Detection rules
YARA, Suricata, Sigma and host-hunt rules pulled from the reports. Click a rule to see the full text and every post that uses it, or pull the set as JSON via the feed. We don't serve loadable rule files by design — copy and review before you deploy.
| Type | Rule | Posts | Last seen |
|---|---|---|---|
| yara | n4d_ssh_key | 1 | 2026-07-18 |
| yara | n4d_persistence_login_hook | 1 | 2026-07-18 |
| yara | n4d_persistence_updater | 1 | 2026-07-18 |
| yara | n4d_persistence_watchdog | 1 | 2026-07-18 |
| yara | n4d_agent_unpacked | 1 | 2026-07-18 |
| yara | n4d_agent_packed | 1 | 2026-07-18 |
| yara | IvantiSentry_JSP_RuntimeExec_Webshell | 1 | 2026-06-21 |
| yara | IvantiSentry_PHP_System_Webshell | 1 | 2026-06-21 |
| yara | DockerPwn_v2_Universal_Persistence_Script | 1 | 2026-06-16 |
| yara | VoidLink_FleetAgent | 1 | 2026-06-16 |