Detection Rule List

YARA

YARA (created by Victor Alvarez at VirusTotal) is a rule-based pattern-matching tool used to identify and classify files especially malware by detecting specific textual, binary, or structural signatures.
CAPA

CAPA (by Mandiant) identifies malware capabilities by analyzing executable behavior and mapping it to known techniques.
SIGMA

SIGMA is a generic, open signature format that allows security analysts to write detection rules that can be applied across different SIEM systems.
Rule Name Rule Type Technique Count Creation Date
Detect ShikataGaNai Encoding YARA 1 2 years, 9 months
Detect FreeLibrary Unhooking CAPA 1 3 years, 1 month
Detect CreateThreadpoolWait Usage YARA 1 3 years, 4 months
Detect XOR Patterns YARA 1 3 years, 4 months
Detect Shortcut Cloaking YARA 1 3 years, 4 months
Detect GetModuleFileName Usage YARA 1 3 years, 4 months
Detect Sysmon Evasion YARA 1 3 years, 4 months
Detect Parent Process Identification YARA 1 3 years, 4 months
Detect Interrupts YARA 1 3 years, 4 months
Detect DLL Proxying YARA 1 3 years, 4 months
Detect DLLSearchOrderHijacking YARA 1 3 years, 4 months
Detect DLL Export Name Modification YARA 1 3 years, 4 months
Detect Hook Injection 2 CAPA 0 3 years, 4 months
Detect Hook Injection CAPA 0 3 years, 4 months
Detect Hook Injection 3 SIGMA 1 3 years, 4 months
Detect Hook Injection 4 YARA 1 3 years, 4 months
Detect BobSoft Packer YARA 1 3 years, 10 months
Detect PESpin Packer YARA 1 3 years, 10 months
Detect Obsidium Protector YARA 1 3 years, 10 months
Detect PELock Protector YARA 1 3 years, 10 months
Detect NSPack Packer 2 YARA 1 3 years, 10 months
Detect ASProtect Packer YARA 1 3 years, 10 months
Detect Crinkler Packer YARA 1 3 years, 10 months
Detect Petite Packer 2 YARA 1 3 years, 10 months
Detect ASPack Packer YARA 1 3 years, 10 months
Detect VMProtect Protector YARA 1 3 years, 10 months
Detect FSG Packer YARA 1 3 years, 10 months
Detect Mew Packer YARA 1 3 years, 10 months
Detect Themida Protector YARA 1 3 years, 10 months
Detect ExeStealth Protector YARA 1 3 years, 10 months
Filter
Clear