valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 10:05:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
943 Commits 2 Branches 1 Tag 33 MiB
78706dbe46
Commit Graph

943 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Florian Roth
78706dbe46 Reworked many rules based on YARA performance guidelines 
https://gist.github.com/Neo23x0/e3d4e316d7441d9143c7
 2019-03-02 16:02:11 +01:00
Florian Roth
f3371f2cfd Obfuscated Batch Script 2019-03-01 08:30:35 +01:00
Florian Roth
9e051bd768 ATM malware dispenserXFS 2019-02-28 13:17:16 +01:00
Florian Roth
7c7ae36887 IOC fix in commented rule 2019-02-28 12:51:04 +01:00
Florian Roth
3327c8a9e4 BRONZE UNION hash IOCs 2019-02-28 12:50:53 +01:00
Florian Roth
fe92bee246 FP: sublime package - recon commands 2019-02-26 11:46:00 +01:00
Florian Roth
cb46d0e0ba False Positive Reduction 2019-02-24 13:15:53 +01:00
Florian Roth
11bbd517f8 APT BabyShark rule 
https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
 2019-02-24 13:15:40 +01:00
Florian Roth
d0b1e17dec False Positive Reduction 2019-02-19 23:46:28 +01:00
Florian Roth
4c5cbb4ee2 FP ntds.dit location 2019-02-19 12:57:36 +01:00
Florian Roth
e6264d4740 ntds.dit FP 2019-02-19 12:55:29 +01:00
Florian Roth
0448d97e8f FP: svchost.exe size 2019-02-19 12:53:01 +01:00
Florian Roth
8f7335c6ad Author adjustments 2019-02-19 08:25:27 +01:00
Florian Roth
4ed1ebc730 Improved suspicious LNK file rule 2019-02-19 08:25:15 +01:00
Florian Roth
63999ebad9 AUS parliament network compromise 
https://cyber.gov.au/government/news/parliament-house-network-compromise/
 2019-02-18 11:03:18 +01:00
Florian Roth
1b85e40833 Suspicious Word VBA Macro strings 2019-02-16 07:49:44 +01:00
Florian Roth
50b0a91ee0 FP: adjusted size of svchost.exe rule 2019-02-16 07:49:25 +01:00
Florian Roth
31be267244 Removed problematic string from rule 2019-02-14 08:42:04 +01:00
Florian Roth
77825e574c Merged suspicious Office Droppers rule with new rule 2019-02-13 08:27:24 +01:00
Florian Roth
a8e639a559 Sigbase rules CSV update 2019-02-11 15:26:17 +01:00
Florian Roth
692282b9d8 Renamed AutoCAD rule 2019-02-11 15:20:13 +01:00
Florian Roth
1b42ce45fa
Merge pull request #60 from JohnLaTwC/patch-11 
Create SUSP_autocad_lsp_malware.yar
 2019-02-11 15:17:06 +01:00
Florian Roth
6a1f8cc3a0
0x28 is subset of other condition 2019-02-11 15:13:47 +01:00
John Lambert
7ef2cad740
Create SUSP_autocad_lsp_malware.yar 2019-02-07 16:05:49 -08:00
Florian Roth
46075a8040 CSV now has sorted tags - makes diffs smaller 2019-02-07 18:57:48 +01:00
Florian Roth
2d096775a2
Merge pull request #59 from JohnLaTwC/patch-10 
Create gen_macro_StarOffice_suspicious.yar
 2019-02-07 18:48:14 +01:00
Florian Roth
ab3b967216
Minor changes 2019-02-07 18:09:34 +01:00
John Lambert
eba6596861
Create gen_macro_StarOffice_suspicious.yar 
Performed a retrohunt to narrow down to the malicious hashes listed
 2019-02-07 09:06:43 -08:00
Florian Roth
d919249ebd Signature base rules CSV update 2019-02-07 09:51:20 +01:00
Florian Roth
06eaa56e82 HWP incident filename IOC 2019-02-07 09:48:39 +01:00
Florian Roth
ec6bcf6edd Changed filename 2019-02-07 09:48:08 +01:00
Florian Roth
abddb56a94 FIlename IOC : ntds.dit in uncommon location 2019-02-07 08:37:13 +01:00
Florian Roth
75f01d8fa8 update: rule info 2019-02-05 19:56:15 +01:00
Florian Roth
ca3960b70e
Merge pull request #58 from JohnLaTwC/patch-9 
Create gen_libre_office_CVE_2018_16858.yar
 2019-02-05 19:54:33 +01:00
Florian Roth
97d70bf8d2 update: rule info 2019-02-05 19:49:39 +01:00
Florian Roth
506a0a1b1b FP Filename IOC Oracle exclude 2019-02-05 19:49:17 +01:00
Florian Roth
312f78bfa3
Minor changes: rule name, nocase, removed size 2019-02-05 17:01:41 +01:00
John Lambert
2199580487
Create gen_libre_office_CVE_2018_16858.yar 2019-02-05 07:20:56 -08:00
Florian Roth
74c8970f95 Suspicious Katz.PDB 2019-02-05 09:11:43 +01:00
Florian Roth
fbe8852a9a Extended suspicious LNK file content rule 2019-02-05 09:11:33 +01:00
Florian Roth
146d0e9ae1 Suspicious big LNK file 2019-02-05 09:11:16 +01:00
Florian Roth
30352f327e ExileRAT 
https://blog.talosintelligence.com/2019/02/exilerat-shares-c2-with-luckycat.html
 2019-02-04 20:44:06 +01:00
Florian Roth
42515d34db CSV signature base rules 2019-02-02 17:14:44 +01:00
Florian Roth
0ee2f3d05f New Crypto Coin miner rule 2019-02-02 17:14:44 +01:00
Florian Roth
925aed89f5 Rule extraction with private rule mjolnir 2019-02-02 17:14:44 +01:00
Florian Roth
42dba65c04 .gitignore update 2019-02-02 17:14:44 +01:00
Florian Roth
e99f7237f2 Rule improvements 2019-02-02 17:14:44 +01:00
Florian Roth
814a2593cd
Merge pull request #57 from JohnLaTwC/patch-8 
Update gen_macro_ShellExecute_action.yar
 2019-02-01 18:14:45 +01:00
John Lambert
7bfd6e14da
Update gen_macro_ShellExecute_action.yar 2019-01-31 19:38:50 -08:00
Florian Roth
4dafd62d5e APT DNS Hijacking campaign AA19-024A 
https://www.us-cert.gov/ncas/alerts/AA19-024A
 2019-01-29 15:31:54 +01:00