valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 10:05:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: FPs

Browse Source
This commit is contained in:
Florian Roth 2021-03-10 19:04:47 +01:00
parent ceef742cdb
commit acf101377f
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
iocs/filename-iocs.txt
View File

@ -3070,7 +3070,7 @@ ystem32\\uploadmgr\.dat;80
\\\.oracleServices\\svshost_serv\.exe;100
# NTDS.DIT in uncommon location https://blog.stealthbits.com/extracting-password-hashes-from-the-ntds-dit-file/
[^s2S]\\ntds.dit;60
[^s2S]\\ntds.dit;60;WinSxS
# MAL HWP Incident Feb 19 https://sfkino.tistory.com/73
\\Local\\Temp\\HimTray\.dll;75

2
yara/gen_url_persitence.yar
View File

@ -129,6 +129,7 @@ rule Methodology_Contains_Shortcut_OtherURIhandlers
and filesize < 30KB
}
/*
rule Methodology_Suspicious_Shortcut_IconShenanigans_dotDL
{
meta:
@ -147,6 +148,7 @@ rule Methodology_Suspicious_Shortcut_IconShenanigans_dotDL
and uint16(0) != 0x5A4D and uint32(0) != 0x464c457f and uint32(0) != 0xBEBAFECA and uint32(0) != 0xFEEDFACE and uint32(0) != 0xFEEDFACF and uint32(0) != 0xCEFAEDFE
and filesize < 30KB
}
*/
rule Methodology_Suspicious_Shortcut_IconNotFromExeOrDLLOrICO
{