Browse Rules

Search and filter across all detection sources

92 rules

yara unknown yara

maldoc_API_hashing [maldocs]
yara unknown yara

maldoc_suspicious_strings [maldocs]
yara unknown yara

maldoc_function_prolog_signature [maldocs]
yara unknown yara

maldoc_getEIP_method_1 [maldocs]
yara unknown yara

maldoc_getEIP_method_4 [maldocs]
yara unknown yara

maldoc_structured_exception_handling [maldocs]
yara unknown yara

maldoc_indirect_function_call_1 [maldocs]
yara unknown yara

maldoc_indirect_function_call_2 [maldocs]
yara unknown yara

maldoc_indirect_function_call_3 [maldocs]
yara unknown yara

macrocheck [maldocs]
yara unknown yara

maldoc_find_kernel32_base_method_1 [maldocs]
yara unknown yara

maldoc_find_kernel32_base_method_2 [maldocs]
yara unknown yara

maldoc_find_kernel32_base_method_3 [maldocs]
yara unknown yara

Maldoc_Suspicious_OLE_target [maldocs]

Detects maldoc With Tartgeting Suspicuios OLE
yara unknown yara

APT_OLE_JSRat [maldocs]
yara unknown yara

Maldoc_CVE_2017_11882 [maldocs]

Detects maldoc With exploit for CVE_2017_11882
yara unknown yara

Maldoc_APT10_MenuPass [maldocs]

Detects APT10 MenuPass Phishing
yara unknown yara

mwi_document [maldocs]

MWI generated document
yara unknown yara

powershell [maldocs]
yara unknown yara

ppaction [maldocs]
yara unknown yara

Dridex_Trojan_XML [maldocs]

Dridex Malware in XML Document
yara unknown yara

office_document_vba [maldocs]

Office document with embedded VBA
yara unknown yara

RTF_Shellcode [maldocs]

identifies RTF's with potential shellcode
yara unknown yara

BlackHole_v2 [maldocs]
yara unknown yara

hancitor_dropper [maldocs]