YARAify Scan Results

You are viewing the YARAify database entry for the file with the SHA256 hash 781d27a1be4bc38ffe6aaf56e1201e6e610e89bd3165c885dad70132579ed2df.

Scan Results

SHA256 hash:	781d27a1be4bc38ffe6aaf56e1201e6e610e89bd3165c885dad70132579ed2df
File size:	10'267'810 bytes
File download:	Original
MIME type:	text/plain
MD5 hash:	78825af1097a69a80f2836c5a7755eb3
SHA1 hash:	47872f506a17046d8e385bf01c3aff8c838d3d94
SHA3-384 hash:	a9ad6fd6bd838998acbd5df2c425d64b1589c0219534707c69c4f24efeab174d6b1ff0f2e93fb3e082f83f1f94568eae
First seen:	2025-08-16 06:09:01 UTC
Last seen:	Never
Sightings:	1
imphash :	n/a
ssdeep :	196608:SuJDPDVJGafw3udzhqWW39DKpF+2DaHXxHj8i/JuZ2UDTeXLywOVpiI5UWU2LOEb:Kc
TLSH :	n/a
telfhash :	n/a
gimphash :	n/a
dhash icon :	n/a

Tasks

There are 1 tasks on YARAify for this particular file. The 10 most recent ones are shown below.

Task Information

Task ID:	811cab8f-7a67-11f0-8fb7-42010aa4000b
File name:	yara-rules-core.yar
Task parameters:	ClamAV scan:	True
	Unpack:	True
	Share file:	True

ClamAV Results

The file matched the following open source and commercial ClamAV rules.

Signature:	{HEX}php.cmdshell.avi.210.UNOFFICIAL Create hunting rule

Signature:	{HEX}php.cmdshell.dC3.240.UNOFFICIAL Create hunting rule

Signature:	{HEX}php.cmdshell.lama.312.UNOFFICIAL Create hunting rule

Signature:	{HEX}php.cmdshell.lib2.313.UNOFFICIAL Create hunting rule

Signature:	{HEX}php.cmdshell.simorghev.371.UNOFFICIAL Create hunting rule

Signature:	{HEX}php.cmdshell.simorghev.372.UNOFFICIAL Create hunting rule

Signature:	{HEX}php.cmdshell.winx.378.UNOFFICIAL Create hunting rule

Signature:	{HEX}php.defash.buno.406.UNOFFICIAL Create hunting rule

Signature:	{HEX}php.exe.globals.417.UNOFFICIAL Create hunting rule

Signature:	{HEX}php.gzbase64.inject.457.UNOFFICIAL Create hunting rule

Signature:	{HEX}php.nested.base64.660.UNOFFICIAL Create hunting rule

Signature:	ditekSHen.MALWARE.PWSH.CUMII.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.Eicar-Test-Signature-1.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.Generic-EXE.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.HTML-10660.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.HTML.Iframe-RJ-1.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.PHP.Shell-55.UNOFFICIAL Create hunting rule

Signature:	SecuriteInfo.com.PUA.DiscordUrl-1.UNOFFICIAL Create hunting rule

Signature:	TwinWave.EvilDoc.PlayItOnTheRadio.20220505.UNOFFICIAL Create hunting rule

Signature:	YARA._root_040_zip_Folder_deploy.UNOFFICIAL Create hunting rule

Signature:	YARA.Ajan_asp.UNOFFICIAL Create hunting rule

Signature:	YARA.Ajax_PHP_Command_Shell_php.UNOFFICIAL Create hunting rule

Signature:	YARA.Antichat_Shell_v1_3_php.UNOFFICIAL Create hunting rule

Signature:	YARA.Antichat_Socks5_Server_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.Asmodeus_v0_1_pl.UNOFFICIAL Create hunting rule

Signature:	YARA.Ayyildiz_Tim___AYT__Shell_v_2_1_Biz_html.UNOFFICIAL Create hunting rule

Signature:	YARA.aZRaiLPhp_v1_0_php.UNOFFICIAL Create hunting rule

Signature:	YARA.backdoor1_php.UNOFFICIAL Create hunting rule

Signature:	YARA.backdoorfr_php.UNOFFICIAL Create hunting rule

Signature:	YARA.bdcli100.UNOFFICIAL Create hunting rule

Signature:	YARA.bin_Client.UNOFFICIAL Create hunting rule

Signature:	YARA.BIN_Server.UNOFFICIAL Create hunting rule

Signature:	YARA.binder2_binder2.UNOFFICIAL Create hunting rule

Signature:	YARA.by063cli.UNOFFICIAL Create hunting rule

Signature:	YARA.by064cli.UNOFFICIAL Create hunting rule

Signature:	YARA.byshell063_ntboot_2.UNOFFICIAL Create hunting rule

Signature:	YARA.c99madshell_v2_0_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.Casus15_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.cgi_python_py.UNOFFICIAL Create hunting rule

Signature:	YARA.CmdAsp_asp.UNOFFICIAL Create hunting rule

Signature:	YARA.cmdjsp_jsp.UNOFFICIAL Create hunting rule

Signature:	YARA.connectback2_pl.UNOFFICIAL Create hunting rule

Signature:	YARA.connector.UNOFFICIAL Create hunting rule

Signature:	YARA.csh_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.cyberlords_sql_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.DarkSpy105.UNOFFICIAL Create hunting rule

Signature:	YARA.dbgiis6cli.UNOFFICIAL Create hunting rule

Signature:	YARA.dbgntboot.UNOFFICIAL Create hunting rule

Signature:	YARA.Debug_cress.UNOFFICIAL Create hunting rule

Signature:	YARA.Dive_Shell_1_0___Emperor_Hacking_Team_php.UNOFFICIAL Create hunting rule

Signature:	YARA.Dx_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.EditServer_Webshell_2.UNOFFICIAL Create hunting rule

Signature:	YARA.EditServer_Webshell.UNOFFICIAL Create hunting rule

Signature:	YARA.EFSO_2_asp.UNOFFICIAL Create hunting rule

Signature:	YARA.elmaliseker_asp.UNOFFICIAL Create hunting rule

Signature:	YARA.elmaliseker.UNOFFICIAL Create hunting rule

Signature:	YARA.FeliksPack3___PHP_Shells_phpft.UNOFFICIAL Create hunting rule

Signature:	YARA.FeliksPack3___PHP_Shells_ssh.UNOFFICIAL Create hunting rule

Signature:	YARA.FeliksPack3___PHP_Shells_usr.UNOFFICIAL Create hunting rule

Signature:	YARA.FSO_s_casus15_2.UNOFFICIAL Create hunting rule

Signature:	YARA.FSO_s_phpinj.UNOFFICIAL Create hunting rule

Signature:	YARA.FSO_s_reader.UNOFFICIAL Create hunting rule

Signature:	YARA.FSO_s_zehir4.UNOFFICIAL Create hunting rule

Signature:	YARA.fuckphpshell_php.UNOFFICIAL Create hunting rule

Signature:	YARA.h4ntu_shell__powered_by_tsoi_.UNOFFICIAL Create hunting rule

Signature:	YARA.hidshell_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.hkdoordll.UNOFFICIAL Create hunting rule

Signature:	YARA.hkshell_hkrmv.UNOFFICIAL Create hunting rule

Signature:	YARA.hkshell_hkshell.UNOFFICIAL Create hunting rule

Signature:	YARA.HYTop_CaseSwitch_2005.UNOFFICIAL Create hunting rule

Signature:	YARA.HYTop_DevPack_server.UNOFFICIAL Create hunting rule

Signature:	YARA.HYTop_DevPack_upload.UNOFFICIAL Create hunting rule

Signature:	YARA.HYTop2006_rar_Folder_2006.UNOFFICIAL Create hunting rule

Signature:	YARA.icyfox007v1_10_rar_Folder_asp.UNOFFICIAL Create hunting rule

Signature:	YARA.installer.UNOFFICIAL Create hunting rule

Signature:	YARA.ironshell_php.UNOFFICIAL Create hunting rule

Signature:	YARA.Java_Shell_js.UNOFFICIAL Create hunting rule

Signature:	YARA.jsp_reverse_jsp.UNOFFICIAL Create hunting rule

Signature:	YARA.jspshall_jsp.UNOFFICIAL Create hunting rule

Signature:	YARA.JspWebshell_1_2_jsp.UNOFFICIAL Create hunting rule

Signature:	YARA.kacak_asp.UNOFFICIAL Create hunting rule

Signature:	YARA.lamashell_php.UNOFFICIAL Create hunting rule

Signature:	YARA.Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_php.UNOFFICIAL Create hunting rule

Signature:	YARA.lurm_safemod_on_cgi.UNOFFICIAL Create hunting rule

Signature:	YARA.Mithril_Mithril.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_php_webshells.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_webshells_0002.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_webshells_0003.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_webshells_0005.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_webshells_0010.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_webshells_0013.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_webshells_0015.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_webshells_0016.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_webshells_0019.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_webshells_0022.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_webshells_0027.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_webshells_0030.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_webshells_0031.UNOFFICIAL Create hunting rule

Signature:	YARA.multiple_webshells_0032.UNOFFICIAL Create hunting rule

Signature:	YARA.mysql_shell_php.UNOFFICIAL Create hunting rule

Signature:	YARA.MySQL_Web_Interface_Version_0_8_php.UNOFFICIAL Create hunting rule

Signature:	YARA.ngh_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.NT_Addy_asp.UNOFFICIAL Create hunting rule

Signature:	YARA.PasswordReminder.UNOFFICIAL Create hunting rule

Signature:	YARA.perlbot_pl.UNOFFICIAL Create hunting rule

Signature:	YARA.PHANTASMA_php.UNOFFICIAL Create hunting rule

Signature:	YARA.PHP_Backdoor_Connect_pl_php.UNOFFICIAL Create hunting rule

Signature:	YARA.php_backdoor_php.UNOFFICIAL Create hunting rule

Signature:	YARA.php_include_w_shell_php.UNOFFICIAL Create hunting rule

Signature:	YARA.PHP_Shell_v1_7.UNOFFICIAL Create hunting rule

Signature:	YARA.PHP_shell.UNOFFICIAL Create hunting rule

Signature:	YARA.pHpINJ_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.phpjackal_php.UNOFFICIAL Create hunting rule

Signature:	YARA.phpshell17_php.UNOFFICIAL Create hunting rule

Signature:	YARA.phvayvv_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.Phyton_Shell_py.UNOFFICIAL Create hunting rule

Signature:	YARA.r57shell_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.rdrbs084.UNOFFICIAL Create hunting rule

Signature:	YARA.rdrbs100.UNOFFICIAL Create hunting rule

Signature:	YARA.Reader_asp.UNOFFICIAL Create hunting rule

Signature:	YARA.Rem_View_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.rknt_zip_Folder_RkNT.UNOFFICIAL Create hunting rule

Signature:	YARA.RkNTLoad.UNOFFICIAL Create hunting rule

Signature:	YARA.rootshell_php.UNOFFICIAL Create hunting rule

Signature:	YARA.rst_sql_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.ru24_post_sh_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.s72_Shell_v1_1_Coding_html.UNOFFICIAL Create hunting rule

Signature:	YARA.Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_php.UNOFFICIAL Create hunting rule

Signature:	YARA.Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php.UNOFFICIAL Create hunting rule

Signature:	YARA.screencap.UNOFFICIAL Create hunting rule

Signature:	YARA.sendmail.UNOFFICIAL Create hunting rule

Signature:	YARA.sh_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.shankar_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.shell_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.shellbot_pl.UNOFFICIAL Create hunting rule

Signature:	YARA.shells_PHP_wso.UNOFFICIAL Create hunting rule

Signature:	YARA.shelltools_g0t_root_Fport.UNOFFICIAL Create hunting rule

Signature:	YARA.shelltools_g0t_root_HideRun.UNOFFICIAL Create hunting rule

Signature:	YARA.shelltools_g0t_root_resolve.UNOFFICIAL Create hunting rule

Signature:	YARA.shelltools_g0t_root_xwhois.UNOFFICIAL Create hunting rule

Signature:	YARA.sig_2008_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.SimAttacker___Vrsion_1_0_0___priv8_4_My_friend_php.UNOFFICIAL Create hunting rule

Signature:	YARA.simple_backdoor_php.UNOFFICIAL Create hunting rule

Signature:	YARA.Simple_PHP_BackDooR.UNOFFICIAL Create hunting rule

Signature:	YARA.SimShell_1_0___Simorgh_Security_MGZ_php.UNOFFICIAL Create hunting rule

Signature:	YARA.Sincap_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.small_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.sql_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.STNC_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.svchostdll.UNOFFICIAL Create hunting rule

Signature:	YARA.telnet_cgi.UNOFFICIAL Create hunting rule

Signature:	YARA.telnetd_pl.UNOFFICIAL Create hunting rule

Signature:	YARA.thelast_orice2.UNOFFICIAL Create hunting rule

Signature:	YARA.Tool_asp.UNOFFICIAL Create hunting rule

Signature:	YARA.Unpack_Injectt.UNOFFICIAL Create hunting rule

Signature:	YARA.vanquish_2.UNOFFICIAL Create hunting rule

Signature:	YARA.vanquish.UNOFFICIAL Create hunting rule

Signature:	YARA.w3d_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_soldierofallah.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell__CrystalShell_v_1_erne_stres.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell__findsock_php_findsock_shell_php_reverse_shell.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell__Small_Web_Shell_by_ZaCo_small_zaco_zacosmall.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_AK_74_Security_Team_Web_Shell_Beta_Version.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_Ayyildiz_Tim___AYT__Shell_v_2_1_Biz.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_aZRaiLPhp_v1_0.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_b374k_mini_shell_php_php.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_b374k_php.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_backupsql.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_c99_locus7s.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_CasuS_1_5.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_CmdAsp_asp_php.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_dC3_Security_Crew_Shell_PRiV.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_DTool_Pro.UNOFFICIAL Create hunting rule

Signature:	YARA.webshell_Dx_Dx.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_Gamma_Web_Shell.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_Generic_PHP_6.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_go_shell.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_hiddens_shell_v1.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_ironshell.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_lamashell.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_NCC_Shell.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_NTDaddy_v1_9.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_php_backdoor.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_php_include_w_shell.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_php_webshells_529.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_php_webshells_cpanel.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_php_webshells_kral.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_php_webshells_lolipop.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_php_webshells_lostDC.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_php_webshells_matamu.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_php_webshells_MyShell.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_php_webshells_NGH.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_php_webshells_pHpINJ.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_php_webshells_pws.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_php_webshells_README.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_PhpSpy_Ver_2006.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_qsd_php_backdoor.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_reader_asp_php.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_ru24_post_sh.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_safe0ver.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_SimAttacker___Vrsion_1_0_0___priv8_4_My_friend.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_simattacker.UNOFFICIAL Create hunting rule

Signature:	YARA.webshell_simple_backdoor.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_simple_cmd.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_Simple_PHP_backdoor_by_DK.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_Sincap_1_0.UNOFFICIAL Create hunting rule

Signature:	YARA.WebShell_WinX_Shell.UNOFFICIAL Create hunting rule

Signature:	YARA.wh_bindshell_py.UNOFFICIAL Create hunting rule

Signature:	YARA.WinX_Shell_html.UNOFFICIAL Create hunting rule

Signature:	YARA.xssshell_db.UNOFFICIAL Create hunting rule

Signature:	YARA.xssshell_save.UNOFFICIAL Create hunting rule

Signature:	YARA.zacosmall_php.UNOFFICIAL Create hunting rule

Signature:	YARA.ZXshell2_0_rar_Folder_nc.UNOFFICIAL Create hunting rule

Signature:	YARA.ZXshell2_0_rar_Folder_zxrecv.UNOFFICIAL Create hunting rule

Signature:	YARA.ZXshell2_0_rar_Folder_ZXshell.UNOFFICIAL Create hunting rule

YARA Results

Static Analysis

The following YARA rules matched on the file (static analysis).

Rule name:	_Bitchin_Threads_ Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file =Bitchin Threads=.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_network_php_php_xinfo_php_php_nfm_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - from files network.php.php.txt, xinfo.php.php.txt, nfm.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_nst_php_php_cybershell_php_php_img_php_php_nstview_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - from files nst.php.php.txt, cybershell.php.php.txt, img.php.php.txt, nstview.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_nst_php_php_img_php_php_nstview_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - from files nst.php.php.txt, img.php.php.txt, nstview.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_r577_php_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - from files r577.php.php.txt, r57.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_r577_php_php_r57_php_php_spy_php_php_s_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - from files r577.php.php.txt, r57.php.php.txt, spy.php.php.txt, s.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_r577_php_php_SnIpEr_SA_Shell_php_r57_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_r577_php_php_SnIpEr_SA_Shell_php_r57_php_php_r57_Shell_php_php_spy_php_php_s_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_root_040_zip_Folder_deploy Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file deploy.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_root_040_zip_Folder_deploy Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file deploy.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_w_php_php_c99madshell_v2_1_php_php_wacking_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_1_SpecialShell_99_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, 1.txt, SpecialShell_99.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_w_php_php_c99madshell_v2_1_php_php_wacking_php_php_c99shell_v1_0_php_php_SpecialShell_99_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, SpecialShell_99.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_w_php_php_wacking_php_php_SpecialShell_99_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - from files w.php.php.txt, wacking.php.php.txt, SpecialShell_99.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	_wacking_php_php_1_SpecialShell_99_php_php_c100_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - from files wacking.php.php.txt, 1.txt, SpecialShell_99.php.php.txt, c100.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	ach_202408_html_TelegramBot Create hunting rule
Author:	abuse.ch
Description:	Detects potential JavaScript Telegram Bot inside HTML code
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	ach_RemcosRAT Create hunting rule
Author:	abuse.ch
TLP:	TLP:WHITE
Repository:	Sandnet

Rule name:	Adfind Create hunting rule
Author:	@bartblaze
Description:	Identifies Adfind, a Command line Active Directory query tool.
Reference:	http://www.joeware.net/freetools/tools/adfind/
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	ADSync_CredDump_Wide Create hunting rule
Author:	SBousseaden
Description:	AD Connect Sync Credential Extract
Reference:	https://blog.xpnsec.com/azuread-connect-for-redteam/
TLP:	TLP:WHITE
Repository:	sbousseaden

Rule name:	ADSync_CredDump_Xor Create hunting rule
Author:	SBousseaden
Description:	Azure AdSync Service Account Password Dumping
Reference:	https://blog.xpnsec.com/azuread-connect-for-redteam/
TLP:	TLP:WHITE
Repository:	sbousseaden

Rule name:	agent_tesla Create hunting rule
Author:	Stormshield
Description:	Detecting HTML strings used by Agent Tesla malware
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	AgentTeslaV2 Create hunting rule
Author:	ditekshen
Description:	AgenetTesla Type 2 Keylogger payload
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	Ajan_asp Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Ajan.asp.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Ajax_PHP_Command_Shell_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Ajax_PHP Command Shell.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	allcome Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked allcome malware samples.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Angry_IP_Scanner_v2_08_ipscan Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file ipscan.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Antichat_Shell_v1_3_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Antichat Shell v1.3.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Antichat_Socks5_Server_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Antichat Socks5 Server.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_APT28_drovorub_unique_network_comms_strings Create hunting rule
Author:	NSA / FBI
Description:	Rule to detect Drovorub-server, Drovorub-agent, or Drovorub-client based
Reference:	https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_APT28_Win_FreshFire Create hunting rule
Author:	threatintel@volexity.com
Description:	The FRESHFIRE malware family. The malware acts as a downloader, pulling down an encrypted snippet of code from a remote source, executing it, and deleting it from the remote server.
Reference:	https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
TLP:	TLP:WHITE

Rule name:	APT_APT29_NOBELIUM_BoomBox_May21_1 Create hunting rule
Author:	Florian Roth
Description:	Detects BoomBox malware as described in APT29 NOBELIUM report
Reference:	https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_APT29_NOBELIUM_BoomBox_May21_1_RID31ED Create hunting rule
Author:	Florian Roth
Description:	Detects BoomBox malware as described in APT29 NOBELIUM report
Reference:	https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
TLP:	TLP:WHITE

Rule name:	APT_APT29_NOBELIUM_Stageless_Loader_May21_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects stageless loader as used by APT29 / NOBELIUM
Reference:	https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_APT29_Win_FlipFlop_LDR Create hunting rule
Author:	threatintel@volexity.com
Description:	A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload.
Reference:	https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
TLP:	TLP:WHITE

Rule name:	APT_APT34_PS_Malware_Apr19_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects APT34 PowerShell malware
Reference:	https://twitter.com/0xffff0800/status/1118406371165126656
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_APT34_PS_Malware_Apr19_1_RID3047 Create hunting rule
Author:	Florian Roth
Description:	Detects APT34 PowerShell malware
Reference:	https://twitter.com/0xffff0800/status/1118406371165126656
TLP:	TLP:WHITE

Rule name:	APT_APT34_PS_Malware_Apr19_3 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects APT34 PowerShell malware
Reference:	https://twitter.com/0xffff0800/status/1118406371165126656
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_APT34_PS_Malware_Apr19_3_RID3049 Create hunting rule
Author:	Florian Roth
Description:	Detects APT34 PowerShell malware
Reference:	https://twitter.com/0xffff0800/status/1118406371165126656
TLP:	TLP:WHITE

Rule name:	APT_APT41_CN_ELF_Speculoos_Backdoor Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Speculoos Backdoor used by APT41
Reference:	https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_APT41_CN_ELF_Speculoos_Backdoor_RID3365 Create hunting rule
Author:	Florian Roth
Description:	Detects Speculoos Backdoor used by APT41
Reference:	https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/
TLP:	TLP:WHITE

Rule name:	APT_Backdoor_Win_GoRat_Memory Create hunting rule
Author:	FireEye
Description:	Identifies GoRat malware in memory based on strings.
Reference:	https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_Bitter_ZxxZ_Downloader Create hunting rule
Author:	SECUINFRA Falcon Team (@SI_FalconTeam)
Description:	Detects Bitter (T-APT-17) ZxxZ Downloader
Reference:	https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh
TLP:	TLP:WHITE
Repository:	SIFalcon

Rule name:	APT_Builder_PY_REDFLARE_1 Create hunting rule
Author:	FireEye
Description:	Detects FireEye's Python Redflar
Reference:	https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Red Delta samples
Reference:	https://twitter.com/JAMESWT_MHT/status/1316387482708119556
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Red Delta samples
Reference:	https://twitter.com/JAMESWT_MHT/status/1316387482708119556
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_2_RID36A3 Create hunting rule
Author:	Florian Roth
Description:	Detects Red Delta samples
Reference:	https://twitter.com/JAMESWT_MHT/status/1316387482708119556
TLP:	TLP:WHITE

Rule name:	APT_Equation_Group_Op_Triangulation_TriangleDB_Implant_Jun23_1 Create hunting rule
Author:	Florian Roth
Description:	Detects TriangleDB implant found being used in Operation Triangulation on iOS devices (maybe also used on macOS systems)
Reference:	https://securelist.com/triangledb-triangulation-implant/110050/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_FIN7_Strings_Aug18_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects strings from FIN7 report in August 2018
Reference:	https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	APT_FIN7_Strings_Aug18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects strings from FIN7 report in August 2018
Reference:	https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	APT_FIN7_Strings_Aug18_1_RID2F27 Create hunting rule
Author:	Florian Roth
Description:	Detects strings from FIN7 report in August 2018
Reference:	https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
TLP:	TLP:WHITE

Rule name:	APT_HAFNIUM_Forensic_Artefacts_Mar21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects forensic artefacts found in HAFNIUM intrusions
Reference:	https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_HAFNIUM_Forensic_Artefacts_Mar21_1_RID3463 Create hunting rule
Author:	Florian Roth
Description:	Detects forensic artefacts found in HAFNIUM intrusions
Reference:	https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
TLP:	TLP:WHITE

Rule name:	APT_MAL_CN_Wocao_Agent_Csharp Create hunting rule
Author:	Fox-IT SRT
Description:	Strings from CSharp version of Agent
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_agent_powershell_b64encoded Create hunting rule
Author:	Fox-IT SRT
Description:	Piece of Base64 encoded data from Agent CSharp version
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_agent_powershell_dropper Create hunting rule
Author:	Fox-IT SRT
Description:	Strings from PowerShell dropper of CSharp version of Agent
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_agent_py_b64encoded Create hunting rule
Author:	Fox-IT SRT
Description:	Piece of Base64 encoded data from Agent Python version
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_checkadmin_bin Create hunting rule
Author:	Fox-IT SRT
Description:	Checkadmin utility
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_getos_py Create hunting rule
Author:	Fox-IT SRT
Description:	Python getos utility
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_info_vbs Create hunting rule
Author:	Fox-IT SRT
Description:	Strings from the information grabber VBS
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_injector_bin Create hunting rule
Author:	Fox-IT SRT
Description:	Process injector/launcher
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_keylogger_py Create hunting rule
Author:	Fox-IT SRT
Description:	Strings from Python keylogger
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_timeliner_bin Create hunting rule
Author:	Fox-IT SRT
Description:	Timeliner utility
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_webshell_console_jsp Create hunting rule
Author:	Fox-IT SRT
Description:	Strings from the console.jsp webshell
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_webshell_ver_jsp Create hunting rule
Author:	Fox-IT SRT
Description:	Strings from the ver.jsp webshell
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_webshell_webinfo Create hunting rule
Author:	Fox-IT SRT
Description:	Generic strings from webinfo.war webshells
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_xserver_csharp Create hunting rule
Author:	Fox-IT SRT
Description:	Strings from the CSharp version of XServer
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_xserver_powershell_b64encoded Create hunting rule
Author:	Fox-IT SRT
Description:	Piece of Base64 encoded data from the XServer PowerShell dropper
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_CN_Wocao_xserver_powershell_dropper Create hunting rule
Author:	Fox-IT SRT
Description:	Strings from the PowerShell dropper of XServer
Reference:	https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_DTRACK_Oct19_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects DTRACK malware
Reference:	https://twitter.com/a_tweeter_user/status/1188811977851887616?s=21
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_HP_iLO_Firmware_Dec21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects suspicios ELF files with sections as described in malicious iLO Board analysis by AmnPardaz in December 2021
Reference:	https://threats.amnpardaz.com/en/2021/12/28/implant-arm-ilobleed-a/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_LNX_RedMenshen_BPFDoor_Controller_May22_3 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects BPFDoor implants used by Chinese actor Red Menshen
Reference:	https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_LUA_Hunting_Lua_SEASPRAY_1 Create hunting rule
Author:	Mandiant
Description:	Hunting rule looking for strings observed in SEASPRAY samples.
Reference:	https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_Sandworm_Exaramel_Configuration_Key Create hunting rule
Author:	FR/ANSSI/SDO
Description:	Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...]
Reference:	https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_Sandworm_Exaramel_Configuration_Name_Encrypted Create hunting rule
Author:	FR/ANSSI/SDO
Description:	Detects the specific name of the configuration file in Exaramel malware as seen in sample e1ff72[...]
Reference:	https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_Sandworm_Exaramel_Socket_Path Create hunting rule
Author:	FR/ANSSI/SDO
Description:	Detects path of the unix socket created to prevent concurrent executions in Exaramel malware
Reference:	https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_Sandworm_Exaramel_Strings Create hunting rule
Author:	FR/ANSSI/SDO (composed from 4 saparate rules by Florian Roth)
Description:	Detects Strings used by Exaramel malware
Reference:	https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_Sandworm_Exaramel_Task_Names Create hunting rule
Author:	FR/ANSSI/SDO
Description:	Detects names of the tasks received from the CC server in Exaramel malware
Reference:	https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_MAL_UNC4841_SEASPY_Jun23_1 Create hunting rule
Author:	Florian Roth
Description:	Detects SEASPY malware used by UNC4841 in attacks against Barracuda ESG appliances exploiting CVE-2023-2868
Reference:	https://blog.talosintelligence.com/alchimist-offensive-framework/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_NK_MAL_DLL_Apr23_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects DLLs loaded by shellcode loader (6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad) (relation to Lazarus group)
Reference:	https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_PY_ESXi_Backdoor_Dec22 Create hunting rule
Author:	Florian Roth
Description:	Detects Python backdoor found on ESXi servers
Reference:	https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_RANSOM_Lockbit_ForensicArtifacts_Nov23 Create hunting rule
Author:	Florian Roth
Description:	Detects patterns found in Lockbit TA attacks exploiting Citrixbleed vulnerability CVE 2023-4966
Reference:	https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_RU_Sandworm_PY_May20_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Sandworm Python loader
Reference:	https://twitter.com/billyleonard/status/1266054881225236482
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_RU_Sandworm_PY_May20_1_RID3026 Create hunting rule
Author:	Florian Roth
Description:	Detects Sandworm Python loader
Reference:	https://twitter.com/billyleonard/status/1266054881225236482
TLP:	TLP:WHITE

Rule name:	APT_SharpTongue_JS_SharpExt_Chrome_Extension Create hunting rule
Author:	threatintel@volexity.com
Description:	A malicious Chrome browser extention used by the SharpTongue threat actor to steal mail data from a victim
Reference:	https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/
TLP:	TLP:WHITE

Rule name:	APT_Turla_Agent_BTZ_Gen_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Turla Agent.BTZ
Reference:	Internal Research
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_Turla_Agent_BTZ_Gen_1_RID3003 Create hunting rule
Author:	Florian Roth
Description:	Detects Turla Agent.BTZ
Reference:	Internal Research
TLP:	TLP:WHITE

Rule name:	APT_UA_Hermetic_Wiper_Artefacts_Feb22_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects artefacts found in Hermetic Wiper malware related intrusions
Reference:	https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects scheduled task pattern found in Hermetic Wiper malware related intrusions
Reference:	https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_UNC2447_MAL_SOMBRAT_May21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects SombRAT samples from UNC2447 campaign
Reference:	https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_UNC2447_MAL_SOMBRAT_May21_1_RID3035 Create hunting rule
Author:	Florian Roth
Description:	Detects SombRAT samples from UNC2447 campaign
Reference:	https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html
TLP:	TLP:WHITE

Rule name:	APT_UNC2447_PS1_WARPRISM_May21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects WARPRISM PowerShell samples from UNC2447 campaign
Reference:	https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	APT_UNC2447_PS1_WARPRISM_May21_1_RID308C Create hunting rule
Author:	Florian Roth
Description:	Detects WARPRISM PowerShell samples from UNC2447 campaign
Reference:	https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html
TLP:	TLP:WHITE

Rule name:	APT_UNC4841_ESG_Barracuda_CVE_2023_2868_Forensic_Artifacts_Jun23_1 Create hunting rule
Author:	Florian Roth
Description:	Detects forensic artifacts found in the exploitation of CVE-2023-2868 in Barracuda ESG devices by UNC4841
Reference:	https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
TLP:	TLP:WHITE

Rule name:	APT_UTA028_ForensicArtefacts_PaloAlto_CVE_2024_3400_Apr24_1 Create hunting rule
Author:	Florian Roth
Description:	Detects forensic artefacts of APT UTA028 as found in a campaign exploiting the Palo Alto CVE-2024-3400 vulnerability
Reference:	https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
TLP:	TLP:WHITE

Rule name:	apt_Windows_TA410_X4_strings Create hunting rule
Author:	ESET Research
Description:	Matches various strings found in TA410 X4
Reference:	https://www.welivesecurity.com/
TLP:	TLP:WHITE
Repository:

Rule name:	APT10_Himawari_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Himawari(a variant of RedLeaves) in memory
Reference:	https://www.jpcert.or.jp/present/2018/JSAC2018_01_nakatsuru.pdf
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	APT10_redleaves_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	RedLeaves malware
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	APT9002 Create hunting rule
Author:	Seth Hardy
Description:	9002
TLP:	TLP:WHITE

Rule name:	APT9002Strings Create hunting rule
Author:	Seth Hardy
Description:	9002 Identifying Strings
TLP:	TLP:WHITE

Rule name:	Asmodeus_v0_1_pl Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Asmodeus v0.1.pl.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	AutoIT_Script Create hunting rule
Author:	@bartblaze
Description:	Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	ave_maria_warzone_rat Create hunting rule
Author:	jeFF0Falltrades
TLP:	TLP:WHITE
Repository:	jeFF0Falltrades

Rule name:	AveMaria Create hunting rule
Author:	@bartblaze
Description:	Identifies AveMaria aka WarZone RAT.
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	Ayyildiz_Tim___AYT__Shell_v_2_1_Biz_html Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Ayyildiz Tim -AYT- Shell v 2.1 Biz.html.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	aZRaiLPhp_v1_0_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file aZRaiLPhp v1.0.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	backdoor1_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file backdoor1.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	backdoorfr_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file backdoorfr.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Base64_decoding Create hunting rule
Author:	iam-py-test
Description:	Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Base64_Encoded_Powershell_Directives Create hunting rule
TLP:	TLP:WHITE
Repository:	InQuest

Rule name:	Base64_PS1_Shellcode Create hunting rule
Author:	Nick Carr, David Ledbetter
Description:	Detects Base64 encoded PS1 Shellcode
Reference:	https://twitter.com/ItsReallyNick/status/1062601684566843392
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	BatModifier2 Create hunting rule
Author:	Madhav
Description:	This is a bat file which is setup a game. 49509
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	bdcli100 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file bdcli100.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	bdcli100 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file bdcli100.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	bin_Client Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file Client.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	bin_Client Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file Client.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	BIN_Server Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file Server.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	BIN_Server Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file Server.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	binder2_binder2 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file binder2.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	binder2_binder2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file binder2.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	BKDR_XZUtil_KillSwitch_CVE_2024_3094_Mar24_1 Create hunting rule
Author:	Florian Roth
Description:	Detects kill switch used by the backdoored XZ library (xzutil) CVE-2024-3094.
Reference:	https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01?permalink_comment_id=5006558#gistcomment-5006558
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	BKDR_XZUtil_Script_CVE_2024_3094_Mar24_1 Create hunting rule
Author:	Florian Roth
Description:	Detects make file and script contents used by the backdoored XZ library (xzutil) CVE-2024-3094.
Reference:	https://www.openwall.com/lists/oss-security/2024/03/29/4
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	BlackDropper Create hunting rule
Author:	enzok
Description:	BlackDropper
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	BlackGuard_Rule Create hunting rule
Author:	Jiho Kim
Description:	Yara rule for BlackGuarad Stealer v1.0 - v3.0
Reference:	https://www.virustotal.com/gui/file/67843d45ba538eca29c63c3259d697f7e2ba84a3da941295b9207cdb01c85b71/detection
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	blackguard_stealer Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked blackguard malware samples.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	blackmoon_payload_v1 Create hunting rule
Author:	RandomMalware
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	BlackTech_PLEAD_elf Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	ELF PLEAD
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	BlackTech_PLEAD_mutex Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	PLEAD malware mutex strings
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	blankgrabber_v1 Create hunting rule
Author:	RandomMalware
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	BluenoroffPoS_DLL Create hunting rule
Author:	http://blog.trex.re.kr/
Description:	Bluenoroff POS malware - hkp.dll
Reference:	http://blog.trex.re.kr/3?category=737685
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	BluesPortScan Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file BluesPortScan.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Borland Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	botnet_plaintext_c2 Create hunting rule
Author:	cip
Description:	Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	brbbot_v1 Create hunting rule
Author:	RandomMalware
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	by063cli Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file by063cli.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	by063cli Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file by063cli.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	by064cli Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file by064cli.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	by064cli Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file by064cli.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	BypassUac2 Create hunting rule
Author:	yarGen Yara Rule Generator
Description:	Auto-generated rule - file BypassUac2.zip
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	byshell063_ntboot_2 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file ntboot.dll
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	byshell063_ntboot_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file ntboot.dll
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	c99madshell_v2_0_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file c99madshell_v2.0.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Casus15_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Casus15.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Cerberus Create hunting rule
Author:	Jean-Philippe Teissier / @Jipe_
Description:	Cerberus
TLP:	TLP:WHITE

Rule name:	cgi_python_py Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file cgi-python.py.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	CGISscan_CGIScan Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file CGIScan.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Check_Dlls Create hunting rule
TLP:	TLP:WHITE
Repository:

Rule name:	ciscotools Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Cisco tools
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	CMD_Ping_Localhost Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	CMD_Shutdown Create hunting rule
Author:	adm1n_usa32
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	CmdAsp_asp Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file CmdAsp.asp.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	cmdjsp_jsp Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file cmdjsp.jsp.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Cobaltbaltstrike_Beacon_Encoded Create hunting rule
Author:	Avast Threat Intel Team
Description:	Detects CobaltStrike payloads
Reference:	https://github.com/avast/ioc
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Cobaltbaltstrike_Payload_Encoded Create hunting rule
Author:	Avast Threat Intel Team
Description:	Detects CobaltStrike payloads
Reference:	https://github.com/avast/ioc
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Cobaltgang_PDF_Metadata_Rev_A Create hunting rule
Author:	Palo Alto Networks Unit 42
Description:	Find documents saved from the same potential Cobalt Gang PDF template
Reference:	https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	CobaltStrike__Resources_Template_Py_v3_3_to_v4_x Create hunting rule
Author:	gssincla@google.com
TLP:	TLP:WHITE
Repository:	GCTI

Rule name:	CobaltStrike__Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13 Create hunting rule
Author:	gssincla@google.com
TLP:	TLP:WHITE
Repository:	GCTI

Rule name:	CobaltStrike_Resources_Template_Py_v3_3_to_v4_x Create hunting rule
Author:	gssincla@google.com
Description:	Cobalt Strike's resources/template.py signature for versions v3.3 to v4.x
Reference:	https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	CobaltStrike_Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13 Create hunting rule
Author:	gssincla@google.com
Description:	Cobalt Strike's resources/template.x64.ps1, resources/template.hint.x64.ps1 and resources/template.hint.x32.ps1 from v3.0 to v4.x except 3.12 and 3.13
Reference:	https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	CobaltStrike_Unmodifed_Beacon Create hunting rule
Author:	yara@s3c.za.net
Description:	Detects unmodified CobaltStrike beacon DLL
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	CobaltStrikeBeacon Create hunting rule
Author:	ditekshen, enzo & Elastic
Description:	Cobalt Strike Beacon Payload
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	connectback2_pl Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file connectback2.pl.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	connector Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file connector.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	connector Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file connector.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	crack_Loader Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file Loader.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	CryLock Create hunting rule
Author:	@bartblaze
Description:	Identifies CryLock aka Cryakl ransomware.
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	csh_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file csh.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	cyberlords_sql_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file cyberlords_sql.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	darkgate_ Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked darkgate malware samples.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Darkside Create hunting rule
Author:	@bartblaze
Description:	Identifies Darkside ransomware.
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	DarkSpy105 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file DarkSpy105.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	DarkSpy105 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file DarkSpy105.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	darktrack_rat Create hunting rule
Author:	jeFF0Falltrades
TLP:	TLP:WHITE
Repository:	jeFF0Falltrades

Rule name:	dbgiis6cli Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file dbgiis6cli.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	dbgiis6cli Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file dbgiis6cli.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	dbgntboot Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file dbgntboot.dll
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	dbgntboot Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file dbgntboot.dll
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Debug_cress Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file cress.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Debug_cress Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file cress.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	DeepPanda_htran_exe Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Hack Deep Panda - htran-exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	DeepPanda_htran_exe_RID2E90 Create hunting rule
Author:	Florian Roth
Description:	Hack Deep Panda - htran-exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	DefenderControl Create hunting rule
Author:	@bartblaze
Description:	Identifies Defender Control, used by attackers to disable Windows Defender.
Reference:	https://www.sordum.org/9480/defender-control-v1-8/
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	dependsonpythonailib Create hunting rule
Author:	Tim Brown
Description:	Hunts for dependencies on Python AI libraries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	detect_braodo_stealer Create hunting rule
Author:	Priya
Description:	This rule detects Broaodo Stealer
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
Author:	classified
Description:	classified

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Detect_Remcos_RAT Create hunting rule
Author:	daniyyell
Description:	Detects Remcos RAT payloads and commands
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	dgaaga Create hunting rule
Author:	Harshit
Description:	Detects suspicious PowerShell or registry activity
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	classified

Rule name:	Dive_Shell_1_0___Emperor_Hacking_Team_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Dive Shell 1.0 - Emperor Hacking Team.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	dl_shadow Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	Dx_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Dx.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	echelon Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked echelon malware samples.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	EditServer_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file EditServer.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	EditServer_2 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file EditServer.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	EditServer_3 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file EditServer.exe
TLP:	TLP:WHITE
Repository:

Rule name:	EditServer_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file EditServer.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	EFSO_2_asp Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file EFSO_2.asp.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	elf_bpfdoor_w2 Create hunting rule
Author:	Florian Roth
Description:	Detects BPFDoor implants used by Chinese actor Red Menshen
Reference:	https://twitter.com/jcksnsec/status/1522163033585467393
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	elf_kobalos_w1 Create hunting rule
Author:	Marc-Etienne M.Léveillé
Description:	Kobalos SSH credential stealer seen in OpenSSH client
Reference:	http://www.welivesecurity.com
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	elf_moose_w1 Create hunting rule
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	Elf_plead Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	ELF_PLEAD
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	elf_pumakit_w0 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	elf_winnti_w0 Create hunting rule
Author:	Silas Cutler (havex [@] chronicle.security), Chronicle Security
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	elmaliseker Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file elmaliseker.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	elmaliseker Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file elmaliseker.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	elmaliseker_asp Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file elmaliseker.asp.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	ESXi_Ransomware_Royal_params Create hunting rule
Author:	albertzsigovits
Description:	Detection for Royal ransomware on ESXi
TLP:	TLP:WHITE

Rule name:	EXPL_Cleo_Exploitation_Log_Indicators_Dec24 Create hunting rule
Author:	Florian Roth
Description:	Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)
Reference:	https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
TLP:	TLP:WHITE

Rule name:	EXPL_GitLab_CE_RCE_CVE_2021_22205 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects signs of exploitation of GitLab CE CVE-2021-22205
Reference:	https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	EXPL_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-27065
Reference:	https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
TLP:	TLP:WHITE

Rule name:	EXPL_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_1_RID3AD7 Create hunting rule
Author:	Florian Roth
Description:	Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-27065
Reference:	https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
TLP:	TLP:WHITE

Rule name:	EXPL_ManageEngine_CVE_2022_47966_Jan23_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects indicators of exploitation of ManageEngine vulnerability as described by Horizon3
Reference:	https://www.horizon3.ai/manageengine-cve-2022-47966-iocs/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	EXPL_PaloAlto_CVE_2024_3400_Apr24_1 Create hunting rule
Author:	Florian Roth
Description:	Detects characteristics of the exploit code used in attacks against Palo Alto GlobalProtect CVE-2024-3400
Reference:	https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	EXPL_POC_SpringCore_0day_Indicators_Mar22_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects indicators found after SpringCore exploitation attempts and in the POC script
Reference:	https://twitter.com/vxunderground/status/1509170582469943303
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	EXPL_Shitrix_Exploit_Code_Jan20_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects payloads used in Shitrix exploitation CVE-2019-19781
Reference:	https://isc.sans.edu/forums/diary/Citrix+ADC+Exploits+Overview+of+Observed+Payloads/25704/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	EXPL_Shitrix_Exploit_Code_Jan20_1_RID331C Create hunting rule
Author:	Florian Roth
Description:	Detects payloads used in Shitrix exploitation CVE-2019-19781
Reference:	https://isc.sans.edu/forums/diary/Citrix+ADC+Exploits+Overview+of+Observed+Payloads/25704/
TLP:	TLP:WHITE

Rule name:	Exploit_Outlook_CVE_2023_23397 Create hunting rule
TLP:	TLP:WHITE
Repository:	fboldewin

Rule name:	EXT_MAL_SystemBC_Mar22_1 Create hunting rule
Author:	Thomas Barabosch, Deutsche Telekom Security
Description:	Detects unpacked SystemBC module as used by Emotet in March 2022
Reference:	https://twitter.com/Cryptolaemus1/status/1502069552246575105
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FeliksPack3___PHP_Shells_phpft Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file phpft.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FeliksPack3___PHP_Shells_phpft Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file phpft.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FeliksPack3___PHP_Shells_ssh Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file ssh.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FeliksPack3___PHP_Shells_ssh Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file ssh.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FeliksPack3___PHP_Shells_usr Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file usr.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FeliksPack3___PHP_Shells_usr Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file usr.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FeliksPack3___Scanners_ipscan Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file ipscan.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	FSO_s_casus15_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file casus15.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FSO_s_casus15_2 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file casus15.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FSO_s_phpinj Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file phpinj.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FSO_s_phpinj Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file phpinj.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FSO_s_reader Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file reader.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FSO_s_reader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file reader.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FSO_s_zehir4 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file zehir4.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	FSO_s_zehir4 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file zehir4.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	fuckphpshell_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file fuckphpshell.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	generic_IG_stealer Create hunting rule
Author:	RE4rensics
Description:	Detects stealers that interacts with IG endpoints after stealing IG cookies
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Gmer Create hunting rule
Author:	@bartblaze
Description:	Identifies Gmer, sometimes used by attackers to disable security software.
Reference:	http://www.gmer.net/
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	GoBinTest Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	golang Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	h4ntu_shell__powered_by_tsoi_ Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file h4ntu shell [powered by tsoi].txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HackTool_Producers Create hunting rule
Description:	Hacktool Producers String
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HackTool_Samples Create hunting rule
Description:	Hacktool
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Hacktool_Strings_p0wnedShell Create hunting rule
Author:	Florian Roth
Description:	Detects strings found in Runspace Post Exploitation Toolkit
Reference:	https://github.com/Cn33liz/p0wnedShell
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Hacktool_Strings_p0wnedShell_RID3234 Create hunting rule
Author:	Florian Roth
Description:	p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs
Reference:	https://github.com/Cn33liz/p0wnedShell
TLP:	TLP:WHITE

Rule name:	has_telegram_urls Create hunting rule
Author:	Aaron DeVera<aaron@backchannel.re>
Description:	Detects Telegram URLs
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	hidshell_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file hidshell.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Himawari Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Himawari(a variant of RedLeaves) in memory
Reference:	https://www.jpcert.or.jp/present/2018/JSAC2018_01_nakatsuru.pdf
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	hkdoordll Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file hkdoordll.dll
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	hkdoordll Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file hkdoordll.dll
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	hkshell_hkrmv Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file hkrmv.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	hkshell_hkrmv Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file hkrmv.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	hkshell_hkshell Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file hkshell.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	hkshell_hkshell Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file hkshell.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_bdcli100_RID2B32 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file bdcli100.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_BIN_Server_RID2C52 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file Server.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_by063cli_RID2B4F Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file by063cli.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_by064cli_RID2B50 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file by064cli.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_byshell063_ntboot_2_RID2FB5 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file ntboot.dll
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_CobaltStrike_Beacon_Strings Create hunting rule
Author:	Elastic
Description:	Identifies strings used in Cobalt Strike Beacon DLL
Reference:	https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_dbgiis6cli_RID2C83 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file dbgiis6cli.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_dbgntboot_RID2C66 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file dbgntboot.dll
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_Debug_cress_RID2D09 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file cress.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_EditServer_2_RID2D31 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file EditServer.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_FeliksPack3___Scanners_ipscan_RID33EA Create hunting rule
Author:	Florian Roth
Description:	Semiautomatically generated YARA rule on file ipscan.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_hkdoordll_RID2C66 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file hkdoordll.dll
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_hkshell_hkrmv_RID2E15 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file hkrmv.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_HYTop_CaseSwitch_2005_RID2FEA Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file 2005.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_IP_Stealing_Utilities_RID30ED Create hunting rule
Author:	Florian Roth
Description:	Semiautomatically generated YARA rule on file IP Stealing Utilities.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_Khepri_Beacon_Sep21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Khepri C2 framework beacons
Reference:	https://github.com/geemion/Khepri/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_Lazagne_Gen_18 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Lazagne password extractor hacktool
Reference:	https://github.com/AlessandroZ/LaZagne
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_Lazagne_Gen_18_RID2DA6 Create hunting rule
Author:	Florian Roth
Description:	Detects Lazagne password extractor hacktool
Reference:	https://github.com/AlessandroZ/LaZagne
TLP:	TLP:WHITE

Rule name:	HKTL_Mithril_tool_RID2D99 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file Mithril.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_NATBypass_Dec22_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects NatBypass tool (also used by APT41)
Reference:	https://github.com/cw1997/NATBypass
TLP:	TLP:WHITE

Rule name:	HKTL_NetBIOS_Name_Scanner_RID3000 Create hunting rule
Author:	Florian Roth
Description:	Semiautomatically generated YARA rule on file NetBIOS Name Scanner.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_NFS_Fuse_NFS Create hunting rule
Author:	Moritz Oettle
Description:	Detects the nfs-security-tooling fuse_nfs by HvS Consulting
Reference:	https://github.com/hvs-consulting/nfs-security-tooling
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_NFS_NFS_Analyze Create hunting rule
Author:	Marc Stroebel
Description:	Detects the nfs-security-tooling nfy_analyze by HvS Consulting
Reference:	https://github.com/hvs-consulting/nfs-security-tooling
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_Nishang_PS1_Invoke_PowerShellTcpOneLine Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects PowerShell Oneliner in Nishang's repository
Reference:	https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_Nishang_PS1_Invoke_PowerShellTcpOneLine_RID379E Create hunting rule
Author:	Florian Roth
Description:	Detects PowerShell Oneliner in Nishang's repository
Reference:	https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1
TLP:	TLP:WHITE

Rule name:	HKTL_NoPowerShell Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects NoPowerShell hack tool
Reference:	https://github.com/bitsadmin/nopowershell
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_NoPowerShell_RID2D65 Create hunting rule
Author:	Florian Roth
Description:	Detects NoPowerShell hack tool
Reference:	https://github.com/bitsadmin/nopowershell
TLP:	TLP:WHITE

Rule name:	HKTL_PasswordReminder_RID2F2C Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file PasswordReminder.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_PortRacer_RID2C35 Create hunting rule
Author:	Florian Roth
Description:	Semiautomatically generated YARA rule on file PortRacer.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_PortScanner_RID2D12 Create hunting rule
Author:	Florian Roth
Description:	Semiautomatically generated YARA rule on file PortScanner.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_PortScanner_Simple_Jan14 Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file PortScanner.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_PowerKatz_Feb19_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detetcs a tool used in the Australian Parliament House network compromise
Reference:	https://twitter.com/cyb3rops/status/1097423665472376832
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_PowerKatz_Feb19_1_RID2EB0 Create hunting rule
Author:	Florian Roth
Description:	Detetcs a tool used in the Australian Parliament House network compromise
Reference:	https://twitter.com/cyb3rops/status/1097423665472376832
TLP:	TLP:WHITE

Rule name:	HKTL_PS1_PowerCat_Mar21 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects PowerCat hacktool
Reference:	https://github.com/besimorhino/powercat
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_PS1_PowerCat_Mar21_RID2EDD Create hunting rule
Author:	Florian Roth
Description:	Detects PowerCat hacktool
Reference:	https://github.com/besimorhino/powercat
TLP:	TLP:WHITE

Rule name:	HKTL_rdrbs084_RID2B5C Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file rdrbs084.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_rdrbs100_RID2B51 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file rdrbs100.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_root_040_zip_Folder_deploy_RID32B3 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file deploy.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_scanarator_RID2CD1 Create hunting rule
Author:	Florian Roth
Description:	Semiautomatically generated YARA rule on file scanarator.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_shelltools_g0t_root_HideRun_RID3387 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file HideRun.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_Unknown_Feb19_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detetcs a tool used in the Australian Parliament House network compromise
Reference:	https://twitter.com/cyb3rops/status/1097423665472376832
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_Unknown_Feb19_1_RID2DF9 Create hunting rule
Author:	Florian Roth
Description:	Detetcs a tool used in the Australian Parliament House network compromise
Reference:	https://twitter.com/cyb3rops/status/1097423665472376832
TLP:	TLP:WHITE

Rule name:	HKTL_Unpack_Injectt_RID2E35 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file Injectt.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_vanquish_2_RID2CA3 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file vanquish.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HKTL_Venom_LIB_Dec22 Create hunting rule
Author:	Ido Veltzman, Florian Roth
Description:	Detects Venom - a library that meant to perform evasive communication using stolen browser socket
Reference:	https://github.com/Idov31/Venom
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HKTL_ZXshell2_0_rar_Folder_zxrecv_RID338E Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file zxrecv.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	HTML_Windows_Search_Abuse Create hunting rule
Author:	marcin@ulikowski.pl
Description:	Detects HTML files abusing Windows system functionalities to redirect and download malicious payloads
TLP:	TLP:WHITE
Repository:

Rule name:	HYTop_CaseSwitch_2005 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file 2005.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HYTop_CaseSwitch_2005 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file 2005.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HYTop_DevPack_server Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file server.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HYTop_DevPack_server Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file server.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HYTop_DevPack_server_RID2ED8 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file server.asp
Reference:	-
TLP:	TLP:WHITE

Rule name:	HYTop_DevPack_upload Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file upload.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HYTop_DevPack_upload Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file upload.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HYTop2006_rar_Folder_2006 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file 2006.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	HYTop2006_rar_Folder_2006 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file 2006.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	IcedID_init_loader Create hunting rule
Author:	@bartblaze
Description:	Identifies IcedID (stage 1 and 2, initial loaders).
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	icyfox007v1_10_rar_Folder_asp Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file asp.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	icyfox007v1_10_rar_Folder_asp Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file asp.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	IDATDropper Create hunting rule
Author:	NDA0E
Description:	Detects files containing embedded JavaScript; the JS executes a PowerShell command which either downloads IDATLoader in an archive, or an executable (not IDATLoader) which is loaded into memory. The modified PE will only run if it's executed as an HTML Application (.hta).
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	IIS_Group14 Create hunting rule
Author:	ESET Research
Description:	Detects Group 14 native IIS malware family
Reference:	https://www.welivesecurity.com/
TLP:	TLP:WHITE
Repository:

Rule name:	Impacket Create hunting rule
Author:	@bartblaze
Description:	Identifies Impacket, a collection of Python classes for working with network protocols.
Reference:	https://github.com/SecureAuthCorp/impacket
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	INDICATOR_KB_ID_PowerShellCookieStealer Create hunting rule
Author:	ditekShen
Description:	Detects email accounts used for exfiltration observed in PowerShellCookieStealer
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_AlKhal Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with AlKhal ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_AlumniLocker Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with AlumniLocker ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_BlackCat Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with BlackCat ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_DarkSide Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with DarkSide ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_DECAF Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with DECAF ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Diavol Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Diavol ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_DoejoCrypt Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with DoejoCrypt ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Epsilon Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Epsilon ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_GoldenAxe Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with GoldenAxe ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Koxic Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with LokiLocker ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_LockDown Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with LockDown / cantopen ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_LokiLocker Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with LokiLocker ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Maze Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Maze ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Payola Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Payola ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Phobos Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Phobos ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Purge Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Purge ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_RansomwareEXX Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with RansomwareEXX Linux ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_RanzyLocker Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with RanzyLocker ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Rapid Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Rapid ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Rhysida Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Rhysida ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Ryuk Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Ryuk ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Ryzerlo Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Ryzerlo / HiddenTear / RSJON ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Satana Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Satana ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Spyro Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Spyro ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Thanos Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Thanos ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_UnlockYourFiles Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with UnlockYourFiles ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Vovalex Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Vovalex ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_KB_ID_Ransomware_Zeoticus Create hunting rule
Author:	ditekShen
Description:	Detects files referencing identities associated with Zeoticus ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	Indicator_MiniDumpWriteDump Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
TLP:	TLP:WHITE

Rule name:	INDICATOR_SUSPICIOUS_GENRansomware Create hunting rule
Author:	ditekSHen
Description:	Detects command variations typically used by ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_TOOL_GoCLR Create hunting rule
Author:	ditekSHen
Description:	Detects binaries utilizing Go-CLR for hosting the CLR in a Go process and using it to execute a DLL from disk or an assembly from memory
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	INDICATOR_TOOL_PWS_PwDump7 Create hunting rule
Author:	ditekSHen
Description:	Detects Pwdump7 password Dumper
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	installer Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file installer.cmd
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	installer Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file installer.cmd
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	IP_Stealing_Utilities Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file IP Stealing Utilities.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	ironshell_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file ironshell.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	IronTiger_ASPXSpy Create hunting rule
Author:	Cyber Safety Solutions, Trend Micro
Description:	ASPXSpy detection. It might be used by other fraudsters
Reference:	http://goo.gl/T5fSJC
TLP:	TLP:WHITE
Repository:

Rule name:	IronTiger_wmiexec Create hunting rule
Author:	Cyber Safety Solutions, Trend Micro
Description:	Iron Tiger Tool - wmi.vbs detection
Reference:	http://goo.gl/T5fSJC
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	ItsSoEasy_Ransomware_basic Create hunting rule
Author:	bstnbuck
Description:	Detect basics of ItsSoEasy Ransomware (Itssoeasy-A)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Java_Shell_js Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Java Shell.js.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	js_node_rat_w0 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Noderat in memory
Reference:	https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	jsp_reverse_jsp Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file jsp-reverse.jsp.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	jspshall_jsp Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file jspshall.jsp.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	JspWebshell_1_2_jsp Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file JspWebshell 1.2.jsp.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Jupyter_infostealer Create hunting rule
Author:	CD_R0M_
Description:	Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022
TLP:	TLP:WHITE
Repository:	CD-R0M

Rule name:	Jupyter_Infostealer_PowerShell Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	observed powershell command strings
Reference:	http://security5magics.blogspot.com/2020/12/tracking-jupyter-malware.html
TLP:	TLP:WHITE
Repository:

Rule name:	kacak_asp Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file kacak.asp.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	kill_explorer Create hunting rule
Author:	iam-py-test
Description:	Detect files killing explorer.exe
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	KINS_dropper Create hunting rule
Author:	AlienVault Labs aortega@alienvault.com
Description:	Match protocol, process injects and windows exploit present in KINS dropper
Reference:	http://goo.gl/arPhm3
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	kobalos_ssh_credential_stealer Create hunting rule
Author:	Marc-Etienne M.Léveillé
Description:	Kobalos SSH credential stealer seen in OpenSSH client
Reference:	http://www.welivesecurity.com
TLP:	TLP:WHITE
Repository:

Rule name:	kraken_cryptor_ransomware Create hunting rule
Author:	Marc Rivero \| McAfee ATR Team
Description:	Rule to detect the Kraken Cryptor Ransomware
Reference:	https://www.mcafee.com/blogs/other-blogs/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/
TLP:	TLP:WHITE
Repository:	advanced-threat-research

Rule name:	lamashell_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file lamashell.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	LaZagne Create hunting rule
Author:	@bartblaze
Description:	Identifies LaZagne, credentials recovery project.
Reference:	https://github.com/AlessandroZ/LaZagne
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	Lazarus_BTREE_str Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	BTREE malware using Lazarus
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	Linux_Backdoor_Tinyshell_67ee6fae Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Exploit_CVE_2021_3156_7f5672d0 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Exploit_CVE_2021_3156_f3fb10cd Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Exploit_CVE_2021_3490_d369d615 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Exploit_CVE_2021_4034_1c8f235d Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Exploit_CVE_2022_0847_e831c285 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Exploit_IOUring_d04c1c19 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Exploit_Log4j_7fc4d480 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/detecting-log4j2-with-elastic-security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Generic_Threat_1973391f Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Generic_Threat_98bbca63 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Hacktool_Fontonlake_68ad8568 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Hacktool_Lightning_e87c9d50 Create hunting rule
Author:	Elastic Security
Reference:	https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Hacktool_LigoloNG_027c0134 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Hacktool_Outlaw_cf069e73 Create hunting rule
Author:	Elastic Security
Description:	Outlaw SSH bruteforce component fom the Dota3 package
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Hacktool_Wipelog_daea1aa4 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Proxy_Frp_4213778f Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_Agenda_4562a654 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_Akira_02237952 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_Babuk_bd216cab Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_Clop_728cf32a Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_Conti_a89c26cf Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_Erebus_ead4f55b Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_Esxiargs_75a8ec04 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_Hellokitty_35731270 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_LimpDemon_95c748e0 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_Lockbit_d248e80e Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_Monti_9c64f016 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_NoEscape_6de58e0c Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_Quantum_8513fb8b Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_RagnarLocker_9f5982b8 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Ransomware_RoyalPest_502a3db6 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Bedevil_2af79cea Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_BrokePKG_7b7d4581 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Diamorphine_66eb93c7 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Diamorphine_716c7ffa Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Generic_482bca48 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Generic_61229bdf Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Generic_d0c5cfe0 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Generic_f07bcabe Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_HiddenWasp_8408057b Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Jynx_c470eaff Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Kovid_b77dc7f4 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Melofee_25d42bdd Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Reptile_85abf958 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Reptile_b2ccf852 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Reptile_c9f8806d Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Reptile_eb201301 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Rootkit_Snapekit_01205a75 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_Azeela_aad9d6cc Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_BPFDoor_0f768f60 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_BPFDoor_1a7d804b Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_BPFDoor_59e029c3 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_BPFDoor_8453771b Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_BPFDoor_e14b0b79 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_DinodasRAT_1d371d10 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_FinalDraft_4ea5a204 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_Mettle_e8fdbcbd Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_Mirai_7c88acbc Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_Mirai_b9a9d04b Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_Orbit_57c23178 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_Pumakit_b86138c3 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_Skidmap_52fb8489 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_XZBackdoor_74e87a9d Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_Zerobot_185e2396 Create hunting rule
Author:	Elastic Security
Description:	Strings found in the zerobot startup / persistanse functions
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Linux_Trojan_Zerobot_3a5b56dd Create hunting rule
Author:	Elastic Security
Description:	Strings found in the Zerobot Spoofed Header method
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	LOG_Exchange_Forensic_Artefacts_CleanUp_Activity_Mar21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects forensic artefacts showing cleanup activity found in HAFNIUM intrusions exploiting
Reference:	https://twitter.com/jdferrell3/status/1368626281970024448
TLP:	TLP:WHITE

Rule name:	LOG_Exchange_Forensic_Artefacts_CleanUp_Activity_Mar21_1_RID3C2E Create hunting rule
Author:	Florian Roth
Description:	Detects forensic artefacts showing cleanup activity found in HAFNIUM intrusions exploiting
Reference:	https://twitter.com/jdferrell3/status/1368626281970024448
TLP:	TLP:WHITE

Rule name:	LOG_EXPL_ADSelfService_CVE_2021_40539_ADSLOG_Sep21 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539
Reference:	https://us-cert.cisa.gov/ncas/alerts/aa21-259a
TLP:	TLP:WHITE

Rule name:	LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_1 Create hunting rule
Author:	Florian Roth
Description:	Detects a potential compromise indicator found in MOVEit Transfer logs
Reference:	https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_2 Create hunting rule
Author:	Florian Roth
Description:	Detects a potential compromise indicator found in MOVEit Transfer logs
Reference:	https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_3 Create hunting rule
Author:	Nasreddine Bencherchali
Description:	Detects a potential compromise indicator found in MOVEit DMZ Web API logs
Reference:	https://attackerkb.com/topics/mXmV0YpC3W/cve-2023-34362/rapid7-analysis
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	LOG_EXPL_ProxyToken_Exploitation_Aug21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects ProxyToken CVE-2021-33766 exploitation attempts on an unpatched system
Reference:	https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	LOG_F5_BIGIP_Exploitation_Artefacts_CVE_2021_22986_Mar21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects forensic artefacts indicating successful exploitation of F5 BIG IP appliances as reported by NCCGroup
Reference:	https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/
TLP:	TLP:WHITE

Rule name:	LOG_F5_BIGIP_Exploitation_Artefacts_CVE_2021_22986_Mar21_1_RID3A2F Create hunting rule
Author:	Florian Roth
Description:	Detects forensic artefacts indicating successful exploitation of F5 BIG IP appliances as reported by NCCGroup
Reference:	https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/
TLP:	TLP:WHITE

Rule name:	LOG_ProxyNotShell_POC_CVE_2022_41040_Nov22 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects logs generated after a successful exploitation using the PoC code against CVE-2022-41040 and CVE-2022-41082 (aka ProxyNotShell) in Microsoft Exchange servers
Reference:	https://github.com/testanull/ProxyNotShell-PoC
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	LOG_SUSP_EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22_ Create hunting rule
Author:	Florian Roth
Description:	Detects payload as seen in PoC code to exploit Workspace ONE Access freemarker server-side template injection CVE-2022-22954
Reference:	https://github.com/sherlocksecurity/VMware-CVE-2022-22954
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	LucaStealer Create hunting rule
Author:	Chat3ux
Description:	Lucasstealer
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	lurm_safemod_on_cgi Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file lurm_safemod_on.cgi.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MacOS_Backdoor_Fakeflashlxk_06fd8071 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Backdoor_Keyboardrecord_832f7bac Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Backdoor_Useragent_1a02fc3a Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Cryptominer_Generic_d3f68e29 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Cryptominer_Xmrig_241780a1 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Exploit_Log4j_75a13888 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Macos_Hacktool_JokerSpy_58a6b26d Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/inital-research-of-jokerspy
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Hacktool_Swiftbelt_bc62ede6 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/inital-research-of-jokerspy
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Macos_Infostealer_EncodedOsascript_eeb54a7e Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Infostealer_MdQueryTCC_142313cb Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Trojan_Eggshell_ddacf7b9 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Trojan_Electrorat_b4dbfd1d Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Trojan_KandyKorn_a7bb6944 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Trojan_Metasploit_293bfea9 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Trojan_Metasploit_448fa81d Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Trojan_Metasploit_6cab0ec0 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Trojan_RustBucket_e64f7a92 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MacOS_Trojan_Thiefquest_9130c0f3 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	MAL_APT_NK_Andariel_GoLang_Validalpha_Tasks Create hunting rule
Author:	CISA.gov
Description:	Detects a variant of the GoLang Validalpha malware
Reference:	https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_APT_NK_Andariel_KaosRAT_Yamabot Create hunting rule
Author:	CISA.gov
Description:	Detects the KaosRAT variant
Reference:	https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_ELF_SALTWATER_Jun23_1 Create hunting rule
Author:	Florian Roth
Description:	Detects SALTWATER malware used in Barracuda ESG exploitations (CVE-2023-2868)
Reference:	https://www.barracuda.com/company/legal/esg-vulnerability
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_EXPL_Perfctl_Oct24 Create hunting rule
Author:	Florian Roth
Description:	Detects exploits used in relation with Perfctl malware campaigns
Reference:	https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_Github_Repo_Compromise_MyJino_Ru_Aug22 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects URL mentioned in report on compromised Github repositories in August 2022
Reference:	https://twitter.com/stephenlacy/status/1554697077430505473
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_Go_Modbus_Jul24_1 Create hunting rule
Author:	Florian Roth
Description:	Detects characteristics reported by Dragos for FrostyGoop ICS malware
Reference:	https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_.pdf
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_Grace_Dec22 Create hunting rule
Author:	X__Junior
Description:	Detects Grace (aka FlawedGrace and GraceWire) RAT
Reference:	https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_HawkEye_Keylogger_Gen_Dec18 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects HawkEye Keylogger Reborn
Reference:	https://twitter.com/James_inthe_box/status/1072116224652324870
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_HawkEye_Keylogger_Gen_Dec18_RID324D Create hunting rule
Author:	Florian Roth
Description:	Detects HawkEye Keylogger Reborn
Reference:	https://twitter.com/James_inthe_box/status/1072116224652324870
TLP:	TLP:WHITE

Rule name:	MAL_IcedId_Core_LDR_202104 Create hunting rule
Author:	Thomas Barabosch, Telekom Security
Description:	2021 loader for Bokbot / Icedid core (license.dat)
Reference:	https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_LNX_CamaroDragon_HorseShell_Oct23 Create hunting rule
Author:	Florian Roth
Description:	Detects CamaroDragon's HorseShell implant for routers
Reference:	https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_LNX_CamaroDragon_Sheel_Oct23 Create hunting rule
Author:	Florian Roth
Description:	Detects CamaroDragon's tool named sheel
Reference:	https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_LNX_LinaDoor_Rootkit_May22 Create hunting rule
Author:	Florian Roth
Description:	Detects LinaDoor Linux Rootkit
Reference:	Internal Research
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_LNX_RedMenshen_BPFDoor_May23_1 Create hunting rule
Author:	Florian Roth
Description:	Detects BPFDoor malware
Reference:	https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_PY_Dimorf Create hunting rule
Author:	Silas Cutler
Description:	Detection for Dimorf ransomeware
Reference:	https://github.com/Ort0x36/Dimorf
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_QBot_HTML_Smuggling_Indicators_Oct22_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects double encoded PKZIP headers as seen in HTML files used by QBot
Reference:	https://twitter.com/ankit_anubhav/status/1578257383133876225?s=20&t=Bu3CCJCzImpTGOQX_KGsdA
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_RANSOM_Crime_DearCry_Mar2021_1 Create hunting rule
Author:	Nils Kuhnert
Description:	Triggers on strings of known DearCry samples
Reference:	https://twitter.com/phillip_misner/status/1370197696280027136
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_RANSOM_DarkBit_Feb23_1 Create hunting rule
Author:	Florian Roth
Description:	Detects indicators found in DarkBit ransomware
Reference:	https://twitter.com/idonaor1/status/1624703255770005506?s=12&t=mxHaauzwR6YOj5Px8cIeIw
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_RANSOM_Darkside_May21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Darkside Ransomware
Reference:	https://app.any.run/tasks/020c1740-717a-4191-8917-5819aa25f385/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_RANSOM_Darkside_May21_1_RID3019 Create hunting rule
Author:	Florian Roth
Description:	Detects Darkside Ransomware
Reference:	https://app.any.run/tasks/020c1740-717a-4191-8917-5819aa25f385/
TLP:	TLP:WHITE

Rule name:	MAL_RANSOM_ELF_ESXi_Attacks_Feb23_1 Create hunting rule
Author:	Florian Roth
Description:	Detects ransomware exploiting and encrypting ESXi servers
Reference:	https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_RANSOM_LNX_macOS_LockBit_Apr23_1 Create hunting rule
Author:	Florian Roth
Description:	Detects LockBit ransomware samples for Linux and macOS
Reference:	https://twitter.com/malwrhunterteam/status/1647384505550876675?s=20
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_RANSOM_LockBit_ForensicArtifacts_Apr23_1 Create hunting rule
Author:	Florian Roth
Description:	Detects forensic artifacts found in LockBit intrusions
Reference:	https://objective-see.org/blog/blog_0x75.html
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_RANSOM_LockBit_Locker_LOG_Apr23_1 Create hunting rule
Author:	Florian Roth
Description:	Detects indicators found in LockBit ransomware log files
Reference:	https://objective-see.org/blog/blog_0x75.html
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MAL_vanquish_RID2BB9 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file vanquish.dll
Reference:	-
TLP:	TLP:WHITE

Rule name:	MAL_WAR_Ivanti_EPMM_MobileIron_LogClear_JAVA_Aug23 Create hunting rule
Author:	Florian Roth
Description:	Detects LogClear.class found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078
Reference:	https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	malware_apt15_generic Create hunting rule
Author:	David Cannings
Description:	Find generic data potentially relating to AP15 tools
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MALWARE_Java_Pyrogenic Create hunting rule
Author:	ditekSHen
Description:	Pyrogenic/Qealler infostealer payload
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	malware_Nanocore_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	malware_netwire_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect netwire in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	malware_Noderat_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Noderat in memory
Reference:	https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	MALWARE_PWSH_CUMII Create hunting rule
Author:	ditekSHen
Description:	Detects multi-dropper PowerShell
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	malware_Remcos_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	malware_sakula_memory Create hunting rule
Author:	David Cannings
Description:	Sakula malware - strings after unpacking (memory rule)
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	malware_Ursnif_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	MALWARE_Win_AgentTeslaV2 Create hunting rule
Author:	ditekSHen
Description:	AgenetTesla Type 2 Keylogger payload
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_AgentTeslaV3 Create hunting rule
Author:	ditekSHen
Description:	AgentTeslaV3 infostealer payload
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_AsyncRAT Create hunting rule
Author:	ditekSHen
Description:	Detects AsyncRAT
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_BlankStealer Create hunting rule
Author:	ditekSHen
Description:	Detects BlankStealer / BlankGrabber / Blank-c Stealer
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_Egregor Create hunting rule
Author:	ditekSHen
Description:	Detects Egregor ransomware variants
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_HoudiniConfig Create hunting rule
Author:	ditekshen
Description:	Detects Houdini Trojan configurations
Reference:	https://github.com/ditekshen/back-in-2017
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_MassLogger Create hunting rule
Author:	ditekSHen
Description:	MassLogger keylogger payload
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_Phoenix Create hunting rule
Author:	ditekSHen
Description:	Phoenix/404KeyLogger keylogger payload
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_PWSH_PoshCookieStealer Create hunting rule
Author:	ditekSHen
Description:	Detects PowerShell PoshCookieStealer
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_PWSH_PoshKeylogger Create hunting rule
Author:	ditekSHen
Description:	Detects PowerShell PoshKeylogger
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_PWSH_PoshWiFiStealer Create hunting rule
Author:	ditekSHen
Description:	Detects PowerShell PoshWiFiStealer
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_PWSHLoader_RunPE01 Create hunting rule
Author:	ditekSHen
Description:	Detects PowerShell PE loader / executer. Observed Gorgon TTPs
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_Quantum Create hunting rule
Author:	ditekSHen
Description:	Detects Quantum locker / ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_QuilClipper Create hunting rule
Author:	ditekSHen
Description:	Detects QuilClipper variants mostly in memory or extracted AutoIt script
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_Qulab Create hunting rule
Author:	ditekSHen
Description:	Qulab information stealer payload or artifacts
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_Satana Create hunting rule
Author:	ditekSHen
Description:	Detects Satana ransomware
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_SweetyStealer Create hunting rule
Author:	ditekSHen
Description:	Detects SweetyStealer
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	MALWARE_Win_VBS_DLAgent01 Create hunting rule
Author:	ditekSHen
Description:	Detects VBS MSHTA downloader
TLP:	TLP:WHITE
Repository:	diˈtekSHən

Rule name:	masslogger_gcch Create hunting rule
Author:	govcert_ch
TLP:	TLP:WHITE
Repository:	Sandnet

Rule name:	Matanbuchus_name_only Create hunting rule
Author:	James_inthe_box
Description:	Matanbuchus
Reference:	https://twitter.com/pr0xylife/status/1537511268591992840
TLP:	TLP:WHITE
Repository:	silence-is-best

Rule name:	meduza Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked meduza malware samples.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	mercurial Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked mercurial malware samples.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	mht_inside_word Create hunting rule
Author:	dPhish
Description:	Detect embedded mht files inside microsfot word.
TLP:	TLP:WHITE

Rule name:	Mimikatz_Memory_Rule_1 Create hunting rule
Author:	Florian Roth
Description:	Detects password dumper mimikatz in memory
TLP:	TLP:WHITE

Rule name:	Mimikatz_SampleSet_5 Create hunting rule
Author:	Florian Roth - Florian Roth
Description:	Mimikatz Rule generated from a big Mimikatz sample set
TLP:	TLP:WHITE

Rule name:	Mithril_Mithril Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file Mithril.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Mithril_Mithril Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file Mithril.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Multi_Cryptominer_Xmrig_f9516741 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Hacktool_Gsocket_761d3a0f Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Hacktool_Rakshasa_d5d3ef21 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Hacktool_Stowaway_89f1d452 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Hacktool_SuperShell_f7486598 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Ransomware_Akira_21842eb3 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Ransomware_BlackCat_70171625 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Ransomware_BlackCat_e066d802 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Ransomware_Luna_8614d3d7 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/luna-ransomware-attack-pattern
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Ransomware_RansomHub_4a8a07cd Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Trojan_Bishopsliver_42298c4a Create hunting rule
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Trojan_Coreimpact_37703dc3 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Trojan_FinalDraft_81975d51 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Trojan_Gosar_31dba745 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Trojan_Merlin_32643f4c Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Trojan_Mythic_4beb7e17 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Trojan_Mythic_528324b4 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Trojan_Mythic_e0ea7ef9 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Trojan_Sliver_3bde542d Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Trojan_Sliver_42298c4a Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Multi_Trojan_SparkRat_9a21e541 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	multiple_php_webshells Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - from files multiple_php_webshells
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	mysql_shell_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file mysql_shell.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	MySQL_Web_Interface_Version_0_8_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file MySQL Web Interface Version 0.8.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	nanocore_rat Create hunting rule
Author:	jeFF0Falltrades
TLP:	TLP:WHITE
Repository:	jeFF0Falltrades

Rule name:	NET Create hunting rule
Author:	malware-lu
TLP:	TLP:WHITE
Repository:

Rule name:	NetBIOS_Name_Scanner Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file NetBIOS Name Scanner.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	netwire Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect netwire in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	jeFF0Falltrades

Rule name:	NetWiredRC_B Create hunting rule
Author:	Jean-Philippe Teissier / @Jipe_
Description:	NetWiredRC
TLP:	TLP:WHITE

Rule name:	ngh_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file ngh.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Noderat Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Noderat in memory
Reference:	https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	NT_Addy_asp Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file NT Addy.asp.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	osx_manuscrypt_w0 Create hunting rule
Author:	AT&T Alien Labs
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	p0wnedPowerCat Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedPowerCat.cs
Reference:	https://github.com/Cn33liz/p0wnedShell
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	p0wnedPowerCat_RID2C84 Create hunting rule
Author:	Florian Roth
Description:	p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedPowerCat_RID2C84.cs
Reference:	https://github.com/Cn33liz/p0wnedShell
TLP:	TLP:WHITE

Rule name:	Parallax Create hunting rule
Author:	@bartblaze
Description:	Identifies Parallax RAT.
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	PasswordReminder Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file PasswordReminder.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	PasswordReminder Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file PasswordReminder.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	perlbot_pl Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file perlbot.pl.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	PHANTASMA_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file PHANTASMA.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	PHP_Backdoor_Connect_pl_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file PHP Backdoor Connect.pl.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	php_backdoor_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file php-backdoor.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	php_include_w_shell_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file php-include-w-shell.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	PHP_shell Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	PHP_shell Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	PHP_Shell_v1_7 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file PHP_Shell_v1.7.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	PHP_Shell_v1_7 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file PHP_Shell_v1.7.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	pHpINJ_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file pHpINJ.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	phpjackal_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file phpjackal.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	phpshell17_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file phpshell17.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	phvayvv_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file phvayvv.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Phyton_Shell_py Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Phyton Shell.py.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	PingPull_mem Create hunting rule
Author:	James_inthe_box
Description:	GALLIUM PingPull
Reference:	https://unit42.paloaltonetworks.com/pingpull-gallium/
TLP:	TLP:WHITE
Repository:	silence-is-best

Rule name:	PortRacer Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file PortRacer.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	portscan Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file portscan.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	PortScanner Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file PortScanner.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:AMBER

Rule name:	poverty_stealer_v1 Create hunting rule
Author:	RandomMalware
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	power_pe_injection Create hunting rule
Author:	Benjamin DELPY (gentilkiwi)
Description:	PowerShell with PE Reflective Injection
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	PowerTool Create hunting rule
Author:	@bartblaze
Description:	Identifies PowerTool, sometimes used by attackers to disable security software.
Reference:	https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	ProPort_zip_Folder_ProPort Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file ProPort.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Pupy_Backdoor Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Pupy backdoor
Reference:	https://github.com/n1nj4sec/pupy-binaries
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Pupy_Backdoor_RID2C43 Create hunting rule
Author:	Florian Roth
Description:	Detects Pupy backdoor
Reference:	https://github.com/n1nj4sec/pupy-binaries
TLP:	TLP:WHITE

Rule name:	py_BraodoStealer Create hunting rule
Author:	NDA0E
Description:	Detects Braodo Stealer python payload
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	Pysa Create hunting rule
Author:	@bartblaze
Description:	Identifies Pysa aka Mespinoza ransomware.
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	QBOT_HTMLSmuggling_a Create hunting rule
Author:	Ankit Anubhav - ankitanubhav.info
Description:	Detects QBOT HTML smuggling variants
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	r57shell_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file r57shell.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	RABBITHUNT_cls Create hunting rule
Author:	Willi Ballenthin
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	raccoon_ Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked raccoon malware samples.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	RagnarLocker Create hunting rule
Author:	@bartblaze
Description:	Identifies RagnarLocker ransomware unpacked or in memory.
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	RANSOM_ESXiArgs_Ransomware_Python_Feb23 Create hunting rule
Author:	SECUINFRA Falcon Team (@SI_FalconTeam)
Description:	Detects the ESXiArgs Ransomware encryption python script
Reference:	https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	ransom_Linux_HelloKitty_0721 Create hunting rule
Author:	Christiaan @ ATR
Description:	rule to detect Linux variant of the Hello Kitty Ransomware
TLP:	TLP:WHITE
Repository:	advanced-threat-research

Rule name:	RANSOM_mountlocker Create hunting rule
Author:	McAfee ATR Team
Description:	Rule to detect Mount Locker ransomware
TLP:	TLP:WHITE
Repository:	advanced-threat-research

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	rdrbs084 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file rdrbs084.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	rdrbs084 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file rdrbs084.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	rdrbs100 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file rdrbs100.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	rdrbs100 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file rdrbs100.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Reader_asp Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Reader.asp.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	RedDelta_loader Create hunting rule
Author:	Intezer Labs
Reference:	https://www.intezer.com
TLP:	TLP:WHITE
Repository:	Intezer

Rule name:	REDLEAVES_CoreImplant_UniqueStrings Create hunting rule
Author:	USG
Description:	Strings identifying the core REDLEAVES RAT in its deobfuscated state
Reference:	https://www.us-cert.gov/ncas/alerts/TA17-117A
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Rem_View_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Rem View.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Remcos Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Remcos in memory
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	remcos_rat Create hunting rule
Author:	jeFF0Falltrades
TLP:	TLP:WHITE
Repository:	jeFF0Falltrades

Rule name:	rhadamanthys_ps1_v1 Create hunting rule
Author:	RandomMalware
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	rknt_zip_Folder_RkNT Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file RkNT.dll
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	rknt_zip_Folder_RkNT Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file RkNT.dll
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	RkNTLoad Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file RkNTLoad.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	RkNTLoad Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file RkNTLoad.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Rookie Create hunting rule
Author:	Seth Hardy
Description:	Rookie
TLP:	TLP:WHITE

Rule name:	RookieStrings Create hunting rule
Author:	Seth Hardy
Description:	Rookie Identifying Strings
TLP:	TLP:WHITE

Rule name:	rootshell_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file rootshell.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	rst_sql_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file rst_sql.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	ru24_post_sh_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file ru24_post_sh.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Rustyloader_mem Create hunting rule
Author:	James_inthe_box
Description:	Corroded buerloader
Reference:	https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
TLP:	TLP:WHITE
Repository:	silence-is-best

Rule name:	Rustyloader_mem_loose Create hunting rule
Author:	James_inthe_box
Description:	Corroded buerloader
Reference:	https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
TLP:	TLP:WHITE
Repository:	silence-is-best

Rule name:	s72_Shell_v1_1_Coding_html Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file s72 Shell v1.1 Coding.html.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Safe0ver Shell -Safe Mod Bypass By Evilc0der.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	scanarator Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file scanarator.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	scanarator_iis Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file iis.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	screencap Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file screencap.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	screencap Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file screencap.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SEH__vba Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	sendmail Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file sendmail.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	sendmail Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file sendmail.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	sh_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file sh.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	shankar_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file shankar.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SharpAdidnsdump Create hunting rule
Author:	@bartblaze
Description:	Identifies SharpAdidnsdump, which allows for AD integrated DNS dumping and also abused by attackers such as Storm-2603.
Reference:	https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	shell_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file shell.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	shellbot_pl Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file shellbot.pl.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	shells_PHP_wso Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file wso.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	shelltools_g0t_root_Fport Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file Fport.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	shelltools_g0t_root_Fport Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file Fport.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	shelltools_g0t_root_HideRun Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file HideRun.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	shelltools_g0t_root_HideRun Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file HideRun.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	shelltools_g0t_root_resolve Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file resolve.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	shelltools_g0t_root_resolve Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file resolve.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	shelltools_g0t_root_xwhois Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file xwhois.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	shelltools_g0t_root_xwhois Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file xwhois.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	shortloader Create hunting rule
Author:	Nikos 'n0t' Totosis
Description:	ShortLoader Payload
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	sig_2008_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file 2008.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SimAttacker___Vrsion_1_0_0___priv8_4_My_friend_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	simple_backdoor_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file simple-backdoor.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Simple_PHP_BackDooR Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file Simple_PHP_BackDooR.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Simple_PHP_BackDooR Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file Simple_PHP_BackDooR.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Simple_PHP_BackDooR_RID2E06 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file Simple_PHP_BackDooR_RID2E06.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	SimpleTea Create hunting rule
Author:	Still
Description:	attempts to match strings/instructions found in SimpleTea
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SimShell_1_0___Simorgh_Security_MGZ_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file SimShell 1.0 - Simorgh Security MGZ.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Sincap_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Sincap.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	small_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file small.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Socks5Systemz_december Create hunting rule
Author:	ch4daev
Description:	Detect socks5systemz botnet
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SparklingGoblin_Mutex Create hunting rule
Author:	ESET Research
Description:	SparklingGoblin ChaCha20 loaders mutexes
Reference:	http://welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/
TLP:	TLP:WHITE
Repository:

Rule name:	SparkRAT Create hunting rule
Author:	t-mtsmt
Description:	SparkRAT Payload
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	sql_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file sql.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Start2_net_mem Create hunting rule
Author:	James_inthe_box
Description:	SystemBC
Reference:	7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
TLP:	TLP:WHITE
Repository:	silence-is-best

Rule name:	StealthWasp_s_Basic_PortScanner_v1_2 Create hunting rule
Author:	yarGen Yara Rule Generator by Florian Roth
Description:	Auto-generated rule on file StealthWasp's Basic PortScanner v1.2.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	STNC_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file STNC.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	STUXSHOP_config Create hunting rule
Author:	JAG-S (turla@chronicle.security)
Reference:	https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	SUSP_Disable_ETW_Jun20_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects method to disable ETW in ENV vars before executing a program
Reference:	https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SUSP_Doc_RTF_OLE2Link_EMAIL_Jun22 Create hunting rule
Author:	Christian Burkard
Description:	Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments
Reference:	Internal Research
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SUSP_Email_Redirection_Spoofing_Feb25 Create hunting rule
Author:	Jonathan Peters (cod3nym)
Description:	Detects redirect spoofing in embedded URLs. This technique is used by threat actors to obscure the actual destination of a link
Reference:	https://any.run/cybersecurity-blog/cyber-attacks-january-2025/#fake-youtube-links-redirect-users-to-phishing-pages-11298
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SUSP_EXPL_LNX_CUPS_CVE_2024_47177_Sep24 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious FoomaticRIPCommandLine command in printer config, which could be used to exploit CUPS CVE-2024-47177
Reference:	https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SUSP_JDNIExploit_Error_Indicators_Dec21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects error messages related to JDNI usage in log files that can indicate a Log4Shell / Log4j exploitation
Reference:	https://twitter.com/marcioalm/status/1470361495405875200?s=20
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SUSP_Netsh_PortProxy_Command Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious command line with netsh and the portproxy command
Reference:	https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-interface-portproxy
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SUSP_Netsh_PortProxy_Command_RID3201 Create hunting rule
Author:	Florian Roth
Description:	Detects a suspicious command line with netsh and the portproxy command
Reference:	https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-interface-portproxy
TLP:	TLP:WHITE

Rule name:	SUSP_NK_MAL_M_Hunting_POOLRAT Create hunting rule
Author:	Mandiant
Description:	Detects strings found in POOLRAT malware
Reference:	https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SUSP_PowerShell_Download_Temp_Rundll Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detect a Download to %temp% and execution with rundll32.exe
TLP:	TLP:WHITE

Rule name:	SUSP_PY_Import_Statement_Apr24_1 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious Python import statement and socket usage often found in Python reverse shells
Reference:	https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SUSP_Websites Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the reference of suspicious sites that might be used to download further malware
TLP:	TLP:WHITE
Repository:	SIFalcon

Rule name:	Suspicious_PS_Strings Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	observed set of strings which are likely malicious, observed with Jupyter malware.
Reference:	http://security5magics.blogspot.com/2020/12/tracking-jupyter-malware.html
TLP:	TLP:WHITE
Repository:

Rule name:	classified
Author:	classified

Rule name:	svchostdll Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file svchostdll.dll
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	svchostdll Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file svchostdll.dll
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	SystemBC_Config Create hunting rule
Author:	@bartblaze
Description:	Identifies SystemBC RAT, decrypted config.
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	telegram_bot_api Create hunting rule
Author:	rectifyq
Description:	Detects file containing Telegram Bot API
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified

Rule name:	telnet_cgi Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file telnet.cgi.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	telnetd_pl Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file telnetd.pl.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	classified
Author:	classified

Rule name:	testlumma Create hunting rule
Author:
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	thelast_orice2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file orice2.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	thelast_orice2 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file orice2.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	thelast_orice2_RID2CA9 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file orice2.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
TLP:	TLP:WHITE

Rule name:	tick_xxmm_strings Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect xxmm in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	Tool_asp Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file Tool.asp.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	TrickBot Create hunting rule
Author:	sysopfb & kevoreilly
Description:	TrickBot Payload
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	Trickbot_PermaDll_UEFI_Module Create hunting rule
Author:	@VK_Intel \| Advanced Intelligence
Description:	Detects TrickBot Banking module permaDll
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	turla_outlook_filenames Create hunting rule
Author:	ESET Research
Description:	Turla Outlook filenames
Reference:	https://www.welivesecurity.com/wp-content/uploads/2018/08/Eset-Turla-Outlook-Backdoor.pdf
TLP:	TLP:WHITE
Repository:

Rule name:	unastealer3_mem Create hunting rule
Author:	James_inthe_box
Description:	Una Stealer
Reference:	https://www.hybrid-analysis.com/string-search/results/54fb74afabde582ae0a730401ea31ee5e0d9cf33582c8a64d634350150cdd78b
TLP:	TLP:WHITE
Repository:	silence-is-best

Rule name:	Unpack_Injectt Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file Injectt.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Unpack_Injectt Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file Injectt.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Ursnif Create hunting rule
Author:	Embee_Research @ Huntress
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	Ursnif Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	CAPE

Rule name:	vanquish Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file vanquish.dll
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	vanquish Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file vanquish.dll
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	vanquish_2 Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file vanquish.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	vanquish_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file vanquish.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques
TLP:	TLP:WHITE
Repository:

Rule name:	VUL_JQuery_FileUpload_CVE_2018_9206 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects JQuery File Upload vulnerability CVE-2018-9206
Reference:	https://www.zdnet.com/article/zero-day-in-popular-jquery-plugin-actively-exploited-for-at-least-three-years/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	VUL_JQuery_FileUpload_CVE_2018_9206_RID32A2 Create hunting rule
Author:	Florian Roth
Description:	Detects JQuery File Upload vulnerability CVE-2018-9206
Reference:	https://www.zdnet.com/article/zero-day-in-popular-jquery-plugin-actively-exploited-for-at-least-three-years/
TLP:	TLP:WHITE

Rule name:	w3d_php_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file w3d.php.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WCE_Modified_1_1014 Create hunting rule
Author:	Florian Roth
Description:	Modified (packed) version of Windows Credential Editor
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WCE_Modified_1_1014 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Modified (packed) version of Windows Credential Editor
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_soldierofallah Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - from files Ajax_PHP Command Shell.php, Ajax_PHP_Command_Shell.php, soldierofallah.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_soldierofallah Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - from files Ajax_PHP Command Shell.php, Ajax_PHP_Command_Shell.php, soldierofallah.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell__CrystalShell_v_1_erne_stres Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - from files CrystalShell v.1.php, erne.php, stres.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell__CrystalShell_v_1_erne_stres Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - from files CrystalShell v.1.php, erne.php, stres.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell__findsock_php_findsock_shell_php_reverse_shell Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - from files findsock.c, php-findsock-shell.php, php-reverse-shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell__findsock_php_findsock_shell_php_reverse_shell Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - from files findsock.c, php-findsock-shell.php, php-reverse-shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell__findsock_php_findsock_shell_php_reverse_shell_RID3D7D Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - from files findsock.c, php-findsock-shell.php, php-reverse-shell.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell__Small_Web_Shell_by_ZaCo_small_zaco_zacosmall Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - from files Small Web Shell by ZaCo.php, small.php, zaco.php, zacosmall.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell__Small_Web_Shell_by_ZaCo_small_zaco_zacosmall Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - from files Small Web Shell by ZaCo.php, small.php, zaco.php, zacosmall.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell__Small_Web_Shell_by_ZaCo_small_zaco_zacosmall_RID3C61 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - from files Small Web Shell by ZaCo.php, small.php, zaco.php, zacosmall.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_Ajan_asp_RID2DC3 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Ajan.asp.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_Ajax_PHP_Command_Shell_php_RID348D Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Ajax_PHP Command Shell.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_AK_74_Security_Team_Web_Shell_Beta_Version Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file AK-74 Security Team Web Shell Beta Version.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_AK_74_Security_Team_Web_Shell_Beta_Version Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file AK-74 Security Team Web Shell Beta Version.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_AK_74_Security_Team_Web_Shell_Beta_Version_RID3A6D Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file AK-74 Security Team Web Shell Beta Version.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_Antichat_Shell_v1_3_php_RID3368 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Antichat Shell v1.3.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_Antichat_Socks5_Server_php_php_RID368D Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Antichat Socks5 Server.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_Asmodeus_v0_1_pl_RID30B7 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Asmodeus v0.1.pl.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WEBSHELL_ASPX_Chopper_Like_Mar21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Chopper like ASPX Webshells
Reference:	Internal Research
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WEBSHELL_ASPX_Chopper_Like_Mar21_1_RID3288 Create hunting rule
Author:	Florian Roth
Description:	Detects Chopper like ASPX Webshells
Reference:	Internal Research
TLP:	TLP:WHITE

Rule name:	WEBSHELL_ASPX_FileExplorer_Mar21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Chopper like ASPX Webshells
Reference:	Internal Research
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WEBSHELL_ASPX_FileExplorer_Mar21_1_RID32A4 Create hunting rule
Author:	Florian Roth
Description:	Detects Chopper like ASPX Webshells
Reference:	Internal Research
TLP:	TLP:WHITE

Rule name:	WEBSHELL_ASPX_reGeorgTunnel Create hunting rule
Author:	threatintel@volexity.com
Description:	variation on reGeorgtunnel
Reference:	https://github.com/sensepost/reGeorg/blob/master/tunnel.aspx
TLP:	TLP:WHITE

Rule name:	WEBSHELL_ASPX_SportsBall Create hunting rule
Author:	threatintel@volexity.com
Description:	The SPORTSBALL webshell allows attackers to upload files or execute commands on the system.
Reference:	https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_Ayyildiz_Tim___AYT__Shell_v_2_1_Biz Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file Ayyildiz Tim -AYT- Shell v 2.1 Biz.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_Ayyildiz_Tim___AYT__Shell_v_2_1_Biz Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file Ayyildiz Tim -AYT- Shell v 2.1 Biz.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_Ayyildiz_Tim___AYT__Shell_v_2_1_Biz_html_RID39CD Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Ayyildiz Tim -AYT- Shell v 2.1 Biz.html.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_aZRaiLPhp_v1_0 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file aZRaiLPhp v1.0.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_aZRaiLPhp_v1_0_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file aZRaiLPhp v1.0.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_aZRaiLPhp_v1_0_php_RID312D Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file aZRaiLPhp v1.0.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_aZRaiLPhp_v1_0_RID2F66 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file aZRaiLPhp v1.0.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_b374k_mini_shell_php_php Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file b374k-mini-shell-php.php.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_b374k_mini_shell_php_php Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file b374k-mini-shell-php.php.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_b374k_mini_shell_php_php_RID33C2 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file b374k-mini-shell-php.php.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_b374k_php Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file b374k.php.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_b374k_php Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file b374k.php.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_b374k_php_RID2D98 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file b374k.php.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_backdoor1_php_RID2FC3 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file backdoor1.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_backdoorfr_php_RID306A Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file backdoorfr.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_backupsql Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file backupsql.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_backupsql Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file backupsql.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_c99_locus7s Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file c99_locus7s.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_c99_locus7s Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file c99_locus7s.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_c99_locus7s_RID2E8A Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file c99_locus7s.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_c99madshell_v2_0_php_php_RID33A9 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file c99madshell_v2.0.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_c99madshell_v2_RID2FCC Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_c99php_NIX_REMOTE_WEB_SHELL_RID3350 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files nixrem.php.php.txt, c99shell_v1.0.php.php.txt, c99php.txt, NIX REMOTE WEB-SHELL v.0.5 alpha Lite Public Version.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_c99shell_v1_0_99_RID2FF9 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, c99shell_v1.0.php.php.txt, SpecialShell_99.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_CasuS_1_5 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file CasuS 1.5.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_CasuS_1_5 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file CasuS 1.5.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_Casus15_php_php_RID3059 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Casus15.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_cgi_python_py_RID3022 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file cgi-python.py.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_CmdAsp_asp_php Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file CmdAsp.asp.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_CmdAsp_asp_php Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file CmdAsp.asp.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_CmdAsp_asp_RID2E81 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file CmdAsp.asp.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_cmdjsp_jsp_RID2ED3 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file cmdjsp.jsp.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_CN_Hacktools_tools_asp_RID3371 Create hunting rule
Author:	Florian Roth
Description:	Chinese Hacktool Archive - file asp.asp
Reference:	xfocus.net
TLP:	TLP:WHITE

Rule name:	Webshell_connectback2_pl_RID308E Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file connectback2.pl.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_connector_ASP_RID2FB4 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file connector.asp
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_csh_php_php_RID2F32 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file csh.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_cyberlords_sql_php_php_RID33DC Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file cyberlords_sql.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_DarkSpy105_RID2DFA Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file DarkSpy105.exe
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_dC3_Security_Crew_Shell_PRiV Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file dC3_Security_Crew_Shell_PRiV.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_dC3_Security_Crew_Shell_PRiV Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file dC3_Security_Crew_Shell_PRiV.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_dC3_Security_Crew_Shell_PRiV_RID351E Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file dC3_Security_Crew_Shell_PRiV.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_Dive_Shell_1_0___Emperor_Hacking_Team_php_RID3A3C Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Dive Shell 1.0 - Emperor Hacking Team.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_DTool_Pro Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file DTool Pro.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_DTool_Pro Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file DTool Pro.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	webshell_Dx_Dx Create hunting rule
Author:	Florian Roth
Description:	Web Shell - file Dx.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	webshell_Dx_Dx Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Web Shell - file Dx.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_Dx_Dx_RID2C7D Create hunting rule
Author:	Florian Roth
Description:	Web Shell - file Dx.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_Dx_php_php_RID2EB0 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Dx.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_EFSO_2_asp_RID2E07 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file EFSO_2.asp.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_elmaliseker_asp_RID30D7 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file elmaliseker.asp.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_elmaliseker_RID2F34 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file elmaliseker.asp
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_FeliksPack3___PHP_Shells_phpft_RID3606 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file phpft.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_FeliksPack3___PHP_Shells_ssh_RID3532 Create hunting rule
Author:	Florian Roth
Description:	Webshells PHP Webshell - file ssh.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_FeliksPack3___PHP_Shells_usr_RID353E Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file usr.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_FSO_s_casus15_2_RID2FD5 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file casus15.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_FSO_s_phpinj_RID2F48 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file phpinj.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_FSO_s_reader_RID2F32 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file reader.asp
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_FSO_s_zehir4_RID2F15 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file zehir4.asp
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_fuckphpshell_php_RID3156 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file fuckphpshell.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_Gamma_Web_Shell Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file Gamma Web Shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_Gamma_Web_Shell Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file Gamma Web Shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_Gamma_Web_Shell_RID303D Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file Gamma Web Shell.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_Generic_PHP_6 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - from files c0derz shell [csh] v. 0.1.1 release.php, CrystalShell v.1.php, load_shell.php, Loaderz WEB Shell.php, stres.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_Generic_PHP_6 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_Generic_PHP_6_RID2F1F Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - from files c0derz shell [csh] v. 0.1.1 release.php, CrystalShell v.1.php, load_shell.php, Loaderz WEB Shell.php, stres.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_go_shell Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file go-shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_go_shell Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file go-shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_h4ntu_shell__powered_by_tsoi__RID367B Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file h4ntu shell [powered by tsoi].txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WEBSHELL_HAFNIUM_CISA_10328929_01 Create hunting rule
Author:	CISA Code & Media Analysis
Description:	Detects CVE-2021-27065 Webshellz
Reference:	https://us-cert.cisa.gov/ncas/analysis-reports/ar21-084a
TLP:	TLP:WHITE

Rule name:	WebShell_hiddens_shell_v1 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file hiddens shell v1.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_hiddens_shell_v1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file hiddens shell v1.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_hiddens_shell_v1_RID30E2 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file hiddens shell v1.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_HYTop_DevPack_upload_RID325B Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file upload.asp
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_HYTop2006_rar_Folder_2006_RID32C8 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file 2006.asp
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_installer_RID2E74 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file installer.cmd
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_ironshell Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file ironshell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_IronShell_4 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file ironshell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_ironshell_php_RID301D Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file ironshell.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_Java_Shell_js_RID2FBB Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Java Shell.js.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_jsp_reverse_jsp_2_RID318B Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file jsp-reverse.jsp.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_jspshall_jsp_RID2FB3 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file jspshall.jsp.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_JspWebshell_1_2_jsp_RID31D6 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file JspWebshell 1.2.jsp.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_kacak_asp_RID2E44 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file kacak.asp.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_lamashell Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file lamashell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_lamashell Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file lamashell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_lamashell_php_RID3000 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file lamashell.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_lamashell_RID2E39 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file lamashell.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_php_RID4390 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_lurm_safemod_on_cgi_RID3272 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file lurm_safemod_on.cgi.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_multiple_php_webshells_RID33E1 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files multiple_php_webshells
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_mysql_shell_php_RID30FA Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file mysql_shell.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_MySQL_Web_Interface_Version_0_8_php_RID37DB Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file MySQL Web Interface Version 0.8.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_NCC_Shell Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file NCC-Shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_NCC_Shell Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file NCC-Shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_network_php_xinfo_RID31DA Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files network.php.php.txt, xinfo.php.php.txt, nfm.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_ngh_php_php_RID2F31 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file ngh.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_nst_perl_proxy_shell_RID3325 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files nst.php.php.txt, img.php.php.txt, nstview.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_nst_php_cybershell_RID322E Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files nst.php.php.txt, cybershell.php.php.txt, img.php.php.txt, nstview.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_NT_Addy_asp_RID2ECC Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file NT Addy.asp.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_NTDaddy_v1_9 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file NTDaddy v1.9.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_NTDaddy_v1_9 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file NTDaddy v1.9.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WEBSHELL_PAS_webshell_SQLDumpFile Create hunting rule
Author:	FR/ANSSI/SDO
Description:	Detects SQL dump file created by P.A.S. webshell
Reference:	https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WEBSHELL_PAS_webshell_ZIPArchiveFile Create hunting rule
Author:	FR/ANSSI/SDO (modified by Florian Roth)
Description:	Detects an archive file created by P.A.S. for download operation
Reference:	https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_perlbot_pl_RID2ED9 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file perlbot.pl.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_PHANTASMA_php_RID2EEA Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file PHANTASMA.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_php_backdoor Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file php-backdoor.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_PHP_Backdoor_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file php-backdoor.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_PHP_Backdoor_Connect_pl_php_RID351D Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file PHP Backdoor Connect.pl.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_php_backdoor_php_RID3139 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file php-backdoor.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_php_include_w_shell Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file php-include-w-shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_include_w_shell Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file php-include-w-shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_php_include_w_shell_php_RID3425 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file php-include-w-shell.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_php_include_w_shell_RID325E Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file php-include-w-shell.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_PHP_shell_RID2E05 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file shell.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_PHP_Shell_v1_7_RID2F81 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file PHP_Shell_v1.7.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_php_webshells_529 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file 529.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_529 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file 529.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_cpanel Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file cpanel.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_cpanel Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file cpanel.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_kral Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file kral.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_kral Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file kral.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_lolipop Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file lolipop.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_lolipop Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file lolipop.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_lolipop_RID3354 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file lolipop.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_php_webshells_lostDC Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file lostDC.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_lostDC Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file lostDC.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_matamu Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file matamu.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_matamu Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file matamu.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_MyShell Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file MyShell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_MyShell Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file MyShell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_myshell_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file myshell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_MyShell_RID3313 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file MyShell.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_php_webshells_myshell_RID3353 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file myshell.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_php_webshells_NGH Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file NGH.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_NGH Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file NGH.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_pHpINJ Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file pHpINJ.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_pHpINJ Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file pHpINJ.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_pHpINJ_RID325E Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file pHpINJ.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_php_webshells_pws Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file pws.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_pws Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file pws.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_README Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file README.md
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_README Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file README.md
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_php_webshells_README_RID3203 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file README.md
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_pHpINJ_php_php_RID2FFD Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file pHpINJ.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_phpjackal_php_RID2FFB Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file phpjackal.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_phpshell17_php_RID3015 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file phpshell17.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_PhpSpy_Ver_2006 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file PhpSpy Ver 2006.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_PhpSpy_Ver_2006 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file PhpSpy Ver 2006.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_PhpSpy_Ver_2006_RID2F9D Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file PhpSpy Ver 2006.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_phvayvv_php_php_RID3108 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file phvayvv.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_Phyton_Shell_py_RID30C7 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Phyton Shell.py.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WEBSHELL_ProxyShell_Exploitation_Nov21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects webshells dropped by DropHell malware
Reference:	https://www.deepinstinct.com/blog/do-not-exchange-it-has-a-shell-inside
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_qsd_php_backdoor Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file qsd-php-backdoor.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_qsd_php_backdoor Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file qsd-php-backdoor.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_r577_php_php_SnIpEr_2_RID322A Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_r577_php_php_SnIpEr_RID3199 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_r577_php_RID2D62 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files r577.php.php.txt, r57.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_r577_php_spy_2_RID2FAE Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files r577.php.php.txt, r57.php.php.txt, spy.php.php.txt, s.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_reader_asp_php Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file reader.asp.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_reader_asp_php Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file reader.asp.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_Reader_asp_RID2E9C Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Reader.asp.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_Rem_View_php_php_RID3112 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Rem View.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_rootshell_php_RID3029 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file rootshell.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_rst_sql_php_php_RID30FC Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file rst_sql.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_ru24_post_sh Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file ru24_post_sh.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_ru24_post_sh Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file ru24_post_sh.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_ru24_post_sh_php_php_RID32A0 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file ru24_post_sh.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_ru24_post_sh_RID2F32 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file ru24_post_sh.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_s72_Shell_v1_1_Coding_html_RID3436 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file s72 Shell v1.1 Coding.html.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2_php_RID3A0D Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_safe0ver Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file safe0ver.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_safe0ver Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file safe0ver.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_Safe0ver_Shell__Safe_Mod_Bypass_By_Evilc0der_php_RID3D04 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Safe0ver Shell -Safe Mod Bypass By Evilc0der.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_sh_php_php_RID2ECF Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file sh.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_shankar_php_php_RID30DC Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file shankar.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_shell_php_php_RID300C Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file shell.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_shellbot_pl_RID2F3E Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file shellbot.pl.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_shells_PHP_wso_RID3030 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file wso.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_sig_2008_php_php_RID3060 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file 2008.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_simattacker Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file simattacker.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_simattacker Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file simattacker.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_SimAttacker___Vrsion_1_0_0___priv8_4_My_friend Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_SimAttacker___Vrsion_1_0_0___priv8_4_My_friend Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_SimAttacker___Vrsion_1_0_0___priv8_4_My_friend_php_RID3D96 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	webshell_simple_backdoor Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Web Shell - file simple-backdoor.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	webshell_simple_backdoor Create hunting rule
Author:	Florian Roth
Description:	Web Shell - file simple-backdoor.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_simple_backdoor_php_RID327B Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file simple-backdoor.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_simple_backdoor_RID30D4 Create hunting rule
Author:	Florian Roth
Description:	Web Shell - file simple-backdoor.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_simple_cmd Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file simple_cmd.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_simple_cmd Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file simple_cmd.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_simple_cmd_RID2EA3 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file simple_cmd.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_Simple_PHP_backdoor_by_DK Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file Simple_PHP_backdoor_by_DK.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_Simple_PHP_backdoor_by_DK Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file Simple_PHP_backdoor_by_DK.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_SimShell_1_0___Simorgh_Security_MGZ_php_RID3987 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file SimShell 1.0 - Simorgh Security MGZ.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_Sincap_1_0 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file Sincap 1.0.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_Sincap_1_0 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file Sincap 1.0.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_Sincap_1_0_RID2E03 Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file Sincap 1.0.php
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_Sincap_php_php_RID3052 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Sincap.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_small_php_php_RID300D Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file small.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_SpecialShell_99_php_php_a_RID343E Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt, 1.txt, SpecialShell_99.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_SpecialShell_99_php_php_c100_php_RID3678 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files wacking.php.php.txt, 1.txt, SpecialShell_99.php.php.txt, c100.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_SpecialShell_99b_RID3092 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - from files w.php.php.txt, wacking.php.php.txt, SpecialShell_99.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_sql_php_php_RID2F44 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file sql.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_STNC_php_php_RID2F2C Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file STNC.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_telnet_cgi_RID2EC4 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file telnet.cgi.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_telnetd_pl_RID2ED1 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file telnetd.pl.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_Tool_asp_RID2DE7 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file Tool.asp.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_w3d_php_php_RID2F02 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file w3d.php.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_wh_bindshell_py_RID30E1 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file wh_bindshell.py.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	WebShell_WinX_Shell Create hunting rule
Author:	Florian Roth
Description:	PHP Webshells Github Archive - file WinX Shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WebShell_WinX_Shell_2 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	PHP Webshells Github Archive - file WinX Shell.php
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Webshell_WinX_Shell_html_RID3097 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file WinX Shell.html.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_xssshell_db_RID2F41 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file db.asp
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_xssshell_save_RID302A Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file save.asp
Reference:	-
TLP:	TLP:WHITE

Rule name:	Webshell_zacosmall_php_RID3013 Create hunting rule
Author:	Florian Roth
Description:	Semi-Auto-generated - file zacosmall.php.txt
Reference:	-
TLP:	TLP:WHITE

Rule name:	wh_bindshell_py Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file wh_bindshell.py.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Wimmie Create hunting rule
Author:	Seth Hardy
Description:	Wimmie family
TLP:	TLP:WHITE

Rule name:	WimmieStrings Create hunting rule
Author:	Seth Hardy
Description:	Strings used by Wimmie
TLP:	TLP:WHITE

Rule name:	classified
Author:	classified
TLP :	TLP:GREEN

Rule name:	classified
Author:	classified
TLP :	TLP:AMBER

Rule name:	WIN_ClickFix_Detection Create hunting rule
Author:	dogsafetyforeverone
Description:	Detects ClickFix social engineering technique using 'Verify you are human' messages and malicious PowerShell commands
Reference:	ClickFix social engineering and malicious PowerShell commands
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	win_crackshot_w0 Create hunting rule
Author:	Florian Roth
Description:	Detects APT41 malware CRACKSHOT
Reference:	https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_darktrack_rat_w0 Create hunting rule
Author:	jeFF0Falltrades
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_dispenserxfs_w0 Create hunting rule
Author:	@Xylit0l @r3c0nst / Modified by Florian Roth
Description:	Detects ATM Malware DispenserXFS
Reference:	https://twitter.com/r3c0nst/status/1100775857306652673
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	WIN_FileFix_Detection Create hunting rule
Author:	dogsafetyforeverone
Description:	Detects FileFix social engineering technique that launches chained PowerShell and PHP commands from file explorer typed paths
Reference:	FileFix social engineering with PowerShell and PHP commands
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	win_gimmick_w0 Create hunting rule
Author:	threatintel@volexity.com
Description:	Detects the base version of GIMMICK in .NET.
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_gimmick_w1 Create hunting rule
Author:	threatintel@volexity.com
Description:	Detects the macOS port of the GIMMICK malware.
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	classified
Author:	classified
TLP :	TLP:GREEN

Rule name:	win_iceid_core_ldr_202104 Create hunting rule
Author:	Thomas Barabosch, Telekom Security
Description:	2021 loader for Bokbot / Icedid core (license.dat)
TLP:	TLP:WHITE
Repository:	Sandnet

Rule name:	classified
Author:	classified
TLP :	TLP:GREEN

Rule name:	win_lockergoga_w0 Create hunting rule
Author:	Florian Roth
Description:	Detects LockerGoga ransomware binaries
Reference:	https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	classified
Author:	classified
TLP :	TLP:AMBER

Rule name:	win_masslogger_w0 Create hunting rule
Author:	govcert_ch
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_naplistener_w1 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_netwire_w0 Create hunting rule
Author:	Jean-Philippe Teissier / @Jipe_
Description:	NetWiredRC
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_orcus_rat_simple_strings_dec_2023 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Strings observed in Orcus RAT
TLP:	TLP:WHITE
Repository:	embee-research

Rule name:	classified
Author:	classified
Description:	classified
Reference:	classified
TLP :	TLP:GREEN

Rule name:	WIN_PowerShell_Telegram_RAT_20250726 Create hunting rule
Author:	dogsafetyforeverone
Description:	Detects PowerShell-based remote access tools (RATs) that leverage the Telegram Bot API for command and control. The rule looks for the Telegram API base URL along with REST endpoints such as sendMessage, getUpdates, sendPhoto and sendDocument, and command strings used to implement RAT features (webcam capture, password grabbing, file execution, process termination, blue screen, microphone recording, self-destruct).
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	classified
Author:	classified
TLP :	TLP:AMBER

Rule name:	win_ratankbapos_w0 Create hunting rule
Author:	Threat Exchange http://blog.trex.re.kr/3
Description:	hkp.dll
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_remcos_rat_unpacked Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	win_remcos_w0 Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects strings present in remcos rat Samples.
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_rgdoor_w0 Create hunting rule
Author:	Florian Roth
Description:	Detects RGDoor backdoor used by OilRig group
Reference:	https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_robinhood_w0 Create hunting rule
Author:	anonymous submission
Description:	Unpacked RobinHood ransomware
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_royal_dns_w0 Create hunting rule
Author:	Florian Roth
Description:	Detects malware from APT 15 report by NCC Group
Reference:	https://goo.gl/HZ5XMN
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_royalcli_w0 Create hunting rule
Author:	Florian Roth
Description:	Detects malware from APT 15 report by NCC Group
Reference:	https://goo.gl/HZ5XMN
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	WIN_SHADOW_UNPACKED Create hunting rule
TLP:	TLP:WHITE
Repository:	MalwareBazaar

Rule name:	win_shylock_w0 Create hunting rule
Author:	Jean-Philippe Teissier / @Jipe_
Description:	Shylock Banker
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	win_stuxnet_w0 Create hunting rule
Author:	JAG-S (turla@chronicle.security)
Description:	Stuxshop standalone sample configuration
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	classified
Author:	classified
TLP :	TLP:GREEN

Rule name:	classified
Author:	classified
TLP :	TLP:GREEN

Rule name:	classified
Author:	classified
Description:	classified
TLP :	TLP:GREEN

Rule name:	win_ursnif_patterns_oct_2022 Create hunting rule
Author:	Embee_Research @ Huntress
TLP:	TLP:WHITE
Repository:	embee-research

Rule name:	WIN_WebSocket_Base64_C2_20250726 Create hunting rule
Author:	dogsafetyforeverone
Description:	Detects configuration strings used by malware to specify WebSocket command-and-control endpoints inside Base64-encoded data. It looks for prefixes such as '#ws://' or '#wss://' that were found in QuasarRAT configuration data.
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	win_winnti_w2 Create hunting rule
Author:	Bundesamt fuer Verfassungsschutz
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	classified
Author:	classified
TLP :	TLP:AMBER

Rule name:	win_yty_w0 Create hunting rule
Author:	James E.C, ProofPoint
Description:	Modular malware framework with similarities to EHDevel
TLP:	TLP:WHITE
Repository:	Malpedia

Rule name:	Windows_Backdoor_TeamViewer_df8e7326 Create hunting rule
Author:	Elastic Security
Reference:	https://vms.drweb.com/virus/?i=8172096
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Exploit_Generic_e95cc41c Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Exploit_Log4j_dbac7698 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Generic_Threat_4578ee8c Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_AskCreds_34e3e3d4 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_Certify_ffe1cca2 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_ChromeKatz_fa232bba Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_ClrOxide_d92d9575 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_COFFLoader_81ba13b8 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_DarkLoadLibrary_c25ee4eb Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_EDRrecon_ca314aa1 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_EDRWFP_f6d7db7a Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_Mimikatz_355d5d3a Create hunting rule
Author:	Elastic Security
Description:	Detection for Invoke-Mimikatz
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_Mimikatz_355d5d3a Create hunting rule
Description:	Detection for Invoke-Mimikatz
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_Phant0m_2d6f9b57 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_RingQ_b9715540 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_Rubeus_43f18623 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_SafetyKatz_072b7370 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_Seatbelt_674fd535 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_SharpAppLocker_9645cf22 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_SharpDump_7c17d8b1 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_SharPersist_06606812 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_SharpHound_5adf9d6d Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_SharpLAPS_381c3f40 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_SharpMove_05e28928 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_SharpRDP_80895fcb Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_SharpShares_88cdcd52 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_SharpStay_eac706c5 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_SharpUp_e5c87c9a Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_SharpView_2c7603ad Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_SharpWMI_a67d6fe5 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_WinPEAS_ng_23fee092 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, File analysis module
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_WinPEAS_ng_413caa6b Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, event module
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_WinPEAS_ng_4a9b9603 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Services info module
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_WinPEAS_ng_4db2c852 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, System info module
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_WinPEAS_ng_66197d54 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, application module
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_WinPEAS_ng_861d3264 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, File Info module
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_WinPEAS_ng_94474b0b Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the bat script
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_WinPEAS_ng_b6bb3e7c Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Windows credentials module
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_WinPEAS_ng_bcedc8b2 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, User info module
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_WinPEAS_ng_cae025b1 Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, Process info module
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Hacktool_WinPEAS_ng_e8ed269c Create hunting rule
Author:	Elastic Security
Description:	WinPEAS detection based on the dotNet binary, checks module
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Infostealer_Generic_acde9261 Create hunting rule
Author:	Elastic Security
Description:	Observed in Stealc/Vidar samples
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Infostealer_PhemedroneStealer_bed8ea8a Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Infostealer_Strela_0dc3e4a1 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_PUP_Generic_198b73aa Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_PUP_MediaArena_a9e3b4a1 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Ransomware_Akira_c8c298ba Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Ransomware_Bitpaymer_bca25ac6 Create hunting rule
Author:	Elastic Security
Description:	Identifies BITPAYMER ransomware
Reference:	https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/
TLP:	TLP:WHITE

Rule name:	Windows_Ransomware_BlackBasta_494d3c54 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Ransomware_Cicada3301_99fee259 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Ransomware_Dharma_b31cac3f Create hunting rule
Author:	Elastic Security
Description:	Identifies DHARMA ransomware
Reference:	https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/
TLP:	TLP:WHITE

Rule name:	Windows_Ransomware_Egregor_f24023f3 Create hunting rule
Author:	Elastic Security
Description:	Identifies EGREGOR (Sekhemt) ransomware
Reference:	https://www.bankinfosecurity.com/egregor-ransomware-adds-to-data-leak-trend-a-15110
TLP:	TLP:WHITE

Rule name:	Windows_Ransomware_Generic_99f5a632 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Ransomware_Helloxd_0c50f01b Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Ransomware_Hive_3ed67fe6 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Ransomware_Hive_55619cd0 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Ransomware_Medusa_fda487fd Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Ransomware_Ragnarok_1cab7ea1 Create hunting rule
Author:	Elastic Security
Description:	Identifies RAGNAROK ransomware
Reference:	https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20
TLP:	TLP:WHITE

Rule name:	Windows_Ransomware_Ragnarok_5625d3f6 Create hunting rule
Author:	Elastic Security
Description:	Identifies RAGNAROK ransomware
Reference:	https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20
TLP:	TLP:WHITE

Rule name:	Windows_Ransomware_Ragnarok_efafbe48 Create hunting rule
Author:	Elastic Security
Description:	Identifies RAGNAROK ransomware
Reference:	https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20
TLP:	TLP:WHITE

Rule name:	Windows_Ransomware_Snake_550e0265 Create hunting rule
Author:	Elastic Security
Description:	Identifies SNAKE ransomware
Reference:	https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/
TLP:	TLP:WHITE

Rule name:	Windows_Ransomware_Thanos_e19feca1 Create hunting rule
Author:	Elastic Security
Description:	Identifies THANOS (Hakbit) ransomware
Reference:	https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/
TLP:	TLP:WHITE

Rule name:	Windows_Trojan_Afdk_5f8cc135 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_AgentTesla_d3ac2b2f Create hunting rule
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_AgentTesla_d3ac2b2f Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Backoff_22798f00 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Bandook_38497690 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Behinder_b9a49f4b Create hunting rule
Author:	Elastic Security
Description:	Webshell found in REF2924, either Behinder or Godzilla based shell in C#
Reference:	https://www.elastic.co/security-labs/ref2924-howto-maintain-persistence-as-an-advanced-threat
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Bitrat_34bd6c83 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Blackwood_2b94bce9 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_BruteRatel_5e383ae0 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_BruteRatel_9b267f96 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Bughatch_98f3c0be Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/bughatch-malware-analysis
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Carberp_d6de82ae Create hunting rule
Author:	Elastic Security
Description:	Identifies VNC module from the leaked Carberp source code. This could exist in other malware families.
Reference:	https://github.com/m0n0ph1/malware-1/blob/master/Carberp%20Botnet/source%20-%20absource/pro/all%20source/hvnc_dll/HVNC%20Lib/vnc/xvnc.h#L342
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_0b58325e Create hunting rule
Author:	Elastic Security
Description:	Identifies Keylogger module from Cobalt Strike
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_15f680fb Create hunting rule
Author:	Elastic Security
Description:	Identifies Netview module from Cobalt Strike
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_5b4383ec Create hunting rule
Author:	Elastic Security
Description:	Identifies Portscan module from Cobalt Strike
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_7efd3c3f Create hunting rule
Author:	Elastic Security
Description:	Identifies Hashdump module from Cobalt Strike
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_7f8da98a Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_91e08059 Create hunting rule
Description:	Identifies Post Ex module from Cobalt Strike
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_91e08059 Create hunting rule
Author:	Elastic Security
Description:	Identifies Post Ex module from Cobalt Strike
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_9c0d5561 Create hunting rule
Description:	Identifies PowerShell Runner module from Cobalt Strike
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_9c0d5561 Create hunting rule
Author:	Elastic Security
Description:	Identifies PowerShell Runner module from Cobalt Strike
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_a3fb2616 Create hunting rule
Author:	Elastic Security
Description:	Rule for browser pivot
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_c851687a Create hunting rule
Author:	Elastic Security
Description:	Identifies UAC Bypass module from Cobalt Strike
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_d00573a3 Create hunting rule
Description:	Identifies Screenshot module from Cobalt Strike
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_d00573a3 Create hunting rule
Author:	Elastic Security
Description:	Identifies Screenshot module from Cobalt Strike
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_ee756db7 Create hunting rule
Author:	Elastic Security
Description:	Attempts to detect Cobalt Strike based on strings found in BEACON
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_CobaltStrike_ee756db7 Create hunting rule
Description:	Attempts to detect Cobalt Strike based on strings found in BEACON
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Darkcomet_1df27bcc Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_DarkGate_fa1f1338 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_DCRat_1aeea1ac Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_DoorMe_246eda61 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_DoubleBack_d2246a35 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_DoubleLoader_3660c98a Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_DownTown_145ecd2f Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_DownTown_901c4fdd Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_DreamJob_00cf26dc Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Dridex_63ddf193 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_DTrack_57db861f Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_FalseFont_d1f0d357 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_FlawedGrace_8c5eb04b Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Generic_40899c85 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Generic_c7fd8d38 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Gh0st_ee6de6bc Create hunting rule
Author:	Elastic Security
Description:	Identifies a variant of Gh0st Rat
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Gozi_261f5ac5 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Guloader_c4d9dd33 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Hancitor_6738d84a Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Hawkeye_975d546c Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_HazelCobra_6a9fe48a Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_HotPage_414f235f Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_IcedID_11d24d35 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_IcedID_56459277 Create hunting rule
Author:	Elastic Security
Description:	IcedID Gzip Variant Core
Reference:	https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Jupyter_56152e31 Create hunting rule
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Jupyter_56152e31 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Kronos_cdd2e2c5 Create hunting rule
Author:	Elastic Security
Description:	Strings used by the Kronos banking trojan and variants.
Reference:	https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Lokibot_1f885282 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Metasploit_dd5ce989 Create hunting rule
Author:	Elastic Security
Description:	Identifies Meterpreter DLL used by Metasploit
Reference:	https://www.rapid7.com/blog/post/2015/03/25/stageless-meterpreter-payloads/
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_ModPipe_12bc2604 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Nanocore_d8c4e3c5 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_NapListener_414180a7 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Netwire_1b43df38 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Netwire_f42cb379 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Nimplant_44ff3211 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_NukeSped_b8e6cc07 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_OnlyLogger_b9e88336 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Pingpull_09dd9559 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_PoshC2_e2d3881e Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_PowerSeal_2e50f393 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/elastic-charms-spectralviper
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Qbot_7d5dc64a Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_RedLineStealer_17ee6a17 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_RedLineStealer_f07b3cb4 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Remcos_7591e9f1 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Remcos_b296e965 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Revcoderat_8e6d4182 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_ShadowPad_be71209d Create hunting rule
Author:	Elastic Security
Description:	Target ShadowPad loader
Reference:	https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_SnakeKeylogger_af3faa65 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Squirrelwaffle_88033ff1 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Stealc_b8ab9ab5 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_STRRAT_a3e48cd2 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_StumpZarus_3f13c4a2 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_SVCReady_af498d39 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_SysJoker_1ef19a12 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_SysJoker_34559bcd Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_SystemBC_c1b58c2f Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Sythe_02b2811a Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Trickbot_07239dad Create hunting rule
Author:	Elastic Security
Description:	Targets vncDll64.dll module containing remote control VNC functionality
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Trickbot_23d77ae5 Create hunting rule
Author:	Elastic Security
Description:	Targets importDll64 containing Browser data stealer module
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Trickbot_2d89e9cd Create hunting rule
Author:	Elastic Security
Description:	Targets tabDll64.dll module containing functionality using SMB for lateral movement
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Trickbot_32930807 Create hunting rule
Author:	Elastic Security
Description:	Targets cookiesdll.dll module containing functionality used to retrieve browser cookie data
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Trickbot_618b27d2 Create hunting rule
Author:	Elastic Security
Description:	Targets Outlook.dll module containing functionality used to retrieve Outlook data
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Trickbot_6eb31e7b Create hunting rule
Author:	Elastic Security
Description:	Targets DomainDll module containing functionality using LDAP to retrieve credentials and configuration information
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Trickbot_91516cf4 Create hunting rule
Author:	Elastic Security
Description:	Generic signature used to identify Trickbot module usage
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Trickbot_d2110921 Create hunting rule
Author:	Elastic Security
Description:	Targets shareDll64.dll module containing functionality use to spread Trickbot across local networks
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_Xworm_732e6c12 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Trojan_XWorm_b7d6eaa8 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	Windows_Virus_Neshta_2a5a14c8 Create hunting rule
Author:	Elastic Security
TLP:	TLP:WHITE
Repository:	elastic

Rule name:	WindowsCredentialEditor Create hunting rule
Description:	Windows Credential Editor
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	WinX_Shell_html Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file WinX Shell.html.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	wsh_rat_keylogger Create hunting rule
Author:	jeFF0Falltrades
Description:	Alerts on the WSH RAT .NET keylogger module
TLP:	TLP:WHITE
Repository:	jeFF0Falltrades

Rule name:	xssshell_db Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file db.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	xssshell_db Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file db.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	xssshell_save Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file save.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	xssshell_save Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file save.asp
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	xxmm Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect xxmm in memory
Reference:	internal research
TLP:	TLP:WHITE
Repository:	JPCERTCC

Rule name:	yarahub_win_remcos_rat_unpacked_aug_2023 Create hunting rule
Author:	Matthew @ Embee_Research
TLP:	TLP:WHITE
Repository:	YARAify

Rule name:	zacosmall_php Create hunting rule
Author:	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Description:	Semi-Auto-generated - file zacosmall.php.txt
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	Zeppelin Create hunting rule
Author:	@bartblaze
Description:	Identifies Zeppelin ransomware and variants (Buran, Vega etc.)
TLP:	TLP:WHITE
Repository:	bartblaze

Rule name:	ZXshell2_0_rar_Folder_nc Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file nc.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	ZXshell2_0_rar_Folder_nc Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file nc.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	ZXshell2_0_rar_Folder_zxrecv Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file zxrecv.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	ZXshell2_0_rar_Folder_zxrecv Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file zxrecv.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	ZXshell2_0_rar_Folder_ZXshell Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Webshells Auto-generated - file ZXshell.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	ZXshell2_0_rar_Folder_ZXshell Create hunting rule
Author:	Yara Bulk Rule Generator by Florian Roth
Description:	Webshells Auto-generated - file ZXshell.exe
TLP:	TLP:WHITE
Repository:	Neo23x0

Rule name:	ZXshell2_0_rar_Folder_ZXshell_RID3224 Create hunting rule
Author:	Florian Roth
Description:	Webshells Auto-generated - file ZXshell.exe
Reference:	-
TLP:	TLP:WHITE

Unpacker

The following YARA rules matched on the unpacked file.

No matches

Unpacked Files

The following files could be unpacked from this sample.

No unpacked files found