valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 10:05:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

docs: side note

Browse Source
This commit is contained in:
Florian Roth 2021-05-29 14:48:58 +02:00
parent 908bf1a091
commit 9ff984dd47
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
yara/apt_apt29_nobelium_may21.yar
View File

@ -48,6 +48,7 @@ rule APT_APT28_Win_FreshFire : APT29 {
Mostly based on MSTICs report
https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/
Not shared publicly: rules for CobaltStrike loader samples, ISOs, specifc msiexec method found in some samples
only available in THOR and VALHALLA
*/
rule APT_APT29_NOBELIUM_JS_EnvyScout_May21_1 {