YARA Rules

gs-netcat embedded operator config (664-byte gsnc_config structure)

Foxveil ClickFix stage-2 zsh: octal-printf strings, /api/metrics/run?event= beacon with user and BuildID headers, payload fetched to /tmp and run

Detects Naming Pattern used by ConfuserEx. ConfuserEx is a widely used open source obfuscator often found in malware

Detects Unknown (class, etat extrait)

Find BumbleBee samples based on specific strings

Detects Windows executables signed with certificates issued to Tobias Weihmann Software Development OU via Sectigo, observed in ShinyHunters / UNC6240 campaigns.

Detects suspicious, unsigned Microsoft Windows APPX/MSIX Installer Packages

Detects LNK files with embedded obfuscated PowerShell scripts that extract and execute embedded payloads

HellsUchecker x64 shellcode loader - position-independent code with SipHash-variant CTR cipher and aPLib decompression. Targets raw shellcode as injected via Hell's Gate NtCreateSection.

Detects Unknown (class, etat binaire)

Detects Unknown (class, etat binaire)

Hunting: .NET loader reading pixel data from a resource Bitmap, loading an assembly and invoking its first exported method via VB LateBinding

Hunts for dependencies on Python AI libraries

Detects ValleyRAT Stage-1 Inflated Loader (Silver Fox)

Detects Unknown (class, etat binaire)

Detects Unknown (class, etat binaire)

Detects obfuscated/rotated 127.0.0.1 strings while excluding raw plaintext

Detects SHubStealer stage-2 AppleScript payload by C2 endpoints and capability markers

Detects samples designed to use WDAC to disable AV/EDR. False positives may occur.

Detects Unknown (class, etat binaire)

Detects Unknown (class, etat binaire)

Detect PE files compiled with PyInstaller with AntiDecompilation string. Observed in GlobalNet botnet campaign.

Detects Unknown (inconnu, etat binaire)

Detects Bitter (T-APT-17) shellcode in oleObject (CVE-2018-0798)

Detects Iron Gate ICS malware targeting simulation environment which appears to be a PoC

Detects Unknown (class, etat binaire)

attempts to match the strings found in BadIIS variant of the JKornevHidden rootkit

Detects Unknown (class, etat binaire)

Detects Unknown (class, etat binaire)

Detects Unknown (class, etat binaire)

Detects Unknown (class, etat binaire)

Detects OriginBot(net) / OriginLoader malware.

Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments

Detects RWX-S signed DLLs. This verifies that the image contains a signature, not that it is valid.

MintsLoader/TAG-124 victim profiler - sandbox detection and scoring

Detects SilentNet (class, etat extrait)

Detects Coyote malware samples based on the PE properties

Detects Koi Loader .NET executables packed with Confuser featuring specific mutex, assembly metadata, and unmanaged DLL imports

Detects Unknown (class, etat binaire)

BYTE_BUNK Shell v4.0 - PHP webshell with OS command execution, MySQL access and a reverse-shell socket, distributed as the root index.php of a repackaged copy of the legitimate WordPress plugin Protect Uploads (Alticreation). Probes for a surviving exec function and clears open_basedir, disable_functions, safe_mode and suhosin.executor.disable_eval.

Babuk Payload ransomware - Curve25519 + ChaCha20 encryption, RC4 FBI footer key, MakeAmericaGreatAgain mutex

Detects RondoDox (Rondo) botnet ELF multi architecture variants

Comprehensive detection for Luckyware RAT: covers PE/DLL infection, temp files, and C2 indicators

Detects Triton ICS malware used to target SIS (Safety Instrumentation Systems)

Detects Unknown (class, etat extrait)

Detects Unknown (class, etat binaire)

Specimen unique (soumission Bazaar) - strings distinctifs propres au sample

Detects Mirai