Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	diamond_fox	—	—
yara	DirtJumper_drive	—	—
yara	DirtJumper_drive2	—	—
yara	DirtJumper_drive3	—	—
yara	eicar	—	—
yara	Trj_Elex_Installer_NSIS	—	—
yara	Trj_Elex_Installer	—	—
yara	md5_825a3b2a6abbe6abcdeda64a73416b3d	—	—
yara	Trj_Elex_Service32	—	—
yara	Trj_Elex_Service64	—	—
yara	Trj_Elex_Dll32	—	—
yara	Trj_Elex_Dll64	—	—
yara	elknot_xor	—	—
yara	Emotets	—	—
yara	Empire_Invoke_MetasploitPayload	—	—
yara	Empire_Exploit_Jenkins	—	—
yara	Empire_Get_SecurityPackages	—	—
yara	Empire_Invoke_PowerDump	—	—
yara	Empire_Install_SSP	—	—
yara	Empire_Invoke_ShellcodeMSIL	—	—
yara	Empire__Users_neo_code_Workspace_Empire_4sigs_PowerUp	—	—
yara	Empire_Invoke_Mimikatz_Gen	—	—
yara	Empire_Get_GPPPassword	—	—
yara	Empire_Invoke_SmbScanner	—	—
yara	Empire_Exploit_JBoss	—	—
yara	Empire_dumpCredStore	—	—
yara	Empire_Invoke_EgressCheck	—	—
yara	Empire_ReflectivePick_x64_orig	—	—
yara	Empire_Out_Minidump	—	—
yara	Empire_Invoke_PsExec	—	—
yara	Empire_Invoke_PostExfil	—	—
yara	Empire_Invoke_SMBAutoBrute	—	—
yara	Empire_Get_Keystrokes	—	—
yara	Empire_Invoke_DllInjection	—	—
yara	Empire_KeePassConfig	—	—
yara	Empire_Invoke_SSHCommand	—	—
yara	Empire_PowerShell_Framework_Gen1	—	—
yara	Empire_PowerUp_Gen	—	—
yara	Empire_PowerShell_Framework_Gen2	—	—
yara	Empire_Agent_Gen	—	—