| Name / Title | Added | Expires | Hits | Comments | Syntax | |
|---|---|---|---|---|---|---|
| YARA Rule Riddle | Sep 27th, 2025 | Never | 16,437 | 3 | YARA | - |
| Manipulated File in Malicious NPM Packages | Sep 8th, 2025 | Never | 22,190 | 9 | JavaScript | - |
| Windows Batch Loader | Mar 29th, 2025 | Never | 1,242 | 1 | Winbatch | - |
| JAVA Memory Shell | Feb 28th, 2025 | Never | 1,016 | 1 | Java | - |
| JAVA Web Shell | Feb 28th, 2025 | Never | 18,938 | 7 | Java | - |
| Java Shell | Feb 28th, 2025 | Never | 995 | 1 | Java | - |
| PowerShell Loader - Obfuscated | Nov 7th, 2024 | Never | 3 | 0 | PowerShell | - |
| StrelaStealer BATCH Obfuscated | Jul 12th, 2024 | Never | 8,052 | 3 | Winbatch | - |
| Example: AI generated malicious script | Dec 28th, 2023 | Never | 2,597 | 13 | PowerShell | - |
| PerlKit Webshell | Jan 20th, 2023 | Never | 10,700 | 3 | Perl | - |
| Batch FUD Samples | Aug 19th, 2022 | Never | 1,318 | 7 | None | - |
| Exif Exploit Payload | Apr 26th, 2022 | Never | 1,433 | 1 | None | - |
| PowerShell Obfuscation with Space and Tab | Jan 21st, 2022 | Never | 2,628 | 1 | PowerShell | - |
| bash_history | Jan 17th, 2022 | Never | 895 | 1 | None | - |
| Obfusctaed PS1 Dec21 | Dec 22nd, 2021 | Never | 2,413 | 1 | PowerShell | - |
| Obfuscated PS1 Dec | Dec 22nd, 2021 | Never | 789 | 1 | PowerShell | - |
| Zoho Desktop Central CVE-2021-44515 Detector | Dec 6th, 2021 | Never | 3,872 | 1 | Java | - |
| Sigma Converter Targets : October 2021 | Oct 22nd, 2021 | Never | 783 | 1 | None | - |
| Related Files - MalDocs Jul 21 | Jul 10th, 2021 | Never | 1,095 | 1 | None | - |
| SilverFish config32.ini Sample B | Mar 19th, 2021 | Never | 19,133 | 3 | INI file | - |
| SilverFish config32.ini Sample A | Mar 19th, 2021 | Never | 1,364 | 1 | INI file | - |
| CS Custom Loader Pivot | Feb 11th, 2021 | Never | 1,110 | 1 | None | - |
| Related Samples | Dec 30th, 2020 | Never | 1,210 | 1 | None | - |
| XORed Shell Codes | Dec 9th, 2020 | Never | 1,292 | 1 | None | - |
| Weekly CrackMe | Jul 1st, 2020 | Never | 1,069 | 1 | None | - |
| AMSI_TN_bypass.txt | Jul 1st, 2020 | Never | 2,292 | 1 | PowerShell | - |
| Translate Examples for GodMode Rule | May 18th, 2020 | Never | 2,636 | 1 | Bash | - |
| Base64 + Reverse + Replaced Malware | Apr 6th, 2020 | Never | 2,249 | 1 | None | - |
| China Chopper | Nov 19th, 2019 | Never | 1,034 | 1 | None | - |
| VpsTools.bat | Oct 30th, 2019 | Never | 1,512 | 1 | Batch | - |
| Bashfuscator Examples | May 25th, 2019 | Never | 1,432 | 1 | None | - |
| APT10 Loader Samples | May 24th, 2019 | Never | 1,507 | 1 | None | - |
| APT10 .NET Loader Samples | May 24th, 2019 | Never | 1,522 | 1 | None | - |
| Malicious or Legitimate | May 19th, 2019 | Never | 2,191 | 1 | JavaScript | - |
| DKMC Matches | Mar 1st, 2019 | Never | 1,159 | 1 | None | - |
| Metasploit User-Agents - no count | Feb 27th, 2019 | Never | 876 | 1 | None | - |
| Metasploit Framework User Agents | Feb 27th, 2019 | Never | 2,432 | 1 | None | - |
| Empire User Agents | Feb 27th, 2019 | Never | 2,221 | 1 | None | - |
| st3.ps1 ISESteroids obfuscation | Jan 26th, 2019 | Never | 1,204 | 1 | PowerShell | - |
| RAT / Patchwork / Imphash Pivot 2dfea0cb99dfd178aefd42a0ebb0 | Jan 12th, 2019 | Never | 1,200 | 13 | None | - |
| SUSP_Obfuscted_PowerShell_Code | Dec 13th, 2018 | Never | 1,003 | 1 | None | - |
| APT34 Obfuscated Code | Dec 13th, 2018 | Never | 3,522 | 1 | PowerShell | - |
| Malformed Zoomit | Dec 7th, 2016 | Never | 1,153 | 1 | None | - |
| Dirty COW Samples | Oct 22nd, 2016 | Never | 1,737 | 1 | None | - |
| Sofacy Samples - and YARA matches | Jun 14th, 2016 | Never | 1,549 | 1 | None | - |
| Dubnium Rule Coverage | Jun 10th, 2016 | Never | 1,146 | 1 | None | - |
| Petrya Samples | Mar 24th, 2016 | Never | 1,085 | 1 | None | - |
| Chrome on OSX Automator - disabled NSA backdoored ciphers | Nov 5th, 2015 | Never | 1,260 | 1 | Perl | - |
| Banker SHIFU Samples | Oct 31st, 2015 | Never | 2,058 | 1 | None | - |
| Unit 78020 Malware Samples | Sep 24th, 2015 | Never | 2,075 | 1 | Perl | - |
| Rocket Kitten 2 - Keylogger | Sep 3rd, 2015 | Never | 1,220 | 1 | None | - |
| Emdivi Rule Results | Aug 21st, 2015 | Never | 1,027 | 1 | None | - |
| Emdivi User Agent | Aug 20th, 2015 | Never | 1,390 | 1 | None | - |
| Phishing campaign SWF CVE-2015-5119 exploit, payload matches | Aug 12th, 2015 | Never | 1,369 | 1 | Python | - |
| KillString | Jul 23rd, 2015 | Never | 1,086 | 1 | None | - |
| Simple PHP Webshell cloaked as GIF | Apr 5th, 2015 | Never | 1,718 | 1 | PHP | - |
| PHP Webshell with GIF Header | Apr 3rd, 2015 | Never | 1,312 | 1 | PHP | - |
| TurkisH-RuleZ SheLL / Webshell Gzipped as 1.CSS | Mar 16th, 2015 | Never | 1,330 | 1 | Java | - |
| Microsoft Identifier used in EquationDrug Platform | Mar 11th, 2015 | Never | 1,186 | 1 | Perl | - |
| BlackEnergy 2 Yara Rule | Feb 19th, 2015 | Never | 1,656 | 2 | Perl | - |
| Equation Group Malware - Yara Signatures | Feb 16th, 2015 | Never | 6,719 | 1 | Perl | - |
| Yara Rules from the Symantec Waterbug Report | Jan 26th, 2015 | Never | 1,636 | 1 | Perl | - |
| Five Eyes QUERTY Malware Yara Rules | Jan 18th, 2015 | Never | 1,962 | 1 | Perl | - |
| Targeted Destructive Malware - Yara Rules - US-CERT | Dec 20th, 2014 | Never | 1,249 | 1 | Perl | - |
| BlueCoat Inception APT Report Yara Rules | Dec 10th, 2014 | Never | 1,259 | 1 | Perl | - |
| Operation Cleaver Yara Rules | Dec 2nd, 2014 | Never | 1,531 | 1 | Perl | - |
| Splunk Tags - Detect Regin Backdoor Logs Files | Nov 26th, 2014 | Never | 2,235 | 8 | Perl | - |
| Regin Backdoor - Yara Rules | Nov 24th, 2014 | Never | 6,881 | 7 | Perl | - |
| CN GUI Scanner Tool Yara Rule | Oct 4th, 2014 | Never | 1,235 | 1 | Perl | - |
| PlugX APT Groups C2 Server | Jun 11th, 2014 | Never | 2,875 | 2 | None | - |
| Nmap Script to detect Linksys "The Moon" malware | Feb 16th, 2014 | Never | 1,674 | 1 | Lua | - |
| POSCardStealer B/R/S Spybot Yara Rule | Feb 10th, 2014 | Never | 1,095 | 1 | Perl | - |
| Malware_Campaign_Jan14 | Jan 15th, 2014 | Never | 1,148 | 1 | Perl | - |
| YARA Rule - AutoIt Malware | Jun 21st, 2013 | Never | 981 | 1 | Perl | - |
| Neurevt Malware Yara Rule | Jun 21st, 2013 | Never | 943 | 5 | Perl | - |
| CVE-2013-3660 EPATHOBJ Exploit Code YARA Signatures | Jun 14th, 2013 | Never | 1,102 | 1 | Perl | - |
| YARA Rules - NetTraveler | Jun 14th, 2013 | Never | 1,015 | 1 | Perl | - |
