valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-07 18:38:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
996 Commits 2 Branches 1 Tag 33 MiB
3a36eabb3f
Commit Graph

746 Commits

Author SHA1 Message Date
Florian Roth
a4544d7c2a Op Magic Hound YARA Signatures 
http://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/
 2017-02-17 15:48:58 +01:00
Florian Roth
72f3c49d99 False positives with AV software DLLs (ESET) 2017-02-17 15:48:21 +01:00
Florian Roth
7d5227d20f Removed WebShell_Generic_PHP_5 prone to false positives 2017-02-16 19:41:26 +01:00
Florian Roth
2cd4d7b422 Deactivated False Positives in Grizzly Steppe Rules - US CERT 2017-02-12 18:26:02 +01:00
Florian Roth
6534da8d3a Cosmetics 2017-02-11 12:01:31 +01:00
Florian Roth
2f42964d1d Removed duplicate rule StreamEx_ShellCrew 2017-02-11 11:38:12 +01:00
Florian Roth
8d577f57b0 US CERT Grizzly Steppe Report 2017-02-11 11:36:10 +01:00
Florian Roth
0069690f19 Remove False Positive Rules 2017-02-10 10:40:52 +01:00
Florian Roth
dd8d5585f0 Metasploit Payloads 2017-02-10 10:40:21 +01:00
Florian Roth
e4c17818b6 Shell Crew StreamEx 2017-02-10 10:23:29 +01:00
Florian Roth
ce887d4eb3 Rotten Potato - Avoiding False Positives 2017-02-07 17:58:44 +01:00
Florian Roth
291833ccdd Winnti malware MS Report 2017-02-07 10:45:19 +01:00
Florian Roth
b80152fbc2 Servant Shell 2017-02-07 10:37:26 +01:00
Florian Roth
959f30b62d Rotten Potato 2017-02-07 09:20:10 +01:00
Florian Roth
376dcfcf5e ysoserial payloads 2017-02-05 13:27:10 +01:00
Florian Roth
2a7c06adf8 CN APT Proofpoint ZeroT RAT 2017-02-05 13:26:03 +01:00
Florian Roth
a384dd543d Private Rule Bugfix 2017-02-03 22:04:51 +01:00
Florian Roth
3a737e0ea8 FP Reduction 2017-02-03 21:59:32 +01:00
Florian Roth
6ace90f226 UAC Elevators Update 2017-02-03 21:59:14 +01:00
Florian Roth
896b6eeb99 Minor changes 2017-01-31 18:47:29 +01:00
Florian Roth
df58486639 FP avoidance 2017-01-28 12:49:14 +01:00
Florian Roth
6ddaf42ec3 Google Bot User Agent 2017-01-28 11:39:32 +01:00
Florian Roth
2ca25d1c00 Greenbug YARA rules 2017-01-26 14:00:36 +01:00
Florian Roth
7b16da5081 P0wnShell 2017-01-15 16:30:56 +01:00
Florian Roth
8b8e11282d EquationGroup Rules Update 2017-01-14 19:38:43 +01:00
Florian Roth
58b7514527 Merge branch 'master' of https://github.com/Neo23x0/signature-base 2017-01-14 19:38:12 +01:00
Florian Roth
b5776d6971 Venom Linux Rootkit 2017-01-14 19:38:06 +01:00
Florian Roth
8e2e39196a FScan output 2017-01-14 19:28:47 +01:00
Florian Roth
14a8c75e89 Merged branch master into master 2017-01-10 11:12:00 +01:00
Florian Roth
72ff9fae4d ShadowBrokers Screens File Names Jan17 2017-01-10 11:07:04 +01:00
Florian Roth
eec5a37407 Updated Grizzly Steppe 
- include more PHP Web kit Versions
 2017-01-02 08:10:21 +01:00
Florian Roth
4112bc4ebf Renamed APT29 YARA rule file 2016-12-30 10:38:03 +01:00
Florian Roth
eb25fa4a1c Grizzly Steppe YARA Rules 2016-12-30 10:36:35 +01:00
Florian Roth
02b006d92b RAT YARA rules from malwareconfig.com 
Thx to Kevin Breen
 2016-12-27 23:26:07 +01:00
Florian Roth
ceb33d261d Telebots YARA Rule 2016-12-27 23:23:59 +01:00
Florian Roth
473ca25339 Promethium Neodymium YARA Rules 2016-12-27 23:23:46 +01:00
Florian Roth
54e1276cd1 False Positive - PipeList 2016-12-27 23:20:01 +01:00
Florian Roth
f485f9bc93 Merged branch master into master 2016-12-18 11:43:28 +01:00
Florian Roth
524bee2139 ShadowBroker Screens / README Extractions 2016-12-18 11:41:35 +01:00
Florian Roth
230713a9e7 SysInternals Anomalies 2016-12-09 00:20:38 +01:00
Florian Roth
cb85ea73ca GoldenEye Ransomware 2016-12-06 17:13:12 +01:00
Florian Roth
86e45a3e70 Shamoon 2.0 Rev1 2016-12-01 23:02:21 +01:00
Florian Roth
a9ff4c43c1 Regshell False Positive 2016-12-01 22:44:48 +01:00
Florian Roth
83daf31b8e Shamoon 2.0 2016-12-01 22:44:35 +01:00
Florian Roth
3e7ce48830 Changed duplicate rule name 2016-11-12 12:26:55 +01:00
Florian Roth
4391fec217 Empire YARA Sigs 2016-11-05 19:57:12 +01:00
Florian Roth
f584562c7e Suspicious String - Ping in EXE 2016-11-05 10:32:30 +01:00
Florian Roth
ab8405b5ab Empire - Out-MiniDump 2016-11-05 10:32:19 +01:00
Florian Roth
0633e4fdf0 Webshell AJAX False Positive 2016-11-05 10:31:43 +01:00
Florian Roth
eab4b5131b False Positives 2016-10-29 12:28:54 +02:00
Florian Roth
c1d9a5379c Improved DirtyCOW Rule 2016-10-24 16:40:54 +02:00
Florian Roth
7a219e5a4b DirtyCOW Update 2016-10-24 09:50:52 +02:00
Florian Roth
0b503ee5a7 Dirty COW 2016-10-22 17:34:30 +02:00
Florian Roth
a0d9c25014 PassCV YARA Rules 
https://blog.cylance.com/digitally-signed-malware-targeting-gaming-compa
nies
 2016-10-21 11:44:38 +02:00
Florian Roth
cc4ca36975 OilRig Campaign 
http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware
-campaign-updates-toolset-and-expands-targets/
 2016-10-13 09:40:36 +02:00
Florian Roth
7f3a863862 False Positive 2016-10-13 09:40:36 +02:00
Florian Roth
e7dd247fa3 Signature Update October 2016 A 2016-10-09 11:33:29 +02:00
Florian Roth
2f4147b6bb Mirai Botnet Malware and Improvements 2016-10-06 08:48:52 +02:00
Florian Roth
3b47e3ecd2 Antic Webshell 2016-09-11 16:43:47 +02:00
Florian Roth
5f673df5f6 New Webshell Rules 2016-09-11 15:59:52 +02:00
Florian Roth
80849d2434 APT29 IOCs and Pirpi YARA Rules 2016-09-11 15:59:36 +02:00
Florian Roth
5744546da1 Fixed duplicate rule name bug 2016-09-11 15:58:57 +02:00
Florian Roth
a3ed8d33b3 New Hacktool Signatures 2016-09-10 01:16:40 +02:00
Florian Roth
bf93ee34d5 APT Buckeye 2016-09-10 01:16:28 +02:00
Florian Roth
0a1648519f PowerShell Toolkit YARA Rules 2016-09-04 18:19:57 +02:00
Florian Roth
c8617942ce Malware Set QA 2016-09-02 08:50:46 +02:00
Florian Roth
54f6aecd44 Removed duplicate rule 2016-08-31 14:34:21 +02:00
Florian Roth
0dfc21592c WCE in-memory rule 2016-08-30 19:41:30 +02:00
Florian Roth
08ebcc5b36 OTX Update and b374k back connect shell 2016-08-26 21:43:11 +02:00
Florian Roth
de84c3ae42 Device Guard Evasion 2016-08-18 08:44:27 +02:00
Florian Roth
c8d65ddbc4 PlugX Signature by Jay DiMartino 
PDF
https://t.co/4xQ8G2mNap
 2016-08-17 13:20:52 +02:00
Florian Roth
1fe1837c0f Rule based on RC5/RC6 static key finding by Kaspersky 2016-08-17 09:32:56 +02:00
Florian Roth
cdb364758a EQRP Extra Rules 2016-08-16 21:35:42 +02:00
Florian Roth
366abc510a Equation Group Firewall Toolset Leak YARA Rules (First Set) 2016-08-16 20:37:13 +02:00
Florian Roth
e3ada3ee24 Renamed Webshell Rules 2016-08-16 20:32:06 +02:00
Jonas Lejon
eea36d5ce0 Add new mimkatz yara-signature 
From https://blog.didierstevens.com/2016/08/12/mimikatz-golden-ticket-dcsync/
 2016-08-13 18:39:22 +02:00
Florian Roth
754d19604d Invoke-Mimikatz Rule 
- useful to impress PowerShell hipsters
 2016-08-10 09:35:08 +02:00
Florian Roth
2c5005744c My Sauron Extra Rules 2016-08-10 09:34:15 +02:00
Florian Roth
dad52eb4a0 Symantec Strider IOCs and YARA Rules 2016-08-10 09:33:54 +02:00
Florian Roth
eca6d816f1 Project Sauron 2016-08-08 17:11:20 +02:00
Florian Roth
630db83081 Renamed Rule 2016-08-01 16:57:58 +02:00
Florian Roth
2db411300f Generic Rule - Transformed Strings 2016-08-01 08:31:33 +02:00
Florian Roth
2ecac1d2c1 CKnife Webshell - by Levi 2016-07-20 13:31:11 +02:00
Florian Roth
37f8738c9e Mimikittenz 2016-07-20 13:30:10 +02:00
Florian Roth
7a68156e21 Furtims Parent 
https://sentinelone.com/blogs/sfg-furtims-parent/
 2016-07-17 12:59:29 +02:00
Florian Roth
e63f5f890d Furtim Malware 2016-07-16 11:03:15 +02:00
Florian Roth
69f96e2011 Stuxnet Rules 
- YARA Rules
- Hash IOCs
 2016-07-11 19:48:03 +02:00
Florian Roth
13ab3e4876 Power PE Reflective Injection Rule by Benjamin Delpy 2016-07-11 19:47:37 +02:00
Florian Roth
e264d66a8e Bugfix in Duqu2 Rule 2016-07-02 19:35:33 +02:00
Florian Roth
76791e7254 False Positive Reduction 2016-07-02 19:32:50 +02:00
Florian Roth
5f664abbd0 SysScan Rules by Kaspersky 2016-07-02 19:32:36 +02:00
Florian Roth
37c1835ae7 Fancy / Cozy Bear Sigs 2016-07-02 19:32:02 +02:00
Florian Roth
652a44d586 Duqu2 Sigs 2016-07-02 19:31:34 +02:00
Florian Roth
a248f3d8a9 Bugfix in prikormka Rules 2016-06-17 17:24:28 +02:00
Florian Roth
a1927bb1e5 FoxIT Mofang IOCs and YARA Rules 
https://goo.gl/t3uUTG
 2016-06-15 18:58:10 +02:00
Florian Roth
a3323e83aa Sofacy Samples June 2016 
http://researchcenter.paloaltonetworks.com/2016/06/unit42-new-sofacy-att
acks-against-us-government-agency/
 2016-06-15 06:54:30 +02:00
Florian Roth
65ee46b9c9 Turla Rules - RUAG APT 
https://goo.gl/N5MEj0
 2016-06-13 10:41:59 +02:00
Florian Roth
b3a3556dcc SharpCat YARA Signature 2016-06-10 18:14:26 +02:00
Florian Roth
1b9ba2eb17 Dubnium YARA Signatures 
https://blogs.technet.microsoft.com/mmpc/2016/06/09/reverse-engineering-
dubnium-2/
 2016-06-10 17:03:29 +02:00
Florian Roth
a27d6ee020 Sickly Nidiran Trojan YARA Signatures 2016-06-09 09:37:59 +02:00
Florian Roth
f23819ce94 Adjusted YARA Rule 2016-06-08 21:08:44 +02:00
Florian Roth
21cb4b1a45 PlugX Rules for Sample Set June 2016 2016-06-08 20:54:12 +02:00
Florian Roth
3b0ad587a7 Minor Changes to YARA Rules 2016-06-08 11:28:42 +02:00
Florian Roth
bfdf1bba60 FireEye IronGate APT Yara Rules & File Name IOCs 2016-06-04 17:32:21 +02:00
Florian Roth
dfb6a2b964 Signature Update 2016-06-04 17:07:38 +02:00
Florian Roth
b302b84740 Danti and SVCMONDR Malware Rules 
PWC Report
http://pwc.blogs.com/cyber_security_updates/2016/05/exploring-cve-2015-2
545-and-its-users.html
Kaspersky Blog Post
https://securelist.com/analysis/publications/74828/cve-2015-2545-overvie
w-of-current-threats/
 2016-05-25 16:14:11 -06:00
Florian Roth
902f434811 RUAG APT Case YARA Signatures 
- Signatures based on descriptions in report > not the actual samples
 2016-05-24 07:29:20 -06:00
Florian Roth
8ac0ec1535 Kerberoast 2016-05-24 07:28:42 -06:00
Florian Roth
b95e46c943 No Powershell 2016-05-24 07:28:29 -06:00
Florian Roth
8ae745cf49 ESET: Operation Groundbait, Prikormka malware 2016-05-18 09:34:49 -06:00
Florian Roth
8125a96e68 dnscat2 hacktool 2016-05-18 09:34:18 -06:00
Florian Roth
99a0bada53 Signature Update 
- New PoisonIvy Rule
- ONHAT proxy tool (htran like)
- BeepService APT group hack tool
- Sofacy Adjustments
 2016-05-13 06:06:18 -06:00
Florian Roth
ece1450481 Gh0st Dragon RAT 2016-04-27 13:36:53 +02:00
Florian Roth
2f6f765ca9 Microsoft Platinum YARA Rules 2016-04-27 13:36:39 +02:00
Florian Roth
f3fd2022d8 False Positive Reduction 2016-04-27 13:36:17 +02:00
Florian Roth
c7d168f5f9 Regsvr32 issue signature 2016-04-26 10:05:17 +02:00
Florian Roth
e3f04a6e71 False Positive Fixes 2016-04-26 10:04:19 +02:00
Florian Roth
b1a5fb6b18 Nano core Rule 
Adjusted Nanocore Rule
 2016-04-25 10:26:46 +02:00
Florian Roth
5533cfb5ab Updated Nanocore Rules 
- Removed Base64 encoded EXE string
 2016-04-24 21:13:18 +02:00
Florian Roth
be8609a15c Adjusted Nanocore Rule 
- false positives with certain IRC DLL
 2016-04-22 17:43:58 +02:00
Florian Roth
83d080688e Nanocore RAT 2016-04-22 17:04:04 +02:00
Florian Roth
0ccd098b6a Removed Anti-Analysis RTF Rule 2016-04-21 13:31:29 +02:00
Florian Roth
7026b52f6b Adjusted SLServer Rule 2016-04-21 11:03:55 +02:00
Florian Roth
44baaa5fe6 APT Between Hong-Kong and Burma Rules 2016-04-21 10:32:31 +02:00
Florian Roth
16a2ab9c0c Metasploit Loader by RSMudge 2016-04-21 10:31:41 +02:00
Florian Roth
e5c22901fe Signature Update 
- RTF Anti Analysis Tricks
 2016-04-20 09:28:13 +02:00
Florian Roth
9151ffd103 Signature Updates 
- Four Element Sword
- THOR inverse matching utilman.exe
- CN Webshell rule cosmetics
 2016-04-20 09:26:09 +02:00
Florian Roth
fa93e8eec1 Typo in comment 2016-04-13 01:04:53 +02:00
Florian Roth
9429919561 Fixed indentation 2016-04-13 00:55:43 +02:00
Florian Roth
fd38e39b7d Mimikatz Rule - apply to memory too 2016-04-13 00:52:06 +02:00
Florian Roth
aad907f7ee RTF Anti-Analysis 
http://decalage.info/rtf_tricks
 2016-04-13 00:51:44 +02:00
Florian Roth
62f3edda9f False Positives with Common File Sizes 2016-04-13 00:51:08 +02:00
Florian Roth
65bb44d764 APT6 Malware Signature 2016-04-09 12:55:32 +02:00
Florian Roth
dd4cb5d8a9 Linux Postscanner Shark 
- Replaced older hack tool rule that matched also on goodware
 2016-04-02 02:06:19 +02:00
Florian Roth
b632c0ddde Signature Update 
- Project M APT malware
- TempRacer Priv Esc Tool
- Winshells
 2016-04-01 16:51:30 +02:00
Florian Roth
26c66878b6 Petya Ransomware 2016-03-25 00:29:51 +01:00
Thomas Patzke
4f503dcb92 Decomposition of $hex_api_call in lsadump rule for Yara compatibility reasons 2016-03-23 10:29:05 +01:00
Florian Roth
7b2101bde0 False Positive with old mstsc 2016-03-23 10:05:57 +01:00
Florian Roth
838cdbe318 Bugfix PSAttack Rule 2016-03-09 14:06:18 +01:00
Florian Roth
4d200832eb PSAttack Signature 2016-03-09 14:05:06 +01:00
Florian Roth
085572e77f New Signatures 2016-03-09 13:40:49 +01:00
Florian Roth
8e4dec9f8d Derusbi ELF / Win32 Turbo Campaign 2016-02-29 20:32:42 +01:00
Florian Roth
02d2b41836 False Positives 
- software_reporter_tool.exe
https://www.virustotal.com/en/file/4d83a4250113aabc303b29c99c26da1decc85
e7866db1922dc312799dccb8302/analysis/
- spoolsv.exe anomaly
 2016-02-29 13:46:21 +01:00
Florian Roth
3da4a289e5 Locky Ransomware 2016-02-17 18:03:58 +01:00
Florian Roth
e923b8d0db OTX Signatures Update 17.02.2016 
- Also removed sublime-workspace file
 2016-02-17 10:21:26 +01:00
Florian Roth
3a61922ceb signatures > yara 2016-02-15 12:31:27 +01:00