diff --git a/yara/md5.md b/yara/md5.md
new file mode 100644
index 0000000..62eb517
--- /dev/null
+++ b/yara/md5.md
@@ -0,0 +1,3 @@
+006c4a5950f75c2c9049cda1a62c09a0	MD5 hash	Web shell (iisstart.aspx) used by BRONZE SILHOUETTE
+af3a81605aa8e29c8be9e91d2ce19fc1	MD5 hash	Base64-encoded web shell (ntuser.ini) used by BRONZE SILHOUETTE
+670545a24a2ce2ac7a0e863790bfe2e1	MD5 hash	Java web shell (AuditReport.jspx) used by BRONZE SILHOUETTE
\ No newline at end of file