloc" ascii fullword
+        $c2 = "__imp__BeaconFormatPrintf" ascii fullword
+        $c3 = "__imp__BeaconOutput" ascii fullword
+        $c4 = "__imp__KERNEL32$LocalAlloc" ascii fullword
+        $c5 = "__imp__KERNEL32$LocalFree" ascii fullword
+        $c6 = "__imp__LoadLibraryA" ascii fullword
+    condition:
+        1 of ($a*) or 4 of ($b*) or 4 of ($c*)
+}
+
+rule Windows_Trojan_CobaltStrike_09b79efa {
+    meta:
+        id = "09b79efa-55d7-481d-9ee0-74ac5f787cef"
+        fingerprint = "04ef6555e8668c56c528dc62184331a6562f47652c73de732e5f7c82779f2fd8"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Invoke Assembly module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "invokeassembly.x64.dll" ascii fullword
+        $a2 = "invokeassembly.dll" ascii fullword
+        $b1 = "[-] Failed to get default AppDomain w/hr 0x%08lx" ascii fullword
+        $b2 = "[-] Failed to load the assembly w/hr 0x%08lx" ascii fullword
+        $b3 = "[-] Failed to create the runtime host" ascii fullword
+        $b4 = "[-] Invoke_3 on EntryPoint failed." ascii fullword
+        $b5 = "[-] CLR failed to start w/hr 0x%08lx" ascii fullword
+        $b6 = "ReflectiveLoader"
+        $b7 = ".NET runtime [ver %S] cannot be loaded" ascii fullword
+        $b8 = "[-] No .NET runtime found. :(" ascii fullword
+        $b9 = "[-] ICorRuntimeHost::GetDefaultDomain failed w/hr 0x%08lx" ascii fullword
+        $c1 = { FF 57 0C 85 C0 78 40 8B 45 F8 8D 55 F4 8B 08 52 50 }
+    condition:
+        1 of ($a*) or 3 of ($b*) or 1 of ($c*)
+}
+
+rule Windows_Trojan_CobaltStrike_6e77233e {
+    meta:
+        id = "6e77233e-7fb4-4295-823d-f97786c5d9c4"
+        fingerprint = "cef2949eae78b1c321c2ec4010749a5ac0551d680bd5eb85493fc88c5227d285"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Kerberos module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\kerberos.x64.o" ascii fullword
+        $a2 = "$unwind$command_kerberos_ticket_use" ascii fullword
+        $a3 = "$pdata$command_kerberos_ticket_use" ascii fullword
+        $a4 = "command_kerberos_ticket_use" ascii fullword
+        $a5 = "$pdata$command_kerberos_ticket_purge" ascii fullword
+        $a6 = "command_kerberos_ticket_purge" ascii fullword
+        $a7 = "$unwind$command_kerberos_ticket_purge" ascii fullword
+        $a8 = "$unwind$kerberos_init" ascii fullword
+        $a9 = "$unwind$KerberosTicketUse" ascii fullword
+        $a10 = "KerberosTicketUse" ascii fullword
+        $a11 = "$unwind$KerberosTicketPurge" ascii fullword
+        $b1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\kerberos.x86.o" ascii fullword
+        $b2 = "_command_kerberos_ticket_use" ascii fullword
+        $b3 = "_command_kerberos_ticket_purge" ascii fullword
+        $b4 = "_kerberos_init" ascii fullword
+        $b5 = "_KerberosTicketUse" ascii fullword
+        $b6 = "_KerberosTicketPurge" ascii fullword
+        $b7 = "_LsaCallKerberosPackage" ascii fullword
+    condition:
+        5 of ($a*) or 3 of ($b*)
+}
+
+rule Windows_Trojan_CobaltStrike_de42495a {
+    meta:
+        id = "de42495a-0002-466e-98b9-19c9ebb9240e"
+        fingerprint = "dab3c25809ec3af70df5a8a04a2efd4e8ecb13a4c87001ea699e7a1512973b82"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Mimikatz module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "\\\\.\\pipe\\mimikatz" ascii fullword
+        $b1 = "ERROR kuhl_m_dpapi_chrome ; Input 'Login Data' file needed (/in:\"%%localappdata%%\\Google\\Chrome\\User Data\\Default\\Login Da" wide
+        $b2 = "ERROR kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)" wide fullword
+        $b3 = "ERROR kuhl_m_lsadump_getUsersAndSamKey ; kuhl_m_lsadump_getSamKey KO" wide fullword
+        $b4 = "ERROR kuhl_m_lsadump_getComputerAndSyskey ; kull_m_registry_RegOpenKeyEx LSA KO" wide fullword
+        $b5 = "ERROR kuhl_m_lsadump_lsa_getHandle ; OpenProcess (0x%08x)" wide fullword
+        $b6 = "ERROR kuhl_m_lsadump_enumdomains_users ; SamLookupNamesInDomain: %08x" wide fullword
+        $b7 = "mimikatz(powershell) # %s" wide fullword
+        $b8 = "powershell_reflective_mimikatz" ascii fullword
+        $b9 = "mimikatz_dpapi_cache.ndr" wide fullword
+        $b10 = "mimikatz.log" wide fullword
+        $b11 = "ERROR mimikatz_doLocal" wide
+        $b12 = "mimikatz_x64.compressed" wide
+    condition:
+        1 of ($a*) and 7 of ($b*)
+}
+
+rule Windows_Trojan_CobaltStrike_72f68375 {
+    meta:
+        id = "72f68375-35ab-49cc-905d-15302389a236"
+        fingerprint = "ecc28f414b2c347722b681589da8529c6f3af0491845453874f8fd87c2ae86d7"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Netdomain module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\net_domain.x64.o" ascii fullword
+        $a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\net_domain.x86.o" ascii fullword
+        $b1 = "__imp_BeaconPrintf" ascii fullword
+        $b2 = "__imp_NETAPI32$NetApiBufferFree" ascii fullword
+        $b3 = "__imp_NETAPI32$DsGetDcNameA" ascii fullword
+        $c1 = "__imp__BeaconPrintf" ascii fullword
+        $c2 = "__imp__NETAPI32$NetApiBufferFree" ascii fullword
+        $c3 = "__imp__NETAPI32$DsGetDcNameA" ascii fullword
+    condition:
+        1 of ($a*) or 2 of ($b*) or 2 of ($c*)
+}
+
+rule Windows_Trojan_CobaltStrike_15f680fb {
+    meta:
+        id = "15f680fb-a04f-472d-a182-0b9bee111351"
+        fingerprint = "0ecb8e41c01bf97d6dea4cf6456b769c6dd2a037b37d754f38580bcf561e1d2c"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Netview module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "netview.x64.dll" ascii fullword
+        $a2 = "netview.dll" ascii fullword
+        $a3 = "\\\\.\\pipe\\netview" ascii fullword
+        $b1 = "Sessions for \\\\%s:" ascii fullword
+        $b2 = "Account information for %s on \\\\%s:" ascii fullword
+        $b3 = "Users for \\\\%s:" ascii fullword
+        $b4 = "Shares at \\\\%s:" ascii fullword
+        $b5 = "ReflectiveLoader" ascii fullword
+        $b6 = "Password changeable" ascii fullword
+        $b7 = "User's Comment" wide fullword
+        $b8 = "List of hosts for domain '%s':" ascii fullword
+        $b9 = "Password changeable" ascii fullword
+        $b10 = "Logged on users at \\\\%s:" ascii fullword
+    condition:
+        2 of ($a*) or 6 of ($b*)
+}
+
+rule Windows_Trojan_CobaltStrike_5b4383ec {
+    meta:
+        id = "5b4383ec-3c93-4e91-850e-d43cc3a86710"
+        fingerprint = "283d3d2924e92b31f26ec4fc6b79c51bd652fb1377b6985b003f09f8c3dba66c"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Portscan module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "portscan.x64.dll" ascii fullword
+        $a2 = "portscan.dll" ascii fullword
+        $a3 = "\\\\.\\pipe\\portscan" ascii fullword
+        $b1 = "(ICMP) Target '%s' is alive. [read %d bytes]" ascii fullword
+        $b2 = "(ARP) Target '%s' is alive. " ascii fullword
+        $b3 = "TARGETS!12345" ascii fullword
+        $b4 = "ReflectiveLoader" ascii fullword
+        $b5 = "%s:%d (platform: %d version: %d.%d name: %S domain: %S)" ascii fullword
+        $b6 = "Scanner module is complete" ascii fullword
+        $b7 = "pingpong" ascii fullword
+        $b8 = "PORTS!12345" ascii fullword
+        $b9 = "%s:%d (%s)" ascii fullword
+        $b10 = "PREFERENCES!12345" ascii fullword
+    condition:
+        2 of ($a*) or 6 of ($b*)
+}
+
+rule Windows_Trojan_CobaltStrike_91e08059 {
+    meta:
+        id = "91e08059-46a8-47d0-91c9-e86874951a4a"
+        fingerprint = "d8baacb58a3db00489827275ad6a2d007c018eaecbce469356b068d8a758634b"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Post Ex module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "postex.x64.dll" ascii fullword
+        $a2 = "postex.dll" ascii fullword
+        $a3 = "RunAsAdminCMSTP" ascii fullword
+        $a4 = "KerberosTicketPurge" ascii fullword
+        $b1 = "GetSystem" ascii fullword
+        $b2 = "HelloWorld" ascii fullword
+        $b3 = "KerberosTicketUse" ascii fullword
+        $b4 = "SpawnAsAdmin" ascii fullword
+        $b5 = "RunAsAdmin" ascii fullword
+        $b6 = "NetDomain" ascii fullword
+    condition:
+        2 of ($a*) or 4 of ($b*)
+}
+
+rule Windows_Trojan_CobaltStrike_ee756db7 {
+    meta:
+        id = "ee756db7-e177-41f0-af99-c44646d334f7"
+        fingerprint = "e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Attempts to detect Cobalt Strike based on strings found in BEACON"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+        $a2 = "%s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+        $a3 = "ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset." ascii fullword
+        $a4 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" ascii fullword
+        $a5 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/')" ascii fullword
+        $a6 = "%s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+        $a7 = "could not run command (w/ token) because of its length of %d bytes!" ascii fullword
+        $a8 = "%s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+        $a9 = "%s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+        $a10 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" ascii fullword
+        $a11 = "Could not open service control manager on %s: %d" ascii fullword
+        $a12 = "%d is an x64 process (can't inject x86 content)" ascii fullword
+        $a13 = "%d is an x86 process (can't inject x64 content)" ascii fullword
+        $a14 = "Failed to impersonate logged on user %d (%u)" ascii fullword
+        $a15 = "could not create remote thread in %d: %d" ascii fullword
+        $a16 = "%s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+        $a17 = "could not write to process memory: %d" ascii fullword
+        $a18 = "Could not create service %s on %s: %d" ascii fullword
+        $a19 = "Could not delete service %s on %s: %d" ascii fullword
+        $a20 = "Could not open process token: %d (%u)" ascii fullword
+        $a21 = "%s.1%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+        $a22 = "Could not start service %s on %s: %d" ascii fullword
+        $a23 = "Could not query service %s on %s: %d" ascii fullword
+        $a24 = "Could not connect to pipe (%s): %d" ascii fullword
+        $a25 = "%s.1%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+        $a26 = "could not spawn %s (token): %d" ascii fullword
+        $a27 = "could not open process %d: %d" ascii fullword
+        $a28 = "could not run %s as %s\\%s: %d" ascii fullword
+        $a29 = "%s.1%08x%08x%08x%08x.%x%x.%s" ascii fullword
+        $a30 = "kerberos ticket use failed:" ascii fullword
+        $a31 = "Started service %s on %s" ascii fullword
+        $a32 = "%s.1%08x%08x%08x.%x%x.%s" ascii fullword
+        $a33 = "I'm already in SMB mode" ascii fullword
+        $a34 = "could not spawn %s: %d" ascii fullword
+        $a35 = "could not open %s: %d" ascii fullword
+        $a36 = "%s.1%08x%08x.%x%x.%s" ascii fullword
+        $a37 = "Could not open '%s'" ascii fullword
+        $a38 = "%s.1%08x.%x%x.%s" ascii fullword
+        $a39 = "%s as %s\\%s: %d" ascii fullword
+        $a40 = "%s.1%x.%x%x.%s" ascii fullword
+        $a41 = "beacon.x64.dll" ascii fullword
+        $a42 = "%s on %s: %d" ascii fullword
+        $a43 = "www6.%x%x.%s" ascii fullword
+        $a44 = "cdn.%x%x.%s" ascii fullword
+        $a45 = "api.%x%x.%s" ascii fullword
+        $a46 = "%s (admin)" ascii fullword
+        $a47 = "beacon.dll" ascii fullword
+        $a48 = "%s%s: %s" ascii fullword
+        $a49 = "@%d.%s" ascii fullword
+        $a50 = "%02d/%02d/%02d %02d:%02d:%02d" ascii fullword
+        $a51 = "Content-Length: %d" ascii fullword
+    condition:
+        6 of ($a*)
+}
+
+rule Windows_Trojan_CobaltStrike_9c0d5561 {
+    meta:
+        id = "9c0d5561-5b09-44ae-8e8c-336dee606199"
+        fingerprint = "01d53fcdb320f0cd468a2521c3e96dcb0b9aa00e7a7a9442069773c6b3759059"
+        creation_date = "2021-03-23"
+        last_modified = "2021-10-04"
+        description = "Identifies PowerShell Runner module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "PowerShellRunner.dll" wide fullword
+        $a2 = "powershell.x64.dll" ascii fullword
+        $a3 = "powershell.dll" ascii fullword
+        $a4 = "\\\\.\\pipe\\powershell" ascii fullword
+        $b1 = "PowerShellRunner.PowerShellRunner" ascii fullword
+        $b2 = "Failed to invoke GetOutput w/hr 0x%08lx" ascii fullword
+        $b3 = "Failed to get default AppDomain w/hr 0x%08lx" ascii fullword
+        $b4 = "ICLRMetaHost::GetRuntime (v4.0.30319) failed w/hr 0x%08lx" ascii fullword
+        $b5 = "CustomPSHostUserInterface" ascii fullword
+        $b6 = "RuntimeClrHost::GetCurrentAppDomainId failed w/hr 0x%08lx" ascii fullword
+        $b7 = "ICorRuntimeHost::GetDefaultDomain failed w/hr 0x%08lx" ascii fullword
+        $c1 = { 8B 08 50 FF 51 08 8B 7C 24 1C 8D 4C 24 10 51 C7 }
+        $c2 = "z:\\devcenter\\aggressor\\external\\PowerShellRunner\\obj\\Release\\PowerShellRunner.pdb" ascii fullword
+    condition:
+        (1 of ($a*) and 4 of ($b*)) or 1 of ($c*)
+}
+
+rule Windows_Trojan_CobaltStrike_59ed9124 {
+    meta:
+        id = "59ed9124-bc20-4ea6-b0a7-63ee3359e69c"
+        fingerprint = "7823e3b98e55a83bf94b0f07e4c116dbbda35adc09fa0b367f8a978a80c2efff"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies PsExec module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\psexec_command.x64.o" ascii fullword
+        $a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\psexec_command.x86.o" ascii fullword
+        $b1 = "__imp_BeaconDataExtract" ascii fullword
+        $b2 = "__imp_BeaconDataParse" ascii fullword
+        $b3 = "__imp_BeaconDataParse" ascii fullword
+        $b4 = "__imp_BeaconDataParse" ascii fullword
+        $b5 = "__imp_ADVAPI32$StartServiceA" ascii fullword
+        $b6 = "__imp_ADVAPI32$DeleteService" ascii fullword
+        $b7 = "__imp_ADVAPI32$QueryServiceStatus" ascii fullword
+        $b8 = "__imp_ADVAPI32$CloseServiceHandle" ascii fullword
+        $c1 = "__imp__BeaconDataExtract" ascii fullword
+        $c2 = "__imp__BeaconDataParse" ascii fullword
+        $c3 = "__imp__BeaconDataParse" ascii fullword
+        $c4 = "__imp__BeaconDataParse" ascii fullword
+        $c5 = "__imp__ADVAPI32$StartServiceA" ascii fullword
+        $c6 = "__imp__ADVAPI32$DeleteService" ascii fullword
+        $c7 = "__imp__ADVAPI32$QueryServiceStatus" ascii fullword
+        $c8 = "__imp__ADVAPI32$CloseServiceHandle" ascii fullword
+    condition:
+        1 of ($a*) or 5 of ($b*) or 5 of ($c*)
+}
+
+rule Windows_Trojan_CobaltStrike_8a791eb7 {
+    meta:
+        id = "8a791eb7-dc0c-4150-9e5b-2dc21af0c77d"
+        fingerprint = "4967886ba5e663f2e2dc0631939308d7d8f2194a30590a230973e1b91bd625e1"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Registry module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\registry.x64.o" ascii fullword
+        $a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\registry.x86.o" ascii fullword
+        $b1 = "__imp_ADVAPI32$RegOpenKeyExA" ascii fullword
+        $b2 = "__imp_ADVAPI32$RegEnumKeyA" ascii fullword
+        $b3 = "__imp_ADVAPI32$RegOpenCurrentUser" ascii fullword
+        $b4 = "__imp_ADVAPI32$RegCloseKey" ascii fullword
+        $b5 = "__imp_BeaconFormatAlloc" ascii fullword
+        $b6 = "__imp_BeaconOutput" ascii fullword
+        $b7 = "__imp_BeaconFormatFree" ascii fullword
+        $b8 = "__imp_BeaconDataPtr" ascii fullword
+        $c1 = "__imp__ADVAPI32$RegOpenKeyExA" ascii fullword
+        $c2 = "__imp__ADVAPI32$RegEnumKeyA" ascii fullword
+        $c3 = "__imp__ADVAPI32$RegOpenCurrentUser" ascii fullword
+        $c4 = "__imp__ADVAPI32$RegCloseKey" ascii fullword
+        $c5 = "__imp__BeaconFormatAlloc" ascii fullword
+        $c6 = "__imp__BeaconOutput" ascii fullword
+        $c7 = "__imp__BeaconFormatFree" ascii fullword
+        $c8 = "__imp__BeaconDataPtr" ascii fullword
+    condition:
+        1 of ($a*) or 5 of ($b*) or 5 of ($c*)
+}
+
+rule Windows_Trojan_CobaltStrike_d00573a3 {
+    meta:
+        id = "d00573a3-db26-4e6b-aabf-7af4a818f383"
+        fingerprint = "b6fa0792b99ea55f359858d225685647f54b55caabe53f58b413083b8ad60e79"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Screenshot module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "screenshot.x64.dll" ascii fullword
+        $a2 = "screenshot.dll" ascii fullword
+        $a3 = "\\\\.\\pipe\\screenshot" ascii fullword
+        $b1 = "1I1n1Q3M5Q5U5Y5]5a5e5i5u5{5" ascii fullword
+        $b2 = "GetDesktopWindow" ascii fullword
+        $b3 = "CreateCompatibleBitmap" ascii fullword
+        $b4 = "GDI32.dll" ascii fullword
+        $b5 = "ReflectiveLoader"
+        $b6 = "Adobe APP14 marker: version %d, flags 0x%04x 0x%04x, transform %d" ascii fullword
+    condition:
+        2 of ($a*) or 5 of ($b*)
+}
+
+rule Windows_Trojan_CobaltStrike_7bcd759c {
+    meta:
+        id = "7bcd759c-8e3d-4559-9381-1f4fe8b3dd95"
+        fingerprint = "553085f1d1ca8dcd797360b287951845753eee7370610a1223c815a200a5ed20"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies SSH Agent module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "sshagent.x64.dll" ascii fullword
+        $a2 = "sshagent.dll" ascii fullword
+        $b1 = "\\\\.\\pipe\\sshagent" ascii fullword
+        $b2 = "\\\\.\\pipe\\PIPEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ascii fullword
+    condition:
+        1 of ($a*) and 1 of ($b*)
+}
+
+rule Windows_Trojan_CobaltStrike_a56b820f {
+    meta:
+        id = "a56b820f-0a20-4054-9c2d-008862646a78"
+        fingerprint = "5418e695bcb1c37e72a7ff24a39219dc12b3fe06c29cedefd500c5e82c362b6d"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Timestomp module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\timestomp.x64.o" ascii fullword
+        $a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\timestomp.x86.o" ascii fullword
+        $b1 = "__imp_KERNEL32$GetFileTime" ascii fullword
+        $b2 = "__imp_KERNEL32$SetFileTime" ascii fullword
+        $b3 = "__imp_KERNEL32$CloseHandle" ascii fullword
+        $b4 = "__imp_KERNEL32$CreateFileA" ascii fullword
+        $b5 = "__imp_BeaconDataExtract" ascii fullword
+        $b6 = "__imp_BeaconPrintf" ascii fullword
+        $b7 = "__imp_BeaconDataParse" ascii fullword
+        $b8 = "__imp_BeaconDataExtract" ascii fullword
+        $c1 = "__imp__KERNEL32$GetFileTime" ascii fullword
+        $c2 = "__imp__KERNEL32$SetFileTime" ascii fullword
+        $c3 = "__imp__KERNEL32$CloseHandle" ascii fullword
+        $c4 = "__imp__KERNEL32$CreateFileA" ascii fullword
+        $c5 = "__imp__BeaconDataExtract" ascii fullword
+        $c6 = "__imp__BeaconPrintf" ascii fullword
+        $c7 = "__imp__BeaconDataParse" ascii fullword
+        $c8 = "__imp__BeaconDataExtract" ascii fullword
+    condition:
+        1 of ($a*) or 5 of ($b*) or 5 of ($c*)
+}
+
+rule Windows_Trojan_CobaltStrike_92f05172 {
+    meta:
+        id = "92f05172-f15c-4077-a958-b8490378bf08"
+        fingerprint = "09b1f7087d45fb4247a33ae3112910bf5426ed750e1e8fe7ba24a9047b76cc82"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies UAC cmstp module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uaccmstp.x64.o" ascii fullword
+        $a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uaccmstp.x86.o" ascii fullword
+        $b1 = "elevate_cmstp" ascii fullword
+        $b2 = "$pdata$elevate_cmstp" ascii fullword
+        $b3 = "$unwind$elevate_cmstp" ascii fullword
+        $c1 = "_elevate_cmstp" ascii fullword
+        $c2 = "__imp__OLE32$CoGetObject@16" ascii fullword
+        $c3 = "__imp__KERNEL32$GetModuleFileNameA@12" ascii fullword
+        $c4 = "__imp__KERNEL32$GetSystemWindowsDirectoryA@8" ascii fullword
+        $c5 = "OLDNAMES"
+        $c6 = "__imp__BeaconDataParse" ascii fullword
+        $c7 = "_willAutoElevate" ascii fullword
+    condition:
+        1 of ($a*) or 3 of ($b*) or 4 of ($c*)
+}
+
+rule Windows_Trojan_CobaltStrike_417239b5 {
+    meta:
+        id = "417239b5-cf2d-4c85-a022-7a8459c26793"
+        fingerprint = "292afee829e838f9623547f94d0561e8a9115ce7f4c40ae96c6493f3cc5ffa9b"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies UAC token module from Cobalt Strike"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uactoken.x64.o" ascii fullword
+        $a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uactoken.x86.o" ascii fullword
+        $a3 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uactoken2.x64.o" ascii fullword
+        $a4 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uactoken2.x86.o" ascii fullword
+        $b1 = "$pdata$is_admin_already" ascii fullword
+        $b2 = "$unwind$is_admin" ascii fullword
+        $b3 = "$pdata$is_admin" ascii fullword
+        $b4 = "$unwind$is_admin_already" ascii fullword
+        $b5 = "$pdata$RunAsAdmin" ascii fullword
+        $b6 = "$unwind$RunAsAdmin" ascii fullword
+        $b7 = "is_admin_already" ascii fullword
+        $b8 = "is_admin" ascii fullword
+        $b9 = "process_walk" ascii fullword
+        $b10 = "get_current_sess" ascii fullword
+        $b11 = "elevate_try" ascii fullword
+        $b12 = "RunAsAdmin" ascii fullword
+        $b13 = "is_ctfmon" ascii fullword
+        $c1 = "_is_admin_already" ascii fullword
+        $c2 = "_is_admin" ascii fullword
+        $c3 = "_process_walk" ascii fullword
+        $c4 = "_get_current_sess" ascii fullword
+        $c5 = "_elevate_try" ascii fullword
+        $c6 = "_RunAsAdmin" ascii fullword
+        $c7 = "_is_ctfmon" ascii fullword
+        $c8 = "_reg_query_dword" ascii fullword
+        $c9 = ".drectve" ascii fullword
+        $c10 = "_is_candidate" ascii fullword
+        $c11 = "_SpawnAsAdmin" ascii fullword
+        $c12 = "_SpawnAsAdminX64" ascii fullword
+    condition:
+        1 of ($a*) or 9 of ($b*) or 7 of ($c*)
+}
+
+rule Windows_Trojan_CobaltStrike_29374056 {
+    meta:
+        id = "29374056-03ce-484b-8b2d-fbf75be86e27"
+        fingerprint = "4cd7552a499687ac0279fb2e25722f979fc5a22afd1ea4abba14a2ef2002dd0f"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies Cobalt Strike MZ Reflective Loader."
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D ?? FF FF FF 48 81 C3 ?? ?? 00 00 FF D3 }
+        $a2 = { 4D 5A E8 00 00 00 00 5B 89 DF 52 45 55 89 E5 }
+    condition:
+        1 of ($a*)
+}
+
+rule Windows_Trojan_CobaltStrike_949f10e3 {
+    meta:
+        id = "949f10e3-68c9-4600-a620-ed3119e09257"
+        fingerprint = "34e04901126a91c866ebf61a61ccbc3ce0477d9614479c42d8ce97a98f2ce2a7"
+        creation_date = "2021-03-25"
+        last_modified = "2021-08-23"
+        description = "Identifies the API address lookup function used by Cobalt Strike along with XOR implementation by Cobalt Strike."
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 AC 3C 61 }
+        $a2 = { 8B 07 01 C3 85 C0 75 E5 58 C3 E8 [2] FF FF 31 39 32 2E 31 36 38 2E ?? 2E }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_CobaltStrike_8751cdf9 {
+    meta:
+        id = "8751cdf9-4038-42ba-a6eb-f8ac579a4fbb"
+        fingerprint = "0988386ef4ba54dd90b0cf6d6a600b38db434e00e569d69d081919cdd3ea4d3f"
+        creation_date = "2021-03-25"
+        last_modified = "2021-08-23"
+        description = "Identifies Cobalt Strike wininet reverse shellcode along with XOR implementation by Cobalt Strike."
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 99
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07 }
+        $a2 = { 8B 07 01 C3 85 C0 75 E5 58 C3 E8 [2] FF FF 31 39 32 2E 31 36 38 2E ?? 2E }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_CobaltStrike_8519072e {
+    meta:
+        id = "8519072e-3e43-470b-a3cf-18f92b3f31a2"
+        fingerprint = "9fc88b798083adbcf25f9f0b35fbb5035a98cdfe55377de96fa0353821de1cc8"
+        creation_date = "2021-03-25"
+        last_modified = "2021-10-04"
+        description = "Identifies Cobalt Strike trial/default versions"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 90
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "User-Agent:"
+        $a2 = "wini"
+        $a3 = "5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" ascii fullword
+        $a4 = /[^0-9";.\/]([0-9]{1,3}\.){3}[0-9]{1,3}[^0-9";.\/]/
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_CobaltStrike_663fc95d {
+    meta:
+        id = "663fc95d-2472-4d52-ad75-c5d86cfc885f"
+        fingerprint = "d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48"
+        creation_date = "2021-04-01"
+        last_modified = "2021-12-17"
+        description = "Identifies CobaltStrike via unidentified function code"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_CobaltStrike_b54b94ac {
+    meta:
+        id = "b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca"
+        fingerprint = "2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8"
+        creation_date = "2021-10-21"
+        last_modified = "2022-01-13"
+        description = "Rule for beacon sleep obfuscation routine"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        reference_sample = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a_x64 = { 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03 }
+        $a_x64_smbtcp = { 4C 8B 07 B8 4F EC C4 4E 41 F7 E1 41 8B C1 C1 EA 02 41 FF C1 6B D2 0D 2B C2 8A 4C 38 10 42 30 0C 06 48 }
+        $a_x86 = { 8B 46 04 8B 08 8B 50 04 83 C0 08 89 55 08 89 45 0C 85 C9 75 04 85 D2 74 23 3B CA 73 E6 8B 06 8D 3C 08 33 D2 }
+        $a_x86_2 = { 8B 06 8D 3C 08 33 D2 6A 0D 8B C1 5B F7 F3 8A 44 32 08 30 07 41 3B 4D 08 72 E6 8B 45 FC EB C7 }
+        $a_x86_smbtcp = { 8B 07 8D 34 08 33 D2 6A 0D 8B C1 5B F7 F3 8A 44 3A 08 30 06 41 3B 4D 08 72 E6 8B 45 FC EB }
+    condition:
+        any of them
+}
+
+rule Windows_Trojan_CobaltStrike_f0b627fc {
+    meta:
+        id = "f0b627fc-97cd-42cb-9eae-1efb0672762d"
+        fingerprint = "fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1"
+        creation_date = "2021-10-21"
+        last_modified = "2022-01-13"
+        description = "Rule for beacon reflective loader"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        reference_sample = "b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $beacon_loader_x64 = { 25 FF FF FF 00 3D 41 41 41 00 75 [5-10] 25 FF FF FF 00 3D 42 42 42 00 75 }
+        $beacon_loader_x86 = { 25 FF FF FF 00 3D 41 41 41 00 75 [4-8] 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 }
+        $beacon_loader_x86_2 = { 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 [4-8] 81 E2 FF FF FF 00 81 FA 42 42 42 00 75 }
+        $generic_loader_x64 = { 89 44 24 20 48 8B 44 24 40 0F BE 00 8B 4C 24 20 03 C8 8B C1 89 44 24 20 48 8B 44 24 40 48 FF C0 }
+        $generic_loader_x86 = { 83 C4 04 89 45 FC 8B 4D 08 0F BE 11 03 55 FC 89 55 FC 8B 45 08 83 C0 01 89 45 08 8B 4D 08 0F BE }
+    condition:
+        any of them
+}
+
+rule Windows_Trojan_CobaltStrike_dcdcdd8c {
+    meta:
+        id = "dcdcdd8c-7395-4453-a74a-60ab8e251a5a"
+        fingerprint = "8aed1ae470d06a7aac37896df22b2f915c36845099839a85009212d9051f71e9"
+        creation_date = "2021-10-21"
+        last_modified = "2022-01-13"
+        description = "Rule for beacon sleep PDB"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        reference_sample = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask.x64.o" ascii fullword
+        $a2 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask.x86.o" ascii fullword
+        $a3 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask_smb.x64.o" ascii fullword
+        $a4 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask_smb.x86.o" ascii fullword
+        $a5 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask_tcp.x64.o" ascii fullword
+        $a6 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask_tcp.x86.o" ascii fullword
+    condition:
+        any of them
+}
+
+rule Windows_Trojan_CobaltStrike_a3fb2616 {
+    meta:
+        id = "a3fb2616-b03d-4399-9342-0fc684fb472e"
+        fingerprint = "c15cf6aa7719dac6ed21c10117f28eb4ec56335f80a811b11ab2901ad36f8cf0"
+        creation_date = "2021-10-21"
+        last_modified = "2022-01-13"
+        description = "Rule for browser pivot "
+        threat_name = "Windows.Trojan.CobaltStrike"
+        reference_sample = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "browserpivot.dll" ascii fullword
+        $a2 = "browserpivot.x64.dll" ascii fullword
+        $b1 = "$$$THREAD.C$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$" ascii fullword
+        $b2 = "COBALTSTRIKE" ascii fullword
+    condition:
+        1 of ($a*) and 2 of ($b*)
+}
+
+rule Windows_Trojan_CobaltStrike_8ee55ee5 {
+    meta:
+        id = "8ee55ee5-67f1-4f94-ab93-62bb5cfbeee9"
+        fingerprint = "7e7ed4f00d0914ce0b9f77b6362742a9c8b93a16a6b2a62b70f0f7e15ba3a72b"
+        creation_date = "2021-10-21"
+        last_modified = "2022-01-13"
+        description = "Rule for wmi exec module"
+        threat_name = "Windows.Trojan.CobaltStrike"
+        reference_sample = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\wmiexec.x64.o" ascii fullword
+        $a2 = "z:\\devcenter\\aggressor\\external\\pxlib\\bin\\wmiexec.x86.o" ascii fullword
+    condition:
+        1 of ($a*)
+}
+
diff --git a/yara/rules/Windows_Trojan_Cryptbot.yar b/yara/rules/Windows_Trojan_Cryptbot.yar
new file mode 100644
index 00000000..35c1a6c2
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Cryptbot.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_Cryptbot_489a6562 {
+    meta:
+        id = "489a6562-870c-4105-9bb7-52ab09e5b09c"
+        fingerprint = "f4578d79f8923706784e9d55a70ec74051273a945d2b277daa6229724defec3f"
+        creation_date = "2021-08-18"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Cryptbot"
+        reference_sample = "423563995910af04cb2c4136bf50607fc26977dfa043a84433e8bd64b3315110"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "/c rd /s /q %Temp%\\" wide fullword
+        $a2 = "\\_Files\\_AllPasswords_list.txt" wide fullword
+        $a3 = "\\files_\\cryptocurrency\\log.txt" wide fullword
+        $a4 = "%wS\\%wS\\%wS.tmp" wide fullword
+        $a5 = "%AppData%\\waves-exchange" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_CyberGate.yar b/yara/rules/Windows_Trojan_CyberGate.yar
new file mode 100644
index 00000000..a46c3ff2
--- /dev/null
+++ b/yara/rules/Windows_Trojan_CyberGate.yar
@@ -0,0 +1,42 @@
+rule Windows_Trojan_CyberGate_517aac7d {
+    meta:
+        id = "517aac7d-2737-4917-9aa1-c0bd1c3e9801"
+        fingerprint = "3d998bda8e56de6fd6267abdacffece8bcf1c62c2e06540a54244dc6ea816825"
+        creation_date = "2022-02-28"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.CyberGate"
+        reference_sample = "07b8f25e7b536f5b6f686c12d04edc37e11347c8acd5c53f98a174723078c365"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "IELOGIN.abc" ascii fullword
+        $a2 = "xxxyyyzzz.dat" ascii fullword
+        $a3 = "_x_X_PASSWORDLIST_X_x_" ascii fullword
+        $a4 = "L$_RasDefaultCredentials#0" ascii fullword
+        $a5 = "\\signons1.txt" ascii fullword
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_CyberGate_9996d800 {
+    meta:
+        id = "9996d800-a833-4535-972b-3ee320215bb6"
+        fingerprint = "eb39d2ff211230aedcf1b5ec0d1dfea108473cc7cba68f5dc1a88479734c02b0"
+        creation_date = "2022-02-28"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.CyberGate"
+        reference_sample = "07b8f25e7b536f5b6f686c12d04edc37e11347c8acd5c53f98a174723078c365"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 24 08 8B 44 24 08 83 C4 14 5D 5F 5E 5B C3 55 8B EC 83 C4 F0 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_DBatLoader.yar b/yara/rules/Windows_Trojan_DBatLoader.yar
new file mode 100644
index 00000000..5f923132
--- /dev/null
+++ b/yara/rules/Windows_Trojan_DBatLoader.yar
@@ -0,0 +1,19 @@
+rule Windows_Trojan_DBatLoader_f93a8e90 {
+    meta:
+        id = "f93a8e90-10ac-44de-ac3b-c0e976628e98"
+        fingerprint = "81b87663fbad9854430e5c4dcade464a15b995e645f9993a3e234593ee4df901"
+        creation_date = "2022-03-11"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.DBatLoader"
+        reference_sample = "f72d7e445702bbf6b762ebb19d521452b9c76953d93b4d691e0e3e508790256e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { FF 00 74 17 8B 45 E8 0F B6 7C 18 FF 66 03 7D EC 66 0F AF 7D F4 66 03 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_DCRat.yar b/yara/rules/Windows_Trojan_DCRat.yar
new file mode 100644
index 00000000..6db21701
--- /dev/null
+++ b/yara/rules/Windows_Trojan_DCRat.yar
@@ -0,0 +1,24 @@
+rule Windows_Trojan_DCRat_1aeea1ac {
+    meta:
+        id = "1aeea1ac-69b9-4cc6-91af-18b7a79f35ce"
+        fingerprint = "fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9"
+        creation_date = "2022-01-15"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.DCRat"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "havecamera" ascii fullword
+        $a2 = "timeout 3 > NUL" wide fullword
+        $a3 = "START \"\" \"" wide fullword
+        $a4 = "L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g" wide fullword
+        $a5 = "U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==" wide fullword
+        $b1 = "DcRatByqwqdanchun" ascii fullword
+        $b2 = "DcRat By qwqdanchun1" ascii fullword
+    condition:
+        5 of ($a*) or 1 of ($b*)
+}
+
diff --git a/yara/rules/Windows_Trojan_Danabot.yar b/yara/rules/Windows_Trojan_Danabot.yar
new file mode 100644
index 00000000..5d106b65
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Danabot.yar
@@ -0,0 +1,26 @@
+rule Windows_Trojan_Danabot_6f3dadb2 {
+    meta:
+        id = "6f3dadb2-3283-4333-8143-1265721d2221"
+        fingerprint = "387e3fb3c3f625c8b5e42052c126ce4dbb7de3a7de6b68addf0a0777b9d3b504"
+        creation_date = "2021-08-15"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Danabot"
+        reference_sample = "716e5a3d29ff525aed30c18061daff4b496f3f828ba2ac763efd857062a42e96"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "%s.dll" ascii fullword
+        $a2 = "del_ini://Main|Password|" wide fullword
+        $a3 = "S-Password.txt" wide fullword
+        $a4 = "BiosTime:" wide fullword
+        $a5 = "%lu:%s:%s:%d:%s" ascii fullword
+        $a6 = "DNS:%s" ascii fullword
+        $a7 = "THttpInject&" ascii fullword
+        $a8 = "TCookies&" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Darkcomet.yar b/yara/rules/Windows_Trojan_Darkcomet.yar
new file mode 100644
index 00000000..1b446285
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Darkcomet.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_Darkcomet_1df27bcc {
+    meta:
+        id = "1df27bcc-9f18-48d4-bd7f-73bdc7cb1e63"
+        fingerprint = "63b77999860534b71b7b4e7b3da9df175ccd0009f4c13215a59c6b83e0e95b3b"
+        creation_date = "2021-08-16"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Darkcomet"
+        reference_sample = "7fbe87545eef49da0df850719536bb30b196f7ad2d5a34ee795c01381ffda569"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "BTRESULTHTTP Flood|Http Flood task finished!|" ascii fullword
+        $a2 = "is now open!|" ascii fullword
+        $a3 = "ActiveOnlineKeylogger" ascii fullword
+        $a4 = "#BOT#RunPrompt" ascii fullword
+        $a5 = "GETMONITORS" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Deimos.yar b/yara/rules/Windows_Trojan_Deimos.yar
new file mode 100644
index 00000000..8d973488
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Deimos.yar
@@ -0,0 +1,41 @@
+rule Windows_Trojan_Deimos_f53aee03 {
+    meta:
+        id = "f53aee03-74c3-4b40-8ae4-4f1bf35f88c8"
+        fingerprint = "12a6d7f9e4f9a937bf1416443dd0d5ee556ac1f67d2b56ad35f9eac2ee6aac74"
+        creation_date = "2021-09-18"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Deimos"
+        reference_sample = "2c1941847f660a99bbc6de16b00e563f70d900f9dbc40c6734871993961d3d3e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "\\APPDATA\\ROAMING" wide fullword
+        $a2 = "{\"action\":\"ping\",\"" wide fullword
+        $a3 = "Deimos" ascii fullword
+    condition:
+        all of ($a*)
+}
+
+rule Windows_Trojan_Deimos_c70677b4 {
+    meta:
+        id = "c70677b4-f5ba-440b-ba31-31e80caee2fe"
+        fingerprint = "ffe0dec3585da9cbb9f8a0fac1bb6fd43d5d6e20a6175aaa889ae13ef2ed101f"
+        creation_date = "2021-09-18"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Deimos"
+        reference_sample = "2c1941847f660a99bbc6de16b00e563f70d900f9dbc40c6734871993961d3d3e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 00 57 00 58 00 59 00 5A 00 5F 00 00 17 75 00 73 00 65 00 72 00 }
+        $a2 = { 0C 08 16 1F 68 9D 08 17 1F 77 9D 08 18 1F 69 9D 08 19 1F 64 9D }
+    condition:
+        1 of ($a*)
+}
+
diff --git a/yara/rules/Windows_Trojan_DiamondFox.yar b/yara/rules/Windows_Trojan_DiamondFox.yar
new file mode 100644
index 00000000..5113685b
--- /dev/null
+++ b/yara/rules/Windows_Trojan_DiamondFox.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_DiamondFox_18bc11e3 {
+    meta:
+        id = "18bc11e3-5872-40b0-a3b7-cef4b32fac15"
+        fingerprint = "6f908d11220e218a7b59239ff3cc00c7e273fb46ec99ef7ae37e4aceb4de7831"
+        creation_date = "2022-03-02"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.DiamondFox"
+        reference_sample = "a44c46d4b9cf1254aaabd1e689f84c4d2c3dd213597f827acabface03a1ae6d1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "\\wscript.vbs" wide fullword
+        $a2 = "\\snapshot.jpg" wide fullword
+        $a3 = "&soft=" wide fullword
+        $a4 = "ping -n 4 127.0.0.1 > nul" wide fullword
+        $a5 = "Select Name from Win32_Process Where Name = '" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Diceloader.yar b/yara/rules/Windows_Trojan_Diceloader.yar
new file mode 100644
index 00000000..946fd0f2
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Diceloader.yar
@@ -0,0 +1,45 @@
+rule Windows_Trojan_Diceloader_b32c6b99 {
+    meta:
+        id = "b32c6b99-f634-4c6f-98f4-39954ef15afa"
+        fingerprint = "15d4bc57c03a560608ae69551aa46d1786072b3d78d747512f8ac3e6822a7b93"
+        creation_date = "2021-04-23"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Diceloader"
+        reference_sample = "a3b3f56a61c6dc8ba2aa25bdd9bd7dc2c5a4602c2670431c5cbc59a76e2b4c54"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "D$0GET " ascii fullword
+        $a2 = "D$THostf" ascii fullword
+        $a3 = "D$,POST" ascii fullword
+        $a4 = "namef" ascii fullword
+        $a5 = "send" ascii fullword
+        $a6 = "log.ini" wide
+        $a7 = { 70 61 73 73 00 00 65 6D 61 69 6C 00 00 6C 6F 67 69 6E 00 00 73 69 67 6E 69 6E 00 00 61 63 63 6F 75 6E 74 00 00 70 65 72 73 69 73 74 65 6E 74 00 00 48 6F 73 74 3A 20 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Diceloader_15eeb7b9 {
+    meta:
+        id = "15eeb7b9-311f-477b-8ae1-b8f689a154b7"
+        fingerprint = "4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb"
+        creation_date = "2021-04-23"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Diceloader"
+        reference_sample = "a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { E9 92 9D FF FF C3 E8 }
+        $a2 = { E9 E8 61 FF FF C3 E8 }
+    condition:
+        any of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Donutloader.yar b/yara/rules/Windows_Trojan_Donutloader.yar
new file mode 100644
index 00000000..87fad6ee
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Donutloader.yar
@@ -0,0 +1,37 @@
+rule Windows_Trojan_Donutloader_f40e3759 {
+    meta:
+        id = "f40e3759-2531-4e21-946a-fb55104814c0"
+        fingerprint = "6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7"
+        creation_date = "2021-09-15"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Donutloader"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $x64 = { 06 B8 03 40 00 80 C3 4C 8B 49 10 49 }
+        $x86 = { 04 75 EE 89 31 F0 FF 46 04 33 C0 EB }
+    condition:
+        any of them
+}
+
+rule Windows_Trojan_Donutloader_5c38878d {
+    meta:
+        id = "5c38878d-ca94-4fd9-a36e-1ae5fe713ca2"
+        fingerprint = "3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150"
+        creation_date = "2021-09-15"
+        last_modified = "2021-01-13"
+        threat_name = "Windows.Trojan.Donutloader"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1 }
+    condition:
+        any of them
+}
+
diff --git a/yara/rules/Windows_Trojan_DoubleBack.yar b/yara/rules/Windows_Trojan_DoubleBack.yar
new file mode 100644
index 00000000..a3396764
--- /dev/null
+++ b/yara/rules/Windows_Trojan_DoubleBack.yar
@@ -0,0 +1,31 @@
+rule Windows_Trojan_DoubleBack_d2246a35 {
+    meta:
+        id = "d2246a35-e582-4707-acd0-f04bb66df722"
+        fingerprint = "949f8d30125fad133f4b897c945c6aa0eccda5456dc887bde4c0a5affece5195"
+        creation_date = "2022-05-29"
+        last_modified = "2022-07-18"
+        threat_name = "Windows.Trojan.DoubleBack"
+        reference_sample = "03d2a0747d06458ccddf65ff5847a511a105e0ad4dcb5134082623af6f705012"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $s1 = "client.dll" ascii fullword
+        $s2 = "=i.ext;" ascii fullword
+        $s3 = "## dbg delay" ascii fullword
+        $s4 = "ehost"
+        $s5 = "msie"
+        $s6 = "POST"
+        $s7 = "%s(%04Xh:%u/%u)[%s %s]: %s" ascii fullword
+        $x64_powershell_msi_check = { 81 3C 39 70 6F 77 65 74 ?? 81 3C 39 6D 73 69 65 41 }
+        $x86_powershell_msi_check = { 81 3C 30 70 6F 77 65 74 ?? 81 3C 30 6D 73 69 65 6A 03 5A 0F }
+        $x64_salted_hash_func = { 8B 7D ?? 4C 8D 45 ?? 81 C7 ?? ?? ?? ?? 48 8D 4D ?? BA 04 00 00 00 89 7D ?? }
+        $x86_salted_hash_func = { 8B 75 ?? 8D 45 ?? 50 6A ?? 81 C6 ?? ?? ?? ?? 8D 4D ?? 5A 89 75 ?? }
+        $x64_guid = { 48 83 EC ?? 45 33 C9 41 B8 DD CC BB AA 45 8D 51 ?? }
+        $x86_guid = { 55 8B EC 83 EC ?? B8 DD CC BB AA 56 57 6A ?? 8D 75 ?? 5F }
+    condition:
+        5 of ($s*) or 2 of ($x64_*) or 2 of ($x86_*)
+}
+
diff --git a/yara/rules/Windows_Trojan_Dridex.yar b/yara/rules/Windows_Trojan_Dridex.yar
new file mode 100644
index 00000000..1ce174b4
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Dridex.yar
@@ -0,0 +1,39 @@
+rule Windows_Trojan_Dridex_63ddf193 {
+    meta:
+        id = "63ddf193-31a6-4139-b452-960fe742da93"
+        fingerprint = "7b4c5fde8e107a67ff22f3012200e56ec452e0a57a49edb2e06ee225ecfe228c"
+        creation_date = "2021-08-07"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Dridex"
+        reference_sample = "b1d66350978808577159acc7dc7faaa273e82c103487a90bf0d040afa000cb0d"
+        severity = 90
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "snxhk.dll" ascii fullword
+        $a2 = "LondLibruryA" ascii fullword
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Dridex_c6f01353 {
+    meta:
+        id = "c6f01353-cf55-4eac-9f25-6f9cce3b7990"
+        fingerprint = "fbdb230032e3655448d26a679afc612c79d33ac827bcd834e54fe5c05f04d828"
+        creation_date = "2021-08-07"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Dridex"
+        reference_sample = "739682ccb54170e435730c54ba9f7e09f32a3473c07d2d18ae669235dcfe84de"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 56 57 55 8B FA 85 C9 74 58 85 FF 74 54 0F B7 37 85 F6 75 04 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Emotet.yar b/yara/rules/Windows_Trojan_Emotet.yar
new file mode 100644
index 00000000..ca233e38
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Emotet.yar
@@ -0,0 +1,105 @@
+rule Windows_Trojan_Emotet_18379a8d {
+    meta:
+        id = "18379a8d-f1f2-49cc-8edf-58a3ba77efe7"
+        fingerprint = "b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc"
+        creation_date = "2021-11-17"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Emotet"
+        reference_sample = "eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Emotet_5528b3b0 {
+    meta:
+        id = "5528b3b0-d4cb-485e-bc0c-96415ec3a795"
+        fingerprint = "717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642"
+        creation_date = "2021-11-17"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Emotet"
+        reference_sample = "eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Emotet_1943bbf2 {
+    meta:
+        id = "1943bbf2-56c0-443e-9208-cd8fc3b02d79"
+        fingerprint = "df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa"
+        creation_date = "2021-11-18"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Emotet"
+        reference_sample = "5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Emotet_db7d33fa {
+    meta:
+        id = "db7d33fa-e50c-4c59-ab92-edb74aac87c9"
+        fingerprint = "eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd"
+        creation_date = "2022-05-09"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.Emotet"
+        reference_sample = "08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $chunk_0 = { 4C 8D 9C 24 ?? ?? ?? ?? 8B C3 49 8B 5B ?? 49 8B 73 ?? 49 8B 7B ?? 49 8B E3 5D C3 }
+        $chunk_1 = { 8B C7 41 0F B7 4C 45 ?? 41 8B 1C 8C 48 03 DD 48 3B DE 72 ?? }
+        $chunk_2 = { 48 8B C4 48 89 48 ?? 48 89 50 ?? 4C 89 40 ?? 4C 89 48 ?? C3 }
+        $chunk_3 = { 48 8B 45 ?? BB 01 00 00 00 48 89 07 8B 45 ?? 89 47 ?? 4C 8D 9C 24 ?? ?? ?? ?? 8B C3 49 8B 5B ?? 49 8B 73 ?? 49 8B 7B ?? 49 8B E3 5D C3 }
+        $chunk_4 = { 48 39 3B 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ?? 49 8B 73 ?? 40 0F 95 C7 8B C7 49 8B 7B ?? 49 8B E3 5D C3 }
+        $chunk_5 = { BE 02 00 00 00 4C 8D 9C 24 ?? ?? ?? ?? 8B C6 49 8B 5B ?? 49 8B 73 ?? 49 8B 7B ?? 49 8B E3 41 5F 41 5E 41 5D 41 5C 5D C3 }
+        $chunk_6 = { 43 8B 84 FE ?? ?? ?? ?? 48 03 C6 48 3B D8 73 ?? }
+        $chunk_7 = { 88 02 48 FF C2 48 FF C3 8A 03 84 C0 75 ?? EB ?? }
+    condition:
+        4 of them
+}
+
+rule Windows_Trojan_Emotet_d6ac1ea4 {
+    meta:
+        id = "d6ac1ea4-b0a8-4023-b712-9f4f2c7146a3"
+        fingerprint = "7e6224c58c283765b5e819eb46814c556ae6b7b5931cd1e3e19ca3ec8fa31aa2"
+        creation_date = "2022-05-24"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.Emotet"
+        reference_sample = "2c6709d5d2e891d1ce26fdb4021599ac10fea93c7773f5c00bea8e5e90404b71"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $calc1 = { C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? }
+        $pre = { 48 83 EC ( 18 | 28 ) C7 44 24 ?? ?? ?? ?? ?? }
+        $setup = { 48 8D 05 ?? ?? ?? ?? 48 89 81 ?? ?? ?? ?? }
+        $post = { 8B 44 24 ?? 89 44 24 ?? 48 83 C4 18 C3 }
+    condition:
+        #calc1 >= 10 and #pre >= 5 and #setup >= 5 and #post >= 5
+}
+
diff --git a/yara/rules/Windows_Trojan_Farfli.yar b/yara/rules/Windows_Trojan_Farfli.yar
new file mode 100644
index 00000000..1b6e9de2
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Farfli.yar
@@ -0,0 +1,19 @@
+rule Windows_Trojan_Farfli_85d1bcc9 {
+    meta:
+        id = "85d1bcc9-c3c7-454c-a77f-0e0de933c4c3"
+        fingerprint = "56a5e4955556d08b80849ea5775f35f5a32999d6b5df92357ab142a4faa74ac3"
+        creation_date = "2022-02-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Farfli"
+        reference_sample = "e3e9ea1b547cc235e6f1a78b4ca620c69a54209f84c7de9af17eb5b02e9b58c3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { AB 66 AB C6 45 D4 25 C6 45 D5 73 C6 45 D6 5C C6 45 D7 25 C6 45 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Fickerstealer.yar b/yara/rules/Windows_Trojan_Fickerstealer.yar
new file mode 100644
index 00000000..b559bc15
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Fickerstealer.yar
@@ -0,0 +1,39 @@
+rule Windows_Trojan_Fickerstealer_cc02e75e {
+    meta:
+        id = "cc02e75e-2049-4ee4-9302-e491e7dad696"
+        fingerprint = "022088764645d85dd20d1ce201395b4e79e3e716723715687eaecfcbe667615e"
+        creation_date = "2021-07-22"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Fickerstealer"
+        reference_sample = "a4113ccb55e06e783b6cb213647614f039aa7dbb454baa338459ccf37897ebd6"
+        severity = 80
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "..\\\\?\\.\\UNC\\Windows stdio in console mode does not support writing non-UTF-8 byte sequences" ascii fullword
+        $a2 = "\"SomeNone" ascii fullword
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Fickerstealer_f2159bec {
+    meta:
+        id = "f2159bec-a3ce-47a9-91ad-43b8a19ac172"
+        fingerprint = "0671691c6d5c7177fe155e4076ab39bf5f909ed300f32c1530e80d471dff0296"
+        creation_date = "2021-07-22"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Fickerstealer"
+        reference_sample = "a4113ccb55e06e783b6cb213647614f039aa7dbb454baa338459ccf37897ebd6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 10 12 F2 0F 10 5A 08 31 C1 89 C6 8B 42 50 89 7D F0 F2 0F 11 8D 18 FF }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Formbook.yar b/yara/rules/Windows_Trojan_Formbook.yar
new file mode 100644
index 00000000..b419fa6a
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Formbook.yar
@@ -0,0 +1,46 @@
+rule Windows_Trojan_Formbook_1112e116 {
+    meta:
+        id = "1112e116-dee0-4818-a41f-ca5c1c41b4b8"
+        fingerprint = "b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134"
+        creation_date = "2021-06-14"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Formbook"
+        reference_sample = "6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 3C 30 50 4F 53 54 74 09 40 }
+        $a2 = { 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 }
+        $a3 = { 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 }
+        $a4 = { 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 }
+    condition:
+        any of them
+}
+
+rule Windows_Trojan_Formbook_772cc62d {
+    meta:
+        id = "772cc62d-345c-42d8-97ab-f67e447ddca4"
+        fingerprint = "b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5"
+        creation_date = "2022-05-23"
+        last_modified = "2022-07-18"
+        threat_name = "Windows.Trojan.Formbook"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko"
+        $a2 = "pass"
+        $a3 = "email"
+        $a4 = "login"
+        $a5 = "signin"
+        $a6 = "persistent"
+        $r1 = /.\:\\Users\\[^\\]{1,50}\\AppData\\Roaming\\[a-zA-Z0-9]{8}\\[a-zA-Z0-9]{3}log\.ini/ wide
+    condition:
+        4 of ($a*) and $r1
+}
+
diff --git a/yara/rules/Windows_Trojan_Generic.yar b/yara/rules/Windows_Trojan_Generic.yar
new file mode 100644
index 00000000..e9cb4216
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Generic.yar
@@ -0,0 +1,165 @@
+rule Windows_Trojan_Generic_a681f24a {
+    meta:
+        id = "a681f24a-7054-4525-bcf8-3ee64a1d8413"
+        fingerprint = "6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0"
+        creation_date = "2021-06-10"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Generic"
+        reference_sample = "a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa"
+        severity = 25
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = "_kasssperskdy" wide fullword
+        $b = "[Time:]%d-%d-%d %d:%d:%d" wide fullword
+        $c = "{SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}" wide fullword
+    condition:
+        2 of them
+}
+
+rule Windows_Trojan_Generic_ae824b13 : ref1296 {
+    meta:
+        id = "ae824b13-eaae-49e6-a965-ff10379f3c41"
+        fingerprint = "8658996385aac060ebe9eab45bbea8b05b9008926bb3085e5589784473bc3086"
+        creation_date = "2022-02-03"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Generic"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 31 31 34 2E 31 31 34 2E 31 31 34 2E 31 31 34 }
+        $a2 = { 69 6E 66 6F 40 63 69 61 2E 6F 72 67 30 }
+        $a3 = { 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E 54 20 36 2E 33 3B 20 57 4F 57 36 34 29 20 41 70 70 6C 65 57 65 62 4B 69 74 2F 35 33 37 2E 33 36 20 28 4B 48 54 4D 4C 2C 20 6C 69 6B 65 20 47 65 63 6B 6F 29 20 43 68 72 6F 6D 65 2F 35 30 2E 30 2E 32 36 36 31 2E 39 34 20 53 61 66 61 72 69 2F 35 33 37 2E 33 36 }
+        $a4 = { 75 73 65 72 25 33 64 61 64 6D 69 6E 25 32 36 70 61 73 73 77 6F 72 64 25 33 64 64 65 66 61 75 6C 74 25 34 30 72 6F 6F 74 }
+    condition:
+        3 of them
+}
+
+rule Windows_Trojan_Generic_eb47e754 : ref1296 {
+    meta:
+        id = "eb47e754-9b4d-45e7-b76c-027d03326c6c"
+        fingerprint = "b71d13a34e5f791612ed414b8b0e993b1f476a8398a1b0be39046914ac5ac21d"
+        creation_date = "2022-02-03"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Generic"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 41 20 61 74 20 4C 20 25 64 }
+        $a2 = { 74 63 70 69 70 5F 74 68 72 65 61 64 }
+        $a3 = { 32 30 38 2E 36 37 2E 32 32 32 2E 32 32 32 }
+        $a4 = { 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E 54 20 36 2E 33 3B 20 57 4F 57 36 34 29 20 41 70 70 6C 65 57 65 62 4B 69 74 2F 35 33 37 2E 33 36 20 28 4B 48 54 4D 4C 2C 20 6C 69 6B 65 20 47 65 63 6B 6F 29 20 43 68 72 6F 6D 65 2F 35 37 2E 30 2E 32 39 38 37 2E 31 33 33 20 53 61 66 61 72 69 2F 35 33 37 2E 33 36 }
+    condition:
+        3 of them
+}
+
+rule Windows_Trojan_Generic_c7fd8d38 {
+    meta:
+        id = "c7fd8d38-eaba-424d-b91a-098c439dab6b"
+        fingerprint = "dc14cd519b3bbad7c2e655180a584db0a4e2ad4eea073a52c94b0a88152b37ba"
+        creation_date = "2022-02-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Generic"
+        reference_sample = "a1702ec12c2bf4a52e11fbdab6156358084ad2c662c8b3691918ef7eabacde96"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "PCREDENTIAL" ascii fullword
+        $a2 = "gHotkey" ascii fullword
+        $a3 = "EFORMATEX" ascii fullword
+        $a4 = "ZLibEx" ascii fullword
+        $a5 = "9Root!" ascii fullword
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Generic_a160ca52 {
+    meta:
+        id = "a160ca52-8911-4649-a1fa-ac8f6f75e18d"
+        fingerprint = "06eca9064ca27784b61994844850f05c47c07ba6c4242a2572d6d0c484a920f0"
+        creation_date = "2022-02-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Generic"
+        reference_sample = "650bf19e73ac2d9ebbf62f15eeb603c2b4a6a65432c70b87edc429165d6706f3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 1C 85 C9 74 02 8B 09 8D 41 FF 89 45 F0 89 55 EC 8B 55 EC 8B }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Generic_bbe6c282 {
+    meta:
+        id = "bbe6c282-e92d-4021-bdaf-189337e4abf0"
+        fingerprint = "e004d77440a86c23f23086e1ada6d1453178b9c2292782c1c88a7b14151c10fe"
+        creation_date = "2022-03-02"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Generic"
+        reference_sample = "a44c46d4b9cf1254aaabd1e689f84c4d2c3dd213597f827acabface03a1ae6d1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 00 D1 1C A5 03 08 08 00 8A 5C 01 08 08 00 8A 58 01 2E 54 FF }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Generic_889b1248 {
+    meta:
+        id = "889b1248-a694-4c9b-8792-c04e582e814c"
+        fingerprint = "a5e0c2bbd6a297c01f31eccabcbe356730f50f074587f679da6caeca99e54bc1"
+        creation_date = "2022-03-11"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Generic"
+        reference_sample = "a48d57a139c7e3efa0c47f8699e2cf6159dc8cdd823b16ce36257eb8c9d14d53"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "BELARUS-VIRUS-MAKER" ascii fullword
+        $a2 = "C:\\windows\\temp\\" ascii fullword
+        $a3 = "~c~a~n~n~a~b~i~s~~i~s~~n~o~t~~a~~d~r~u~g~" ascii fullword
+        $a4 = "untInfector" ascii fullword
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Generic_02a87a20 {
+    meta:
+        id = "02a87a20-a5b4-44c6-addc-c70b327d7b2c"
+        fingerprint = "fb25a522888efa729ee6d43a3eec7ade3d08dba394f3592d1c3382a5f7a813c8"
+        creation_date = "2022-03-04"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Generic"
+        reference_sample = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 24 3C 8B C2 2B C1 83 F8 01 72 3A 8D 41 01 83 FA 08 89 44 24 38 8D 44 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Gh0st.yar b/yara/rules/Windows_Trojan_Gh0st.yar
new file mode 100644
index 00000000..e55fe1f2
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Gh0st.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_Gh0st_ee6de6bc {
+    meta:
+        id = "ee6de6bc-1648-4a77-9607-e2a211c7bda4"
+        fingerprint = "3c529043f34ad8a8692b051ad7c03206ce1aafc3a0eb8fcf7f5bcfdcb8c1b455"
+        creation_date = "2021-06-10"
+        last_modified = "2021-08-23"
+        description = "Identifies a variant of Gh0st Rat"
+        threat_name = "Windows.Trojan.Gh0st"
+        reference_sample = "ea1dc816dfc87c2340a8b8a77a4f97618bccf19ad3b006dce4994be02e13245d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = ":]%d-%d-%d  %d:%d:%d" ascii fullword
+        $a2 = "[Pause Break]" ascii fullword
+        $a3 = "f-secure.exe" ascii fullword
+        $a4 = "Accept-Language: zh-cn" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Glupteba.yar b/yara/rules/Windows_Trojan_Glupteba.yar
new file mode 100644
index 00000000..dd5868f0
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Glupteba.yar
@@ -0,0 +1,43 @@
+rule Windows_Trojan_Glupteba_70557305 {
+    meta:
+        id = "70557305-3d11-4dde-b53b-94f1ecc0380b"
+        fingerprint = "bac7daa5c491de8f8a75b203cdb1cdab2c10633aa45a82e6b04d2f577e3e8415"
+        creation_date = "2021-08-08"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Glupteba"
+        reference_sample = "3ad13fd7968f9574d2c822e579291c77a0c525991cfb785cbe6cdd500b737218"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "%TEMP%\\app.exe && %TEMP%\\app.exe"
+        $a2 = "is unavailable%d smbtest"
+        $a3 = "discovered new server %s"
+        $a4 = "uldn't get usernamecouldn't hide servicecouldn't"
+        $a5 = "TERMINATE PROCESS: %ws, %d, %d" ascii fullword
+        $a6 = "[+] Extracting vulnerable driver as \"%ws\"" ascii fullword
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Glupteba_4669dcd6 {
+    meta:
+        id = "4669dcd6-8e04-416d-91c0-f45816430869"
+        fingerprint = "5b598640f42a99b00d481031f5fcf143ffcc32ef002eac095a14edb18d5b02c9"
+        creation_date = "2021-08-08"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Glupteba"
+        reference_sample = "1b55042e06f218546db5ddc52d140be4303153d592dcfc1ce90e6077c05e77f7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 40 C3 8B 44 24 48 8B 4C 24 44 89 81 AC 00 00 00 8B 44 24 4C 89 81 B0 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Gozi.yar b/yara/rules/Windows_Trojan_Gozi.yar
new file mode 100644
index 00000000..e01573b0
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Gozi.yar
@@ -0,0 +1,59 @@
+rule Windows_Trojan_Gozi_fd494041 {
+    meta:
+        id = "fd494041-3fe8-4ffa-9ab8-6798032f1d66"
+        fingerprint = "faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2"
+        creation_date = "2021-03-22"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Gozi"
+        reference_sample = "0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "/C ping localhost -n %u && del \"%s\"" wide fullword
+        $a2 = "/C \"copy \"%s\" \"%s\" /y && \"%s\" \"%s\"" wide fullword
+        $a3 = "/C \"copy \"%s\" \"%s\" /y && rundll32 \"%s\",%S\"" wide fullword
+        $a4 = "ASCII.GetString(( gp \"%S:\\%S\").%s))',0,0)" wide
+        $a5 = "filename=\"%.4u.%lu\""
+        $a6 = "Urundll32 \"%s\",%S" wide fullword
+        $a7 = "version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s" ascii fullword
+        $a8 = "%08X-%04X-%04X-%04X-%08X%04X" ascii fullword
+        $a9 = "&whoami=%s" ascii fullword
+        $a10 = "%u.%u_%u_%u_x%u" ascii fullword
+        $a11 = "size=%u&hash=0x%08x" ascii fullword
+        $a12 = "&uptime=%u" ascii fullword
+        $a13 = "%systemroot%\\system32\\c_1252.nls" ascii fullword
+        $a14 = "IE10RunOnceLastShown_TIMESTAMP" ascii fullword
+    condition:
+        8 of ($a*)
+}
+
+rule Windows_Trojan_Gozi_261f5ac5 {
+    meta:
+        id = "261f5ac5-7800-4580-ac37-80b71c47c270"
+        fingerprint = "cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c"
+        creation_date = "2019-08-02"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Gozi"
+        reference_sample = "31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x"
+        $a2 = "version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s"
+        $a3 = "Content-Disposition: form-data; name=\"upload_file\"; filename=\"%.4u.%lu\""
+        $a4 = "&tor=1"
+        $a5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)"
+        $a6 = "http://constitution.org/usdeclar.txt"
+        $a7 = "grabs="
+        $a8 = "CHROME.DLL"
+        $a9 = "Software\\AppDataLow\\Software\\Microsoft\\"
+    condition:
+        4 of ($a*)
+}
+
diff --git a/yara/rules/Windows_Trojan_Guloader.yar b/yara/rules/Windows_Trojan_Guloader.yar
new file mode 100644
index 00000000..314d6c0a
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Guloader.yar
@@ -0,0 +1,42 @@
+rule Windows_Trojan_Guloader_8f10fa66 {
+    meta:
+        id = "8f10fa66-a24b-4cc2-b9e0-11be14aba9af"
+        fingerprint = "5841d70a38d4620c446427c80ca12b5e918f23e90c5288854943b0240958bcfb"
+        creation_date = "2021-08-17"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Guloader"
+        reference_sample = "a3e2d5013b80cd2346e37460753eca4a4fec3a7941586cc26e049a463277562e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "msvbvm60.dll" wide fullword
+        $a2 = "C:\\Program Files\\qga\\qga.exe" ascii fullword
+        $a3 = "C:\\Program Files\\Qemu-ga\\qemu-ga.exe" ascii fullword
+        $a4 = "USERPROFILE=" wide fullword
+        $a5 = "Startup key" ascii fullword
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Guloader_c4d9dd33 {
+    meta:
+        id = "c4d9dd33-b7e7-4ff4-a2f3-62316d064f5a"
+        fingerprint = "53a2d6f895cdd1a6384a55756711d9d758b3b20dd0b87d62a89111fd1a20d1d6"
+        creation_date = "2021-08-17"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Guloader"
+        reference_sample = "a3e2d5013b80cd2346e37460753eca4a4fec3a7941586cc26e049a463277562e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "This program cannot be run under virtual environment or debugging software !" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Hancitor.yar b/yara/rules/Windows_Trojan_Hancitor.yar
new file mode 100644
index 00000000..a6cd88d6
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Hancitor.yar
@@ -0,0 +1,21 @@
+rule Windows_Trojan_Hancitor_6738d84a {
+    meta:
+        id = "6738d84a-7393-4db2-97cc-66f471b5699a"
+        fingerprint = "44a4dd7c35e0b4f3f161b82463d8f0ee113eaedbfabb7d914ce9486b6bd3a912"
+        creation_date = "2021-06-17"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Hancitor"
+        reference_sample = "a674898f39377e538f9ec54197689c6fa15f00f51aa0b5cc75c2bafd86384a40"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d"
+        $b1 = "Rundll32.exe %s, start" ascii fullword
+        $b2 = "MASSLoader.dll" ascii fullword
+    condition:
+        $a1 or all of ($b*)
+}
+
diff --git a/yara/rules/Windows_Trojan_Hawkeye.yar b/yara/rules/Windows_Trojan_Hawkeye.yar
new file mode 100644
index 00000000..5ba3341e
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Hawkeye.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_Hawkeye_77c36ace {
+    meta:
+        id = "77c36ace-3857-43f8-a6de-596ba7964b6f"
+        fingerprint = "c9a1c61b4fa78c46d493e1b307e9950bd714ba4e5a6249f15a3b86a74b7638e5"
+        creation_date = "2021-08-16"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Hawkeye"
+        reference_sample = "28e28025060f1bafd4eb96c7477cab73497ca2144b52e664b254c616607d94cd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Logger - Key Recorder - [" wide fullword
+        $a2 = "http://whatismyipaddress.com/" wide fullword
+        $a3 = "Keylogger Enabled: " wide fullword
+        $a4 = "LoadPasswordsSeaMonkey" wide fullword
+        $a5 = "\\.minecraft\\lastlogin" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_IcedID.yar b/yara/rules/Windows_Trojan_IcedID.yar
new file mode 100644
index 00000000..04e2cd74
--- /dev/null
+++ b/yara/rules/Windows_Trojan_IcedID.yar
@@ -0,0 +1,188 @@
+rule Windows_Trojan_IcedID_1cd868a6 {
+    meta:
+        id = "1cd868a6-d2ec-4c48-a69a-aaa6c7af876c"
+        fingerprint = "3e76b3ac03c5268923cfd5d0938745d66cda273d436b83bee860250fdcca6327"
+        creation_date = "2021-02-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.IcedID"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html"
+        reference_sample = "68dce9f214e7691db77a2f03af16a669a3cb655699f31a6c1f5aaede041468ff"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 24 2C B9 09 00 00 00 2A C2 2C 07 88 44 24 0F 0F B6 C3 6B C0 43 89 44 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_IcedID_237e9fb6 {
+    meta:
+        id = "237e9fb6-b5fa-4747-af1f-533c76a5a639"
+        fingerprint = "e2ea6d1477ce4132f123b6c00101a063f7bba7acf38be97ee8dca22cc90ed511"
+        creation_date = "2021-02-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.IcedID"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html"
+        reference_sample = "b21f9afc6443548427bf83b5f93e7a54ac3af306d9d71b8348a6f146b2819457"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 60 8B 55 D4 3B D0 7E 45 83 F8 08 0F 4C 45 EC 3B D0 8D 3C 00 0F }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_IcedID_f1ce2f0a {
+    meta:
+        id = "f1ce2f0a-0d34-46a4-8e42-0906adf4dc1b"
+        fingerprint = "1940c4bf5d8011dc7edb8dde718286554ed65f9e96fe61bfa90f6182a4b8ca9e"
+        creation_date = "2021-02-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.IcedID"
+        reference = "https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html"
+        reference_sample = "b21f9afc6443548427bf83b5f93e7a54ac3af306d9d71b8348a6f146b2819457"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 8B C8 8B C6 F7 E2 03 CA 8B 54 24 14 2B D0 8B 44 24 14 89 54 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_IcedID_08530e24 {
+    meta:
+        id = "08530e24-5b84-40a4-bc5c-ead74762faf8"
+        fingerprint = "f2b5768b87eec7c1c9730cc99364cc90e87fd9201bf374418ad008fd70d321af"
+        creation_date = "2021-03-21"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.IcedID"
+        reference_sample = "31db92c7920e82e49a968220480e9f130dea9b386083b78a79985b554ecdc6e4"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "c:\\ProgramData\\" ascii fullword
+        $a2 = "loader_dll_64.dll" ascii fullword
+        $a3 = "aws.amazon.com" wide fullword
+        $a4 = "Cookie: __gads=" wide fullword
+        $b1 = "LookupAccountNameW" ascii fullword
+        $b2 = "GetUserNameA" ascii fullword
+        $b3 = "; _gat=" wide fullword
+        $b4 = "; _ga=" wide fullword
+        $b5 = "; _u=" wide fullword
+        $b6 = "; __io=" wide fullword
+        $b7 = "; _gid=" wide fullword
+        $b8 = "%s%u" wide fullword
+        $b9 = "i\\|9*" ascii fullword
+        $b10 = "WinHttpSetStatusCallback" ascii fullword
+    condition:
+        all of ($a*) and 5 of ($b*)
+}
+
+rule Windows_Trojan_IcedID_11d24d35 {
+    meta:
+        id = "11d24d35-6bff-4fac-83d8-4d152aa0be57"
+        fingerprint = "155e5df0f3f598cdc21e5c85bcf21c1574ae6788d5f7e0058be823c71d06c21e"
+        creation_date = "2022-02-16"
+        last_modified = "2022-04-06"
+        threat_name = "Windows.Trojan.IcedID"
+        reference_sample = "b8d794f6449669ff2d11bc635490d9efdd1f4e92fcb3be5cdb4b40e4470c0982"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "C:\\Users\\user\\source\\repos\\anubis\\bin\\RELEASE\\loader_dll_64.pdb" ascii fullword
+        $a2 = "loader_dll_64.dll" ascii fullword
+    condition:
+        1 of ($a*)
+}
+
+rule Windows_Trojan_IcedID_0b62e783 {
+    meta:
+        id = "0b62e783-5c1a-4377-8338-1c53194b8d01"
+        fingerprint = "2f473fbe6338d9663808f1a3615cf8f0f6f9780fbce8f4a3c24f0ddc5f43dd4a"
+        creation_date = "2022-04-06"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.IcedID"
+        reference_sample = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 89 44 95 E0 83 E0 07 8A C8 42 8B 44 85 E0 D3 C8 FF C0 42 89 44 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_IcedID_91562d18 {
+    meta:
+        id = "91562d18-28a1-4349-9e4b-92ad165510c9"
+        fingerprint = "024bbd15da6bc759e321779881b466b500f6364a1d67bbfdc950aedccbfbc022"
+        creation_date = "2022-04-06"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.IcedID"
+        reference_sample = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 44 8B 4C 19 2C 4C 03 D6 74 1C 4D 85 C0 74 17 4D 85 C9 74 12 41 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_IcedID_2086aecb {
+    meta:
+        id = "2086aecb-161b-4102-89c7-580fb9ac3759"
+        fingerprint = "c80ba4185d671811d8ea74fbe4e79353d3fa71d7ef29fa385a713bb7d565c13b"
+        creation_date = "2022-04-06"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.IcedID"
+        reference_sample = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 4C 8D 05 ?? ?? ?? ?? 42 8A 44 01 ?? 42 32 04 01 88 44 0D ?? 48 FF C1 48 83 F9 20 72 ?? }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_IcedID_48029e37 {
+    meta:
+        id = "48029e37-b392-4d53-b0de-2079f6a8a9d9"
+        fingerprint = "375266b526fe14354550d000d3a10dde3f6a85e11f4ba5cab14d9e1f878de51e"
+        creation_date = "2022-04-06"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.IcedID"
+        reference_sample = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 48 C1 E3 10 0F 31 48 C1 E2 ?? 48 0B C2 0F B7 C8 48 0B D9 8B CB 83 E1 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_JesterStealer.yar b/yara/rules/Windows_Trojan_JesterStealer.yar
new file mode 100644
index 00000000..8cffc6a5
--- /dev/null
+++ b/yara/rules/Windows_Trojan_JesterStealer.yar
@@ -0,0 +1,44 @@
+rule Windows_Trojan_JesterStealer_b35c6f4b {
+    meta:
+        id = "b35c6f4b-995f-4336-94bf-fc6dc8c124f4"
+        fingerprint = "d91c26a06ba7c9330e38a4744299223d3b28a96f131bce5198c4ef7c74b7d2ff"
+        creation_date = "2022-02-28"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.JesterStealer"
+        reference_sample = "10c3846867f70dd26c5a54332ed22070c9e5e0e4f52f05fdae12ead801f7933b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "[Decrypt Chrome Password] {0}" wide fullword
+        $a2 = "Passwords.txt" wide fullword
+        $a3 = "9Stealer.Recovery.FTP.FileZilla+<EnumerateCredentials>d__0" ascii fullword
+        $a4 = "/C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A \"" wide fullword
+        $a5 = "citigroup.com" wide fullword
+        $a6 = "Password: {1}" wide fullword
+        $a7 = "set_steamLogin" ascii fullword
+    condition:
+        5 of them
+}
+
+rule Windows_Trojan_JesterStealer_8f657f58 {
+    meta:
+        id = "8f657f58-57e0-4e5f-9223-00bfade16605"
+        fingerprint = "aabf8633e853f623b75e8a354378d110442e724425f623b8c553d3522ca5dad6"
+        creation_date = "2022-02-28"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.JesterStealer"
+        reference_sample = "10c3846867f70dd26c5a54332ed22070c9e5e0e4f52f05fdae12ead801f7933b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 27 01 00 00 00 96 08 0B 80 79 01 6C 02 A4 27 01 00 00 00 96 08 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Jupyter.yar b/yara/rules/Windows_Trojan_Jupyter.yar
new file mode 100644
index 00000000..acee57c9
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Jupyter.yar
@@ -0,0 +1,22 @@
+rule Windows_Trojan_Jupyter_56152e31 {
+    meta:
+        id = "56152e31-77c6-49fa-bbc5-c3630f11e633"
+        fingerprint = "9cccc2e3d4cfe9ff090d02b143fa837f4da0c229426435b4e097f902e8c5fb01"
+        creation_date = "2021-07-22"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Jupyter"
+        reference_sample = "ce486097ad2491aba8b1c120f6d0aa23eaf59cf698b57d2113faab696d03c601"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "%appdata%\\solarmarker.dat" ascii fullword
+        $a2 = "\\AppData\\Roaming\\solarmarker.dat" wide fullword
+        $b1 = "steal_passwords" ascii fullword
+        $b2 = "jupyter" ascii fullword
+    condition:
+        1 of ($a*) or 2 of ($b*)
+}
+
diff --git a/yara/rules/Windows_Trojan_Kronos.yar b/yara/rules/Windows_Trojan_Kronos.yar
new file mode 100644
index 00000000..0ee975e3
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Kronos.yar
@@ -0,0 +1,27 @@
+rule Windows_Trojan_Kronos_cdd2e2c5 {
+    meta:
+        id = "cdd2e2c5-17fc-4cec-aece-0b19c54faccf"
+        fingerprint = "0e124d42a6741a095b66928303731e7060788bc1035b98b729ca91e4f7b6bc44"
+        creation_date = "2021-02-07"
+        last_modified = "2021-08-23"
+        description = "Strings used by the Kronos banking trojan and variants."
+        threat_name = "Windows.Trojan.Kronos"
+        reference = "https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects"
+        reference_sample = "baa9cedbbe0f5689be8f8028a6537c39e9ea8b0815ad76cb98f365ca5a41653f"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "data_inject" ascii wide fullword
+        $a2 = "set_filter" ascii wide fullword
+        $a3 = "set_url" ascii wide fullword
+        $a4 = "%ws\\%ws.cfg" ascii wide fullword
+        $a5 = "D7T1H5F0F5A4C6S3" ascii wide fullword
+        $a6 = "[DELETE]" ascii wide fullword
+        $a7 = "Kronos" ascii wide fullword
+    condition:
+        4 of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Limerat.yar b/yara/rules/Windows_Trojan_Limerat.yar
new file mode 100644
index 00000000..84a0b772
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Limerat.yar
@@ -0,0 +1,19 @@
+rule Windows_Trojan_Limerat_24269a79 {
+    meta:
+        id = "24269a79-0172-4da5-9b4d-f61327072bf0"
+        fingerprint = "cb714cd787519216d25edaad9f89a9c0ce1b8fbbbcdf90bda4c79f5d85fdf381"
+        creation_date = "2021-08-17"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Limerat"
+        reference_sample = "ec781a714d6bc6fac48d59890d9ae594ffd4dbc95710f2da1f1aa3d5b87b9e01"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr \"'" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Lokibot.yar b/yara/rules/Windows_Trojan_Lokibot.yar
new file mode 100644
index 00000000..7ca1015d
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Lokibot.yar
@@ -0,0 +1,38 @@
+rule Windows_Trojan_Lokibot_1f885282 {
+    meta:
+        id = "1f885282-b60e-491e-ae1b-d26825e5aadb"
+        fingerprint = "a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b"
+        creation_date = "2021-06-22"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Lokibot"
+        reference_sample = "916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "MAC=%02X%02X%02XINSTALL=%08X%08Xk" fullword
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Lokibot_0f421617 {
+    meta:
+        id = "0f421617-df2b-4cb5-9d10-d984f6553012"
+        fingerprint = "9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda"
+        creation_date = "2021-07-20"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Lokibot"
+        reference_sample = "de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Lucifer.yar b/yara/rules/Windows_Trojan_Lucifer.yar
new file mode 100644
index 00000000..d924072d
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Lucifer.yar
@@ -0,0 +1,19 @@
+rule Windows_Trojan_Lucifer_ce9d4cc8 {
+    meta:
+        id = "ce9d4cc8-8f16-4272-a54b-e500d4edea9b"
+        fingerprint = "77c86dfbbd4fb113dabf6016f22d879322357de8ea4a8a598ce9fba761419c55"
+        creation_date = "2022-02-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Lucifer"
+        reference_sample = "1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 00 0A 28 47 00 00 0A 00 DE 02 00 DC 00 28 09 00 00 06 02 6F 48 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Lurker.yar b/yara/rules/Windows_Trojan_Lurker.yar
new file mode 100644
index 00000000..f5f349dc
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Lurker.yar
@@ -0,0 +1,19 @@
+rule Windows_Trojan_Lurker_0ee51802 {
+    meta:
+        id = "0ee51802-4ff3-4edf-95ed-bb0338ff25d9"
+        fingerprint = "c30bc4e25c1984268a3bb44c59081131d1e81254b94734f6af2b47969c0acd0e"
+        creation_date = "2022-04-04"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.Lurker"
+        reference_sample = "5718fd4f807e29e48a8b6a6f4484426ba96c61ec8630dc78677686e0c9ba2b87"
+        severity = 50
+        arch_context = "x86"
+        scan_context = "file"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $str1 = "\\Device\\ZHWLurker0410" wide fullword
+    condition:
+        int16(uint32(0x3C) + 0x5c) == 0x0001 and $str1
+}
+
diff --git a/yara/rules/Windows_Trojan_MassLogger.yar b/yara/rules/Windows_Trojan_MassLogger.yar
new file mode 100644
index 00000000..508e5d7e
--- /dev/null
+++ b/yara/rules/Windows_Trojan_MassLogger.yar
@@ -0,0 +1,24 @@
+rule Windows_Trojan_MassLogger_511b001e {
+    meta:
+        id = "511b001e-dc67-4e45-9096-0b01101ca0ab"
+        fingerprint = "14ec9c32af7c1dd4a1f73e37ef9e042c18d9e0179b0e5732752767f93be6d4e2"
+        creation_date = "2022-03-02"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.MassLogger"
+        reference_sample = "177875c756a494872c516000beb6011cec22bd9a73e58ba6b2371dba2ab8c337"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "ExecutionPolicy Bypass -WindowStyle Hidden -Command netsh advfirewall firewall add rule name='allow RemoteDesktop' dir=in protoc" wide
+        $a2 = "https://raw.githubusercontent.com/lisence-system/assemply/main/VMprotectEncrypt.jpg" wide fullword
+        $a3 = "ECHO $SMTPServer  = smtp.gmail.com >> %PSScript%" wide fullword
+        $a4 = "Injecting Default Template...." wide fullword
+        $a5 = "GetVncLoginMethodAsync" ascii fullword
+        $a6 = "/c start computerdefaults.exe" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Matanbuchus.yar b/yara/rules/Windows_Trojan_Matanbuchus.yar
new file mode 100644
index 00000000..bbf0e22d
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Matanbuchus.yar
@@ -0,0 +1,79 @@
+rule Windows_Trojan_Matanbuchus_b521801b {
+    meta:
+        id = "b521801b-5623-4bfe-9a9d-9e16afa63c63"
+        fingerprint = "7792cffc82678bb05ba1aa315011317611eb0bf962665e0657a7db2ce95f81b4"
+        creation_date = "2022-03-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Matanbuchus"
+        reference_sample = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "%PROCESSOR_ARCHITECTURE%" ascii fullword
+        $a2 = "%PROCESSOR_REVISION%\\" ascii fullword
+        $a3 = "%LOCALAPPDATA%\\" ascii fullword
+        $a4 = "\"C:\\Windows\\system32\\schtasks.exe\" /Create /SC MINUTE /MO 1 /TN" ascii fullword
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Matanbuchus_4ce9affb {
+    meta:
+        id = "4ce9affb-58ef-4d31-b1ff-5a1c52822a01"
+        fingerprint = "61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435"
+        creation_date = "2022-03-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Matanbuchus"
+        reference_sample = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { F4 83 7D F4 00 77 43 72 06 83 7D F0 11 73 3B 6A 00 6A 01 8B }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Matanbuchus_58a61aaa {
+    meta:
+        id = "58a61aaa-51b2-47f2-ab32-2e639957b2d5"
+        fingerprint = "332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5"
+        creation_date = "2022-03-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Matanbuchus"
+        reference_sample = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 55 8B EC 83 EC 08 53 56 0F 57 C0 66 0F 13 45 F8 EB ?? 8B 45 F8 83 C0 01 8B 4D FC 83 D1 00 89 45 F8 89 4D FC 8B 55 FC 3B 55 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Matanbuchus_c7811ccc {
+    meta:
+        id = "c7811ccc-5d8d-4bc8-a630-ac3282bb207e"
+        fingerprint = "05f209a24d9eb2be7fa50444d8271b6f147027291f55a352ac3af5e9b3207010"
+        creation_date = "2022-03-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Matanbuchus"
+        reference_sample = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 55 8B EC 83 EC 08 53 56 0F 57 C0 66 0F 13 45 F8 EB ?? 8B 45 F8 83 C0 01 8B 4D FC 83 D1 00 89 45 F8 89 4D FC 8B 55 FC 3B 55 10 77 ?? 72 ?? 8B 45 F8 3B 45 0C 73 ?? 6A 00 6A 08 8B 4D FC 51 8B 55 F8 52 E8 ?? ?? ?? ?? 6A 00 6A 08 52 50 E8 ?? ?? ?? ?? 8B C8 8B 45 14 8B 55 18 E8 ?? ?? ?? ?? 0F BE F0 6A 00 6A 01 8B 55 FC 52 8B 45 F8 50 E8 ?? ?? ?? ?? 8B 4D 08 0F BE 1C 01 33 DE 6A 00 6A 01 8B 55 FC 52 8B 45 F8 50 E8 ?? ?? ?? ?? 8B 4D 08 88 1C 01 E9 ?? ?? ?? ?? 5E 5B 8B E5 5D C2 14 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Merlin.yar b/yara/rules/Windows_Trojan_Merlin.yar
new file mode 100644
index 00000000..85305b40
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Merlin.yar
@@ -0,0 +1,19 @@
+rule Windows_Trojan_Merlin_e8ecb3be {
+    meta:
+        id = "e8ecb3be-edba-4617-b4df-9d5b6275d310"
+        fingerprint = "54e03337930d74568a91e797cfda3b7bfbce3aad29be2543ed58c51728d8e185"
+        creation_date = "2022-01-05"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Merlin"
+        reference_sample = "768c120e63d3960a0842dcc538749955ab7caabaeaf3682f6d1e30666aac65a8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { AF F0 4C 01 F1 4C 8B B4 24 A8 00 00 00 4D 0F AF F4 4C 01 F1 4C 8B B4 24 B0 00 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Metasploit.yar b/yara/rules/Windows_Trojan_Metasploit.yar
new file mode 100644
index 00000000..59ea7f6f
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Metasploit.yar
@@ -0,0 +1,216 @@
+rule Windows_Trojan_Metasploit_a6e956c9 {
+    meta:
+        id = "a6e956c9-799e-49f9-b5c5-ac68aaa2dc21"
+        fingerprint = "21855599bc51ec2f71d694d4e0f866f815efe54a42842dfe5f8857811530a686"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies the API address lookup function leverage by metasploit shellcode"
+        threat_name = "Windows.Trojan.Metasploit"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 60 89 E5 31 C0 64 8B 50 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF AC 3C 61 7C 02 2C 20 }
+    condition:
+        $a1
+}
+
+rule Windows_Trojan_Metasploit_38b8ceec {
+    meta:
+        id = "38b8ceec-601c-4117-b7a0-74720e26bf38"
+        fingerprint = "44b9022d87c409210b1d0807f5a4337d73f19559941660267d63cd2e4f2ff342"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon)."
+        threat_name = "Windows.Trojan.Metasploit"
+        severity = 85
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 AC 3C 61 }
+    condition:
+        $a1
+}
+
+rule Windows_Trojan_Metasploit_7bc0f998 {
+    meta:
+        id = "7bc0f998-7014-4883-8a56-d5ee00c15aed"
+        fingerprint = "fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies the API address lookup function leverage by metasploit shellcode"
+        threat_name = "Windows.Trojan.Metasploit"
+        severity = 84
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61 }
+    condition:
+        $a1
+}
+
+rule Windows_Trojan_Metasploit_f7f826b4 {
+    meta:
+        id = "f7f826b4-6456-4819-bc0c-993aeeb7e325"
+        fingerprint = "9b07dc54d5015d0f0d84064c5a989f94238609c8167cae7caca8665930a20f81"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies metasploit kernel->user shellcode. Likely used in ETERNALBLUE and BlueKeep exploits."
+        threat_name = "Windows.Trojan.Metasploit"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 48 92 31 C9 51 51 49 89 C9 4C 8D 05 0? 00 00 00 89 CA 48 83 EC 20 FF D0 48 83 C4 30 C3 }
+    condition:
+        $a1
+}
+
+rule Windows_Trojan_Metasploit_24338919 {
+    meta:
+        id = "24338919-8efe-4cf2-a23a-a3f22095b42d"
+        fingerprint = "ac76190a84c4bdbb6927c5ad84a40e2145ca9e76369a25ac2ffd727eefef4804"
+        creation_date = "2021-03-23"
+        last_modified = "2021-08-23"
+        description = "Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon)."
+        threat_name = "Windows.Trojan.Metasploit"
+        severity = 80
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07 }
+    condition:
+        $a1
+}
+
+rule Windows_Trojan_Metasploit_0f5a852d {
+    meta:
+        id = "0f5a852d-cacd-43d7-8754-204b09afba2f"
+        fingerprint = "97daac4249e85a73d4e6a4450248e59e0d286d5e7c230cf32a38608f8333f00d"
+        creation_date = "2021-04-07"
+        last_modified = "2021-08-23"
+        description = "Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families."
+        threat_name = "Windows.Trojan.Metasploit"
+        severity = 80
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 49 BE 77 69 6E 69 6E 65 74 00 41 56 48 89 E1 49 C7 C2 4C 77 26 07 FF D5 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Metasploit_c9773203 {
+    meta:
+        id = "c9773203-6d1e-4246-a1e0-314217e0207a"
+        fingerprint = "afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36"
+        creation_date = "2021-04-07"
+        last_modified = "2021-08-23"
+        description = "Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families."
+        threat_name = "Windows.Trojan.Metasploit"
+        reference = "https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm"
+        severity = 10
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Metasploit_dd5ce989 {
+    meta:
+        id = "dd5ce989-3925-4e27-97c1-3b8927c557e9"
+        fingerprint = "4fc7c309dca197f4626d6dba8afcd576e520dbe2a2dd6f7d38d7ba33ee371d55"
+        creation_date = "2021-04-14"
+        last_modified = "2021-08-23"
+        description = "Identifies Meterpreter DLL used by Metasploit"
+        threat_name = "Windows.Trojan.Metasploit"
+        reference = "https://www.rapid7.com/blog/post/2015/03/25/stageless-meterpreter-payloads/"
+        reference_sample = "86cf98bf854b01a55e3f306597437900e11d429ac6b7781e090eeda3a5acb360"
+        severity = 90
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "metsrv.x64.dll" fullword
+        $a2 = "metsrv.dll" fullword
+        $b1 = "ReflectiveLoader"
+    condition:
+        1 of ($a*) and 1 of ($b*)
+}
+
+rule Windows_Trojan_Metasploit_96233b6b {
+    meta:
+        id = "96233b6b-d95a-4e0e-8f83-f2282a342087"
+        fingerprint = "40032849674714bc9eb020971dd9f27a07b53b8ff953b793cb3aad136256fd70"
+        creation_date = "2021-06-10"
+        last_modified = "2021-08-23"
+        description = "Identifies another 64 bit API hashing function used by Metasploit."
+        threat_name = "Windows.Trojan.Metasploit"
+        reference_sample = "e7a2d966deea3a2df6ce1aeafa8c2caa753824215a8368e0a96b394fb46b753b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 31 FF 0F B7 4A 26 31 C0 AC 3C 61 7C 02 2C 20 C1 CF 0D }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Metasploit_4a1c4da8 {
+    meta:
+        id = "4a1c4da8-837d-4ad1-a672-ddb8ba074936"
+        fingerprint = "7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987"
+        creation_date = "2021-06-10"
+        last_modified = "2021-08-23"
+        description = "Identifies Metasploit 64 bit reverse tcp shellcode."
+        threat_name = "Windows.Trojan.Metasploit"
+        reference_sample = "9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Metasploit_91bc5d7d {
+    meta:
+        id = "91bc5d7d-31e3-4c02-82b3-a685194981f3"
+        fingerprint = "8848a3de66a25dd98278761a7953f31b7995e48621dec258f3d92bd91a4a3aa3"
+        creation_date = "2021-08-02"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Metasploit"
+        reference_sample = "0dd993ff3917dc56ef02324375165f0d66506c5a9b9548eda57c58e041030987"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 49 BE 77 73 32 5F 33 32 00 00 41 56 49 89 E6 48 81 EC A0 01 00 00 49 89 E5 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_MicroBackdoor.yar b/yara/rules/Windows_Trojan_MicroBackdoor.yar
new file mode 100644
index 00000000..918de440
--- /dev/null
+++ b/yara/rules/Windows_Trojan_MicroBackdoor.yar
@@ -0,0 +1,43 @@
+rule Windows_Trojan_MicroBackdoor_903e33c3 {
+    meta:
+        id = "903e33c3-d8f1-4c3b-900b-7503edb11951"
+        fingerprint = "06b3c0164c2d06f50d1e6ae0a9edf823ae1fef53574e0d20020aada8721dfee0"
+        creation_date = "2022-03-07"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.MicroBackdoor"
+        reference_sample = "fbbfcc81a976b57739ef13c1545ea4409a1c69720469c05ba249a42d532f9c21"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 55 8B EC 83 EC 1C 56 57 E8 33 01 00 00 8B F8 85 FF 74 48 BA 26 80 AC C8 8B CF E8 E1 01 00 00 BA }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_MicroBackdoor_46f2e5fd {
+    meta:
+        id = "46f2e5fd-edea-4321-b38c-7478b47f054b"
+        fingerprint = "d4e410b9c36c1d5206f5d17190ef4e5fd4b4e4d40acad703775aed085a08ef7c"
+        creation_date = "2022-03-07"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.MicroBackdoor"
+        reference_sample = "fbbfcc81a976b57739ef13c1545ea4409a1c69720469c05ba249a42d532f9c21"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "cmd.exe /C \"%s%s\"" wide fullword
+        $a2 = "%s|%s|%d|%s|%d|%d" wide fullword
+        $a3 = "{{{$%.8x}}}" ascii fullword
+        $a4 = "30D78F9B-C56E-472C-8A29-E9F27FD8C985" ascii fullword
+        $a5 = "chcp 65001 > NUL & " wide fullword
+        $a6 = "CONNECT %s:%d HTTP/1.0" ascii fullword
+    condition:
+        5 of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Nanocore.yar b/yara/rules/Windows_Trojan_Nanocore.yar
new file mode 100644
index 00000000..c315d5b4
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Nanocore.yar
@@ -0,0 +1,29 @@
+rule Windows_Trojan_Nanocore_d8c4e3c5 {
+    meta:
+        id = "d8c4e3c5-8bcc-43d2-9104-fa3774282da5"
+        fingerprint = "e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4"
+        creation_date = "2021-06-13"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Nanocore"
+        reference_sample = "b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "NanoCore.ClientPluginHost" ascii fullword
+        $a2 = "NanoCore.ClientPlugin" ascii fullword
+        $b1 = "get_BuilderSettings" ascii fullword
+        $b2 = "ClientLoaderForm.resources" ascii fullword
+        $b3 = "PluginCommand" ascii fullword
+        $b4 = "IClientAppHost" ascii fullword
+        $b5 = "GetBlockHash" ascii fullword
+        $b6 = "AddHostEntry" ascii fullword
+        $b7 = "LogClientException" ascii fullword
+        $b8 = "PipeExists" ascii fullword
+        $b9 = "IClientLoggingHost" ascii fullword
+    condition:
+        1 of ($a*) or 6 of ($b*)
+}
+
diff --git a/yara/rules/Windows_Trojan_Netwire.yar b/yara/rules/Windows_Trojan_Netwire.yar
new file mode 100644
index 00000000..012b6610
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Netwire.yar
@@ -0,0 +1,40 @@
+rule Windows_Trojan_Netwire_6a7df287 {
+    meta:
+        id = "6a7df287-1656-4779-9a96-c0ab536ae86a"
+        fingerprint = "85051a0b94da4388eaead4c4f4b2d16d4a5eb50c3c938b3daf5c299c9c12f1e6"
+        creation_date = "2021-06-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Netwire"
+        reference_sample = "e6f446dbefd4469b6c4d24988dd6c9ccd331c8b36bdbc4aaf2e5fc49de2c3254"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 0F B6 74 0C 10 89 CF 29 C7 F7 C6 DF 00 00 00 74 09 41 89 F3 88 5C }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Netwire_1b43df38 {
+    meta:
+        id = "1b43df38-886e-4f58-954a-a09f30f19907"
+        fingerprint = "4142ea14157939dc23b8d1f5d83182aef3a5877d2506722f7a2706b7cb475b76"
+        creation_date = "2021-06-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Netwire"
+        reference_sample = "e6f446dbefd4469b6c4d24988dd6c9ccd331c8b36bdbc4aaf2e5fc49de2c3254"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "[%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword
+        $a2 = "\\Login Data"
+        $a3 = "SOFTWARE\\NetWire" fullword
+    condition:
+        2 of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Njrat.yar b/yara/rules/Windows_Trojan_Njrat.yar
new file mode 100644
index 00000000..149843c2
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Njrat.yar
@@ -0,0 +1,24 @@
+rule Windows_Trojan_Njrat_30f3c220 {
+    meta:
+        id = "30f3c220-b8dc-45a1-bcf0-027c2f76fa63"
+        fingerprint = "d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4"
+        creation_date = "2021-06-13"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Njrat"
+        reference_sample = "741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "get_Registry" ascii fullword
+        $a2 = "SEE_MASK_NOZONECHECKS" wide fullword
+        $a3 = "Download ERROR" wide fullword
+        $a4 = "cmd.exe /c ping 0 -n 2 & del \"" wide fullword
+        $a5 = "netsh firewall delete allowedprogram \"" wide fullword
+        $a6 = "[+] System : " wide fullword
+    condition:
+        3 of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Octopus.yar b/yara/rules/Windows_Trojan_Octopus.yar
new file mode 100644
index 00000000..34ea819a
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Octopus.yar
@@ -0,0 +1,19 @@
+rule Windows_Trojan_Octopus_15813e26 {
+    meta:
+        id = "15813e26-77f8-46cf-a6a3-ae081925b85a"
+        fingerprint = "a3294547f7e3cead0cd64eb3d2e7dbd8ccfc4d9eedede240a643c8cd114cbcce"
+        creation_date = "2021-11-10"
+        last_modified = "2022-01-13"
+        description = "Identifies Octopus, an Open source pre-operation C2 server based on Python and PowerShell"
+        threat_name = "Windows.Trojan.Octopus"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = "C:\\Users\\UNKNOWN\\source\\repos\\OctopusUnmanagedExe\\OctopusUnmanagedExe\\obj\\x64\\Release\\SystemConfiguration.pdb" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_OnlyLogger.yar b/yara/rules/Windows_Trojan_OnlyLogger.yar
new file mode 100644
index 00000000..347e91b6
--- /dev/null
+++ b/yara/rules/Windows_Trojan_OnlyLogger.yar
@@ -0,0 +1,45 @@
+rule Windows_Trojan_OnlyLogger_b9e88336 {
+    meta:
+        id = "b9e88336-9719-4f43-afc9-b0e6c7d72b6f"
+        fingerprint = "5c8c98b250252d178c8dbad60bf398489d9396968e33b3e004219a4f323eeed8"
+        creation_date = "2022-03-22"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.OnlyLogger"
+        reference_sample = "69876ee4d89ba68ee86f1a4eaf0a7cb51a012752e14c952a177cd5ffd8190986"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "C:\\Users\\Ddani\\source\\repos\\onlyLogger\\Release\\onlyLogger.pdb" ascii fullword
+        $b1 = "iplogger.org" ascii fullword
+        $b2 = "NOT elevated" ascii fullword
+        $b3 = "WinHttpSendRequest" ascii fullword
+    condition:
+        1 of ($a*) or all of ($b*)
+}
+
+rule Windows_Trojan_OnlyLogger_ec14d5f2 {
+    meta:
+        id = "ec14d5f2-5716-47f3-a7fb-98ec2d8679d1"
+        fingerprint = "c69da3dfe0a464665759079207fbc0c82e690d812b38c83d3f4cd5998ecee1ff"
+        creation_date = "2022-03-22"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.OnlyLogger"
+        reference_sample = "f45adcc2aad5c0fd900df4521f404bc9ca71b01e3378a5490f5ae2f0c711912e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "KILLME" ascii fullword
+        $a2 = "%d-%m-%Y %H" ascii fullword
+        $a3 = "/c taskkill /im \"" ascii fullword
+        $a4 = "\" /f & erase \"" ascii fullword
+        $a5 = "/info.php?pub=" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_OskiStealer.yar b/yara/rules/Windows_Trojan_OskiStealer.yar
new file mode 100644
index 00000000..7b63f621
--- /dev/null
+++ b/yara/rules/Windows_Trojan_OskiStealer.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_OskiStealer_a158b1e3 {
+    meta:
+        id = "a158b1e3-21b7-4009-9646-6bee9bde98ad"
+        fingerprint = "3996a89d37494b118654f3713393f415c662850a5a76afa00e83f9611aee3221"
+        creation_date = "2022-03-21"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.OskiStealer"
+        reference_sample = "568cd515c9a3bce7ef21520761b02cbfc95d8884d5b2dc38fc352af92356c694"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "\"os_crypt\":{\"encrypted_key\":\"" ascii fullword
+        $a2 = "%s / %s" ascii fullword
+        $a3 = "outlook.txt" ascii fullword
+        $a4 = "GLoX6gmCFw==" ascii fullword
+        $a5 = "KaoQpEzKSjGm8Q==" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Pandastealer.yar b/yara/rules/Windows_Trojan_Pandastealer.yar
new file mode 100644
index 00000000..54db150d
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Pandastealer.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_Pandastealer_8b333e76 {
+    meta:
+        id = "8b333e76-f723-4093-ad72-2f5d42aaa9c9"
+        fingerprint = "873af8643b7f08b159867c3556654a5719801aa82e1a1f6402029afad8c01487"
+        creation_date = "2021-09-02"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Pandastealer"
+        reference_sample = "ec346bd56be375b695b4bc76720959fa07d1357ffc3783eb61de9b8d91b3d935"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "] - [user: " ascii fullword
+        $a2 = "[-] data unpacked failed" ascii fullword
+        $a3 = "[+] data unpacked" ascii fullword
+        $a4 = "\\history\\" ascii fullword
+        $a5 = "PlayerName" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Phoreal.yar b/yara/rules/Windows_Trojan_Phoreal.yar
new file mode 100644
index 00000000..c6b18c37
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Phoreal.yar
@@ -0,0 +1,22 @@
+rule Windows_Trojan_Phoreal_66e91de3 {
+    meta:
+        id = "66e91de3-a510-4a64-b03d-5385ceb32360"
+        fingerprint = "36c9150137b3d65ea6127abe54571f7346c5ebffd1966bf0a9ff99406fe5aa24"
+        creation_date = "2022-02-16"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Phoreal"
+        reference_sample = "88f073552b30462a00d1d612b1638b0508e4ef02c15cf46203998091f0aef4de"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 5C 00 5C 00 2E 00 5C 00 70 00 69 00 70 00 65 00 5C 00 7B 00 41 00 30 00 36 00 46 00 31 00 37 00 36 00 46 00 2D 00 37 00 39 00 46 00 31 00 2D 00 34 00 37 00 33 00 45 00 2D 00 41 00 46 00 34 00 34 00 2D 00 39 00 37 00 36 00 33 00 45 00 33 00 43 00 42 00 33 00 34 00 45 00 35 00 7D 00 }
+        $a2 = { 4C 00 6F 00 63 00 61 00 6C 00 5C 00 7B 00 35 00 46 00 42 00 43 00 33 00 46 00 35 00 33 00 2D 00 41 00 37 00 36 00 44 00 2D 00 34 00 32 00 34 00 38 00 2D 00 39 00 36 00 39 00 41 00 2D 00 33 00 31 00 37 00 34 00 30 00 43 00 42 00 43 00 38 00 41 00 44 00 36 00 7D 00 }
+        $a3 = { 7B 46 44 35 46 38 34 34 37 2D 36 35 37 41 2D 34 35 43 31 2D 38 39 34 42 2D 44 35 33 33 39 32 36 43 39 42 36 36 7D 2E 64 6C 6C }
+        $b1 = { 8B FF 55 8B EC 56 E8 3F 3E 00 00 E8 34 3E 00 00 50 E8 14 3E 00 00 85 C0 75 2A 8B 75 08 56 E8 21 }
+    condition:
+        2 of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Pingpull.yar b/yara/rules/Windows_Trojan_Pingpull.yar
new file mode 100644
index 00000000..a2ee2599
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Pingpull.yar
@@ -0,0 +1,25 @@
+rule Windows_Trojan_Pingpull_09dd9559 {
+    meta:
+        id = "09dd9559-ce77-4f55-9e81-3b90add40103"
+        fingerprint = "b471e0f40780523bf396323a3b70fd285944fef2960ae43a36068eaf2f2fea4f"
+        creation_date = "2022-06-16"
+        last_modified = "2022-07-18"
+        threat_name = "Windows.Trojan.Pingpull"
+        reference_sample = "de14f22c88e552b61c62ab28d27a617fb8c0737350ca7c631de5680850282761"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $s1 = "PROJECT_%s_%s_%08X" ascii fullword
+        $s2 = "Iph1psvc" ascii fullword
+        $s3 = "IP He1per" ascii fullword
+        $s4 = "If this service is stopped, the computer will not have the enhanced connectivity benefits that these technologies offer."
+        $a1 = { 02 C? 66 C7 44 24 ?? 3A 00 4C 8D 44 24 ?? 88 4C 24 ?? 48 83 C9 FF 88 44 24 ?? F2 AE 33 ?? 0F 1F }
+        $a2 = { 48 85 FF 74 ?? 41 C1 E0 04 0F B6 4C 3C ?? 33 D2 8D 41 ?? ?? 19 77 ?? 80 C1 E0 8D 41 ?? 3C 09 77 }
+        $a3 = { 4C 63 74 24 ?? 48 8B ?? 43 8D 44 36 ?? 4C 63 E8 49 8B CD E8 ?? ?? ?? ?? 48 8B ?? 48 85 C0 0F 84 }
+    condition:
+        3 of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Pony.yar b/yara/rules/Windows_Trojan_Pony.yar
new file mode 100644
index 00000000..d19d9cc7
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Pony.yar
@@ -0,0 +1,25 @@
+rule Windows_Trojan_Pony_d5516fe8 {
+    meta:
+        id = "d5516fe8-3b25-4c46-9e5b-111ca312a824"
+        fingerprint = "9d4d847f55a693a45179a904efe20afd05a92650ac47fb19ef523d469a33795f"
+        creation_date = "2021-08-14"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Pony"
+        reference_sample = "423e792fcd00265960877482e8148a0d49f0898f4bbc190894721fde22638567"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "\\Global Downloader" ascii fullword
+        $a2 = "wiseftpsrvs.bin" ascii fullword
+        $a3 = "SiteServer %d\\SFTP" ascii fullword
+        $a4 = "%s\\Keychain" ascii fullword
+        $a5 = "Connections.txt" ascii fullword
+        $a6 = "ftpshell.fsi" ascii fullword
+        $a7 = "inetcomm server passwords" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_ProtectS.yar b/yara/rules/Windows_Trojan_ProtectS.yar
new file mode 100644
index 00000000..d62fca8d
--- /dev/null
+++ b/yara/rules/Windows_Trojan_ProtectS.yar
@@ -0,0 +1,19 @@
+rule Windows_Trojan_ProtectS_9f6eaa90 {
+    meta:
+        id = "9f6eaa90-b3d4-4f0f-a81e-8010be0a6d36"
+        fingerprint = "46bf59901876794dcc338923076939d765d3ce7f14d784b9687fbc05461ed6b4"
+        creation_date = "2022-04-04"
+        last_modified = "2022-06-09"
+        threat_name = "Windows.Trojan.ProtectS"
+        reference_sample = "c0330e072b7003f55a3153ac3e0859369b9c3e22779b113284e95ce1e2ce2099"
+        severity = 50
+        arch_context = "x86"
+        scan_context = "file"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $str1 = "\\ProtectS.pdb"
+    condition:
+        int16(uint32(0x3C) + 0x5c) == 0x0001 and $str1
+}
+
diff --git a/yara/rules/Windows_Trojan_Qbot.yar b/yara/rules/Windows_Trojan_Qbot.yar
new file mode 100644
index 00000000..1e1e214c
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Qbot.yar
@@ -0,0 +1,109 @@
+rule Windows_Trojan_Qbot_92c67a6d {
+    meta:
+        id = "92c67a6d-9290-4cd9-8123-7dace2cf333d"
+        fingerprint = "4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd"
+        creation_date = "2021-02-16"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Qbot"
+        reference_sample = "636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Qbot_d91c1384 {
+    meta:
+        id = "d91c1384-839f-4062-8a8d-5cda931029ae"
+        fingerprint = "1b47ede902b6abfd356236e91ed3e741cf1744c68b6bb566f0d346ea07fee49a"
+        creation_date = "2021-07-08"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Qbot"
+        reference_sample = "18ac3870aaa9aaaf6f4a5c0118daa4b43ad93d71c38bf42cb600db3d786c6dda"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { FE 8A 14 06 88 50 FF 8A 54 BC 11 88 10 8A 54 BC 10 88 50 01 47 83 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Qbot_7d5dc64a {
+    meta:
+        id = "7d5dc64a-a597-44ac-a0fd-cefffc5e9cff"
+        fingerprint = "ab80d96a454e0aad56621e70be4d55f099c41b538a380feb09192d252b4db5aa"
+        creation_date = "2021-10-04"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Qbot"
+        reference_sample = "a2bacde7210d88675564106406d9c2f3b738e2b1993737cb8bf621b78a9ebf56"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "%u.%u.%u.%u.%u.%u.%04x" ascii fullword
+        $a2 = "stager_1.dll" ascii fullword
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Qbot_6fd34691 {
+    meta:
+        id = "6fd34691-10e4-4a66-85ff-1b67ed3da4dd"
+        fingerprint = "187fc04abcba81a2cbbe839adf99b8ab823cbf65993c8780d25e7874ac185695"
+        creation_date = "2022-03-07"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Qbot"
+        reference_sample = "0838cd11d6f504203ea98f78cac8f066eb2096a2af16d27fb9903484e7e6a689"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 75 C9 8B 45 1C 89 45 A4 8B 45 18 89 45 A8 8B 45 14 89 45 AC 8B }
+        $a2 = "\\stager_1.obf\\Benign\\mfc\\" wide
+    condition:
+        any of them
+}
+
+rule Windows_Trojan_Qbot_3074a8d4 {
+    meta:
+        id = "3074a8d4-d93c-4987-9031-9ecd3881730d"
+        fingerprint = "c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac"
+        creation_date = "2022-06-07"
+        last_modified = "2022-07-18"
+        threat_name = "Windows.Trojan.Qbot"
+        reference_sample = "c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "qbot" wide
+        $a2 = "stager_1.obf\\Benign\\mfc" wide
+        $a3 = "common.obf\\Benign\\mfc" wide
+        $a4 = "%u;%u;%u;"
+        $a5 = "%u.%u.%u.%u.%u.%u.%04x"
+        $a6 = "%u&%s&%u"
+        $get_string1 = { 33 D2 8B ?? 6A 5A 5? F7 ?? 8B ?? 08 8A 04 ?? 8B 55 ?? 8B ?? 10 3A 04 ?? }
+        $get_string2 = { 33 D2 8B ?? F7 75 F4 8B 45 08 8A 04 02 32 04 ?? 88 04 ?? ?? 83 ?? 01 }
+        $set_key = { 8D 87 00 04 00 00 50 56 E8 ?? ?? ?? ?? 59 8B D0 8B CE E8 }
+        $do_computer_use_russian_like_keyboard = { B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D }
+        $execute_each_tasks = { 8B 44 0E ?? 85 C0 74 ?? FF D0 EB ?? 6A 00 6A 00 6A 00 FF 74 0E ?? E8 ?? ?? ?? ?? 83 C4 10 }
+        $generate_random_alpha_num_string = { 57 E8 ?? ?? ?? ?? 48 50 8D 85 ?? ?? ?? ?? 6A 00 50 E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C }
+        $load_base64_dll_from_file_and_inject_into_targets = { 10 C7 45 F0 50 00 00 00 83 65 E8 00 83 7D F0 0B 73 08 8B 45 F0 89 }
+    condition:
+        6 of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Quasarrat.yar b/yara/rules/Windows_Trojan_Quasarrat.yar
new file mode 100644
index 00000000..3248be79
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Quasarrat.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_Quasarrat_e52df647 {
+    meta:
+        id = "e52df647-c197-4790-b051-8951fba80c3b"
+        fingerprint = "c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815"
+        creation_date = "2021-06-27"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Quasarrat"
+        reference_sample = "a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "GetKeyloggerLogsResponse" ascii fullword
+        $a2 = "DoDownloadAndExecute" ascii fullword
+        $a3 = "http://api.ipify.org/" wide fullword
+        $a4 = "Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7}" wide fullword
+        $a5 = "\" /sc ONLOGON /tr \"" wide fullword
+    condition:
+        4 of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Raccoon.yar b/yara/rules/Windows_Trojan_Raccoon.yar
new file mode 100644
index 00000000..406b490a
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Raccoon.yar
@@ -0,0 +1,61 @@
+rule Windows_Trojan_Raccoon_af6decc6 {
+    meta:
+        id = "af6decc6-f917-4a80-b96d-1e69b8f8ebe0"
+        fingerprint = "f9314a583040e4238aab7712ac16d7638a3b7c9194cbcf2ea9b4516c228c546b"
+        creation_date = "2021-06-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Raccoon"
+        reference_sample = "fe09bef10b21f085e9ca411e24e0602392ab5044b7268eaa95fb88790f1a124d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "A:\\_Work\\rc-build-v1-exe\\json.hpp" wide fullword
+        $a2 = "\\stealler\\json.hpp" wide fullword
+    condition:
+        any of them
+}
+
+rule Windows_Trojan_Raccoon_58091f64 {
+    meta:
+        id = "58091f64-2118-47f8-bcb2-407a3c62fa33"
+        fingerprint = "ea819b46ec08ba6b33aa19dcd6b5ad27d107a8e37f3f9eb9ff751fe8e1612f88"
+        creation_date = "2021-06-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Raccoon"
+        reference_sample = "fe09bef10b21f085e9ca411e24e0602392ab5044b7268eaa95fb88790f1a124d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 74 FF FF FF 10 8D 4D AC 53 6A 01 8D 85 60 FF FF FF 0F 43 85 60 FF }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Raccoon_deb6325c {
+    meta:
+        id = "deb6325c-5556-44ce-a184-6369105485d5"
+        fingerprint = "17c34b5b9a0211255a93f9662857361680e72a45135d6ea9b5af8d77b54583b9"
+        creation_date = "2022-06-28"
+        last_modified = "2022-07-18"
+        threat_name = "Windows.Trojan.Raccoon"
+        reference_sample = "f7b1aaae018d5287444990606fc43a0f2deb4ac0c7b2712cc28331781d43ae27"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "\\ffcookies.txt" wide fullword
+        $a2 = "wallet.dat" wide fullword
+        $a3 = "0Network\\Cookies" wide fullword
+        $a4 = "Wn0nlDEXjIzjLlkEHYxNvTAXHXRteWg0ieGKVyD52CvONbW7G91RvQDwSZi/N2ISm4xEWRKYJwjnYUGS9OZmj/TAie8jG07EXEcO8D7h2m2lGzWnFG31R1rsxG1+G8E="
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_RedLineStealer.yar b/yara/rules/Windows_Trojan_RedLineStealer.yar
new file mode 100644
index 00000000..f77cacfb
--- /dev/null
+++ b/yara/rules/Windows_Trojan_RedLineStealer.yar
@@ -0,0 +1,156 @@
+rule Windows_Trojan_RedLineStealer_17ee6a17 {
+    meta:
+        id = "17ee6a17-161e-454a-baf1-2734995c82cd"
+        fingerprint = "a1f75937e83f72f61e027a1045374d3bd17cd387b223a6909b9aed52d2bc2580"
+        creation_date = "2021-06-12"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.RedLineStealer"
+        reference_sample = "497bc53c1c75003fe4ae3199b0ff656c085f21dffa71d00d7a3a33abce1a3382"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "RedLine.Logic.SQLite" ascii fullword
+        $a2 = "RedLine.Reburn.Data.Browsers.Gecko" ascii fullword
+        $a3 = "RedLine.Client.Models.Gecko" ascii fullword
+        $b1 = "SELECT * FROM Win32_Process Where SessionId='{0}'" wide fullword
+        $b2 = "get_encryptedUsername" ascii fullword
+        $b3 = "https://icanhazip.com" wide fullword
+        $b4 = "GetPrivate3Key" ascii fullword
+        $b5 = "get_GrabTelegram" ascii fullword
+        $b6 = "<GrabUserAgent>k__BackingField" ascii fullword
+    condition:
+        1 of ($a*) or all of ($b*)
+}
+
+rule Windows_Trojan_RedLineStealer_f54632eb {
+    meta:
+        id = "f54632eb-2c66-4aff-802d-ad1c076e5a5e"
+        fingerprint = "6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0"
+        creation_date = "2021-06-12"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.RedLineStealer"
+        reference_sample = "d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "ttp://checkip.amazonaws.com/logins.json" wide fullword
+        $a2 = "https://ipinfo.io/ip%appdata%\\" wide fullword
+        $a3 = "Software\\Valve\\SteamLogin Data" wide fullword
+        $a4 = "get_ScannedWallets" ascii fullword
+        $a5 = "get_ScanTelegram" ascii fullword
+        $a6 = "get_ScanGeckoBrowsersPaths" ascii fullword
+        $a7 = "<Processes>k__BackingField" ascii fullword
+        $a8 = "<GetWindowsVersion>g__HKLM_GetString|11_0" ascii fullword
+        $a9 = "<ScanFTP>k__BackingField" ascii fullword
+        $a10 = "DataManager.Data.Credentials" ascii fullword
+    condition:
+        6 of ($a*)
+}
+
+rule Windows_Trojan_RedLineStealer_a7da40b7 {
+    meta:
+        id = "a7da40b7-63cc-4456-a592-0485932092d5"
+        fingerprint = "62a62ede10d977582329b3daaa80b0b64576add77736135bac97d3a3eb6de558"
+        creation_date = "2022-02-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.RedLineStealer"
+        reference_sample = "2fb7241ffdfa7525f125e6d7b18e895cfb512ebb6905d056dbe7d76e8d6df806"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 18 B9 10 00 00 00 83 E2 0F 2B CA 3B 4D 14 76 03 8B 4D 14 8D 5C }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_RedLineStealer_d4b38e13 {
+    meta:
+        id = "d4b38e13-1439-4549-ba90-0b4a8ed57fb3"
+        fingerprint = "c91f97a7e609d8138f8c5c7dd66cf675b1b3762f26baa5bf983ee212011b99cb"
+        creation_date = "2022-02-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.RedLineStealer"
+        reference_sample = "a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 5B 5D C2 04 00 8B C2 5F 5E 5B 5D C2 04 00 55 8B EC 57 8B 45 08 0F }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_RedLineStealer_d25e974b {
+    meta:
+        id = "d25e974b-7cf0-4c0e-bf57-056cbb90d77e"
+        fingerprint = "f936511802dcce39dfed9ec898f3ab0c4b822fd38bac4e84d60966c7b791688c"
+        creation_date = "2022-02-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.RedLineStealer"
+        reference_sample = "a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 48 43 3F FF 48 42 3F FF 48 42 3F FF 48 42 3E FF 48 42 3E FF }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_RedLineStealer_ed346e4c {
+    meta:
+        id = "ed346e4c-7890-41ee-8648-f512682fe20e"
+        fingerprint = "834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82"
+        creation_date = "2022-02-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.RedLineStealer"
+        reference_sample = "a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_RedLineStealer_3d9371fd {
+    meta:
+        id = "3d9371fd-c094-40fc-baf8-f0e9e9a54ff9"
+        fingerprint = "2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23"
+        creation_date = "2022-02-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.RedLineStealer"
+        reference_sample = "0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "get_encrypted_key" ascii fullword
+        $a2 = "get_PassedPaths" ascii fullword
+        $a3 = "ChromeGetLocalName" ascii fullword
+        $a4 = "GetBrowsers" ascii fullword
+        $a5 = "Software\\Valve\\SteamLogin Data" wide fullword
+        $a6 = "%appdata%\\" wide fullword
+        $a7 = "ScanPasswords" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Remcos.yar b/yara/rules/Windows_Trojan_Remcos.yar
new file mode 100644
index 00000000..2b4cf2e0
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Remcos.yar
@@ -0,0 +1,22 @@
+rule Windows_Trojan_Remcos_b296e965 {
+    meta:
+        id = "b296e965-a99e-4446-b969-ba233a2a8af4"
+        fingerprint = "a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d"
+        creation_date = "2021-06-10"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Remcos"
+        reference_sample = "0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Remcos restarted by watchdog!" ascii fullword
+        $a2 = "Mutex_RemWatchdog" ascii fullword
+        $a3 = "%02i:%02i:%02i:%03i"
+        $a4 = "* Remcos v" ascii fullword
+    condition:
+        2 of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Remotemanipulator.yar b/yara/rules/Windows_Trojan_Remotemanipulator.yar
new file mode 100644
index 00000000..6b29cde1
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Remotemanipulator.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_Remotemanipulator_9ec52153 {
+    meta:
+        id = "9ec52153-3b62-432d-b87c-895035df1a46"
+        fingerprint = "02220e8af70ecffb3a7585f756c59ef5d9e17e6690c36d6bffc458e1d17dbd0c"
+        creation_date = "2021-09-02"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Remotemanipulator"
+        reference_sample = "1dd15c830c0a159b53ed21b8c2ce1b7e8093256368d7b96c1347c6851ee6c4f6"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "killself.bat" wide fullword
+        $a2 = "rutserv.exe" wide fullword
+        $a3 = "rfusclient.exe" wide fullword
+        $a4 = "install.log" wide fullword
+        $a5 = "Unable to create Agent's path." wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Revcoderat.yar b/yara/rules/Windows_Trojan_Revcoderat.yar
new file mode 100644
index 00000000..bc15d072
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Revcoderat.yar
@@ -0,0 +1,22 @@
+rule Windows_Trojan_Revcoderat_8e6d4182 {
+    meta:
+        id = "8e6d4182-4ea8-4d4c-ad3a-d16b42e387f4"
+        fingerprint = "bc259d888e913dffb4272e2f871592238eb78922989d30ac4dc23cdeb988cc78"
+        creation_date = "2021-09-02"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Revcoderat"
+        reference_sample = "77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "PLUGIN_PROCESS_REVERSE_PROXY: Plugin already exists, skipping download!" ascii fullword
+        $a2 = "TARGET_HOST_UPDATE(): Sync successful!" ascii fullword
+        $a3 = "WEBCAM_ACTIVATE: Plugin already exists, skipping download!" ascii fullword
+        $a4 = "send_keylog_get" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Revengerat.yar b/yara/rules/Windows_Trojan_Revengerat.yar
new file mode 100644
index 00000000..5f9ce339
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Revengerat.yar
@@ -0,0 +1,22 @@
+rule Windows_Trojan_Revengerat_db91bcc6 {
+    meta:
+        id = "db91bcc6-024d-42da-8d0a-bd69374bf622"
+        fingerprint = "9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666"
+        creation_date = "2021-09-02"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Revengerat"
+        reference_sample = "30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Revenge-RAT" wide fullword
+        $a2 = "SELECT * FROM FirewallProduct" wide fullword
+        $a3 = "HKEY_CURRENT_USER\\SOFTWARE\\" wide fullword
+        $a4 = "get_MachineName" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_SVCReady.yar b/yara/rules/Windows_Trojan_SVCReady.yar
new file mode 100644
index 00000000..f0af38bb
--- /dev/null
+++ b/yara/rules/Windows_Trojan_SVCReady.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_SVCReady_af498d39 {
+    meta:
+        id = "af498d39-6ae8-46de-ad6c-81b346d80139"
+        fingerprint = "6e30d9977698c7864a8c264a7fe8c9a558f6e51dda9c887bda94261ce187645f"
+        creation_date = "2022-06-12"
+        last_modified = "2022-07-18"
+        threat_name = "Windows.Trojan.SVCReady"
+        reference_sample = "08e427c92010a8a282c894cf5a77a874e09c08e283a66f1905c131871cc4d273"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "RunPEDllNative::HookNtCreateUserProcess fail: targetMapping.valid" ascii fullword
+        $a2 = "Section Mapping error:Process=0x%x Section [%s] res[0x%x] != va[0x%x] Status:%u" ascii fullword
+        $a3 = "%s - %I64d < %I64d > %I64d clicks, %I64d pixels, ready=%i" ascii fullword
+        $a4 = "Svc:windowThreadRunner done" ascii fullword
+        $a5 = "svc commonMain" ascii fullword
+    condition:
+        4 of them
+}
+
diff --git a/yara/rules/Windows_Trojan_ServHelper.yar b/yara/rules/Windows_Trojan_ServHelper.yar
new file mode 100644
index 00000000..5d9b741e
--- /dev/null
+++ b/yara/rules/Windows_Trojan_ServHelper.yar
@@ -0,0 +1,39 @@
+rule Windows_Trojan_ServHelper_f4dee200 {
+    meta:
+        id = "f4dee200-5471-472b-a017-bfcc9c291cbe"
+        fingerprint = "24e49a0c72e665a03cea66614481665eea962a0c6b0a2f9d459866d8070ab456"
+        creation_date = "2022-03-22"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.ServHelper"
+        reference_sample = "05d183430a7afe16a3857fc4e87568fcc18518e108823c37eabf0514660aa17c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 48 8B 45 78 48 63 4D 44 48 8B 55 48 4C 63 45 44 48 0F B7 44 48 FE 66 42 33 44 42 FE 66 89 45 42 48 8D 4D 28 48 0F B7 55 42 E8 ?? ?? ?? ?? 48 8B 4D 70 48 8B 55 28 E8 ?? ?? ?? ?? 83 45 44 01 83 EB 01 85 DB 75 ?? }
+        $b = { 39 5D ?? 0F 8F ?? ?? ?? ?? 2B D8 83 C3 01 48 8B 45 ?? 48 63 4D ?? 66 83 7C 48 ?? 20 72 ?? 48 8B 45 ?? 48 63 4D ?? 66 83 7C 48 ?? 7F 76 ?? 48 8B 45 ?? 48 63 4D ?? 48 0F B7 44 48 ?? 66 83 E8 08 66 83 F8 07 77 ?? B2 01 8B C8 80 E1 7F D3 E2 48 0F B6 05 ?? ?? ?? ?? 84 C2 0F 95 C0 EB ?? 33 C0 84 C0 74 ?? 83 45 ?? 01 }
+    condition:
+        any of them
+}
+
+rule Windows_Trojan_ServHelper_370c5287 {
+    meta:
+        id = "370c5287-0e2f-4113-95b6-53d31671fa46"
+        fingerprint = "a66134e9344cc5ba403fe0aad70e8a991c61582d6a5640c3b9e4a554374176a2"
+        creation_date = "2022-03-24"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.ServHelper"
+        reference_sample = "05d183430a7afe16a3857fc4e87568fcc18518e108823c37eabf0514660aa17c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 00 10 66 01 00 48 66 01 00 98 07 2B 00 50 66 01 00 95 66 01 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Smokeloader.yar b/yara/rules/Windows_Trojan_Smokeloader.yar
new file mode 100644
index 00000000..ce2ab8fa
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Smokeloader.yar
@@ -0,0 +1,57 @@
+rule Windows_Trojan_Smokeloader_4e31426e {
+    meta:
+        id = "4e31426e-d62e-4b6d-911b-4223e1f6adef"
+        fingerprint = "cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277"
+        creation_date = "2021-07-21"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Smokeloader"
+        reference_sample = "1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Smokeloader_3687686f {
+    meta:
+        id = "3687686f-8fbf-4f09-9afa-612ee65dc86c"
+        fingerprint = "0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc"
+        creation_date = "2021-07-21"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Smokeloader"
+        reference_sample = "8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Smokeloader_4ee15b92 {
+    meta:
+        id = "4ee15b92-c62f-42d2-bbba-1dac2fa5644f"
+        fingerprint = "5d2ed385c76dbb4c1c755ae88b68306086a199a25a29317ae132bc874b253580"
+        creation_date = "2022-02-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Smokeloader"
+        reference_sample = "09b9283286463b35ea2d5abfa869110eb124eb8c1788eb2630480d058e82abf2"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 24 34 30 33 33 8B 45 F4 5F 5E 5B C9 C2 10 00 55 89 E5 83 EC }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_SnakeKeylogger.yar b/yara/rules/Windows_Trojan_SnakeKeylogger.yar
new file mode 100644
index 00000000..2b2d315d
--- /dev/null
+++ b/yara/rules/Windows_Trojan_SnakeKeylogger.yar
@@ -0,0 +1,32 @@
+rule Windows_Trojan_SnakeKeylogger_af3faa65 {
+    meta:
+        id = "af3faa65-b19d-4267-ac02-1a3b50cdc700"
+        fingerprint = "15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d"
+        creation_date = "2021-04-06"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.SnakeKeylogger"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "get_encryptedPassword" ascii fullword
+        $a2 = "get_encryptedUsername" ascii fullword
+        $a3 = "get_timePasswordChanged" ascii fullword
+        $a4 = "get_passwordField" ascii fullword
+        $a5 = "set_encryptedPassword" ascii fullword
+        $a6 = "get_passwords" ascii fullword
+        $a7 = "get_logins" ascii fullword
+        $a8 = "GetOutlookPasswords" ascii fullword
+        $a9 = "StartKeylogger" ascii fullword
+        $a10 = "KeyLoggerEventArgs" ascii fullword
+        $a11 = "KeyLoggerEventArgsEventHandler" ascii fullword
+        $a12 = "GetDataPassword" ascii fullword
+        $a13 = "_encryptedPassword" ascii fullword
+        $b1 = "----------------S--------N--------A--------K--------E----------------"
+        $c1 = "SNAKE-KEYLOGGER" ascii fullword
+    condition:
+        8 of ($a*) or #b1 > 5 or #c1 > 5
+}
+
diff --git a/yara/rules/Windows_Trojan_Squirrelwaffle.yar b/yara/rules/Windows_Trojan_Squirrelwaffle.yar
new file mode 100644
index 00000000..181588df
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Squirrelwaffle.yar
@@ -0,0 +1,41 @@
+rule Windows_Trojan_Squirrelwaffle_88033ff1 {
+    meta:
+        id = "88033ff1-f9b1-4cdc-bb68-bd3a10027584"
+        fingerprint = "94c0d8ce3e06cf02a6fb57c074ff0ef60346babcde43c61371d099b011d9fcf9"
+        creation_date = "2021-09-20"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Squirrelwaffle"
+        reference_sample = "00d045c89934c776a70318a36655dcdd77e1fedae0d33c98e301723f323f234c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "start /i /min /b start /i /min /b start /i /min /b " ascii fullword
+        $a2 = " HTTP/1.1" ascii fullword
+        $a3 = "Host:" ascii fullword
+        $a4 = "APPDATA" ascii fullword
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Squirrelwaffle_d3b685a1 {
+    meta:
+        id = "d3b685a1-2d1c-44a3-8d83-ff661d491a52"
+        fingerprint = "15df7efab9cc40ff57070d18ae67b549c55595d7cbf3ca02963336e4297156c4"
+        creation_date = "2021-09-21"
+        last_modified = "2022-01-13"
+        threat_name = "Windows.Trojan.Squirrelwaffle"
+        reference_sample = "00d045c89934c776a70318a36655dcdd77e1fedae0d33c98e301723f323f234c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { 08 85 C0 75 0F 8D 45 94 50 8D 45 D0 6A 20 50 FF D7 83 C4 0C }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_StormKitty.yar b/yara/rules/Windows_Trojan_StormKitty.yar
new file mode 100644
index 00000000..661d4a15
--- /dev/null
+++ b/yara/rules/Windows_Trojan_StormKitty.yar
@@ -0,0 +1,24 @@
+rule Windows_Trojan_StormKitty_6256031a {
+    meta:
+        id = "6256031a-e7dd-423b-a83f-4db428cb3d1b"
+        fingerprint = "6f0463de42c97701b0f3b8172e7e461501357921a3d11e6ca467bd1ca397d0b6"
+        creation_date = "2022-03-21"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.StormKitty"
+        reference_sample = "0c69015f534d1da3770dbc14183474a643c4332de6a599278832abd2b15ba027"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "https://github.com/LimerBoy/StormKitty" ascii fullword
+        $a2 = "127.0.0.1 www.malwarebytes.com" wide fullword
+        $a3 = "KillDefender"
+        $a4 = "Username: {1}" wide fullword
+        $a5 = "# End of Cookies" wide fullword
+        $a6 = "# End of Passwords" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_SysJoker.yar b/yara/rules/Windows_Trojan_SysJoker.yar
new file mode 100644
index 00000000..068d437d
--- /dev/null
+++ b/yara/rules/Windows_Trojan_SysJoker.yar
@@ -0,0 +1,47 @@
+rule Windows_Trojan_SysJoker_1ef19a12 {
+    meta:
+        id = "1ef19a12-ee26-47da-8d65-272f6749b476"
+        fingerprint = "9123af8b8b27ebfb9199e70eb34d43378b1796319186d5d848d650a8be02d5d5"
+        creation_date = "2022-02-17"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.SysJoker"
+        reference_sample = "61df74731fbe1eafb2eb987f20e5226962eeceef010164e41ea6c4494a4010fc"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "';Write-Output \"Time taken : $((Get - Date).Subtract($start_time).Seconds) second(s)\"" ascii fullword
+        $a2 = "powershell.exe Expand-Archive -LiteralPath '" ascii fullword
+        $a3 = "powershell.exe Invoke-WebRequest -Uri '" ascii fullword
+        $a4 = "\\recoveryWindows.zip" ascii fullword
+    condition:
+        3 of them
+}
+
+rule Windows_Trojan_SysJoker_34559bcd {
+    meta:
+        id = "34559bcd-661a-4213-b896-2d7f882a16ef"
+        fingerprint = "b1e01d0b94a60f6f5632a14d3d32f78bbe3049886ea3a3e838a29fb790a45918"
+        creation_date = "2022-02-21"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.SysJoker"
+        reference_sample = "1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "\\txc1.txt\" && type \"" ascii fullword
+        $a2 = "tempo1.txt" nocase
+        $a3 = "user_token="
+        $a4 = "{\"status\":\"success\",\"result\":\"" ascii fullword
+        $a5 = "\",\"av\":\"" ascii fullword
+        $a6 = "aSwpEHc0QyIxPRAqNmkeEwskMW8HODkkYRkCICIrJysHNmtlIzQiChMiGAxzQg==" ascii fullword
+        $a7 = "ESQuBT8uQyglJy4QOicGXDMiayYtPQ==" ascii fullword
+    condition:
+        4 of them
+}
+
diff --git a/yara/rules/Windows_Trojan_SystemBC.yar b/yara/rules/Windows_Trojan_SystemBC.yar
new file mode 100644
index 00000000..8872c382
--- /dev/null
+++ b/yara/rules/Windows_Trojan_SystemBC.yar
@@ -0,0 +1,24 @@
+rule Windows_Trojan_SystemBC_5e883723 {
+    meta:
+        id = "5e883723-7eaa-4992-91de-abb0ffbba54e"
+        fingerprint = "add95c1f4bb279c8b189c3d64a0c2602c73363ebfad56a4077119af148dd2d87"
+        creation_date = "2022-03-22"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.SystemBC"
+        reference_sample = "b432805eb6b2b58dd957481aa8a973be58915c26c04630ce395753c6a5196b14"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "GET /tor/rendezvous2/%s HTTP/1.0" ascii fullword
+        $a2 = "https://api.ipify.org/" ascii fullword
+        $a3 = "KEY-----" ascii fullword
+        $a4 = "Host: %s" ascii fullword
+        $a5 = "BEGINDATA" ascii fullword
+        $a6 = "-WindowStyle Hidden -ep bypass -file \"" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Tofsee.yar b/yara/rules/Windows_Trojan_Tofsee.yar
new file mode 100644
index 00000000..8c24cfd5
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Tofsee.yar
@@ -0,0 +1,20 @@
+rule Windows_Trojan_Tofsee_26124fe4 {
+    meta:
+        id = "26124fe4-f2a1-4fc9-8155-585b581476de"
+        fingerprint = "dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31"
+        creation_date = "2022-03-31"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Tofsee"
+        reference_sample = "e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 55 8B EC 8B 45 ?? 57 8B 7D ?? B1 01 85 FF 74 ?? 56 8B 75 ?? 2B F0 8A 14 06 32 55 ?? 88 10 8A D1 02 55 ?? F6 D9 00 55 ?? 40 4F 75 ?? 5E 8B 45 ?? 5F 5D C3 }
+        $b = { 8B 44 24 ?? 53 8A 18 84 DB 74 ?? 8B D0 2B 54 24 ?? 8B 4C 24 ?? 84 DB 74 ?? 8A 19 84 DB 74 ?? 38 1C 0A 75 ?? 41 80 3C 0A 00 75 ?? 80 39 00 74 ?? 40 8A 18 42 84 DB 75 ?? 33 C0 5B C3 }
+    condition:
+        any of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Trickbot.yar b/yara/rules/Windows_Trojan_Trickbot.yar
new file mode 100644
index 00000000..63548c08
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Trickbot.yar
@@ -0,0 +1,937 @@
+rule Windows_Trojan_Trickbot_01365e46 {
+    meta:
+        id = "01365e46-c769-4c6e-913a-4d1e42948af2"
+        fingerprint = "98505c3418945c10bf4f50a183aa49bdbc7c1c306e98132ae3d0fc36e216f191"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "5c450d4be39caef1d9ec943f5dfeb6517047175fec166a52970c08cd1558e172"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 8B 43 28 4C 8B 53 18 4C 8B 5B 10 4C 8B 03 4C 8B 4B 08 89 44 24 38 48 89 4C 24 30 4C }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_06fd4ac4 {
+    meta:
+        id = "06fd4ac4-1155-4068-ae63-4d83db2bd942"
+        fingerprint = "ece49004ed1d27ef92b3b1ec040d06e90687d4ac5a89451e2ae487d92cb24ddd"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        description = "Identifies Trickbot unpacker"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 5F 33 C0 68 ?? ?? 00 00 59 50 E2 FD 8B C7 57 8B EC 05 ?? ?? ?? 00 89 45 04 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_ce4305d1 {
+    meta:
+        id = "ce4305d1-8a6f-4797-afaf-57e88f3d38e6"
+        fingerprint = "ae606e758b02ccf2a9a313aebb10773961121f79a94c447e745289ee045cf4ee"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { F9 8B 45 F4 89 5D E4 85 D2 74 39 83 C0 02 03 C6 89 45 F4 8B }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_1e56fad7 {
+    meta:
+        id = "1e56fad7-383f-4ee0-9f8f-a0b3dcceb691"
+        fingerprint = "a0916134f47df384bbdacff994970f60d3613baa03c0a581b7d1dd476af3121b"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 5B C9 C2 18 00 43 C1 02 10 7C C2 02 10 54 C1 02 10 67 C1 02 10 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_93c9a2a4 {
+    meta:
+        id = "93c9a2a4-a07a-4ed4-a899-b160d235bf50"
+        fingerprint = "0ff82bf9e70304868ff033f0d96e2a140af6e40c09045d12499447ffb94ab838"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 6A 01 8B CF FF 50 5C 8B 4F 58 49 89 4F 64 8B 4D F4 8B 45 E4 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_5340afa3 {
+    meta:
+        id = "5340afa3-ff90-4f61-a1ac-aba1f32dd375"
+        fingerprint = "7da4726ccda6a76d2da773d41f012763802d586f64a313c1c37733905ae9da81"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { E8 0C 89 5D F4 0F B7 DB 03 5D 08 66 83 F8 03 75 0A 8B 45 14 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_e7932501 {
+    meta:
+        id = "e7932501-66bf-4713-b10e-bcda29f4b901"
+        fingerprint = "ae31b49266386a6cf42289a08da4a20fc1330096be1dae793de7b7230225bfc7"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 24 0C 01 00 00 00 85 C0 7C 2F 3B 46 24 7D 2A 8B 4E 20 8D 04 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_cd0868d5 {
+    meta:
+        id = "cd0868d5-42d8-437f-8c1a-303526c08442"
+        fingerprint = "2f777285a90fce20cd4eab203f3ec7ed1c62e09fc2dfdce09b57e0802f49628f"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 8D 1C 01 89 54 24 10 8B 54 24 1C 33 C9 66 8B 0B 8D 3C 8A 8B 4C }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_515504e2 {
+    meta:
+        id = "515504e2-6b7f-4398-b89b-3af2b46c78a7"
+        fingerprint = "8eb741e1b3bd760e2cf511ad6609ac6f1f510958a05fb093eae26462f16ee1d0"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 6A 00 6A 00 8D 4D E0 51 FF D6 85 C0 74 29 83 F8 FF 74 0C 8D }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_a0fc8f35 {
+    meta:
+        id = "a0fc8f35-cbeb-43a8-b00d-7a0f981e84e4"
+        fingerprint = "033ff4f47fece45dfa7e3ba185df84a767691e56f0081f4ed96f9e2455a563cb"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 18 33 DB 53 6A 01 53 53 8D 4C 24 34 51 8B F0 89 5C 24 38 FF D7 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_cb95dc06 {
+    meta:
+        id = "cb95dc06-6383-4487-bf10-7fd68d61e37a"
+        fingerprint = "0d28f570db007a1b91fe48aba18be7541531cceb7f11a6a4471e92abd55b3b90"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 08 5F 5E 33 C0 5B 5D C3 8B 55 14 89 02 8B 45 18 5F 89 30 B9 01 00 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_9d4d3fa4 {
+    meta:
+        id = "9d4d3fa4-4e37-40d7-8399-a49130b7ef49"
+        fingerprint = "b06c3c7ba1f5823ce381971ed29554e5ddbe327b197de312738165ee8bf6e194"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 89 44 24 18 33 C9 89 44 24 1C 8D 54 24 38 89 44 24 20 33 F6 89 44 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_34f00046 {
+    meta:
+        id = "34f00046-8938-4103-91ec-4a745a627d4a"
+        fingerprint = "5c6f11e2a040ae32336f4b4c4717e0f10c73359899302b77e1803f3a609309c0"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 30 FF FF FF 03 08 8B 95 30 FF FF FF 2B D1 89 95 30 FF FF FF }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_f2a18b09 {
+    meta:
+        id = "f2a18b09-f7b3-4d1a-87ab-3018f520b69c"
+        fingerprint = "3e4474205efe22ea0185c49052e259bc08de8da7c924372f6eb984ae36b91a1c"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 04 39 45 08 75 08 8B 4D F8 8B 41 18 EB 0F 8B 55 F8 8B 02 89 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_d916ae65 {
+    meta:
+        id = "d916ae65-c97b-495c-89c2-4f1ec90081d2"
+        fingerprint = "2e109ed59a1e759ef089e04c21016482bf70228da30d8b350fc370b4e4d120e0"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 5F 24 01 10 CF 22 01 10 EC 22 01 10 38 23 01 10 79 23 01 10 82 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_52722678 {
+    meta:
+        id = "52722678-afbe-43ec-a39b-6848b7d49488"
+        fingerprint = "e67dda5227be74424656957843777ea533b6800576fd85f978fd8fb50504209c"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 2B 5D 0C 89 5D EC EB 03 8B 5D EC 8A 1C 3B 84 DB 74 0D 38 1F }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_28a60148 {
+    meta:
+        id = "28a60148-2efb-4cd2-ada1-dd2ae2699adf"
+        fingerprint = "c857aa792ef247bfcf81e75fb696498b1ba25c09fc04049223a6dfc09cc064b1"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { C0 31 E8 83 7D 0C 00 89 44 24 38 0F 29 44 24 20 0F 29 44 24 10 0F 29 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_997b25a0 {
+    meta:
+        id = "997b25a0-aeac-4f74-aa87-232c4f8329b6"
+        fingerprint = "0bba1c5284ed0548f51fdfd6fb96e24f92f7f4132caefbf0704efb0b1a64b7c4"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 85 D2 74 F0 C6 45 E1 20 8D 4D E1 C6 45 E2 4A C6 45 E3 4A C6 45 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_b17b33a1 {
+    meta:
+        id = "b17b33a1-1021-4980-8ffd-2e7aa4ca2ae4"
+        fingerprint = "753d15c1ff0cc4cf75250761360bb35280ff0a1a4d34320df354e0329dd35211"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 08 53 55 56 57 64 A1 30 00 00 00 89 44 24 10 8B 44 24 10 8B }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_23d77ae5 {
+    meta:
+        id = "23d77ae5-80de-4bb0-8701-ddcaff443dcc"
+        fingerprint = "d382a99e5eed87cf2eab5e238e445ca0bf7852e40b0dd06a392057e76144699f"
+        creation_date = "2021-03-28"
+        last_modified = "2021-08-23"
+        description = "Targets importDll64 containing Browser data stealer module"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "844974A2D3266E1F9BA275520C0E8A5D176DF69A0CCD5135B99FACF798A5D209"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "/system32/cmd.exe /c \"start microsoft-edge:{URL}\"" ascii fullword
+        $a2 = "SELECT name, value, host_key, path, expires_utc, creation_utc, encrypted_value FROM cookies" ascii fullword
+        $a3 = "attempt %d. Cookies not found" ascii fullword
+        $a4 = "attempt %d. History not found" ascii fullword
+        $a5 = "Cookies version is %d (%d)" ascii fullword
+        $a6 = "attempt %d. Local Storage not found" ascii fullword
+        $a7 = "str+='xie.com.'+p+'.guid='+'{'+components[i]+'}\\n';" ascii fullword
+        $a8 = "Browser exec is: %s" ascii fullword
+        $a9 = "found mozilla key: %s" ascii fullword
+        $a10 = "Version %d is not supported" ascii fullword
+        $a11 = "id %d - %s" ascii fullword
+        $a12 = "prot: %s, scope: %s, port: %d" ascii fullword
+        $a13 = "***** Send %d bytes to callback from %s *****" ascii fullword
+        $a14 = "/chrome.exe {URL}" ascii fullword
+    condition:
+        4 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_5574be7d {
+    meta:
+        id = "5574be7d-7502-4357-8110-2fb4a661b2bd"
+        fingerprint = "23d9b89917a0fc5aad903595b89b650f6dbb0f82ce28ce8bcc891904f62ccf1b"
+        creation_date = "2021-03-29"
+        last_modified = "2021-08-23"
+        description = "Targets injectDll64 containing injection functionality to steal banking credentials"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "8c5c0d27153f60ef8aec57def2f88e3d5f9a7385b5e8b8177bab55fa7fac7b18"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "webinject64.dll" ascii fullword
+        $a2 = "Mozilla Firefox version: %s" ascii fullword
+        $a3 = "socks=127.0.0.1:" ascii fullword
+        $a4 = "<conf ctl=\"dpost\" file=\"dpost\" period=\"60\"/>" ascii fullword
+        $a5 = "<moduleconfig>" ascii fullword
+        $a6 = "https://%.*s%.*s" ascii fullword
+        $a7 = "http://%.*s%.*s" ascii fullword
+        $a8 = "Chrome version: %s" ascii fullword
+        $a9 = "IE version real: %s" ascii fullword
+        $a10 = "IE version old: %s" ascii fullword
+        $a11 = "Build date: %s %s" ascii fullword
+        $a12 = "EnumDpostServer" ascii fullword
+        $a13 = "ESTR_PASS_" ascii fullword
+        $a14 = "<conf ctl=\"dinj\" file=\"dinj\" period=\"20\"/>" ascii fullword
+        $a15 = "<conf ctl=\"sinj\" file=\"sinj\" period=\"20\"/>" ascii fullword
+        $a16 = "<autoconf>" ascii fullword
+    condition:
+        4 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_1473f0b4 {
+    meta:
+        id = "1473f0b4-a6b5-4b19-a07e-83d32a7e44a0"
+        fingerprint = "15438ae141a2ac886b1ba406ba45119da1a616c3b2b88da3f432253421aa8e8b"
+        creation_date = "2021-03-29"
+        last_modified = "2021-08-23"
+        description = "Targets mailsearcher64.dll module"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "9cfb441eb5c60ab1c90b58d4878543ee554ada2cceee98d6b867e73490d30fec"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "mailsearcher.dll" ascii fullword
+        $a2 = "%s/%s/%s/send/" wide fullword
+        $a3 = "Content-Disposition: form-data; name=\"list\"" ascii fullword
+        $a4 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autostart>no</autostart><autoconf><conf ctl=\"SetConf\" file=\"mail"
+        $a5 = "eriod=\"60\"/></autoconf></moduleconfig>" ascii fullword
+        $a6 = "=Waitu H" ascii fullword
+        $a7 = "Content-Length: %d" ascii fullword
+    condition:
+        2 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_dcf25dde {
+    meta:
+        id = "dcf25dde-36c4-4a24-aa2b-0b3f42324918"
+        fingerprint = "4088ae29cb3b665ccedf69e9d02c1ff58620d4b589343cd4077983b25c5b479f"
+        creation_date = "2021-03-29"
+        last_modified = "2021-08-23"
+        description = "Targets networkDll64.dll module containing functionality to gather network and system information"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "BA2A255671D33677CAB8D93531EB25C0B1F1AC3E3085B95365A017463662D787"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "Host Name - %s" wide fullword
+        $a2 = "Last Boot Up Time - %02u/%02u/%04u %02d.%02d.%02d" wide fullword
+        $a3 = "Install Date - %02u/%02u/%04u %02d.%02d.%02d" wide fullword
+        $a4 = "System Directory - %s" wide fullword
+        $a5 = "OS Version - %s" wide fullword
+        $a6 = "***PROCESS LIST***" wide fullword
+        $a7 = "Product Type - Domain Controller" wide fullword
+        $a8 = "Registered Organization - %s" wide fullword
+        $a9 = "Product Type - Domain Controller" wide fullword
+        $a10 = "Build Type - %s" wide fullword
+        $a11 = "Boot Device - %s" wide fullword
+        $a12 = "Serial Number - %s" wide fullword
+        $a13 = "OS Architecture - %s" wide fullword
+        $a14 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"SetConf\" file=\"dpost\" period=\"1440\"/></au"
+        $a15 = "oduleconfig>" ascii fullword
+        $a16 = "Computer name: %s" wide fullword
+        $a17 = "/c net view /all /domain" ascii fullword
+        $a18 = "/c nltest /domain_trusts" ascii fullword
+        $a19 = "***SYSTEMINFO***" wide fullword
+        $a20 = "***LOCAL MACHINE DATA***" wide fullword
+        $a21 = "Admin Name: %s" wide fullword
+        $a22 = "Domain controller: %s" wide fullword
+        $a23 = "Admin E-mail: %s" wide fullword
+    condition:
+        4 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_46dc12dd {
+    meta:
+        id = "46dc12dd-d81a-43a6-b7c3-f59afa1c863e"
+        fingerprint = "997fe1c5a06bfffb754051436c48a0538ff2dcbfddf0d865c3a3797252247946"
+        creation_date = "2021-03-29"
+        last_modified = "2021-08-23"
+        description = "Targets newBCtestDll64 module containing reverse shell functionality"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "BF38A787AEE5AFDCAB00B95CCDF036BC7F91F07151B4444B54165BB70D649CE5"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "setconf" ascii fullword
+        $a2 = "<moduleconfig><autostart>yes</autostart><sys>yes</sys><needinfo name = \"id\"/><needinfo name = \"ip\"/><autoconf><conf ctl = \""
+        $a3 = "nf\" file = \"bcconfig\" period = \"90\"/></autoconf></moduleconfig>" ascii fullword
+        $a4 = "<moduleconfig><autostart>yes</autostart><sys>yes</sys><needinfo name = \"id\"/><needinfo name = \"ip\"/><autoconf><conf ctl = \""
+        $a5 = "<addr>" ascii fullword
+        $a6 = "</addr>" ascii fullword
+    condition:
+        4 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_78a26074 {
+    meta:
+        id = "78a26074-dc4b-436d-8188-2a3cfdabf6db"
+        fingerprint = "f0446c7e1a497b93720824f4a5b72f23f00d0ee9a1607bc0c1b097109ec132a8"
+        creation_date = "2021-03-29"
+        last_modified = "2021-08-23"
+        description = "Targets psfin64.dll module containing point-of-sale recon functionality"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "8CD75FA8650EBCF0A6200283E474A081CC0BE57307E54909EE15F4D04621DDE0"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"SetConf\" file=\"dpost\" period=\"14400\"/></a"
+        $a2 = "Dpost servers unavailable" ascii fullword
+        $a3 = "moduleconfig>" ascii fullword
+        $a4 = "ALOHA found: %d" wide fullword
+        $a5 = "BOH found: %d" wide fullword
+        $a6 = "MICROS found: %d" wide fullword
+        $a7 = "LANE found: %d" wide fullword
+        $a8 = "RETAIL found: %d" wide fullword
+        $a9 = "REG found: %d" wide fullword
+        $a10 = "STORE found: %d" wide fullword
+        $a11 = "POS found: %d" wide fullword
+        $a12 = "DOMAIN %s" wide fullword
+        $a13 = "/%s/%s/90" wide fullword
+        $a14 = "CASH found: %d" wide fullword
+        $a15 = "COMPUTERS:" wide fullword
+        $a16 = "TERM found: %d" wide fullword
+    condition:
+        3 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_217b9c97 {
+    meta:
+        id = "217b9c97-a637-49b8-a652-5a42ea19ee8e"
+        fingerprint = "7d5dcb60526a80926bbaa7e3cd9958719e326a160455095ff9f0315e85b8adf6"
+        creation_date = "2021-03-29"
+        last_modified = "2021-08-23"
+        description = "Targets pwgrab64.dll module containing functionality use to retrieve local passwords"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "1E90A73793017720C9A020069ED1C87879174C19C3B619E5B78DB8220A63E9B7"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "pwgrab.dll" ascii fullword
+        $a2 = "\\\\.\\pipe\\pidplacesomepipe" ascii fullword
+        $a3 = "\\Google\\Chrome\\User Data\\Default\\Login Data.bak" ascii fullword
+        $a4 = "select origin_url, username_value, password_value, length(password_value) from logins where blacklisted_by_user = 0" ascii fullword
+        $a5 = "<moduleconfig><autostart>yes</autostart><all>yes</all><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"dpost"
+        $a6 = "Grab_Passwords_Chrome(0)" ascii fullword
+        $a7 = "Grab_Passwords_Chrome(1)" ascii fullword
+        $a8 = "=\"dpost\" period=\"60\"/></autoconf></moduleconfig>" ascii fullword
+        $a9 = "Grab_Passwords_Chrome(): Can't open database" ascii fullword
+        $a10 = "UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_"
+        $a11 = "Chrome login db copied" ascii fullword
+        $a12 = "Skip Chrome login db copy" ascii fullword
+        $a13 = "Mozilla\\Firefox\\Profiles\\" ascii fullword
+        $a14 = "Grab_Passwords_Chrome() success" ascii fullword
+        $a15 = "No password provided by user" ascii fullword
+        $a16 = "Chrome login db should be copied (copy absent)" ascii fullword
+        $a17 = "Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2" wide fullword
+    condition:
+        4 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_d2110921 {
+    meta:
+        id = "d2110921-b957-49b7-8a26-4c0b7d1d58ad"
+        fingerprint = "55dbbcbc77ec51a378ad2ba8d56cb0811d23b121cacd037503fd75d08529c5b5"
+        creation_date = "2021-03-29"
+        last_modified = "2021-08-23"
+        description = "Targets shareDll64.dll module containing functionality use to spread Trickbot across local networks"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "05EF40F7745DB836DE735AC73D6101406E1D9E58C6B5F5322254EB75B98D236A"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "module64.dll" ascii fullword
+        $a2 = "Size - %d kB" ascii fullword
+        $a3 = "%s - FAIL" wide fullword
+        $a4 = "%s - SUCCESS" wide fullword
+        $a5 = "ControlSystemInfoService" ascii fullword
+        $a6 = "<moduleconfig><autostart>yes</autostart></moduleconfig>" ascii fullword
+        $a7 = "Copy: %d" wide fullword
+        $a8 = "Start sc 0x%x" wide fullword
+        $a9 = "Create sc 0x%x" wide fullword
+        $a10 = "Open sc %d" wide fullword
+        $a11 = "ServiceInfoControl" ascii fullword
+    condition:
+        3 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_0114d469 {
+    meta:
+        id = "0114d469-8731-4f4f-8657-49cded5efadb"
+        fingerprint = "4f1fa072f4ba577d590bb8946ea9b9774aa291cb2406f13be5932e97e8e760c6"
+        creation_date = "2021-03-29"
+        last_modified = "2021-08-23"
+        description = "Targets systeminfo64.dll module containing functionality use to retrieve system information"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "083CB35A7064AA5589EFC544AC1ED1B04EC0F89F0E60383FCB1B02B63F4117E9"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "<user>%s</user>" wide fullword
+        $a2 = "<service>%s</service>" wide fullword
+        $a3 = "<users>" wide fullword
+        $a4 = "</users>" wide fullword
+        $a5 = "%s%s%s</general>" wide fullword
+        $a6 = "<program>%s</program>" wide fullword
+        $a7 = "<moduleconfig><autostart>no</autostart><limit>2</limit></moduleconfig>" ascii fullword
+        $a8 = "<cpu>%s</cpu>" wide fullword
+        $a9 = "<ram>%s</ram>" wide fullword
+        $a10 = "</installed>" wide fullword
+        $a11 = "<installed>" wide fullword
+        $a12 = "<general>" wide fullword
+        $a13 = "SELECT * FROM Win32_Processor" wide fullword
+        $a14 = "SELECT * FROM Win32_OperatingSystem" wide fullword
+        $a15 = "SELECT * FROM Win32_ComputerSystem" wide fullword
+    condition:
+        6 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_07239dad {
+    meta:
+        id = "07239dad-7f9e-4b20-a691-d9538405b931"
+        fingerprint = "32d63b8db4307fd67e2c9068e22f843f920f19279c4a40e17cd14943577e7c81"
+        creation_date = "2021-03-29"
+        last_modified = "2021-08-23"
+        description = "Targets vncDll64.dll module containing remote control VNC functionality"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "DBD534F2B5739F89E99782563062169289F23AA335639A9552173BEDC98BB834"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "C:\\Users\\MaxMikhaylov\\Documents\\Visual Studio 2010\\MMVNC.PROXY\\VNCSRV\\x64\\Release\\VNCSRV.pdb" ascii fullword
+        $a2 = "vncsrv.dll" ascii fullword
+        $a3 = "-new -noframemerging http://www.google.com" ascii fullword
+        $a4 = "IE.HTTP\\shell\\open\\command" ascii fullword
+        $a5 = "EDGE\\shell\\open\\command" ascii fullword
+        $a6 = "/K schtasks.exe |more" ascii fullword
+        $a7 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/></moduleconfig> " ascii fullword
+        $a8 = "\\Microsoft Office\\Office16\\outlook.exe" ascii fullword
+        $a9 = "\\Microsoft Office\\Office11\\outlook.exe" ascii fullword
+        $a10 = "\\Microsoft Office\\Office15\\outlook.exe" ascii fullword
+        $a11 = "\\Microsoft Office\\Office12\\outlook.exe" ascii fullword
+        $a12 = "\\Microsoft Office\\Office14\\outlook.exe" ascii fullword
+        $a13 = "TEST.TEMP:" ascii fullword
+        $a14 = "Chrome_WidgetWin" wide fullword
+        $a15 = "o --disable-gpu --disable-d3d11 --disable-accelerated-2d-canvas" ascii fullword
+        $a16 = "NetServerStart" ascii fullword
+    condition:
+        6 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_fd7a39af {
+    meta:
+        id = "fd7a39af-c6ea-4682-a00a-01f775c3bb8d"
+        fingerprint = "3f2e654f2ffdd940c27caec3faeb4bda24c797a17d0987378e36c1e16fadc772"
+        creation_date = "2021-03-29"
+        last_modified = "2021-08-23"
+        description = "Targets wormDll64.dll module containing spreading functionality"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "D5BB8D94B71D475B5EB9BB4235A428563F4104EA49F11EF02C8A08D2E859FD68"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "module64.dll" ascii fullword
+        $a2 = "worming.png" wide
+        $a3 = "Size - %d kB" ascii fullword
+        $a4 = "[+] %s -" wide fullword
+        $a5 = "%s\\system32" ascii fullword
+        $a6 = "[-] %s" wide fullword
+        $a7 = "<moduleconfig><autostart>yes</autostart><sys>yes</sys><needinfo name=\"id\"/><needinfo name=\"ip\"/></moduleconfig>" ascii fullword
+        $a8 = "*****MACHINE IN WORKGROUP*****" wide fullword
+        $a9 = "*****MACHINE IN DOMAIN*****" wide fullword
+        $a10 = "\\\\%s\\IPC$" ascii fullword
+        $a11 = "Windows 5" ascii fullword
+        $a12 = "InfMach" ascii fullword
+        $a13 = "%s x64" wide fullword
+        $a14 = "%s x86" wide fullword
+        $a15 = "s(&(objectCategory=computer)(userAccountControl:" wide fullword
+        $a16 = "------MACHINE IN D-N------" wide fullword
+    condition:
+        5 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_2d89e9cd {
+    meta:
+        id = "2d89e9cd-2941-4b20-ab4e-a487d329ff76"
+        fingerprint = "e6eea38858cfbbe5441b1f69c5029ff9279e7affa51615f6c91981fe656294fc"
+        creation_date = "2021-03-29"
+        last_modified = "2021-08-23"
+        description = "Targets tabDll64.dll module containing functionality using SMB for lateral movement"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "3963649ebfabe8f6277190be4300ecdb68d4b497ac5f81f38231d3e6c862a0a8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "[INJECT] inject_via_remotethread_wow64: pExecuteX64( pX64function, ctx ) failed" ascii fullword
+        $a2 = "[INJECT] inject_via_remotethread_wow64: VirtualAlloc pExecuteX64 failed" ascii fullword
+        $a3 = "%SystemRoot%\\system32\\stsvc.exe" ascii fullword
+        $a4 = "[INJECT] inject_via_remotethread_wow64: pExecuteX64=0x%08p, pX64function=0x%08p, ctx=0x%08p" ascii fullword
+        $a5 = "DLL and target process must be same architecture" ascii fullword
+        $a6 = "[INJECT] inject_via_remotethread_wow64: VirtualAlloc pX64function failed" ascii fullword
+        $a7 = "%SystemDrive%\\stsvc.exe" ascii fullword
+        $a8 = "Wrote shellcode to 0x%x" ascii fullword
+        $a9 = "ERROR: %d, line - %d" wide fullword
+        $a10 = "[INJECT] inject_via_remotethread_wow64: Success, hThread=0x%08p" ascii fullword
+        $a11 = "GetProcessPEB:EXCEPT" wide fullword
+        $a12 = "Checked count - %i, connected count %i" wide fullword
+        $a13 = "C:\\%s\\%s C:\\%s\\%s" ascii fullword
+        $a14 = "C:\\%s\\%s" ascii fullword
+        $a15 = "%s\\ADMIN$\\stsvc.exe" wide fullword
+        $a16 = "%s\\C$\\stsvc.exe" wide fullword
+        $a17 = "Size - %d kB" ascii fullword
+        $a18 = "<moduleconfig><autostart>yes</autostart><sys>yes</sys><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"dpost"
+        $a19 = "%s - FAIL" wide fullword
+        $a20 = "%s - SUCCESS" wide fullword
+        $a21 = "CmainSpreader::init() CreateEvent, error code %i" wide fullword
+        $a22 = "Incorrect ModuleHandle %i, expect %i" wide fullword
+        $a23 = "My interface is \"%i.%i.%i.%i\", mask \"%i.%i.%i.%i\"" wide fullword
+        $a24 = "WormShare" ascii fullword
+        $a25 = "ModuleHandle 0x%08X, call Control: error create thread %i" wide fullword
+        $a26 = "Enter to Control: moduleHandle 0x%08X, unknown Ctl = \"%S\"" wide fullword
+    condition:
+        3 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_32930807 {
+    meta:
+        id = "32930807-30bb-4c57-8e17-0da99a816405"
+        fingerprint = "0aeb68977f4926272f27d5fba44e66bdbb9d6a113da5d7b4133a379b06df4474"
+        creation_date = "2021-03-30"
+        last_modified = "2021-10-04"
+        description = "Targets cookiesdll.dll module containing functionality used to retrieve browser cookie data"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "e999b83629355ec7ff3b6fda465ef53ce6992c9327344fbf124f7eb37808389d"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "select name, encrypted_value, host_key, path, length(encrypted_value), creation_utc, expires_utc from cookies where datetime(exp"
+        $a2 = "Cookies send failure: servers unavailable" ascii fullword
+        $a3 = "<moduleconfig>"
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_618b27d2 {
+    meta:
+        id = "618b27d2-22ad-4542-86ed-7148f17971da"
+        fingerprint = "df4336e5cbca495dac4fe110bd7a727e91bb3d465f76d3f3796078332c13633c"
+        creation_date = "2021-03-30"
+        last_modified = "2021-08-23"
+        description = "Targets Outlook.dll module containing functionality used to retrieve Outlook data"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "d3ec8f4a46b21fb189fc3d58f3d87bf9897653ecdf90b7952dcc71f3b4023b4e"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "OutlookX32.dll" ascii fullword
+        $a2 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" wide fullword
+        $a3 = "Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook" wide fullword
+        $a4 = "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook" wide fullword
+        $a5 = "OutlookX32" ascii fullword
+        $a6 = " Port:" wide fullword
+        $a7 = " User:" wide fullword
+        $a8 = " Pass:" wide fullword
+        $a9 = "String$" ascii fullword
+        $a10 = "outlookDecrU" ascii fullword
+        $a11 = "Cannot Decrypt" ascii fullword
+        $a12 = " Mail:" wide fullword
+        $a13 = " Serv:" wide fullword
+        $a14 = ",outlookDecr" ascii fullword
+        $a15 = "CryptApi" ascii fullword
+    condition:
+        5 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_6eb31e7b {
+    meta:
+        id = "6eb31e7b-9dc3-48ff-91fe-8c584729c415"
+        fingerprint = "d145b7c95bca0dc0c46a8dff60341a21dce474edd169dd0ee5ea2396dad60b92"
+        creation_date = "2021-03-30"
+        last_modified = "2021-10-04"
+        description = "Targets DomainDll module containing functionality using LDAP to retrieve credentials and configuration information"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "3e3d82ea4764b117b71119e7c2eecf46b7c2126617eafccdfc6e96e13da973b1"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "module32.dll" ascii fullword
+        $a2 = "Size - %d kB" ascii fullword
+        $a3 = "</moduleconfig> " ascii fullword
+        $a4 = "<moduleconfig>" ascii fullword
+        $a5 = "\\\\%ls\\SYSVOL\\%ls" wide fullword
+        $a6 = "DomainGrabber"
+        $a7 = "<autostart>yes</autostart>" ascii fullword
+        $a8 = "<needinfo name=\"id\"/>" ascii fullword
+        $a9 = "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" wide fullword
+    condition:
+        5 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_91516cf4 {
+    meta:
+        id = "91516cf4-c826-4d5d-908f-e1c0b3bccec5"
+        fingerprint = "2667c7181fb4db3f5765369fc2ec010b807a7bf6e2878fc42af410f036c61cbe"
+        creation_date = "2021-03-30"
+        last_modified = "2021-08-31"
+        description = "Generic signature used to identify Trickbot module usage"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "6cd0d4666553fd7184895502d48c960294307d57be722ebb2188b004fc1a8066"
+        severity = 80
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "<moduleconfig>" ascii wide
+        $a2 = "<autostart>" ascii wide
+        $a3 = "</autostart>" ascii wide
+        $a4 = "</moduleconfig>" ascii wide
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Trickbot_be718af9 {
+    meta:
+        id = "be718af9-5995-4ae2-ba55-504e88693c96"
+        fingerprint = "047b1c64b8be17d4a6030ab2944ad715380f53a8a6dd9c8887f198693825a81d"
+        creation_date = "2021-03-30"
+        last_modified = "2021-08-23"
+        description = "Targets permadll module used to fingerprint BIOS/firmaware data"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "c1f1bc58456cff7413d7234e348d47a8acfdc9d019ae7a4aba1afc1b3ed55ffa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "user_platform_check.dll" ascii fullword
+        $a2 = "<moduleconfig><nohead>yes</nohead></moduleconfig>" ascii fullword
+        $a3 = "DDEADFDEEEEE"
+        $a4 = "\\`Ruuuuu_Exs|_" ascii fullword
+        $a5 = "\"%pueuu%" ascii fullword
+    condition:
+        3 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_f8dac4bc {
+    meta:
+        id = "f8dac4bc-2ea1-4733-a260-59f3cae2eba8"
+        fingerprint = "256daf823f6296ae02103336817dec565129a11f37445b791b2f8e3163f0c17f"
+        creation_date = "2021-03-30"
+        last_modified = "2021-08-23"
+        description = "Targets rdpscan module used to bruteforce RDP"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "13d102d546b9384f944f2a520ba32fb5606182bed45a8bba681e4374d7e5e322"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "rdpscan.dll" ascii fullword
+        $a2 = "F:\\rdpscan\\Bin\\Release_nologs\\"
+        $a3 = "Cookie: %s %s" wide fullword
+        $a4 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"srv\" file=\"srv\" period=\"60\"/></autoconf><"
+        $a5 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"srv\" file=\"srv\" period=\"60\"/></autoconf><"
+        $a6 = "X^Failed to create a list of contr" ascii fullword
+        $a7 = "rdp/domains" wide fullword
+        $a8 = "Your product name" wide fullword
+        $a9 = "rdp/over" wide fullword
+        $a10 = "rdp/freq" wide fullword
+        $a11 = "rdp/names" wide fullword
+        $a12 = "rdp/dict" wide fullword
+        $a13 = "rdp/mode" wide fullword
+    condition:
+        4 of ($a*)
+}
+
+rule Windows_Trojan_Trickbot_9c0fa8fe {
+    meta:
+        id = "9c0fa8fe-8d5f-4581-87a0-92a4ed1b32b3"
+        fingerprint = "bd49ed2ee65ff0cfa95efc9887ed24de3882c5b5740d0efc6b9690454ca3f5dc"
+        creation_date = "2021-07-13"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Trickbot"
+        reference_sample = "f528c3ea7138df7c661d88fafe56d118b6ee1d639868212378232ca09dc9bfad"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 74 19 48 85 FF 74 60 8B 46 08 39 47 08 76 6A 33 ED B1 01 B0 01 }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Vidar.yar b/yara/rules/Windows_Trojan_Vidar.yar
new file mode 100644
index 00000000..d24a0acf
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Vidar.yar
@@ -0,0 +1,43 @@
+rule Windows_Trojan_Vidar_9007feb2 {
+    meta:
+        id = "9007feb2-6ad1-47b6-bae2-3379d114e4f1"
+        fingerprint = "8416b14346f833264e32c63253ea0b0fe28e5244302b2e1b266749c543980fe2"
+        creation_date = "2021-06-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Vidar"
+        reference_sample = "34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { E8 53 FF D6 50 FF D7 8B 45 F0 8D 48 01 8A 10 40 3A D3 75 F9 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Vidar_114258d5 {
+    meta:
+        id = "114258d5-f05e-46ac-914b-1a7f338ccf58"
+        fingerprint = "9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934"
+        creation_date = "2021-06-28"
+        last_modified = "2021-08-23"
+        threat_name = "Windows.Trojan.Vidar"
+        reference_sample = "34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "BinanceChainWallet" fullword
+        $a2 = "*wallet*.dat" fullword
+        $a3 = "SOFTWARE\\monero-project\\monero-core" fullword
+        $b1 = "CC\\%s_%s.txt" fullword
+        $b2 = "History\\%s_%s.txt" fullword
+        $b3 = "Autofill\\%s_%s.txt" fullword
+    condition:
+        1 of ($a*) and 1 of ($b*)
+}
+
diff --git a/yara/rules/Windows_Trojan_WhisperGate.yar b/yara/rules/Windows_Trojan_WhisperGate.yar
new file mode 100644
index 00000000..fdee8512
--- /dev/null
+++ b/yara/rules/Windows_Trojan_WhisperGate.yar
@@ -0,0 +1,23 @@
+rule Windows_Trojan_WhisperGate_9192618b {
+    meta:
+        id = "9192618b-4f3e-4503-a97f-3c4420fb79e0"
+        fingerprint = "21f2a5b730a86567e68491a0d997fc52ba37f28b2164747240a74c225be3c661"
+        creation_date = "2022-01-17"
+        last_modified = "2022-01-17"
+        threat_name = "Windows.Trojan.WhisperGate"
+        reference_sample = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "https://cdn.discordapp.com/attachments/" wide
+        $a2 = "DxownxloxadDxatxxax" wide fullword
+        $a3 = "powershell" wide fullword
+        $a4 = "-enc UwB0AGEAcgB0AC" wide fullword
+        $a5 = "Ylfwdwgmpilzyaph" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Xpertrat.yar b/yara/rules/Windows_Trojan_Xpertrat.yar
new file mode 100644
index 00000000..ea39550f
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Xpertrat.yar
@@ -0,0 +1,21 @@
+rule Windows_Trojan_Xpertrat_ce03c41d {
+    meta:
+        id = "ce03c41d-d5c3-43f5-b3ca-f244f177d710"
+        fingerprint = "8aa4336ba6909c820f1164c78453629959e28cb619fda45dbe46291f9fbcbec4"
+        creation_date = "2021-08-06"
+        last_modified = "2021-10-04"
+        threat_name = "Windows.Trojan.Xpertrat"
+        reference_sample = "d7f2fddb43eb63f9246f0a4535dfcca6da2817592455d7eceaacde666cf1aaae"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "[XpertRAT-Mutex]" wide fullword
+        $a2 = "XPERTPLUGIN" wide fullword
+        $a3 = "keylog.tmp" wide fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_XtremeRAT.yar b/yara/rules/Windows_Trojan_XtremeRAT.yar
new file mode 100644
index 00000000..eb9c7ce9
--- /dev/null
+++ b/yara/rules/Windows_Trojan_XtremeRAT.yar
@@ -0,0 +1,28 @@
+rule Windows_Trojan_XtremeRAT_cd5b60be {
+    meta:
+        id = "cd5b60be-4685-425a-8fe1-8366c0e5b84a"
+        fingerprint = "2ee35d7c34374e9f5cffceb36fe1912932288ea4e8211a8b77430b98a9d41fb2"
+        creation_date = "2022-03-15"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.XtremeRAT"
+        reference_sample = "735f7bf255bdc5ce8e69259c8e24164e5364aeac3ee78782b7b5275c1d793da8"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $s01 = "SOFTWARE\\XtremeRAT" wide fullword
+        $s02 = "XTREME" wide fullword
+        $s03 = "STARTSERVERBUFFER" wide fullword
+        $s04 = "ENDSERVERBUFFER" wide fullword
+        $s05 = "ServerKeyloggerU" ascii fullword
+        $s06 = "TServerKeylogger" ascii fullword
+        $s07 = "XtremeKeylogger" wide fullword
+        $s08 = "XTREMEBINDER" wide fullword
+        $s09 = "UnitInjectServer" ascii fullword
+        $s10 = "shellexecute=" wide fullword
+    condition:
+        7 of ($s*)
+}
+
diff --git a/yara/rules/Windows_Trojan_Zeus.yar b/yara/rules/Windows_Trojan_Zeus.yar
new file mode 100644
index 00000000..01442591
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Zeus.yar
@@ -0,0 +1,25 @@
+rule Windows_Trojan_Zeus_e51c60d7 {
+    meta:
+        id = "e51c60d7-3afa-4cf5-91d8-7782e5026e46"
+        fingerprint = "813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba"
+        creation_date = "2021-02-07"
+        last_modified = "2021-10-04"
+        description = "Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature."
+        threat_name = "Windows.Trojan.Zeus"
+        reference = "https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects"
+        reference_sample = "d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "name=%s&port=%u" ascii fullword
+        $a2 = "data_inject" ascii wide fullword
+        $a3 = "keylog.txt" ascii fullword
+        $a4 = "User-agent: %s]]]" ascii fullword
+        $a5 = "%s\\%02d.bmp" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Trojan_Zloader.yar b/yara/rules/Windows_Trojan_Zloader.yar
new file mode 100644
index 00000000..7e36bf23
--- /dev/null
+++ b/yara/rules/Windows_Trojan_Zloader.yar
@@ -0,0 +1,76 @@
+rule Windows_Trojan_Zloader_5dd0a0bf {
+    meta:
+        id = "5dd0a0bf-20e4-4c52-b9d9-c157e871b06b"
+        fingerprint = "06545df6c556adf8a6844724e77d005c0299b544f21df2ea44bb9679964dbb9f"
+        creation_date = "2022-03-03"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Zloader"
+        reference_sample = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { B6 08 89 CA 80 C2 F7 80 FA 05 72 F2 80 F9 20 74 ED 03 5D 0C 8D }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Zloader_4fe0f7f1 {
+    meta:
+        id = "4fe0f7f1-93c6-4397-acd5-1557608efaf4"
+        fingerprint = "f340f41cc69930d24ffdae484d1080cd9ce5cb5e7720868c956923a5b8e6c9b1"
+        creation_date = "2022-03-03"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Zloader"
+        reference_sample = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 08 8B 75 F0 85 DB 8D 7D 94 89 45 E8 0F 45 FB 31 DB 85 F6 0F }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Zloader_363c65ed {
+    meta:
+        id = "363c65ed-e394-4a40-9c2a-a6f6fd284ed3"
+        fingerprint = "33ae4cee122269f4342a3fd829236cbd303d8821b548ab93bbebc9dee3eb67f2"
+        creation_date = "2022-03-03"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Zloader"
+        reference_sample = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 04 8D 4D E4 8D 55 E8 6A 00 6A 00 51 6A 00 6A 00 50 52 57 53 }
+    condition:
+        all of them
+}
+
+rule Windows_Trojan_Zloader_79535191 {
+    meta:
+        id = "79535191-59df-4c78-9f62-b8614ef992d3"
+        fingerprint = "ee3c4cf0d694119acfdc945a964e4fc0f51355eabca900ffbcc21aec0b3e1e3c"
+        creation_date = "2022-03-03"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Trojan.Zloader"
+        reference_sample = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a = { 28 4B 74 26 8B 46 FC 85 C0 74 F3 8B 4E F4 8B 16 39 C8 0F 47 C1 8B }
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Wiper_CaddyWiper.yar b/yara/rules/Windows_Wiper_CaddyWiper.yar
new file mode 100644
index 00000000..a6f6e758
--- /dev/null
+++ b/yara/rules/Windows_Wiper_CaddyWiper.yar
@@ -0,0 +1,22 @@
+rule Windows_Wiper_CaddyWiper_484bd98a {
+    meta:
+        id = "484bd98a-543f-42de-a58c-fe9c7b5605a3"
+        fingerprint = "de16515a72cd1f7b4d7ee46a4fafde07cf224c2b6df9037bcd20ab4d39181fa8"
+        creation_date = "2022-03-14"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Wiper.CaddyWiper"
+        reference_sample = "a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = { C6 45 AC 43 C6 45 AD 3A C6 45 AE 5C C6 45 AF 55 C6 45 B0 73 C6 45 B1 65 C6 45 B2 72 C6 45 B3 73 }
+        $a2 = { C6 45 E0 44 C6 45 E1 3A C6 45 E2 5C }
+        $a3 = { C6 45 9C 6E C6 45 9D 65 C6 45 9E 74 C6 45 9F 61 C6 45 A0 70 C6 45 A1 69 C6 45 A2 33 C6 45 A3 32 }
+        $s1 = "DsRoleGetPrimaryDomainInformation"
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Wiper_DoubleZero.yar b/yara/rules/Windows_Wiper_DoubleZero.yar
new file mode 100644
index 00000000..0b432a7b
--- /dev/null
+++ b/yara/rules/Windows_Wiper_DoubleZero.yar
@@ -0,0 +1,23 @@
+rule Windows_Wiper_DoubleZero_65ec0c50 {
+    meta:
+        id = "65ec0c50-4038-46a7-879b-fbb4aab18725"
+        fingerprint = "2441bcdf7bc48df098f4ef68231fb15fc5c8f96af2e170de77f1718487b945b2"
+        creation_date = "2022-03-22"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Wiper.DoubleZero"
+        reference_sample = "3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $s1 = "\\Users\\\\.*?\\\\AppData\\\\Roaming\\\\Microsoft.*" wide fullword
+        $s2 = "\\Users\\\\.*?\\\\AppData\\\\Local\\\\Application Data.*" wide fullword
+        $s3 = "\\Users\\\\.*?\\\\Local Settings.*" wide fullword
+        $s4 = "get__beba00adeeb086e6" ascii fullword
+        $s5 = "FileShareWrite" ascii fullword
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Wiper_HermeticWiper.yar b/yara/rules/Windows_Wiper_HermeticWiper.yar
new file mode 100644
index 00000000..7f89f3da
--- /dev/null
+++ b/yara/rules/Windows_Wiper_HermeticWiper.yar
@@ -0,0 +1,24 @@
+rule Windows_Wiper_HermeticWiper_7206a969 {
+    meta:
+        id = "7206a969-bbd6-4c2d-a19d-380b71a4ab08"
+        fingerprint = "e3486c785f99f4376d4161704afcaf61e8a5ab6101463a76d134469f8a5581bf"
+        creation_date = "2022-02-24"
+        last_modified = "2022-02-24"
+        threat_name = "Windows.Wiper.HermeticWiper"
+        reference_sample = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "\\\\?\\C:\\Windows\\System32\\winevt\\Logs" wide fullword
+        $a2 = "\\\\.\\EPMNTDRV\\%u" wide fullword
+        $a3 = "tdrv.pdb" ascii fullword
+        $a4 = "%s%.2s" wide fullword
+        $a5 = "ccessdri" ascii fullword
+        $a6 = "Hermetica Digital"
+    condition:
+        all of them
+}
+
diff --git a/yara/rules/Windows_Wiper_IsaacWiper.yar b/yara/rules/Windows_Wiper_IsaacWiper.yar
new file mode 100644
index 00000000..b2749163
--- /dev/null
+++ b/yara/rules/Windows_Wiper_IsaacWiper.yar
@@ -0,0 +1,24 @@
+rule Windows_Wiper_IsaacWiper_239cd2dc {
+    meta:
+        id = "239cd2dc-6f93-43fa-98e8-ad7a0edb8a8a"
+        fingerprint = "a9c193d7c60b0c793c299b23f672d6428ceb229f2ceb2acbfc1124387954b244"
+        creation_date = "2022-03-04"
+        last_modified = "2022-04-12"
+        threat_name = "Windows.Wiper.IsaacWiper"
+        reference_sample = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
+        severity = 100
+        arch_context = "x86"
+        scan_context = "file, memory"
+        license = "Elastic License v2"
+        os = "windows"
+    strings:
+        $a1 = "C:\\ProgramData\\log.txt" wide fullword
+        $a2 = "system physical drive -- FAILED" wide fullword
+        $a3 = "-- system logical drive: " wide fullword
+        $a4 = "start erasing system logical drive " wide fullword
+        $a5 = "-- logical drive: " wide fullword
+        $a6 = "-- start erasing logical drive " wide fullword
+    condition:
+        5 of them
+}
+