Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source	Rule	Status	Updated
yara	PubSabCode	—	—
yara	PubSabStrings	—	—
yara	PubSab	—	—
yara	MALW_PurpleWave_v1	—	—
yara	MALW_FakePyPI	—	—
yara	PE_File_pyinstaller	—	—
yara	MachO_File_pyinstaller	—	—
yara	QuarianStrings	—	—
yara	QuarianCode	—	—
yara	Quarian	—	—
yara	MALW_Rebirth_Vulcan_ELF	—	—
yara	RegSubDatCode	—	—
yara	RegSubDatStrings	—	—
yara	RookieCode	—	—
yara	Rookie	—	—
yara	rovnix_downloader	—	—
yara	SafeNetCode	—	—
yara	SafeNetStrings	—	—
yara	SafeNet	—	—
yara	Sakurel_backdoor	—	—
yara	Vinsula_Sayad_Binder	—	—
yara	skeleton_key_patcher	—	—
yara	Vinsula_Sayad_Client	—	—
yara	ScarhiknStrings	—	—
yara	ScarhiknCode	—	—
yara	Scarhikn	—	—
yara	sendsafe	—	—
yara	CrowdStrike_Shamoon_DroppedFile	—	—
yara	SurtrCode	—	—
yara	Shamoon2_Wiper	—	—
yara	Shamoon2_ComComp	—	—
yara	EldoS_RawDisk	—	—
yara	Shamoon_Disttrack_Dropper	—	—
yara	Shifu_Banking_Trojan_0	—	—
yara	SHIFU_Banking_Trojan_1	—	—
yara	Shifu	—	—
yara	skeleton_key_injected_code	—	—
yara	Spora	—	—
yara	unk_packer	—	—
yara	with_sqlite	—	—