Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	HKTL_NET_GUID_MemoryMapper	—	—
yara	HKTL_NET_GUID_VanillaRAT	—	—
yara	HKTL_NET_GUID_UnmanagedPowerShell	—	—
yara	HKTL_NET_GUID_Quasar	—	—
yara	HKTL_NET_GUID_SharpAdidnsdump	—	—
yara	HKTL_NET_GUID_DotNetToJScript	—	—
yara	HKTL_NET_GUID_SharpSearch	—	—
yara	HKTL_NET_GUID_SharpSecDump	—	—
yara	HKTL_NET_GUID_Net_GPPPassword	—	—
yara	HKTL_NET_GUID_FileSearcher	—	—
yara	HKTL_NET_GUID_ADFSDump	—	—
yara	HKTL_NET_GUID_SharpRDP	—	—
yara	HKTL_NET_GUID_SharpCall	—	—
yara	HKTL_NET_GUID_ysoserial_net	—	—
yara	HKTL_NET_GUID_ManagedInjection	—	—
yara	HKTL_NET_GUID_SharpSocks	—	—
yara	HKTL_NET_GUID_Sharp_WMIExec	—	—
yara	HKTL_NET_GUID_KeeThief	—	—
yara	HKTL_NET_GUID_fakelogonscreen	—	—
yara	HKTL_NET_GUID_PoshSecFramework	—	—
yara	HKTL_NET_GUID_SharpAttack	—	—
yara	HKTL_NET_GUID_Altman	—	—
yara	HKTL_NET_GUID_BrowserPass	—	—
yara	HKTL_NET_GUID_Mythic	—	—
yara	HKTL_NET_GUID_Nuages	—	—
yara	HKTL_NET_GUID_SharpSniper	—	—
yara	HKTL_NET_GUID_SharpHound3	—	—
yara	HKTL_NET_GUID_BlockEtw	—	—
yara	HKTL_NET_NAME_Recon_AD	—	—
yara	HKTL_NET_NAME_SharpWatchdogs	—	—
yara	HKTL_NET_NAME_SharpCat	—	—
yara	HKTL_NET_NAME_aspnetcore_bypassing_authentication	—	—
yara	HKTL_NET_NAME_K8tools	—	—
yara	HKTL_NET_NAME_HTTPSBeaconShell	—	—
yara	HKTL_NET_NAME_Ghostpack_CompiledBinaries	—	—
yara	HKTL_NET_NAME_metasploit_sharp	—	—
yara	HKTL_NET_NAME_trevorc2	—	—
yara	HKTL_NET_NAME_petaqc2	—	—
yara	HKTL_NET_NAME_NativePayload_DNS2	—	—
yara	HKTL_NET_NAME_cve_2017_7269_tool	—	—