Search and filter across all detection sources
756 rules
apt_37_chinotto [yara_rules]
Detects obfuscation and string of APT37 stealer
apt37_rokrat_macho [yara_rules]
Detects Public key of Macho samples of RokRAT
apt_3cx_payload_stealer [yara_rules]
Detects stealer used in 3CX campaign
apt_agent_racoon_strings [yara_rules]
Detects Agent Racoon used by CL-STA-0002
apt_andariel_dorarat_strings [yara_rules]
Detects Dora RAT based on strings
apt_andariel_keylogger_strings [yara_rules]
Detects one of the Andariel keylogger
apt_andariel_nestdoor_variants_strings [yara_rules]
Detects Nestdoor based on (weak) strings
apt_andariel_siennablue [yara_rules]
Detects SiennaBlue based routine names
apt_apt10_hui_loader [yara_rules]
Specific string for HUI Loader
apt_apt28_document_phishing_webpage [yara_rules]
Detects APT28 document phishing webpage
apt_apt28_htmlsmuggling [yara_rules]
Detects some kind of HTMLSmuggling used by APT28
apt_apt28_htmlsmuggling_disclosing_ip [yara_rules]
apt_apt28_powershell_ntlm_stealer [yara_rules]
Detects the NTLM Stealer used by APT28 against UA energy sector
apt_apt28_susp_graphite_downloader [yara_rules]
Matches the routine which decrypts the RSA key blob in the Graphite downloader
apt_apt28_ukrnet_phishing_page [yara_rules]
Detects APT28 Phishing page
apt_apt28_wayzgoose_exploit_string [yara_rules]
Detects APT28's Wayzgoose exploit strings
apt_apt29_malicious_rdp_file [yara_rules]
Detects malicious RDP files
apt_apt29_quarterrig [yara_rules]
Detects QUARTERRIG
apt_apt29_wineloader_malicious_hta [yara_rules]
Detects malicious HTA used by APT29 to drop Wineloader
apt_apt29_wineloader_malicious_pdf [yara_rules]
Detects malicious PDF used by APT29 to drop Wineloader
apt_apt31_pakdoor [yara_rules]
Detects APT31 ORB implant - 2019/2021
apt_apt31_rekoobe [yara_rules]
Find Rekoobe sample via Trend Elf Hash (telfhash)
apt_apt33_falsefont [yara_rules]
FalseFont backdoor
apt_apt33_tickler [yara_rules]
Detects APT33 Tickler malware
apt_apt35_iisraid_strings [yara_rules]
Detects APT35s ISSRaid implant