Florian Roth
4263292a16
Hidden Cobra Wiper
...
https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity
2018-03-28 19:57:12 +02:00
Florian Roth
364b2abdcd
Merge pull request #30 from JohnLaTwC/patch-5
...
update for VT uploads that include the POST header
2018-03-28 15:00:11 +02:00
John Lambert
df49f01006
update for VT uploads that include the POST header
...
came across submissions (7d5819a2ea62376e24f0dd3cf5466d97bbbf4f5f730eb9302307154b363967ea, 2a69e46094d0fef2b3ffcab73086c16a10b517f58e0c1f743ece4f246889962b) with a header such as:
POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: 90.147.64.54:80
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0
Connection: Close
Content-Type: text/xml
Content-Length: 1214
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/ ">
<soapenv:Header>...
2018-03-28 05:31:01 -07:00
Florian Roth
2d4a023211
Updated Keyboy malware rules
2018-03-28 11:28:38 +02:00
Florian Roth
5a5268e3db
Suspicious Keylogger / Backdoor PDB strings
2018-03-28 11:27:53 +02:00
Florian Roth
d89fda03fe
Improved Impacket rules
2018-03-28 11:27:18 +02:00
Florian Roth
29dc390b2b
OilRig / Chafer YARA Rules
...
https://nyotron.com/nyotron-discovers-next-generation-oilrig-attacks/
2018-03-23 08:43:43 +01:00
Florian Roth
89eb1aaed2
Added .yar extension to weblogic exploit rule
2018-03-22 00:19:09 +01:00
Florian Roth
525bb2d361
False Positive Reduction
2018-03-22 00:17:41 +01:00
Florian Roth
e7149067b5
Merge pull request #29 from JohnLaTwC/patch-4
...
detect Oracle Weblogic exploit CVE-2017-10271
2018-03-22 00:16:31 +01:00
John Lambert
f6fef3e296
detect Oracle Weblogic exploit CVE-2017-10271
...
Performed a retrohunt. 3 matches came back--all true positives:
20f5a6b4915d51c36b1e2fa77da7f75c44b07697b717ef733deba86d7c57b09a
376c2bc11d4c366ad4f6fecffc0bea8b195e680b4c52a48d85a8d3f9fab01c95
864e9d8904941fae90ddd10eb03d998f85707dc2faff80cba2e365a64e830e1d/subfile
2018-03-21 14:06:07 -07:00
Florian Roth
1e2fb32e11
Removed rule - prone to false positives
2018-03-20 15:15:28 +01:00
Florian Roth
2b845847fc
Bugfix in TA18-074A webshell rule
2018-03-17 11:18:13 +01:00
Florian Roth
59aaf36901
TEMP.Persicope hash IOCs
2018-03-16 23:23:02 +01:00
Florian Roth
a6e46b9b4a
TA18-074A filename IOCs
2018-03-16 23:22:44 +01:00
Florian Roth
0cef4b1890
Revised YARA rules of TA18-074A
2018-03-16 23:22:20 +01:00
Florian Roth
892b159c00
First commit of TA18-074A rules
2018-03-16 16:32:11 +01:00
Florian Roth
d37c5f6b98
False Positive
...
https://github.com/Neo23x0/Loki/issues/101#issuecomment-373337359
2018-03-15 12:36:37 +01:00
Florian Roth
65d45e5638
Fixed false positives in Slingshot APT sigs
2018-03-12 15:26:00 +01:00
Florian Roth
5334216f73
Prone to false positives
...
https://www.virustotal.com/en/file/8e928dc79b4dd5695b1b3fcd4592b7179c2e2857a82d325d49237977636b21d2/analysis/
2018-03-12 14:56:19 +01:00
Florian Roth
2ce3e0bbaf
Fix to avoid too many false positives
2018-03-12 14:49:03 +01:00
Florian Roth
117270469f
Moved all rules that use ext vars to a new rule set
2018-03-12 13:47:40 +01:00
Florian Roth
ff9c4850c5
Updated README - YARA rules with external vars
2018-03-12 13:44:40 +01:00
Florian Roth
3018b8b551
Extended the APT15 rules by NCCGroups rules (revised)
...
https://github.com/nccgroup/Royal_APT/blob/master/signatures/apt15.yara
2018-03-12 12:55:33 +01:00
Florian Roth
07b44fe78a
APT15 YARA signatures
...
https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
2018-03-12 09:40:31 +01:00
Florian Roth
125a220411
Slingshot APT YARA signatures
...
https://securelist.com/apt-slingshot/84312/
2018-03-10 12:20:04 +01:00
Florian Roth
9f06d34539
Slingshot APT file hashes
...
https://securelist.com/apt-slingshot/84312/
2018-03-09 16:58:04 +01:00
Florian Roth
3fe8f66d3b
Bigfix: missing "pe" import
2018-03-09 15:35:38 +01:00
Florian Roth
d99e4b859e
NSA’s perspective on APT landscape - file name IOCs
...
https://blog.crysys.hu/2018/03/territorial-dispute-nsas-perspective-on-apt-landscape/
2018-03-09 15:30:19 +01:00
Florian Roth
9c5765484d
DonotTeam YTYFramework YARA sig
...
https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/
2018-03-09 15:29:45 +01:00
Florian Roth
b031d55469
Crimson RAT
2018-03-08 18:56:38 +01:00
Florian Roth
cecd779892
Updated generic dump files : gesecdump output
2018-03-08 18:48:55 +01:00
Florian Roth
b0f6890de1
TSCookie RAT
2018-03-08 18:48:55 +01:00
Florian Roth
9152a81c7e
Merge pull request #27 from JohnLaTwC/patch-3
...
finds powershell commands obfuscated by unicorn
2018-03-08 18:26:22 +01:00
Florian Roth
62ff9d53f5
PowerShell payload obfuscated by Unicorn toolkit
2018-03-08 18:24:10 +01:00
JohnLaTwC
70c1a24de4
finds powershell commands obfuscated by unicorn
...
I see unicorn samples uploaded to VT a few times a day. Here is a rule for it.
Unicorn toolkit: https://github.com/trustedsec/unicorn/
Example hashes:
14c708d8577eafc56fa8af4d45aaedfbba185aee6ffc22650b2b5b4a58c6ae0f
19c8d44fe80cfbd61e30f9aeef3f7433473e6ae66d7b2e26bae22ed9b338a755
1f1990d08ae6ac2480e2ba4fcc4f00105aa2eb8606fa5b23be450922a705a637
211c690cded91446b43ec2bd89a8071df8b96442b3fa9762a91945c8987996db
4b877196a90b2ad62fe795fff63d36742d9099ae677fe5e44ef47e6a9919adc4
5239c2de70c82b70ce3dac0669b4b4ec95b5d5fd0286bad8e3ec960217e20627
Also https://twitter.com/JohnLaTwC/status/971536587388407809
2018-03-07 17:29:36 -08:00
Florian Roth
37ccc0a471
Merge pull request #26 from JohnLaTwC/patch-2
...
yara rule for encoded python payloads for adware
2018-03-07 23:07:08 +01:00
JohnLaTwC
7cab502150
yara rule for encoded python payloads for adware
...
Ran it through a retrohunt earlier and has good true positive track record in VT. Very interesting python samples that it is a part of.
2018-03-07 08:45:57 -08:00
Florian Roth
5110a57cd5
Minor changes: performance reasons, reference, hashes split up
2018-03-05 15:41:51 +01:00
Florian Roth
7c4b9b1725
Merge pull request #24 from JohnLaTwC/patch-1
...
generic python reverse shell
2018-03-05 15:36:05 +01:00
Florian Roth
27442f03b0
Operation Honey Bee Malware YARA sigs
...
https://securingtomorrow.mcafee.com/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/
2018-03-03 16:12:34 +01:00
Florian Roth
77281d4ea2
Generic dropper PDB string
2018-03-03 12:15:31 +01:00
Florian Roth
0b21871f52
IceFog malware
...
https://twitter.com/ClearskySec/status/968104465818669057
2018-03-03 10:15:24 +01:00
Florian Roth
51f7b978a1
FinFisher IOCs
2018-03-02 17:04:34 +01:00
Florian Roth
e9eac4fdc6
Merge pull request #25 from jantdm/patch-1
...
Link broken
2018-03-02 13:46:54 +01:00
Florian Roth
c41806f2cf
False Positive Reduction
2018-03-01 19:13:20 +01:00
Florian Roth
aefa8e8af7
Bugfix and extended Sofacy rule
2018-03-01 09:34:03 +01:00
Florian Roth
4bdcf3c64b
Sofacy IOCs and YARA signature
2018-03-01 09:29:57 +01:00
Florian Roth
c6807a024d
Dumper False Positive Reduction
2018-03-01 09:29:35 +01:00
Jan Tiedemann
786fe0bffb
Link broken
...
Link to DCSO Apache Struts Vulns was broken (https://goo.gl/t4FKT5 ). Fixed that for you (https://goo.gl/7jGkpV ).
2018-02-28 20:44:59 +01:00
