Search and filter across all detection sources
1,398 rules
domain [utils]
IP [utils]
url [utils]
catch_intelligence_files [utils]
catch files
WMI_strings [utils]
Accesses the WMI
Antivirus [utils]
Contains references to security software
BITS_CLSID [utils]
References the BITS service.
Browsers [utils]
Contains references to internet browsers
Dropper_Strings [utils]
May have dropper capabilities
maldoc_OLE_file_magic_number [utils]
Misc_Suspicious_Strings [utils]
Miscellaneous malware strings
Obfuscated_Strings [utils]
Contains obfuscated function names
Base64d_PE [utils]
Contains a base64-encoded executable
FE_PCAPs [utils]
All pcaps uploaded to VT
Parallels_Detection [utils]
Looks for Parallels presence
Qemu_Detection [utils]
Looks for Qemu presence
Sandboxie_Detection [utils]
Looks for Sandboxie presence
VirtualBox_Detection [utils]
Looks for VirtualBox presence
VirtualPC_Detection [utils]
Looks for VirtualPC presence
VMWare_Detection [utils]
Looks for VMWare presence
webshell_jsp_utils [yara]
Web Shell - file utils.jsp
AutoIT_compiled_script [utils]
Is an AutoIT compiled script
System_Tools [utils]
Contains references to system / monitoring tools
webshell_jsp_utils [webshells]
contains_base64 [utils]
This rule finds for base64 strings