Detection rules
Every rule tracked across all seven sources, newest updates first.
| Source | Rule | Status | Updated |
|---|---|---|---|
| yara | Crimson | — | — |
| yara | CrossRAT | — | — |
| yara | CyberGate | — | — |
| yara | DarkComet_1 | — | — |
| yara | DarkComet_5 | — | — |
| yara | FlyingKitten | — | — |
| yara | CSIT_14003_03 | — | — |
| yara | APT_WIN_Gh0st_ver | — | — |
| yara | Gh0st | — | — |
| yara | gh0st | — | — |
| yara | gholeeV1 | — | — |
| yara | gholeeV2 | — | — |
| yara | MW_gholee_v1 | — | — |
| yara | MW_gholee_v2 | — | — |
| yara | glassrat | — | — |
| yara | Win32OPCHavex | — | — |
| yara | Win32FertgerHavex | — | — |
| yara | Havex_Trojan_PHP_Server | — | — |
| yara | SANS_ICS_Cybersecurity_Challenge_400_Havex_Memdump | — | — |
| yara | apt_win32_dll_rat_hiZor_RAT | — | — |
| yara | Indetectables_RAT | — | — |
| yara | BergSilva_Malware | — | — |
| yara | apt_win32_dll_rat_1a53b0cp32e46g0qio7 | — | — |
| yara | Meterpreter_Reverse_Tcp | — | — |
| yara | Ap0calypse | — | — |
| yara | Nanocore_RAT_Gen_1 | — | — |
| yara | Nanocore_RAT_Gen_2 | — | — |
| yara | Nanocore_RAT_Sample_1 | — | — |
| yara | Nanocore_RAT_Sample_2 | — | — |
| yara | NetWiredRC_B | — | — |
| yara | Njrat | — | — |
| yara | njrat1 | — | — |
| yara | win_exe_njRAT | — | — |
| yara | network_traffic_njRAT | — | — |
| yara | RAT_Orcus | — | — |
| yara | PlugXStrings | — | — |
| yara | plugX | — | — |
| yara | Arcom | — | — |
| yara | PlugX_mw | — | — |
| yara | PoetRat_Doc | — | — |