https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/

Create APT_DPRK_ROKRAT.yar

Rules from https://www.carbonblack.com/2018/02/27/threat-analysis-rokrat-malware/

Create Android_Tempting_Cedar_Spyware.yar

see reference for hashes

Create MALW_Monero_Miner_installer.yar

Update RANSOM_MS17-010_Wannacrypt.yar

Update RANSOM_Petya_MS17_010

Create Android_Polish_Bankbot.yar

Add Turla neuron2 from NCSC report

Create CVE-2018-4878.yar

https://www.cert.pl/en/news/single/analysis-of-a-polish-bankbot/

adding rule from https://blueliv.com/petya-ransomware-cyber-attack-is-spreading-across-the-globe-part-2/

rules from https://blueliv.com/wannacrypt-malware-analysis/

https://www.alienvault.com/blogs/labs-research/a-north-korean-monero-cryptocurrency-miner

Create RAT_CrossRAT.yar

Created new ELF malware rules: MALW_Rebirth_Vulcan_ELF.yar to generic detects its variants.

Pullreq on MALW_Httpsd_ELF.yar, MALW_Mirai_Okiru_ELF.yar and MALW_Mirai_Satori_ELF.yar

Update Email_generic_phishing

Add rule to detect Agent Tesla information stealer malware

Create TOOLKIT_powerstager.yar

Create CVE-2017-11882.yar