Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	fromCharCode_in_unicode	—	—
yara	APT1_WEBC2_Y21K	—	—
yara	APT1_WEBC2_YAHOO	—	—
yara	r4_wiper_2	—	—
yara	APT_Hikit_msrv	—	—
yara	obf_base64_decode	—	—
yara	php_uname	—	—
yara	APT1_WEBC2_TOCK	—	—
yara	scriptkiddies	—	—
yara	eval_with_comments	—	—
yara	PM_Email_Sent_By_PHP_Script	—	—
yara	PM_Zip_with_js	—	—
yara	APT1_WEBC2_RAVE	—	—
yara	APT1_WEBC2_GREENCAT	—	—
yara	Rooter	—	—
yara	RookieStrings	—	—
yara	CALENDAR_APT1	—	—
yara	SType_Backdoor	—	—
yara	GLOOXMAIL_APT1	—	—
yara	GOGGLES_APT1	—	—
yara	HACKSFASE2_APT1	—	—
yara	is__Mirai_gen7	—	—
yara	LIGHTDART_APT1	—	—
yara	AURIGA_APT1	—	—
yara	AURIGA_driver_APT1	—	—
yara	BANGAT_APT1	—	—
yara	BISCUIT_GREENCAT_APT1	—	—
yara	BOUNCER_APT1	—	—
yara	MANITSME_APT1	—	—
yara	MINIASP_APT1	—	—
yara	NEWSREELS_APT1	—	—
yara	SEASALT_APT1	—	—
yara	STARSYPOUND_APT1	—	—
yara	SWORD_APT1	—	—
yara	thequickbrow_APT1	—	—
yara	TABMSGSQL_APT1	—	—
yara	CCREWBACK1	—	—
yara	APT1_WEBC2_CSON	—	—
yara	APT1_WEBC2_CLOVER	—	—
yara	APT1_WEBC2_BOLID	—	—