617 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Florian Roth	7d90aa1737	APT34 rules ... https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html	2017-12-08 12:19:27 +01:00
Florian Roth	14137908cc	False Positive Reduction	2017-12-07 15:23:59 +01:00
Florian Roth	ba3802d816	Universal exploit strings	2017-12-06 22:38:09 +01:00
Florian Roth	80c5113b02	Suspicious JS content	2017-12-06 22:37:57 +01:00
Florian Roth	41e0956fdc	Remote Admin - tool	2017-12-06 22:37:40 +01:00
Florian Roth	2c1e768adc	Charming Kitten Hash IOCs	2017-12-06 22:37:12 +01:00
Florian Roth	4c893df291	Carbanak Hash IOCs	2017-12-06 22:37:01 +01:00
Florian Roth	f34bf9d9c8	Reduced false positives with PowerShell casing anomaly rule	2017-11-30 15:13:36 +01:00
Florian Roth	2f9ac3fe8f	UBoatRAT ... https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/	2017-11-30 15:13:21 +01:00
Florian Roth	500e6c2da2	ROKRAT Update ... http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html	2017-11-29 16:04:36 +01:00
Florian Roth	beb91736c3	Improved CVE 2017 8759 rule	2017-11-28 10:56:48 +01:00
Florian Roth	eaf9756bc9	Greenbug Malware	2017-11-27 16:55:43 +01:00
Florian Roth	7a9d7b9abd	APT Turla Neuron	2017-11-25 00:40:07 +01:00
Florian Roth	dc521f581d	Fixed OilRig rule - missing pe module	2017-11-24 13:06:18 +01:00
Florian Roth	864ca6c808	Put the threat intel receivers under the Apache License	2017-11-23 22:04:51 +01:00
Florian Roth	10607e7268	Updated Hash IOCs	2017-11-23 21:48:56 +01:00
Florian Roth	a6383df158	CVE-2017-11882 by John Davison	2017-11-23 20:33:58 +01:00
Florian Roth	f8f8193249	Typo in ALFA shell rule	2017-11-22 18:15:00 +01:00
Florian Roth	15cbfd9048	New OilRig signature ... https://twitter.com/ClearskySec/status/933280188733018113	2017-11-22 18:14:50 +01:00
Florian Roth	f11f0b27c1	Malicious lnk file rule	2017-11-22 16:46:31 +01:00
Florian Roth	8515a0b301	Improved description and added note for known false positives	2017-11-22 13:42:44 +01:00
Florian Roth	30610ff120	Webshell FOPO Obfuscation	2017-11-18 20:04:29 +01:00
Florian Roth	6943c01fc2	Alert (TA17-318B) HIDDEN COBRA – Volgmer ... https://www.us-cert.gov/ncas/alerts/TA17-318B	2017-11-15 21:45:49 +01:00
Florian Roth	b7621bcb99	Alert (TA17-318A) HIDDEN COBRA – FALLCHILL ... https://www.us-cert.gov/ncas/alerts/TA17-318A	2017-11-15 21:45:10 +01:00
Florian Roth	c0ab6f8453	False Positives	2017-11-12 18:35:04 +01:00
Florian Roth	b187609d40	Reaver and SunOrcal malware ... https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/	2017-11-12 15:13:38 +01:00
Florian Roth	55868b5eff	False Positive Reduction	2017-11-08 18:39:40 +01:00
Florian Roth	5bd15e9651	Bronze Butler Daserf malware	2017-11-08 12:52:38 +01:00
Florian Roth	3795d702b3	CrunchRAT ... https://github.com/t3ntman/CrunchRAT	2017-11-04 01:57:05 +01:00
Florian Roth	be700a3c42	PowerShell Obfuscated Invoke - PE Loader	2017-11-03 08:28:52 +01:00
Florian Roth	b6522edf1f	KeyBoys malware ... http://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html	2017-11-03 08:28:16 +01:00
Florian Roth	b08dc91116	OTX IOCs Update Nov 17	2017-11-02 09:08:22 +01:00
Florian Roth	f33f0140eb	Silence malware ... https://securelist.com/the-silence/83009/	2017-11-02 09:07:58 +01:00
Florian Roth	6d85ad4e2e	Missing "pe" module import in Kasper rule	2017-10-31 12:11:27 +01:00
Florian Roth	1e22089eee	Missing "pe" module import in APT28 rule	2017-10-31 11:29:48 +01:00
Florian Roth	8ffdc4c43c	Kasper malware update	2017-10-31 10:44:39 +01:00
Florian Roth	49ce0546e9	APT Sofacy Hospitality report malware by CSECybsec ... http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf	2017-10-31 10:44:17 +01:00
Florian Roth	c83cf1a6ed	Improved DDE in Office documents rules by NVISO Labs	2017-10-25 23:44:30 +02:00
Florian Roth	85c8608499	False Positive Reduction	2017-10-25 23:43:56 +02:00
Florian Roth	957ac24585	BadRabbit ransomware	2017-10-25 08:57:00 +02:00
Florian Roth	04825e634c	Sofacy Campaign IOCs	2017-10-23 19:10:44 +02:00
Florian Roth	e2e253c2f2	APT28 / Sofacy malware ... http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html	2017-10-23 16:56:32 +02:00
Florian Roth	b542e0635c	Cleanup	2017-10-23 16:54:53 +02:00
Florian Roth	81e2977704	False Positive Reduction	2017-10-23 16:54:34 +02:00
Florian Roth	3947d5adfd	Changed wording after quality checks	2017-10-21 19:56:50 +02:00
Florian Roth	bce45632c9	US-CERT TA17-293A - modified YARA rule set ... https://www.us-cert.gov/ncas/alerts/TA17-293A	2017-10-21 19:53:02 +02:00
Florian Roth	c9a9932b7b	Bad Patch report YARA signatures ... https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/	2017-10-21 16:27:18 +02:00
Florian Roth	4755027693	US-CERT TA17-293A - Part 1 - Filename, Hash, C2 IOCs ... https://www.us-cert.gov/ncas/alerts/TA17-293A	2017-10-21 16:26:07 +02:00
Florian Roth	7db1c95466	Added AirBnb / BinaryAlert YARA rules in new vendor directory	2017-10-20 11:21:49 +02:00
Florian Roth	43d5b1737f	Bugfix in Puppy RAT rule	2017-10-20 09:54:59 +02:00