Search and filter across all detection sources
5,910 rules
_1_c2007_php_php_c100_php [yara]
Semi-Auto-generated - from files 1.txt, c2007.php.php.txt, c100.php.txt
ACE_Containing_EXE [yara]
Looks for ACE Archives containing an exe/scr file
Acrotray_Anomaly [yara]
Detects an acrotray.exe that does not contain the usual strings
adjustcr [yara]
Webshells Auto-generated - file adjustcr.exe
admin_ad [yara]
Webshells Auto-generated - file admin-ad.asp
Agent_BTZ_Aug17 [yara]
Detects Agent.BTZ
Agent_BTZ_Proxy_DLL_1 [yara]
Detects Agent-BTZ Proxy DLL - activeds.dll
Agent_BTZ_Proxy_DLL_2 [yara]
Ajan_asp [yara]
Semi-Auto-generated - file Ajan.asp.txt
Ajax_PHP_Command_Shell_php [yara]
Semi-Auto-generated - file Ajax_PHP Command Shell.php.txt
ak74shell_php_php [yara]
Semi-Auto-generated - file ak74shell.php.php.txt
ALFA_SHELL [yara]
Detects web shell often used by Iranian APT groups
AllTheThings [yara]
Detects AllTheThings
Ammyy_Admin_AA_v3 [yara]
Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe
Andromeda_MalBot_Jun_1A [yara]
Detects a malicious Worm Andromeda / RETADUP
Angry_IP_Scanner_v2_08_ipscan [yara]
Auto-generated rule on file ipscan.exe
_antichat_php_php_Fatalshell_php_php_a_gedit_php_php [yara]
Semi-Auto-generated - from files antichat.php.php.txt, Fatalshell.php.php.txt, a_gedit.php.php.txt
Antichat_Shell_v1_3_php [yara]
Semi-Auto-generated - file Antichat Shell v1.3.php.txt
Antichat_Socks5_Server_php_php [yara]
Semi-Auto-generated - file Antichat Socks5 Server.php.php.txt
Antiy_Ports_1_21 [yara]
Disclosed hacktool set (old stuff) - file Antiy Ports 1.21.exe
aolipsniffer [yara]
Auto-generated rule on file aolipsniffer.exe
Apolmy_Privesc_Trojan [yara]
Apolmy Privilege Escalation Trojan used in APT Terracotta
AppInitHook [yara]
AppInitGlobalHooks-Mimikatz - Hide Mimikatz From Process Lists - file AppInitHook.dll
APT10_Malware_Sample_Gen [yara]
APT 10 / Cloud Hopper malware campaign
APT12_Malware_Aug17 [yara]
Detects APT 12 Malware