Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	Caracachs	—	—
yara	StringDotSimplified	—	—
yara	searchinject	—	—
yara	FakeTLS_ServerHelloGetSelectedCipher	—	—
yara	XORDecodeA7	—	—
yara	DynamicAPILoading	—	—
yara	DNSCalcStyleEncodeAndDecode	—	—
yara	GenerateTLSClientHelloPacket_Test	—	—
yara	RC4SboxKeyGen	—	—
yara	RandomTimestampGenerator	—	—
yara	CPUInfoExtraction	—	—
yara	SuicideScriptL1	—	—
yara	SuicideScriptR1_Multi	—	—
yara	SuicideScriptR	—	—
yara	blackpos_v2	—	—
yara	dump_tool	—	—
yara	osql_tool	—	—
yara	misc_pos	—	—
yara	unknown	—	—
yara	heistenberg_pos	—	—
yara	regex_pos	—	—
yara	regexpr_pos	—	—
yara	reg_pos	—	—
yara	sets_pos	—	—
yara	monitor_tool_pos	—	—
yara	pstgdump	—	—
yara	keyfinder_tool	—	—
yara	memdump_diablo	—	—
yara	blazingtools	—	—
yara	sysocmgr	—	—
yara	lacy_keylogger	—	—
yara	pos_memory_scrapper_	—	—
yara	pos_malwre_dexter_stardust	—	—
yara	pos_malware_project_hook	—	—
yara	pdb_strings_Rescator	—	—
yara	pos_uploader	—	—
yara	winxml_dll	—	—
yara	pos_chewbacca	—	—
yara	BernhardPOS	—	—
yara	POS_bruteforcing_bot	—	—