Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacyΒ© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
yara-rules β€” Collection of YARA rules for hunting malware, malicious Office documents, and exploit artifacts, with references to samples and research write-ups. | Kitploit
Tools/GitHubGitHub/inquest/yara-rules
Defensive ToolsIndicator of Compromise (IOC) ManagementThreat Feeds & AggregatorsMalware AnalysisThreat IntelligencePapers & ResearchIncident ResponseCurated Resources
GitHubinquest/yara-rules

yara-rules

Collection of YARA rules for hunting malware, malicious Office documents, and exploit artifacts, with references to samples and research write-ups.

38956194 years agoReviewed by Kitploit

Most Popular

View all β†’

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools β†’
View Repository
Share

yara-rules

A collection of YARA rules from the folks at InQuest we wish to share with the world. These rules should not be considered production appropriate. Rather, they are valuable for research and hunting purposes.

See also:

  • https://github.com/InQuest/yara-rules-vt πŸ“–
  • https://github.com/InQuest/awesome-yara πŸ†πŸ₯‡
  • https://labs.inquest.net πŸ₯ΌπŸ”¬πŸ§ͺ
  • http://yaramate.com πŸ˜†

The rules are listed here, alphabetically, along with references for further reading:

  • Base64 Encoded Powershell
    • YARA
    • Blog
    • Samples
  • CVE-2018-4878: Adobe Flash MediaPlayer DRM user-after-free Vulnerability
    • CVE_2018_4878_0day_ITW
    • Microsoft_Office_Document_with_Embedded_Flash_File
    • Adobe_Flash_DRM_Use_After_Free
    • Blog: Adobe Flash MediaPlayer DRM Use-after-free Vulnerability
    • Follow highlights of the conversation on Twitter from this "moment" we maintain.
  • Embedded PE Files
    • Discover embedded PE files, without relying on easily stripped/modified header strings.
  • Executables Converted to MSI
    • Blog: "Carving Sneaky XLM Files"
    • www.exetomsi.com
  • Hex Encoded Powershell Pivot
    • Sample
    • Related Samples
    • Mixed Hex Case Regex Generator
  • Hidden Bee Custom Windows Executable Format
    • Malwarebytes Blog
    • Malware Samples
  • Hunting Suspicious IQY Files
    • IQY_File
    • IQY_File_With_Suspicious_URL
    • IQY_File_With_Pivot_Extension_URL.rule
  • labs.inquest.net
    • VirusTotal Intelligence hunt rules that feed the InQuest Labs data portal.
  • Microsoft Excel Hidden Macro Sheets
    • Blog: "Carving Sneaky XLM Files"
  • Microsoft Excel Data Connection
    • Blog: "Getting Sneakier: Hidden Sheets, Data Connections, and XLM Macros"
  • Microsoft_Office_DDE_Command_Execution
    • Blogs: Overview, Hunting, and Mitigation, Freddie Mac Targeted Lure, SEC OMB Masquerading Lure, Vortex Ransomware Targeting Poland.
    • Follow highlights of the conversation on Twitter from this "moment" we maintain.
  • Microsoft XLSX with Macrosheet
    • Blog: "Zloader 4.0 Macrosheet Evolution"
    • Github Hosted Samples and Macrosheet Extractions
    • InQuest Labs Samples by Heuristic Match
  • MSIExec Pivot
    • Blog: "Carving Sneaky XLM Files"
    • Reference: Custom Action Type 19
  • NTLM_Credentials_Theft_via_PDF
    • This signature detects Adobe PDF files that reference a remote UNC object for the purpose of leaking NTLM hashes. New methods for NTLM hash leaks are discovered from time to time. This particular one is triggered upon opening of a malicious crafted PDF. Original write-up from CheckPoint.
  • RTF_Byte_Nibble_Obfuscation
    • This signature is designed to detect the obfuscation method described by Boris Larin here Disappearing bytes: Reverse engineering the MS Office RTF parser. This obfuscation method is rarely seen but was used in the distribution of CVE-2018-8174 0day discovered in-the-wild.
    • We'll continue to earmark interesting tidbits around the subject matter in this Twitter Moment.
  • Suspicious Symbolic Link Files that contain Excel 4.0 macros Or File Characteristics
    • These signatures detect Symbolic Link (SLK) files that contain Excel 4.0 macros described here by Stan Hegt.
  • CVE-2020-0601 ("Chain of Fools" or "Curveball")
    • This signature detects a Microsoft Windows executable that has been signed using Elliptic Curve Cryptography (ECC) certificates with an explicit curve.
  • GlowSpark
    • This signature detects a second stage Actinium Downloader dubbed GlowSpark.
Download Tool