Detection Rule List

YARA

YARA (created by Victor Alvarez at VirusTotal) is a rule-based pattern-matching tool used to identify and classify files especially malware by detecting specific textual, binary, or structural signatures.
CAPA

CAPA (by Mandiant) identifies malware capabilities by analyzing executable behavior and mapping it to known techniques.
SIGMA

SIGMA is a generic, open signature format that allows security analysts to write detection rules that can be applied across different SIEM systems.
Rule Name Rule Type Technique Count Creation Date
Detect ShikataGaNai Encoding YARA 1 3 years
Detect FreeLibrary Unhooking CAPA 1 3 years, 3 months
Detect CreateThreadpoolWait Usage YARA 1 3 years, 6 months
Detect XOR Patterns YARA 1 3 years, 6 months
Detect Shortcut Cloaking YARA 1 3 years, 6 months
Detect GetModuleFileName Usage YARA 1 3 years, 7 months
Detect Sysmon Evasion YARA 1 3 years, 7 months
Detect Parent Process Identification YARA 1 3 years, 7 months
Detect Interrupts YARA 1 3 years, 7 months
Detect DLL Proxying YARA 1 3 years, 7 months
Detect DLLSearchOrderHijacking YARA 1 3 years, 7 months
Detect DLL Export Name Modification YARA 1 3 years, 7 months
Detect Hook Injection 2 CAPA 0 3 years, 7 months
Detect Hook Injection CAPA 0 3 years, 7 months
Detect Hook Injection 3 SIGMA 1 3 years, 7 months
Detect Hook Injection 4 YARA 1 3 years, 7 months
Detect BobSoft Packer YARA 1 4 years
Detect PESpin Packer YARA 1 4 years
Detect Obsidium Protector YARA 1 4 years
Detect PELock Protector YARA 1 4 years
Detect NSPack Packer 2 YARA 1 4 years
Detect ASProtect Packer YARA 1 4 years
Detect Crinkler Packer YARA 1 4 years
Detect Petite Packer 2 YARA 1 4 years
Detect ASPack Packer YARA 1 4 years
Detect VMProtect Protector YARA 1 4 years
Detect FSG Packer YARA 1 4 years
Detect Mew Packer YARA 1 4 years
Detect Themida Protector YARA 1 4 years
Detect ExeStealth Protector YARA 1 4 years
Filter
Clear