Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	APT3102Code	—	—
yara	WebShell_PHP_Web_Kit_v4	—	—
yara	WebShell_PHP_Web_Kit_v3	—	—
yara	PAS_TOOL_PHP_WEB_KIT_mod	—	—
yara	GRIZZLY_STEPPE_Malware_2	—	—
yara	GRIZZLY_STEPPE_Malware_1	—	—
yara	APT17_Sample_FXSST_DLL	—	—
yara	malware_apt15_generic	—	—
yara	malware_apt15_exchange_tool	—	—
yara	malware_apt15_royaldll_2	—	—
yara	malware_apt15_royaldll	—	—
yara	malware_apt15_bs2005	—	—
yara	malware_apt15_royalcli_2	—	—
yara	malware_apt15_royalcli_1	—	—
yara	clean_apt15_patchedcmd	—	—
yara	Tofu_Backdoor	—	—
yara	Ham_backdoor	—	—
yara	PLUGX_RedLeaves	—	—
yara	REDLEAVES_CoreImplant_UniqueStrings	—	—
yara	REDLEAVES_DroppedFile_ObfuscatedShellcodeAndRAT_handkerchief	—	—
yara	REDLEAVES_DroppedFile_ImplantLoader_Starburn	—	—
yara	Dropper_DeploysMalwareViaSideLoading	—	—
yara	APT1_known_malicious_RARSilent	—	—
yara	APT1_dbg_mess	—	—
yara	APT1_Revird_svc	—	—
yara	APT1_aspnetreport	—	—
yara	APT1_RARSilent_EXE_PDF	—	—
yara	APT1_TARSIP_MOON	—	—
yara	APT1_TARSIP_ECLIPSE	—	—
yara	APT1_WARP	—	—
yara	APT1_WEBC2_AUSOV	—	—
yara	APT1_WEBC2_ADSPACE	—	—
yara	APT1_WEBC2_BOLID	—	—
yara	APT1_WEBC2_CLOVER	—	—
yara	APT1_WEBC2_CSON	—	—
yara	CCREWBACK1	—	—
yara	TABMSGSQL_APT1	—	—
yara	thequickbrow_APT1	—	—
yara	SWORD_APT1	—	—
yara	STARSYPOUND_APT1	—	—