yara-rules
inquest/yara-rulesCollection of YARA rules for hunting malware, malicious Office documents, and exploit artifacts, with references to samples and research write-ups.
curated-resourcesdefensive-toolsincident-response+5
389
inquest/yara-rulesCollection of YARA rules for hunting malware, malicious Office documents, and exploit artifacts, with references to samples and research write-ups.
embee-research/yara-detection-rulesYara Rules for Modern Malware
dmitry-matvienko/malware-analysis-fake-hwmonitorTechnical analysis, writeup, and YARA rules for a DLL Sideloading campaign disguised as HWMonitor
inquest/yara-rules-vtCollection of YARA rules designed for usage through VirusTotal.com.
ahmetpayaslioglu/yararulesCurated collection of YARA detection rules for identifying and classifying malware, supporting threat hunting and detection workflows.
rivitna/malwareCurated YARA rules and detection programs for identifying ransomware families, providing signature-based indicators for malware triage, threat…
strangerealintel/orionA YARA rules repository continuously updated for monitoring the old and new threats from articles, incidents responses ...
chronicle/gctiDetection signature repository providing YARA rules and threat-hunting content for identifying malware and malicious activity across enterprise…
corelight/quipuA desktop workbench for writing, validating, compiling, and testing YARA rules.
dissectmalware/yaradbg-frontendWeb-based Yara rule debugger with an editor, live match evaluation, matched-string details, and rule dependency visualization for detection…
fevar54/cve-2026-76461-detection-kit-Defensive detection kit for CVE-2026-76461, a critical SQL injection in Cisco Secure Email Gateway, with Sigma and YARA rules, IOCs, and remediation…
arpsyndicate/vedas-signaturesVEDAS-Driven Autonomous Generation + Community Contributions of Suricata & Nuclei Rules for over 15k CVEs
immersive-labs-sec/bruteratel-detectiontoolsA collection of Tools and Rules for decoding Brute Ratel C4 badgers
hullabrian/eventhorizonTool that gathers a customizable set of ETW telemetry and generates user-defined detections
magicsword-io/lolrmmCurated catalog of Remote Monitoring and Management tools abused by threat actors, with YAML profiles, Sigma detection rules, and API access for…
rabbitstack/fibratusSecurity sensor for realtime threat detection and protection
xacone/bestedrofthemarketOpen-source Windows kernel-level EDR lab for understanding and testing detection methods against process injection, credential dumping, and other…