YARA Rules

Detects Naming Pattern used by ConfuserEx. ConfuserEx is a widely used open source obfuscator often found in malware

Find BumbleBee samples based on specific strings

Detects suspicious, unsigned Microsoft Windows APPX/MSIX Installer Packages

Detects LNK files with embedded obfuscated PowerShell scripts that extract and execute embedded payloads

HellsUchecker x64 shellcode loader - position-independent code with SipHash-variant CTR cipher and aPLib decompression. Targets raw shellcode as injected via Hell's Gate NtCreateSection.

Hunts for dependencies on Python AI libraries

Detects ValleyRAT Stage-1 Inflated Loader (Silver Fox)

Detects SHubStealer stage-2 AppleScript payload by C2 endpoints and capability markers

Detects samples designed to use WDAC to disable AV/EDR. False positives may occur.

Detect PE files compiled with PyInstaller with AntiDecompilation string. Observed in GlobalNet botnet campaign.

Detects Bitter (T-APT-17) shellcode in oleObject (CVE-2018-0798)

Detects Iron Gate ICS malware targeting simulation environment which appears to be a PoC

attempts to match the strings found in BadIIS variant of the JKornevHidden rootkit

Detects OriginBot(net) / OriginLoader malware.

Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments

Detects RWX-S signed DLLs. This verifies that the image contains a signature, not that it is valid.

MintsLoader/TAG-124 victim profiler - sandbox detection and scoring

Detects Coyote malware samples based on the PE properties

Babuk Payload ransomware - Curve25519 + ChaCha20 encryption, RC4 FBI footer key, MakeAmericaGreatAgain mutex

Detects RondoDox (Rondo) botnet ELF multi architecture variants

Comprehensive detection for Luckyware RAT: covers PE/DLL infection, temp files, and C2 indicators

Detects Triton ICS malware used to target SIS (Safety Instrumentation Systems)

Detects Mirai

signed_sys_with_vulnerablity

AES-GCM key and nonce copy stub in 64-bit PE (rep movs patterns)

Detects Elusive Stealer malware

Identify QuasarRAT samples

Detects JeevanReward variants using Technical, Anti-Analysis, and Indian SE keywords

Detects Torii IoT Botnet (stealthier Mirai alternative)

CSC-846 Golang detection ruleset

Linux SSH brute-force toolkit (PRG / OLDTEAM), often masquerading as image

Detects Zipline backdoor malware samples based on ELF properties and strings

Detects Vile Ransomware, based on family-specific markers and ransom-note strings.

Detects files and emails containing the windows hostname WIN-7IOM204AHBC.

Identifies a backdoor known as FalseFront which was used by Peach Sandstorm

Detects the AtlasB batch crypter using certutil decode + temp dropper

This is a bat file which is setup a game. 49509

Customized Gafgyt/BASHLITE DDoS bot delivered via Langflow CVE-2025-3248; identifies the actor's embedded affine S-box, 16-byte magic key, and LCG-driven stream cipher used for the encrypted C2 protocol

Detects the Atlantida Stealer malware based on matched strings

Hydra SSH brute-force campaign credentials pattern from NSVPS honeypot

Regla para correo malicioso

detects unpacked Laplas Clipper

Detects PacketSDK-based proxy/tunnel component used in sysvideo/onedrivesync case

This is a bat file which is a info stealer which take SS of the desktop and sends it to the attackers discord webhook using curl

Detects Python Stealer based on generic strings and high entropy in resources