Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	skeleton_key_injected_code	—	—
yara	Shifu	—	—
yara	SHIFU_Banking_Trojan_1	—	—
yara	Shifu_Banking_Trojan_0	—	—
yara	Shamoon_Disttrack_Dropper	—	—
yara	EldoS_RawDisk	—	—
yara	Shamoon2_ComComp	—	—
yara	Shamoon2_Wiper	—	—
yara	SurtrCode	—	—
yara	CrowdStrike_Shamoon_DroppedFile	—	—
yara	sendsafe	—	—
yara	Scarhikn	—	—
yara	ScarhiknCode	—	—
yara	ScarhiknStrings	—	—
yara	Vinsula_Sayad_Client	—	—
yara	Base64_encoded_Executable	—	—
yara	Pandora	—	—
yara	CVE_2015_1674_CNGSYS	—	—
yara	DownExecute_A	—	—
yara	qti_certificate	—	—
yara	callTogether_certificate	—	—
yara	spyeye_plugins	—	—
yara	spyeye	—	—
yara	shylock	—	—
yara	qadars	—	—
yara	ice_ix_12xy	—	—
yara	SpyGate_v2_9	—	—
yara	LightFTP_Config	—	—
yara	LightFTP_fftp_x86_64	—	—
yara	Yayih	—	—
yara	PUP_InstallRex_AntiFWb	—	—
yara	EmiratesStatement	—	—
yara	OrcaRAT	—	—
yara	ZXProxy	—	—
yara	rtf_yahoo_ken	—	—
yara	Cloaked_as_JPG	—	—
yara	TrojanDownloader	—	—
yara	ScanBox_Malware_Generic	—	—
yara	memory_shylock	—	—
yara	memory_pivy	—	—