| Name / Title | Added | Expires | Hits | Comments | Syntax | |
|---|---|---|---|---|---|---|
| YARA Rule Riddle | Sep 27th, 2025 | Never | 15,909 | 3 | YARA | - |
| Manipulated File in Malicious NPM Packages | Sep 8th, 2025 | Never | 18,885 | 8 | JavaScript | - |
| Windows Batch Loader | Mar 29th, 2025 | Never | 1,208 | 1 | Winbatch | - |
| JAVA Memory Shell | Feb 28th, 2025 | Never | 981 | 1 | Java | - |
| JAVA Web Shell | Feb 28th, 2025 | Never | 16,397 | 7 | Java | - |
| Java Shell | Feb 28th, 2025 | Never | 947 | 1 | Java | - |
| PowerShell Loader - Obfuscated | Nov 7th, 2024 | Never | 3 | 0 | PowerShell | - |
| StrelaStealer BATCH Obfuscated | Jul 12th, 2024 | Never | 7,542 | 3 | Winbatch | - |
| Example: AI generated malicious script | Dec 28th, 2023 | Never | 2,548 | 13 | PowerShell | - |
| PerlKit Webshell | Jan 20th, 2023 | Never | 10,028 | 3 | Perl | - |
| Batch FUD Samples | Aug 19th, 2022 | Never | 1,278 | 7 | None | - |
| Exif Exploit Payload | Apr 26th, 2022 | Never | 1,396 | 1 | None | - |
| PowerShell Obfuscation with Space and Tab | Jan 21st, 2022 | Never | 2,582 | 1 | PowerShell | - |
| bash_history | Jan 17th, 2022 | Never | 856 | 1 | None | - |
| Obfusctaed PS1 Dec21 | Dec 22nd, 2021 | Never | 2,377 | 1 | PowerShell | - |
| Obfuscated PS1 Dec | Dec 22nd, 2021 | Never | 750 | 1 | PowerShell | - |
| Zoho Desktop Central CVE-2021-44515 Detector | Dec 6th, 2021 | Never | 3,830 | 1 | Java | - |
| Sigma Converter Targets : October 2021 | Oct 22nd, 2021 | Never | 747 | 1 | None | - |
| Related Files - MalDocs Jul 21 | Jul 10th, 2021 | Never | 1,055 | 1 | None | - |
| SilverFish config32.ini Sample B | Mar 19th, 2021 | Never | 16,636 | 3 | INI file | - |
| SilverFish config32.ini Sample A | Mar 19th, 2021 | Never | 1,311 | 1 | INI file | - |
| CS Custom Loader Pivot | Feb 11th, 2021 | Never | 1,073 | 1 | None | - |
| Related Samples | Dec 30th, 2020 | Never | 1,165 | 1 | None | - |
| XORed Shell Codes | Dec 9th, 2020 | Never | 1,252 | 1 | None | - |
| Weekly CrackMe | Jul 1st, 2020 | Never | 981 | 1 | None | - |
| AMSI_TN_bypass.txt | Jul 1st, 2020 | Never | 2,235 | 1 | PowerShell | - |
| Translate Examples for GodMode Rule | May 18th, 2020 | Never | 2,596 | 1 | Bash | - |
| Base64 + Reverse + Replaced Malware | Apr 6th, 2020 | Never | 2,207 | 1 | None | - |
| China Chopper | Nov 19th, 2019 | Never | 993 | 1 | None | - |
| VpsTools.bat | Oct 30th, 2019 | Never | 1,472 | 1 | Batch | - |
| Bashfuscator Examples | May 25th, 2019 | Never | 1,387 | 1 | None | - |
| APT10 Loader Samples | May 24th, 2019 | Never | 1,463 | 1 | None | - |
| APT10 .NET Loader Samples | May 24th, 2019 | Never | 1,474 | 1 | None | - |
| Malicious or Legitimate | May 19th, 2019 | Never | 2,156 | 1 | JavaScript | - |
| DKMC Matches | Mar 1st, 2019 | Never | 1,118 | 1 | None | - |
| Metasploit User-Agents - no count | Feb 27th, 2019 | Never | 833 | 1 | None | - |
| Metasploit Framework User Agents | Feb 27th, 2019 | Never | 2,390 | 1 | None | - |
| Empire User Agents | Feb 27th, 2019 | Never | 2,183 | 1 | None | - |
| st3.ps1 ISESteroids obfuscation | Jan 26th, 2019 | Never | 1,152 | 1 | PowerShell | - |
| RAT / Patchwork / Imphash Pivot 2dfea0cb99dfd178aefd42a0ebb0 | Jan 12th, 2019 | Never | 1,159 | 13 | None | - |
| SUSP_Obfuscted_PowerShell_Code | Dec 13th, 2018 | Never | 968 | 1 | None | - |
| APT34 Obfuscated Code | Dec 13th, 2018 | Never | 3,478 | 1 | PowerShell | - |
| Malformed Zoomit | Dec 7th, 2016 | Never | 1,115 | 1 | None | - |
| Dirty COW Samples | Oct 22nd, 2016 | Never | 1,685 | 1 | None | - |
| Sofacy Samples - and YARA matches | Jun 14th, 2016 | Never | 1,513 | 1 | None | - |
| Dubnium Rule Coverage | Jun 10th, 2016 | Never | 1,097 | 1 | None | - |
| Petrya Samples | Mar 24th, 2016 | Never | 1,045 | 1 | None | - |
| Chrome on OSX Automator - disabled NSA backdoored ciphers | Nov 5th, 2015 | Never | 1,217 | 1 | Perl | - |
| Banker SHIFU Samples | Oct 31st, 2015 | Never | 2,016 | 1 | None | - |
| Unit 78020 Malware Samples | Sep 24th, 2015 | Never | 2,035 | 1 | Perl | - |
| Rocket Kitten 2 - Keylogger | Sep 3rd, 2015 | Never | 1,182 | 1 | None | - |
| Emdivi Rule Results | Aug 21st, 2015 | Never | 989 | 1 | None | - |
| Emdivi User Agent | Aug 20th, 2015 | Never | 1,353 | 1 | None | - |
| Phishing campaign SWF CVE-2015-5119 exploit, payload matches | Aug 12th, 2015 | Never | 1,329 | 1 | Python | - |
| KillString | Jul 23rd, 2015 | Never | 1,030 | 1 | None | - |
| Simple PHP Webshell cloaked as GIF | Apr 5th, 2015 | Never | 1,679 | 1 | PHP | - |
| PHP Webshell with GIF Header | Apr 3rd, 2015 | Never | 1,272 | 1 | PHP | - |
| TurkisH-RuleZ SheLL / Webshell Gzipped as 1.CSS | Mar 16th, 2015 | Never | 1,290 | 1 | Java | - |
| Microsoft Identifier used in EquationDrug Platform | Mar 11th, 2015 | Never | 1,144 | 1 | Perl | - |
| BlackEnergy 2 Yara Rule | Feb 19th, 2015 | Never | 1,616 | 2 | Perl | - |
| Equation Group Malware - Yara Signatures | Feb 16th, 2015 | Never | 6,675 | 1 | Perl | - |
| Yara Rules from the Symantec Waterbug Report | Jan 26th, 2015 | Never | 1,588 | 1 | Perl | - |
| Five Eyes QUERTY Malware Yara Rules | Jan 18th, 2015 | Never | 1,923 | 1 | Perl | - |
| Targeted Destructive Malware - Yara Rules - US-CERT | Dec 20th, 2014 | Never | 1,213 | 1 | Perl | - |
| BlueCoat Inception APT Report Yara Rules | Dec 10th, 2014 | Never | 1,215 | 1 | Perl | - |
| Operation Cleaver Yara Rules | Dec 2nd, 2014 | Never | 1,485 | 1 | Perl | - |
| Splunk Tags - Detect Regin Backdoor Logs Files | Nov 26th, 2014 | Never | 2,187 | 8 | Perl | - |
| Regin Backdoor - Yara Rules | Nov 24th, 2014 | Never | 6,835 | 7 | Perl | - |
| CN GUI Scanner Tool Yara Rule | Oct 4th, 2014 | Never | 1,186 | 1 | Perl | - |
| PlugX APT Groups C2 Server | Jun 11th, 2014 | Never | 2,832 | 2 | None | - |
| Nmap Script to detect Linksys "The Moon" malware | Feb 16th, 2014 | Never | 1,638 | 1 | Lua | - |
| POSCardStealer B/R/S Spybot Yara Rule | Feb 10th, 2014 | Never | 1,050 | 1 | Perl | - |
| Malware_Campaign_Jan14 | Jan 15th, 2014 | Never | 1,109 | 1 | Perl | - |
| YARA Rule - AutoIt Malware | Jun 21st, 2013 | Never | 938 | 1 | Perl | - |
| Neurevt Malware Yara Rule | Jun 21st, 2013 | Never | 902 | 5 | Perl | - |
| CVE-2013-3660 EPATHOBJ Exploit Code YARA Signatures | Jun 14th, 2013 | Never | 1,070 | 1 | Perl | - |
| YARA Rules - NetTraveler | Jun 14th, 2013 | Never | 979 | 1 | Perl | - |
