valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-07 10:28:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
329 Commits 2 Branches 1 Tag 33 MiB
4bebc275ec
Commit Graph

329 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Florian Roth
fec50df702 False Positives 2017-05-22 16:46:08 +02:00
Florian Roth
d14126699f Merge pull request #15 from msenturk/patch-1 
wannacry hashes
 2017-05-21 18:35:52 +02:00
Florian Roth
d8956eabe8 False Positives 2017-05-20 10:18:37 +02:00
Florian Roth
27ca4a3c23 EternalRocks 2017-05-18 08:51:29 +02:00
Florian Roth
9359eee461 Kaspersky's lazaruswannacry rule 2017-05-15 23:24:22 +02:00
msenturk
d3fe119760 wannacry hashes 2017-05-15 22:11:46 +03:00
Florian Roth
e65845f278 Malware Dropper - DOCM in PDF 2017-05-15 19:36:58 +02:00
Florian Roth
6b66ad72b8 Updated WannCry Ransomware Rule 2017-05-15 19:36:40 +02:00
Florian Roth
b519e7cc51 WannaCry - New Generic Rule 2017-05-14 16:13:18 +02:00
Florian Roth
629337be4e Update on WannaCry Rules 2017-05-13 19:30:36 +02:00
Florian Roth
a8a3ec5348 Update on WannaCry Rules 2017-05-13 19:27:58 +02:00
Florian Roth
e785dcc509 Added WannaCry string for ZIP password 2017-05-13 11:27:40 +02:00
Florian Roth
b110d022ed Fixed WannaCry extensions to the end of string 2017-05-13 10:50:43 +02:00
Florian Roth
5342cf8057 WannaCry Ransomware file names 2017-05-13 10:49:48 +02:00
Florian Roth
3ce5d5a213 WannaCry YARA Rules 2017-05-13 10:05:08 +02:00
Florian Roth
4b9d80d4bd Mirai Malware Update 2017-05-12 16:49:51 +02:00
Florian Roth
cbb45ab017 FP Hash DA5EE020BEF41DC95C3532CBAA1EA8F4 2017-05-12 15:48:50 +02:00
Florian Roth
b43cf3b185 Rule cleanup 2017-05-11 13:34:28 +02:00
Florian Roth
7404d697ca Keylogging HP Audio Driver 2017-05-11 13:34:10 +02:00
Florian Roth
3344486b9c Vault7 Archimedes File Name Pattern (low scoring) 
https://wikileaks.org/vault7/document/#archimedes
 2017-05-05 15:14:55 +02:00
Florian Roth
af4b03df31 Vault7 Archimedes File Hashes 
https://wikileaks.org/vault7/document/#archimedes
 2017-05-05 15:14:29 +02:00
Florian Roth
7522ec6f7e Impacket Generic Rule FPs 2017-05-05 15:13:57 +02:00
Florian Roth
340c60d9b7 ISM RAT Filenames 2017-05-04 13:10:04 +02:00
Florian Roth
dd145e731a ISMRAT 2017-05-04 12:22:58 +02:00
Florian Roth
0208aef709 Update on Snake/Turla - Shell scripts 2017-05-04 11:55:50 +02:00
Florian Roth
2c84ae6371 Kazuar Hashes 2017-05-04 11:30:08 +02:00
Florian Roth
00b8270b65 Snake/Turla, FIN7, Kazuar 2017-05-04 11:28:03 +02:00
Florian Roth
e10ea9642d Bugfix 2017-05-03 13:41:29 +02:00
Florian Roth
66668ca36b Enigma protected malware 2017-05-03 09:02:08 +02:00
Florian Roth
1365a6016b EquationGroup FP 2017-05-03 09:01:57 +02:00
Florian Roth
276c899901 Oilrig Filenames 2017-05-03 09:01:44 +02:00
Florian Roth
adc742e6c3 US CERT Alert TA17-117A https://goo.gl/fZhL9H 2017-04-28 11:14:52 +02:00
Florian Roth
69c85e8d9f False Positives 2017-04-28 10:32:36 +02:00
Florian Roth
225d917432 New rules for obfuscated samples 2017-04-22 13:54:08 +02:00
Florian Roth
7081f9926f Updated DeepPanda rule 2017-04-22 13:53:46 +02:00
Florian Roth
9ef6409535 Removed Dumpel (Resource Kit Win 2000) False Positive 2017-04-19 13:55:49 +02:00
Florian Roth
addeab74bb meta data hash identifier fixed, scanner output rule 2017-04-17 16:49:04 +02:00
Florian Roth
cfebd5ea39 New Equation Group Signatures 2017-04-17 11:18:41 +02:00
Florian Roth
a9f685816d More white listed IOCs 2017-04-14 14:32:38 +02:00
Florian Roth
886e005fb3 OTX Update 2017-04-14 14:31:58 +02:00
Florian Roth
f9d0882a35 Remove byte chain that is slowing down scanning 2017-04-13 09:52:27 +02:00
Florian Roth
b496ed91a6 Changed OLE2Link signature 2017-04-12 19:11:36 +02:00
Florian Roth
2245f5d7cb Renamed - Crime > Exploit 2017-04-12 15:52:06 +02:00
Florian Roth
a431674976 OLE2Link Update with NVISIO rule 2017-04-12 15:50:29 +02:00
Florian Roth
629afa0835 RFT OLE2Link Exploit 2017-04-12 11:25:22 +02:00
Florian Roth
52ab2fc0aa Lazarus Group FileNames 2017-04-12 11:25:02 +02:00
Florian Roth
46568f0d03 Removed rule prone to false positives 2017-04-10 13:02:20 +02:00
Florian Roth
a9fc876114 False positive comment in EQGRP rules 2017-04-10 00:07:13 +02:00
Florian Roth
801026a0e5 Removed false positives 2017-04-09 23:50:47 +02:00
Florian Roth
04e1e8bb10 File Type Signatures: ELF, Script 2017-04-09 23:41:07 +02:00