valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-07 10:28:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
387 Commits 2 Branches 1 Tag 33 MiB
2444eb6d8f
Commit Graph

292 Commits

Author SHA1 Message Date
Florian Roth
859a183bfa TeleDoor YARA Signature 2017-07-05 13:34:41 -06:00
Florian Roth
ca2c820f5c Powershell in Word Doc 2017-07-01 14:35:23 +02:00
Florian Roth
366b9095fe Malware / Bot / Andromeda Jun 17 2017-07-01 14:35:09 +02:00
Florian Roth
77299ec82d Added hashes to rule 2017-06-28 08:34:56 +02:00
Florian Roth
6a256ba5c6 NotPetya Rule Update 2017-06-28 08:27:18 +02:00
Florian Roth
0d1125be4d Yet another name refresh 2017-06-27 20:53:31 +02:00
Florian Roth
d2cb411ddc NoPetya renamed 2017-06-27 20:37:21 +02:00
Florian Roth
f422b95ce3 NoPetya Ransomware 2017-06-27 20:35:25 +02:00
Florian Roth
61ce0b2d8f Petya Ransomware 2017-06-27 17:42:57 +02:00
Florian Roth
701e306eb6 Reflective loader rule 2017-06-26 14:30:35 +02:00
Florian Roth
32a08da312 Bugfix in web shell rule 2017-06-26 14:18:30 +02:00
Florian Roth
203df010da Wordpress Webshell 2017-06-26 08:07:29 +02:00
Florian Roth
e39ad5b411 Waterbear Malware 2017-06-24 08:53:52 +02:00
Florian Roth
7016ebb6ac PowerShell Obfuscation - 1st rule for LOKI 2017-06-23 11:29:56 +02:00
Florian Roth
0f08853291 Crime CN Group BTC Miner and Ammyy Admin 2017-06-23 08:18:41 +02:00
Florian Roth
59a7d00307 Reference in HTA anomaly rules 2017-06-21 17:03:06 +02:00
Florian Roth
d5892fdbc6 HTA File Anomalies 2017-06-21 15:56:24 +02:00
Florian Roth
33c2a7fcc8 New Mimikatz Strings Rule 2017-06-21 15:56:06 +02:00
Florian Roth
91862d2006 False positive with KAV 2017-06-17 10:53:32 +02:00
Florian Roth
78c49917db Invoke-TheHash 2017-06-14 21:46:43 +02:00
Florian Roth
024e26df96 Hidden Cobra IOCs and YARA Sigs 2017-06-14 09:16:23 +02:00
Florian Roth
9e830da305 Industroyer YARA Sigs 2017-06-14 09:05:54 +02:00
Florian Roth
b08898cbb2 Crash Override YARA Sigs 
https://t.co/h8QaIP4FU8
 2017-06-12 19:49:08 +02:00
Florian Roth
32ec315e97 False Positive Reduction 2017-06-08 17:08:04 +02:00
Florian Roth
054a4f3061 Generic Credential Stealer 2017-06-07 16:21:24 +02:00
Florian Roth
0082d91da8 APT 19 - FireEye report 
https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html
 2017-06-07 16:20:34 +02:00
Florian Roth
f4c725bb84 False Positive Reduction 2017-06-07 09:18:52 +02:00
Florian Roth
346b903485 Removed hacktoolset from rules 2017-06-06 23:21:29 +02:00
Florian Roth
ba81dfbebf False Positive Reduction 2017-06-06 09:16:02 +02:00
Florian Roth
890c6f122b FireEye - EternalBlue Non-Wannacry attack 
https://www.fireeye.com/blog/threat-research/2017/05/threat-actors-leverage-eternalblue-exploit-to-deliver-non-wannacry-payloads.html
 2017-06-04 17:00:14 +02:00
Florian Roth
8e5c129124 Renamed Rule 2017-06-03 14:36:07 +02:00
Florian Roth
d80a434473 Fireball Malware 2017-06-03 14:34:20 +02:00
Florian Roth
e0bb3b902e TA459 Malware 2017-06-01 19:46:36 +02:00
Florian Roth
fc807db9ce False Positives 2017-05-25 11:36:50 +02:00
Florian Roth
fec50df702 False Positives 2017-05-22 16:46:08 +02:00
Florian Roth
d8956eabe8 False Positives 2017-05-20 10:18:37 +02:00
Florian Roth
27ca4a3c23 EternalRocks 2017-05-18 08:51:29 +02:00
Florian Roth
9359eee461 Kaspersky's lazaruswannacry rule 2017-05-15 23:24:22 +02:00
Florian Roth
e65845f278 Malware Dropper - DOCM in PDF 2017-05-15 19:36:58 +02:00
Florian Roth
6b66ad72b8 Updated WannCry Ransomware Rule 2017-05-15 19:36:40 +02:00
Florian Roth
b519e7cc51 WannaCry - New Generic Rule 2017-05-14 16:13:18 +02:00
Florian Roth
629337be4e Update on WannaCry Rules 2017-05-13 19:30:36 +02:00
Florian Roth
a8a3ec5348 Update on WannaCry Rules 2017-05-13 19:27:58 +02:00
Florian Roth
e785dcc509 Added WannaCry string for ZIP password 2017-05-13 11:27:40 +02:00
Florian Roth
3ce5d5a213 WannaCry YARA Rules 2017-05-13 10:05:08 +02:00
Florian Roth
4b9d80d4bd Mirai Malware Update 2017-05-12 16:49:51 +02:00
Florian Roth
cbb45ab017 FP Hash DA5EE020BEF41DC95C3532CBAA1EA8F4 2017-05-12 15:48:50 +02:00
Florian Roth
b43cf3b185 Rule cleanup 2017-05-11 13:34:28 +02:00
Florian Roth
7522ec6f7e Impacket Generic Rule FPs 2017-05-05 15:13:57 +02:00
Florian Roth
dd145e731a ISMRAT 2017-05-04 12:22:58 +02:00
Florian Roth
0208aef709 Update on Snake/Turla - Shell scripts 2017-05-04 11:55:50 +02:00
Florian Roth
00b8270b65 Snake/Turla, FIN7, Kazuar 2017-05-04 11:28:03 +02:00
Florian Roth
66668ca36b Enigma protected malware 2017-05-03 09:02:08 +02:00
Florian Roth
1365a6016b EquationGroup FP 2017-05-03 09:01:57 +02:00
Florian Roth
adc742e6c3 US CERT Alert TA17-117A https://goo.gl/fZhL9H 2017-04-28 11:14:52 +02:00
Florian Roth
69c85e8d9f False Positives 2017-04-28 10:32:36 +02:00
Florian Roth
225d917432 New rules for obfuscated samples 2017-04-22 13:54:08 +02:00
Florian Roth
7081f9926f Updated DeepPanda rule 2017-04-22 13:53:46 +02:00
Florian Roth
9ef6409535 Removed Dumpel (Resource Kit Win 2000) False Positive 2017-04-19 13:55:49 +02:00
Florian Roth
addeab74bb meta data hash identifier fixed, scanner output rule 2017-04-17 16:49:04 +02:00
Florian Roth
cfebd5ea39 New Equation Group Signatures 2017-04-17 11:18:41 +02:00
Florian Roth
f9d0882a35 Remove byte chain that is slowing down scanning 2017-04-13 09:52:27 +02:00
Florian Roth
b496ed91a6 Changed OLE2Link signature 2017-04-12 19:11:36 +02:00
Florian Roth
2245f5d7cb Renamed - Crime > Exploit 2017-04-12 15:52:06 +02:00
Florian Roth
a431674976 OLE2Link Update with NVISIO rule 2017-04-12 15:50:29 +02:00
Florian Roth
629afa0835 RFT OLE2Link Exploit 2017-04-12 11:25:22 +02:00
Florian Roth
46568f0d03 Removed rule prone to false positives 2017-04-10 13:02:20 +02:00
Florian Roth
a9fc876114 False positive comment in EQGRP rules 2017-04-10 00:07:13 +02:00
Florian Roth
2592ea04b4 Equation Group Tools 2017-04-09 23:31:32 +02:00
Florian Roth
efe01ca941 Compiled Impacket Tools 2017-04-08 12:58:04 +02:00
Florian Roth
a0b8a9039e Floxif Malware 2017-04-08 12:57:47 +02:00
Florian Roth
70dc674fc7 Improved Cloud Hopper Malware Sigs 2017-04-08 12:57:20 +02:00
Florian Roth
997da192a8 Quasar RAT 2017-04-07 20:41:00 +02:00
Jonas Lejon
716be0088c C2 hosts/strings for APT10 / Cloud Hopper 2017-04-07 09:32:42 +02:00
Florian Roth
b1bb790655 ROKRAT 2017-04-05 11:23:44 +02:00
Florian Roth
68c999de89 Operation Cloud Hopper 2017-04-05 11:23:31 +02:00
Florian Roth
1c4c8df573 APT Moonlight Maze 2017-04-03 21:33:07 +02:00
Florian Roth
6316b06a35 Removed other rules from this set 2017-04-03 09:39:35 +02:00
Florian Roth
2815d65738 Mimipenguin 2017-04-01 11:56:35 +02:00
Florian Roth
3d505b74b3 Carbon - Turla - rules by ESET 2017-04-01 11:56:20 +02:00
Florian Roth
c1af41f3f9 False Positives 
https://github.com/Neo23x0/signature-base/issues/7
 2017-03-28 08:32:20 +02:00
Florian Roth
a5be8e42f6 Osiris Device Guard Bypass 2017-03-27 09:39:43 +02:00
Florian Roth
46444066a6 WMI Implant PowerShell 2017-03-24 17:33:26 +01:00
Florian Roth
8734ab6680 Javascript obfuscated PowerShell (droppers) 2017-03-24 14:52:26 +01:00
Florian Roth
f90da1ff10 WPR and BeyondExec 2017-03-17 16:08:44 +01:00
Florian Roth
f39f51d234 Suspicious PowerShell Invocation 2017-03-12 17:06:18 +01:00
Florian Roth
9f96ed873e Bugfix - non OpenSSL binaries 2017-03-09 18:09:15 +01:00
Florian Roth
8c0de6120e Removed False Positives 2017-03-07 21:09:38 +01:00
Florian Roth
b73d07558a Tiny JSP Webshell YARA Rule 2017-03-07 11:24:48 +01:00
Florian Roth
48a8a94196 StoneDrill Threat: YARA rules and filename IOCs 2017-03-07 11:24:27 +01:00
Florian Roth
8bf466a9ac Kriskynote Malware 2017-03-04 14:38:35 +01:00
Florian Roth
ea2c46df32 Derusbi Samples 2017-03-04 14:38:20 +01:00
Florian Roth
db4465f417 New Simple PHP Webshell 2017-03-04 14:36:07 +01:00
Florian Roth
c64d284911 ChChes - Ham / Tofu Backdoors by Cylance 2017-02-28 14:05:19 +01:00
Florian Roth
a564860d0a PowerShell Rule Bugfix 2017-02-23 17:42:26 +01:00
Florian Roth
8dc9ba46d5 Suspicious PowerShell Code 2017-02-23 17:13:04 +01:00
Florian Roth
a4544d7c2a Op Magic Hound YARA Signatures 
http://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/
 2017-02-17 15:48:58 +01:00
Florian Roth
72f3c49d99 False positives with AV software DLLs (ESET) 2017-02-17 15:48:21 +01:00
Florian Roth
7d5227d20f Removed WebShell_Generic_PHP_5 prone to false positives 2017-02-16 19:41:26 +01:00
Florian Roth
2cd4d7b422 Deactivated False Positives in Grizzly Steppe Rules - US CERT 2017-02-12 18:26:02 +01:00