valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-07 02:25:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
65 Commits 2 Branches 1 Tag 33 MiB
21cb4b1a45
Commit Graph

65 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Florian Roth
21cb4b1a45 PlugX Rules for Sample Set June 2016 2016-06-08 20:54:12 +02:00
Florian Roth
3b0ad587a7 Minor Changes to YARA Rules 2016-06-08 11:28:42 +02:00
Florian Roth
16de1a3b72 OTX Update 
- Removed some Sofacy C2 False Positives
 2016-06-08 11:28:22 +02:00
Florian Roth
f6c188143d Merge branch 'master' of https://github.com/Neo23x0/signature-base 2016-06-04 17:39:00 +02:00
Florian Roth
bfdf1bba60 FireEye IronGate APT Yara Rules & File Name IOCs 2016-06-04 17:32:21 +02:00
Florian Roth
b6afdd9631 FireEye IronGate APT File Name IOCs 2016-06-04 17:16:55 +02:00
Florian Roth
0787a28332 FireEye IronGate APT Yara Rules 2016-06-04 17:07:54 +02:00
Florian Roth
dfb6a2b964 Signature Update 2016-06-04 17:07:38 +02:00
Florian Roth
b302b84740 Danti and SVCMONDR Malware Rules 
PWC Report
http://pwc.blogs.com/cyber_security_updates/2016/05/exploring-cve-2015-2
545-and-its-users.html
Kaspersky Blog Post
https://securelist.com/analysis/publications/74828/cve-2015-2545-overvie
w-of-current-threats/
 2016-05-25 16:14:11 -06:00
Florian Roth
902f434811 RUAG APT Case YARA Signatures 
- Signatures based on descriptions in report > not the actual samples
 2016-05-24 07:29:20 -06:00
Florian Roth
8ac0ec1535 Kerberoast 2016-05-24 07:28:42 -06:00
Florian Roth
b95e46c943 No Powershell 2016-05-24 07:28:29 -06:00
Florian Roth
8ae745cf49 ESET: Operation Groundbait, Prikormka malware 2016-05-18 09:34:49 -06:00
Florian Roth
8125a96e68 dnscat2 hacktool 2016-05-18 09:34:18 -06:00
Florian Roth
99a0bada53 Signature Update 
- New PoisonIvy Rule
- ONHAT proxy tool (htran like)
- BeepService APT group hack tool
- Sofacy Adjustments
 2016-05-13 06:06:18 -06:00
Florian Roth
358f4efd8e OTX Hash IOCs 2016-04-27 13:38:08 +02:00
Florian Roth
f6dcff1e51 False Positive Reduction 2016-04-27 13:37:54 +02:00
Florian Roth
ece1450481 Gh0st Dragon RAT 2016-04-27 13:36:53 +02:00
Florian Roth
2f6f765ca9 Microsoft Platinum YARA Rules 2016-04-27 13:36:39 +02:00
Florian Roth
f3fd2022d8 False Positive Reduction 2016-04-27 13:36:17 +02:00
Florian Roth
728ff9d6f3 File Type Signature Update 
- lowercase XML
 2016-04-26 10:08:37 +02:00
Florian Roth
c7d168f5f9 Regsvr32 issue signature 2016-04-26 10:05:17 +02:00
Florian Roth
e3f04a6e71 False Positive Fixes 2016-04-26 10:04:19 +02:00
Florian Roth
b1a5fb6b18 Nano core Rule 
Adjusted Nanocore Rule
 2016-04-25 10:26:46 +02:00
Florian Roth
5533cfb5ab Updated Nanocore Rules 
- Removed Base64 encoded EXE string
 2016-04-24 21:13:18 +02:00
Florian Roth
be8609a15c Adjusted Nanocore Rule 
- false positives with certain IRC DLL
 2016-04-22 17:43:58 +02:00
Florian Roth
83d080688e Nanocore RAT 2016-04-22 17:04:04 +02:00
Florian Roth
0ccd098b6a Removed Anti-Analysis RTF Rule 2016-04-21 13:31:29 +02:00
Florian Roth
7026b52f6b Adjusted SLServer Rule 2016-04-21 11:03:55 +02:00
Florian Roth
44baaa5fe6 APT Between Hong-Kong and Burma Rules 2016-04-21 10:32:31 +02:00
Florian Roth
16a2ab9c0c Metasploit Loader by RSMudge 2016-04-21 10:31:41 +02:00
Florian Roth
e5c22901fe Signature Update 
- RTF Anti Analysis Tricks
 2016-04-20 09:28:13 +02:00
Florian Roth
9151ffd103 Signature Updates 
- Four Element Sword
- THOR inverse matching utilman.exe
- CN Webshell rule cosmetics
 2016-04-20 09:26:09 +02:00
Florian Roth
fa93e8eec1 Typo in comment 2016-04-13 01:04:53 +02:00
Florian Roth
9429919561 Fixed indentation 2016-04-13 00:55:43 +02:00
Florian Roth
fd38e39b7d Mimikatz Rule - apply to memory too 2016-04-13 00:52:06 +02:00
Florian Roth
aad907f7ee RTF Anti-Analysis 
http://decalage.info/rtf_tricks
 2016-04-13 00:51:44 +02:00
Florian Roth
62f3edda9f False Positives with Common File Sizes 2016-04-13 00:51:08 +02:00
Florian Roth
65bb44d764 APT6 Malware Signature 2016-04-09 12:55:32 +02:00
Florian Roth
dd4cb5d8a9 Linux Postscanner Shark 
- Replaced older hack tool rule that matched also on goodware
 2016-04-02 02:06:19 +02:00
Florian Roth
b632c0ddde Signature Update 
- Project M APT malware
- TempRacer Priv Esc Tool
- Winshells
 2016-04-01 16:51:30 +02:00
Florian Roth
26c66878b6 Petya Ransomware 2016-03-25 00:29:51 +01:00
Florian Roth
c820d24d95 OTX Update 2016-03-23 14:30:36 +01:00
Florian Roth
faed52d107 Merge pull request #1 from TKCERT/devel 
Decomposition of $hex_api_call in lsadump rule for Yara compatibility reasons
 2016-03-23 10:43:58 +01:00
Thomas Patzke
4f503dcb92 Decomposition of $hex_api_call in lsadump rule for Yara compatibility reasons 2016-03-23 10:29:05 +01:00
Florian Roth
7b2101bde0 False Positive with old mstsc 2016-03-23 10:05:57 +01:00
Florian Roth
681ed2c3f5 New OTX IOCs 2016-03-09 19:46:59 +01:00
Florian Roth
838cdbe318 Bugfix PSAttack Rule 2016-03-09 14:06:18 +01:00
Florian Roth
4d200832eb PSAttack Signature 2016-03-09 14:05:06 +01:00
Florian Roth
085572e77f New Signatures 2016-03-09 13:40:49 +01:00