# YARA Published articles for YARA. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering DevFeed: [AutoPYara: Next-Gen YARA Rule Generator for Malware Family Clustering]() Original publisher: [Read original article]() Author: Mabon Ninan, Nhat Nguyen, Soumyajyoti Dutta, Sidharth Anil, Marcus Botacin Published: 2026-11-09T05:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security](), [arXiv: Machine Learning]() Topics: [clustering](), [Tool](), [rule-engine](), [pip]() Tags: [abstract](), [automatic](), [cluster](), [clustering](), [coverage](), [cs-cr](), [cs-lg](), [data](), [datasets](), [diversity](), [effective](), [generation](), [generator](), [hashing](), [implement](), [incident-response](), [malware](), [next](), [open-source](), [package](), [pip-install](), [yara]() ### AI overview AutoPYara targets degraded YARA rule quality caused by diverse malware within a family and noisy clustering. It selects cluster centroids using similarity hashing and estimates family subclusters with a heuristic based on historical VirusTotal data. The authors report 14 percentage points higher rule coverage, 7.1 percentage points lower average variance than AutoYara, and 10% better threat-hunting accuracy. They provide it as an open-source Python package installable with `pip install autopyara`. These are abstract-level reported results; the supplied excerpt gives no evaluation details. ### Source excerpt arXiv:2611.08608v1 Announce Type: new Abstract: Millions of malware variants threaten users daily, such that clustering these samples is key for fast incident response. AutoYara is the current state-of-the-art for automatic YARA rule generation, but the task remains challenging on realistic datasets, where intra-family diversity and noisy clustering can degrade rule quality. We present AutoPYara, a solution armored with: (1) precise cluster centroid selection based on similarity hashing, and (2) an improved heuristic for estimating subclusters within a malware family using historical VirusTotal data. We implement AutoPYara as an open-source Python package (pip install autopyara) to support reproducibility and practical use. We show that AutoPYara, (1) increases rule coverage by 14 percentage points; (2) reduces variance by 7.1 percentage points, comparing the average variance AutoPYara exhibits to that of AutoYara; and (3) improves threat-hunting accuracy by 10%. AutoPYara produces robust and effective YARA rules than prior automatic approaches in practical settings. ## Adversary Brains: Hypothesis-Based Logical Signatures for Threat Actor Detection with LLMs DevFeed: [Adversary Brains: Hypothesis-Based Logical Signatures for Threat Actor Detection with LLMs]() Original publisher: [Read original article]() Author: Gadi Evron Published: 2026-10-27T04:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [Threat Research](), [threat detection](), [Large Language Model](), [C2]() Tags: [ach](), [adversary](), [behavior](), [brain](), [c2](), [campaign](), [continuous](), [cs-cr](), [cs-lg](), [detection](), [intelligence](), [language-models](), [llm](), [llms](), [logical](), [model](), [pattern](), [yara]() ### AI overview The paper proposes "adversary brains": evolving logical signatures that represent a threat actor's or campaign's activity pattern, rather than matching a single indicator. The design adapts Analysis of Competing Hypotheses (ACH) to handle thousands of hypotheses and to support continuous detection. LLMs are described as turning prose reports into signatures, assessing matches, and helping keep them current. Partial patterns may also match new values, such as a fresh C2 domain, to help discover indicators. The supplied text is an abstract and does not provide implementation details or evaluation results. ### Source excerpt arXiv:2610.35624v1 Announce Type: new Abstract: An adversary brain is an LLM-based model of a threat actor's behavior, held as an evolving logical signature: a hypothesis with enough structure that data can test it continuously, without a person re-interpreting it each time. Rather than any single observation, such as an IoC (Indicator of Compromise), it is the arrangement that becomes a detection, or intelligence, mechanism. Where YARA matches a file and Sigma matches a log line, an adversary brain matches the activity pattern of a campaign or threat actor. This is based on an intelligence analysis technique called Analysis of Competing Hypotheses (ACH), which the design lifts from the limitation of a few hypotheses at a time, to thousands, and then also operationalizes it for continuous detection purposes. Language models make the concept, and scale, practical: they turn prose reports into brains, judge matches, and drive the loop that keeps brains current. A partial pattern in a brain can also match a new value, such as a fresh C2 (command and control) domain name, assisting with the discovery of new indicators, and turning unknown unknowns into known unknowns, and potentially into knowns. The author would like to thank Ryan Moon for the collaboration, and Sounil Yu, Chris Inglis, Thomas Roccia, Marius Benthin, Israel Grimberg, Michal Kamensky, Justin Borland, Brandon Levene, John Hultquist, and John Bambenek for their feedback and assistance. ## PHP2SHELL Detection Coverage in THOR DevFeed: [PHP2SHELL Detection Coverage in THOR]() Original publisher: [Read original article]() Author: Nextron Threat Research Team Published: 2026-10-22T13:29:04Z Content type: article Language: en Sources: [Cyber Newsroom]() Topics: [Endpoint Security & XDR](), [Detection engineering](), [threat detection](), [Threat Research](), [Incident response]() Tags: [2026](), [alert](), [artifacts](), [coverage](), [cve](), [cve-2026-109618](), [cve-2026-109619](), [cve-2026-88771](), [detection](), [exploit](), [exploitation](), [logs](), [newsletter](), [nextron](), [php](), [php2shell](), [post-exploitation](), [research](), [rules](), [scan](), [security-monitoring](), [server-logs](), [sigma](), [thor](), [thor-cloud](), [thor-lite](), [vulnerabilities](), [web-server](), [yara]() ### AI overview THOR's PHP2SHELL coverage combines rules for exploit artifacts in web-server logs with existing Sigma detections for post-exploitation process activity and new PHP2SHELL-specific rules. Log or crash indicators may show an attempt without proving code execution; a malicious reverse shell launched by PHP is stronger evidence, and findings need context. Detection depends on the events and fields retained for scanning: standard Apache access logs omit Content-Type and Cookie headers, and THOR cannot recover unlogged or discarded request details or process events. The article also recommends continued PHP and distributor updates and deployment-specific mitigations, while warning that none blocks every variant and some trade off memory-exhaustion protection. Customers can access detections through preview signatures; those have passed automated checks but may produce additional false positives. Preserve relevant logs and correlate matches with process execution, connections, payloads, and persistence; no finding does not rule out compromise. ### Source excerpt PHP2SHELL Detection Coverage in THOR THOR applies Sigma rules to supported log data on an endpoint during a scan. For PHP2SHELL, this means looking for exploit-related artifacts in web-server logs and for recorded post-exploitation activ ... Read more Published Date: Oct 22, 2026 (1 day, 6 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-109619 CVE-2026-109618 CVE-2026-88772 CVE-2026-88771 CVE-2026-54121 ## Cisco Talos finds malware that puts its next move to a four-model vote DevFeed: [Cisco Talos finds malware that puts its next move to a four-model vote]() Original publisher: [Read original article]() Author: Duncan Riley Published: 2026-09-22T23:44:32Z Content type: news Language: en Sources: [SiliconANGLE]() Topics: [Malware](), [Threat Research](), [Artificial Intelligence](), [Cisco Talos](), [Windows](), [Go Language](), [Open Source]() Tags: [ai](), [artificial-intelligence](), [cairn](), [chrome](), [cisco](), [cisco-systems](), [cisco-talos](), [closedquorum](), [command-and-control](), [credential-theft](), [cybersecurity](), [deepseek](), [discord](), [edge](), [ethereum](), [exodus](), [firefox](), [github](), [go](), [google](), [google-gemini](), [malware](), [metamask](), [mistral](), [news](), [open-source](), [qwen](), [ryan-fetterman](), [security](), [the-latest](), [threat-intelligence](), [windows](), [yara]() ### AI overview Cisco Talos reported CLOSEDQUORUM, a Windows credential-stealing malware sample whose tactical decisions are chosen by votes among four commercial language models. The report also describes CAIRN, an open-source toolkit for identifying AI integration in malware from metadata. ### Source excerpt Cisco Systems Inc.'s Talos Threat Intelligence group today released an open-source toolkit for hunting malware that has artificial intelligence built into it. The first sample it has detailed is a Windows credential stealer that takes its orders from no command-and-control server. Talos calls it CLOSEDQUORUM, and its tactical decisions go to a vote among four [...] The post Cisco Talos finds malware that puts its next move to a four-model vote appeared first on SiliconANGLE. ## What's new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support DevFeed: [What's new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support]() Original publisher: [Read original article]() Author: Pedro Jaramillo,Roxana Gheorghe,Mia LaVada Published: 2026-07-31T00:00:00Z Content type: release Language: en Sources: [Elastic Security Labs]() Topics: [Security](), [Endpoint Security & XDR](), [Windows](), [Kernel](), [VirusTotal](), [ransomware](), [Arm]() Tags: [arm](), [endpoint-protection-security](), [endpoint-security](), [kernel](), [security](), [virustotal](), [what-s-new](), [yara]() ### AI overview Elastic Defend introduces more than 800 vulnerable-driver YARA rules generated from public sources, automated troubleshooting through Elastic Agent Builder, and Windows on ARM endpoint protection. The release targets BYOVD attacks that abuse signed drivers to gain kernel-level access and disable security defenses. ### Source excerpt Elastic Defend automatically generates and instantly deploys vulnerable driver YARA rules from VirusTotal, LOLDrivers and Microsoft's blocklist, closing the gap BYOVD attacks depend on. Plus a new troubleshooting skill and ARM endpoint protection. ## JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models DevFeed: [JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models]() Original publisher: [Read original article]() Author: Michael Clark Published: 2026-07-20T00:00:00Z Content type: article Language: en Sources: [Sysdig]() Topics: [ransomware](), [Threat Research](), [AI Infrastructure](), [AI Models](), [Cybercrime]() Tags: [agentic-ransomware](), [agentic-threat-actor](), [ai-infrastructure](), [ai-infrastructure-security](), [ai-model-recovery](), [ai-models](), [ai-pipeline-security](), [ai-ransomware](), [ata](), [cloud-attack](), [cloud-threat-detection](), [container-escape](), [cve-2025-3248](), [docker-socket-abuse](), [encforge](), [exploited](), [gguf](), [go](), [jadepuffer](), [langflow](), [llm-security](), [machine-learning-security](), [ml-ransomware](), [model-artifact-encryption](), [mysql](), [privileged-container](), [pytorch](), [ransomware](), [ransomware-detection](), [runtime-security](), [safetensors](), [sysdig-trt](), [threat-research](), [vector-database-security](), [yara]() ### AI overview Sysdig Threat Research reports that JADEPUFFER, an autonomous threat actor, upgraded its attack on Langflow-based AI infrastructure by deploying ENCFORGE, a Go ransomware payload designed to encrypt model checkpoints, vector databases, training datasets, and embedding indices. ### Source excerpt JADEPUFFER, the agentic threat actor documented by the Sysdig Threat Research Team, is now using ransomware to destroy trained AI models. ## Tricks and Treats: GHOSTPULSE's new pixel-level deception DevFeed: [Tricks and Treats: GHOSTPULSE's new pixel-level deception]() Original publisher: [Read original article]() Author: Salim Bitam Published: 2024-10-19T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [ransomware](), [Security](), [Social engineering](), [PowerShell](), [payload](), [JavaScript](), [Windows](), [Image](), [pixel]() Tags: [javascript](), [malware](), [malware-analysis](), [payload](), [pixel](), [pixels](), [powershell](), [security](), [social-engineering](), [windows](), [yara]() ### AI overview Elastic Security Labs analyzes an updated GHOSTPULSE malware technique that embeds encrypted configuration and payload data in image pixels rather than PNG IDAT chunks. The research also describes CAPTCHA-based social engineering that uses malicious JavaScript, Windows keyboard shortcuts, and PowerShell to initiate the infection chain, along with updated YARA rules and extraction tooling. ### Source excerpt The updated GHOSTPULSE malware has evolved to embed malicious data directly within pixel structures, making it harder to detect and requiring new analysis and detection techniques. ## Introducing pattern-based agentless malware detection using YARA rules DevFeed: [Introducing pattern-based agentless malware detection using YARA rules]() Original publisher: [Read original article]() Author: Shaked Rotlevi Published: 2024-07-31T14:13:57Z Content type: release Language: en Sources: [Wiz]() Topics: [Malware](), [Security](), [Threat Research](), [cloud-infrastructure]() Tags: [cloud-threat-intelligence](), [malware](), [malware-detection](), [product](), [research](), [security](), [threat-intelligence](), [yara]() ### AI overview Wiz is adding agentless, pattern-based malware detection using YARA rules to continuously scan cloud environments. The rules are designed to identify known and emerging malware variants across virtual machines, containers, serverless environments, buckets, and code repositories without requiring an agent. ### Source excerpt Wiz is expanding our existing detection capabilities to include pattern-based malware detection using YARA rules written by the Wiz Research team ## VulnCheck Initial Access Intelligence Update - May 2024 DevFeed: [VulnCheck Initial Access Intelligence Update - May 2024]() Original publisher: [Read original article]() Author: Patrick Garrity Published: 2024-06-07T00:00:00Z Content type: release Language: en Sources: [VulnCheck]() Topics: [Vulnerabilities](), [intelligence]() Tags: [artifacts](), [cves](), [detection](), [exploit](), [exploits](), [initial-access](), [intelligence](), [products](), [rce](), [remote-code-execution](), [rules](), [scanners](), [snort](), [vulncheck](), [yara]() ### AI overview In May 2024, VulnCheck developed Initial Access Intelligence artifacts for 20 CVEs across 16 vendors and 18 products. The described artifacts include exploits, version scanners, PCAPs, Suricata and Snort rules, YARA rules, and GreyNoise, Censys, and Shodan queries. The source presents them as detection resources for initial access vulnerabilities already being exploited or considered likely to be exploited soon. ### Source excerpt In May 2024, we developed new Initial Access Intelligence (IAI) artifacts for 20 CVEs, covering 16 different vendors and 18 different products. ## Globally distributed stealers DevFeed: [Globally distributed stealers]() Original publisher: [Read original article]() Author: Salim Bitam,Daniel Stepanic,Terrance DeJesus,Samir Bousseaden Published: 2024-05-24T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [Malware](), [telemetry](), [observability](), [Security Information and Event Management (SIEM)](), [Windows]() Tags: [analysis](), [article](), [defense-in-depth](), [detection](), [malware](), [malware-analysis](), [telemetry](), [windows](), [windows-malware](), [yara]() ### AI overview An analysis of major Windows malware stealer families, including their operating methods, updates, configurations, prevalence, and distribution. The article uses telemetry data and discusses defense-in-depth measures, ES|QL hunting queries, and YARA rules for detection. ### Source excerpt This article describes our analysis of the top malware stealer families, unveiling their operation methodologies, recent updates, and configurations. By understanding the modus operandi of each family, we better comprehend the magnitude of their impact and can fortify our defences accordingly. ## 500ms to midnight: XZ A.K.A. liblzma backdoor DevFeed: [500ms to midnight: XZ A.K.A. liblzma backdoor]() Original publisher: [Read original article]() Author: Samir Bousseaden,Mika Ayenson,Jake King Published: 2024-04-05T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [liblzma](), [Security](), [xz](), [open-source-security](), [Open Source](), [OpenSSH](), [Malware](), [Linux](), [Maintainers]() Tags: [analysis](), [backdoor](), [detection](), [intermittent-failures](), [latency](), [liblzma](), [linux](), [maintainers](), [malware-analysis](), [open-source](), [oss-security](), [process](), [security](), [security-labs](), [ssh](), [systems](), [target](), [testing](), [xz](), [yara]() ### AI overview Elastic Security Labs provides an initial analysis of the XZ/liblzma backdoor, describing how malicious code in XZ versions 5.6.0 and 5.6.1 could circumvent SSH authentication and execute code. The document also provides YARA rules, osquery queries, and KQL searches to help identify compromises. ### Source excerpt Elastic Security Labs is releasing an initial analysis of the XZ Utility backdoor, including YARA rules, osquery, and KQL searches to identify potential compromises. ## Huntress Warns of a Possible Compromise of AnyDesk's Code-Signing Certificate DevFeed: [Huntress Warns of a Possible Compromise of AnyDesk's Code-Signing Certificate]() Original publisher: [Read original article]() Author: John Hammond Published: 2024-02-02T00:00:00Z Content type: news Language: en Sources: [Huntress Blog]() Topics: [Cybersecurity](), [remote access](), [Security Attacks](), [Process]() Tags: [remote-access](), [remote-access-trojan](), [security](), [signing](), [threat-advisory](), [yara]() ### AI overview Huntress discusses reports that AnyDesk may have been compromised, based on an unexpected maintenance period and a changed code-signing certificate. The advisory recommends auditing AnyDesk use and other applications signed with the same certificate while the concern remains unconfirmed. ### Source excerpt Huntress is tracking concerns regarding the AnyDesk remote control software and provider. ## Elastic Security Labs discovers the LOBSHOT malware DevFeed: [Elastic Security Labs discovers the LOBSHOT malware]() Original publisher: [Read original article]() Author: Daniel Stepanic Published: 2023-05-16T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [Malware](), [Security](), [Cybercrime](), [infection chain](), [execution](), [modules](), [proofpoint](), [Google]() Tags: [cybercrime](), [detection](), [google](), [infection-chain](), [malware](), [malware-analysis](), [proofpoint](), [security](), [security-labs](), [yara]() ### AI overview Elastic Security Labs reports on LOBSHOT, a malware family that uses malvertising and hidden virtual network computing sessions to distribute backdoors disguised as legitimate software installers. The report describes its infection chain, behavior, and suspected financial motivations. ### Source excerpt Elastic Security Labs is naming a new malware family, LOBSHOT. LOBSHOT propagates and infiltrates targeted networks through Google Ads and hVNC sessions to deploy backdoors masquerading as legitimate application installers. ## QBOT Malware Analysis DevFeed: [QBOT Malware Analysis]() Original publisher: [Read original article]() Author: Cyril François Published: 2023-02-14T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [Malware](), [Security](), [Threat Research](), [C2](), [Reverse Engineering](), [execution](), [Persistence](), [Windows]() Tags: [c2](), [iocs](), [malware](), [malware-analysis](), [report](), [research](), [reverse-engineering](), [security](), [windows](), [yara]() ### AI overview Elastic Security Labs analyzes the QBOT/QAKBOT V4 banking trojan, tracing its execution from launch through installation and command-and-control communication. The research produces a YARA rule, a configuration extractor, and indicators of compromise. ### Source excerpt Elastic Security Labs releases a QBOT malware analysis report covering the execution chain. From this research, the team has produced a YARA rule, configuration-extractor, and indicators of compromises (IOCs). ## NETWIRE Dynamic Configuration Extraction DevFeed: [NETWIRE Dynamic Configuration Extraction]() Original publisher: [Read original article]() Author: Seth Goodwin,Salim Bitam Published: 2023-01-30T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [Malware](), [Security](), [Encryption](), [Tool](), [Assembly](), [Code](), [.env]() Tags: [assembly](), [decrypt](), [encryption](), [integrations-tools](), [malware](), [rat](), [reversing](), [security](), [security-labs](), [tool](), [trojan](), [yara]() ### AI overview Elastic Security Labs examines the NETWIRE remote access trojan and releases a tool for dynamically extracting its encrypted configuration from files and memory dumps. The article describes the malware's RC4-protected configuration, relevant functions and assembly patterns, and YARA rules for locating keys and encrypted values. ### Source excerpt Elastic Security Labs discusses the NETWIRE trojan and is releasing a tool to dynamically extract configuration files. ## CUBA Ransomware Campaign Analysis DevFeed: [CUBA Ransomware Campaign Analysis]() Original publisher: [Read original article]() Author: Daniel Stepanic,Derek Ditch,Seth Goodwin,Salim Bitam,Andrew Pease Published: 2022-09-08T00:00:00Z Content type: article Language: en Sources: [Elastic Security Labs]() Topics: [ransomware](), [Malware](), [Security](), [Threat Research](), [Cybercrime](), [Exploit](), [Vulnerabilities](), [remote access](), [data]() Tags: [analysis](), [cryptocurrency](), [data-exfiltration](), [deployment](), [exfiltration](), [exploit](), [exploits](), [lateral-movement](), [leveraging](), [malware](), [malware-analysis](), [network](), [offensive-security](), [ransomware](), [remote-access](), [security](), [security-tools](), [threat-intelligence](), [vulnerabilities](), [vulnerability](), [yara]() ### AI overview Elastic Security analyzes a CUBA ransomware and extortion campaign targeting retailers and manufacturers. The campaign involves data exfiltration, lateral movement, ransomware deployment, and cryptocurrency demands; the article also provides a YARA signature and hunting queries for detection. ### Source excerpt Elastic Security observed a ransomware and extortion campaign leveraging a combination of offensive security tools, LOLBAS, and exploits to deliver the CUBA ransomware malware.