592 Commits

Author	SHA1	Message	Date
Florian Roth	265ad6fba8	Suspicious LNK files	2018-09-19 08:51:23 +02:00
Florian Roth	9412f650d8	Fix: tightened the SFX rule	2018-09-17 08:27:58 +02:00
Florian Roth	954bb96328	Anomaly: SFX with Microsoft Copyright	2018-09-17 08:21:16 +02:00
Florian Roth	f2984271d4	Generic rule: Suspicious office dropper strings	2018-09-14 00:24:44 +02:00
Florian Roth	3efa3f9648	BlackBone Driver Injector	2018-09-11 13:34:44 +02:00
Florian Roth	eed7fcdf4c	False Positive Reduction	2018-09-11 13:34:14 +02:00
Florian Roth	1d3baf823b	Fixed error in RC4 keys list	2018-08-26 20:16:40 +02:00
Florian Roth	7c8745c59e	License notice on my own rules, removed rules with unclear/problematic licensing	2018-08-26 12:48:01 +02:00
Florian Roth	3281e6dc72	APT Lazarus Operation Applejeus YARA rules	2018-08-26 12:48:01 +02:00
Florian Roth	3fb661511c	Modified mimikatz rule to exclude low performing expr	2018-08-26 12:48:01 +02:00
Florian Roth	4a1deff33c	DriveCrypt exploits	2018-08-22 11:10:00 +02:00
Florian Roth	8ddab9bd5a	False Positive Reduction https://github.com/Neo23x0/signature-base/issues/42	2018-08-22 11:09:39 +02:00
Florian Roth	5d4ed2203d	fix: fixed typo in rule name	2018-08-21 11:09:06 +02:00
Florian Roth	e3d60d7899	Metasploit Framework UA	2018-08-21 10:59:12 +02:00
Florian Roth	a30f16f056	False Positive Reduction	2018-08-21 10:58:45 +02:00
Florian Roth	9020d1f005	More HiddenCobra rules ... https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/	2018-08-13 16:27:03 +02:00
Florian Roth	1ee9142dc5	Improved certificate payload rule	2018-08-02 15:47:42 +02:00
Florian Roth	62400d7324	fix: missing import "pe" statement	2018-08-02 12:20:24 +02:00
Florian Roth	5141e33893	YARA rules for sample in FireEye's FIN7 report ... https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html	2018-08-02 12:15:01 +02:00
Florian Roth	1ba9e9f57f	DarkHydrus YARA rules	2018-08-02 11:51:03 +02:00
Florian Roth	3e9a1a5579	Certificate Payloads	2018-08-02 11:50:29 +02:00
Florian Roth	9bdccc2360	Hacktools: BeRoot, PDF Embedded Mal Code	2018-07-27 13:25:10 +02:00
Florian Roth	0cd91f3afe	FancyBear MacOS Agent	2018-07-16 11:44:59 -06:00
Florian Roth	1bea712d70	False Positive Reduction	2018-07-16 11:44:41 -06:00
Florian Roth	24a899602e	fix: Added missing import statement for "pe" module	2018-07-14 08:06:35 -06:00
Florian Roth	af76f26aa3	Big Bang report by Check Point ... https://research.checkpoint.com/apt-attack-middle-east-big-bang/	2018-07-14 07:58:52 -06:00
Florian Roth	e6d6825c94	Monero miner update	2018-07-06 16:07:00 -06:00
Florian Roth	c2634bfa23	APT Rancor ... https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/	2018-06-27 07:57:03 +02:00
Florian Roth	4122386cba	Limited Cloud Hopper Rule	2018-06-25 10:57:21 +02:00
Florian Roth	93f62d8300	Hacktool PowerSploit Dropper	2018-06-24 22:44:28 +02:00
Florian Roth	5f87e74c00	Tick Weaponized USB	2018-06-24 22:44:11 +02:00
Florian Roth	1c41cd5d16	APT Thrip ... https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets	2018-06-22 00:01:47 +02:00
Florian Roth	04a5426a14	Minor changes and adjustments	2018-06-22 00:00:14 +02:00
Florian Roth	c835b3a58c	PLEAD Downloader	2018-06-16 17:40:31 +02:00
Florian Roth	3b25bd8a05	AR18-165 YARA rules	2018-06-16 17:40:18 +02:00
Florian Roth	e53539d7e4	Turla Agent.BTZ	2018-06-16 17:39:25 +02:00
Florian Roth	edfdb48bdc	Score adjusted	2018-06-13 13:37:06 +02:00
Florian Roth	6dd31e254c	New MuddyWater signature	2018-06-13 13:34:58 +02:00
Florian Roth	4a4a94fc9c	Rules prone to false positives on process memory to "file" only	2018-06-13 08:30:02 +02:00
Florian Roth	c42709fe0d	BluenoroffPoS DLL ... http://blog.trex.re.kr/	2018-06-08 21:12:24 +02:00
Florian Roth	be2315b3cf	False Positive Reduction	2018-06-08 21:11:39 +02:00
Florian Roth	8f48aa959b	APT Lazarus RAT & Dropper ... https://twitter.com/DrunkBinary/status/1002587521073721346	2018-06-03 00:28:59 +02:00
Florian Roth	55aa4639d2	TA18-149A YARA signatures ... https://www.us-cert.gov/ncas/alerts/TA18-149A	2018-06-01 09:25:27 +02:00
Florian Roth	077384492c	Updated BadPDF rule	2018-05-29 14:22:41 +02:00
Florian Roth	3596fea85a	False Positive Reduction	2018-05-24 16:12:52 +02:00
Florian Roth	c9296e7ca8	VPNFilter YARA rules	2018-05-24 16:12:37 +02:00
Florian Roth	ee986a7e7b	Bugfix - missing "pe"	2018-05-20 19:41:00 +02:00
Florian Roth	9f3067d594	Floxif / FlyStudio malware	2018-05-20 18:49:45 +02:00
Florian Roth	0838bfff7d	Hacktool ShellPop shells	2018-05-20 18:49:45 +02:00
Florian Roth	ae1bd7b7ea	Suspicious LNK file with path traversal like relative path	2018-05-20 18:49:45 +02:00