valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 18:15:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
940 Commits 2 Branches 1 Tag 33 MiB
7c7ae36887
Commit Graph

700 Commits

Author SHA1 Message Date
Florian Roth
65ee46b9c9 Turla Rules - RUAG APT 
https://goo.gl/N5MEj0
 2016-06-13 10:41:59 +02:00
Florian Roth
b3a3556dcc SharpCat YARA Signature 2016-06-10 18:14:26 +02:00
Florian Roth
1b9ba2eb17 Dubnium YARA Signatures 
https://blogs.technet.microsoft.com/mmpc/2016/06/09/reverse-engineering-
dubnium-2/
 2016-06-10 17:03:29 +02:00
Florian Roth
a27d6ee020 Sickly Nidiran Trojan YARA Signatures 2016-06-09 09:37:59 +02:00
Florian Roth
f23819ce94 Adjusted YARA Rule 2016-06-08 21:08:44 +02:00
Florian Roth
21cb4b1a45 PlugX Rules for Sample Set June 2016 2016-06-08 20:54:12 +02:00
Florian Roth
3b0ad587a7 Minor Changes to YARA Rules 2016-06-08 11:28:42 +02:00
Florian Roth
bfdf1bba60 FireEye IronGate APT Yara Rules & File Name IOCs 2016-06-04 17:32:21 +02:00
Florian Roth
dfb6a2b964 Signature Update 2016-06-04 17:07:38 +02:00
Florian Roth
b302b84740 Danti and SVCMONDR Malware Rules 
PWC Report
http://pwc.blogs.com/cyber_security_updates/2016/05/exploring-cve-2015-2
545-and-its-users.html
Kaspersky Blog Post
https://securelist.com/analysis/publications/74828/cve-2015-2545-overvie
w-of-current-threats/
 2016-05-25 16:14:11 -06:00
Florian Roth
902f434811 RUAG APT Case YARA Signatures 
- Signatures based on descriptions in report > not the actual samples
 2016-05-24 07:29:20 -06:00
Florian Roth
8ac0ec1535 Kerberoast 2016-05-24 07:28:42 -06:00
Florian Roth
b95e46c943 No Powershell 2016-05-24 07:28:29 -06:00
Florian Roth
8ae745cf49 ESET: Operation Groundbait, Prikormka malware 2016-05-18 09:34:49 -06:00
Florian Roth
8125a96e68 dnscat2 hacktool 2016-05-18 09:34:18 -06:00
Florian Roth
99a0bada53 Signature Update 
- New PoisonIvy Rule
- ONHAT proxy tool (htran like)
- BeepService APT group hack tool
- Sofacy Adjustments
 2016-05-13 06:06:18 -06:00
Florian Roth
ece1450481 Gh0st Dragon RAT 2016-04-27 13:36:53 +02:00
Florian Roth
2f6f765ca9 Microsoft Platinum YARA Rules 2016-04-27 13:36:39 +02:00
Florian Roth
f3fd2022d8 False Positive Reduction 2016-04-27 13:36:17 +02:00
Florian Roth
c7d168f5f9 Regsvr32 issue signature 2016-04-26 10:05:17 +02:00
Florian Roth
e3f04a6e71 False Positive Fixes 2016-04-26 10:04:19 +02:00
Florian Roth
b1a5fb6b18 Nano core Rule 
Adjusted Nanocore Rule
 2016-04-25 10:26:46 +02:00
Florian Roth
5533cfb5ab Updated Nanocore Rules 
- Removed Base64 encoded EXE string
 2016-04-24 21:13:18 +02:00
Florian Roth
be8609a15c Adjusted Nanocore Rule 
- false positives with certain IRC DLL
 2016-04-22 17:43:58 +02:00
Florian Roth
83d080688e Nanocore RAT 2016-04-22 17:04:04 +02:00
Florian Roth
0ccd098b6a Removed Anti-Analysis RTF Rule 2016-04-21 13:31:29 +02:00
Florian Roth
7026b52f6b Adjusted SLServer Rule 2016-04-21 11:03:55 +02:00
Florian Roth
44baaa5fe6 APT Between Hong-Kong and Burma Rules 2016-04-21 10:32:31 +02:00
Florian Roth
16a2ab9c0c Metasploit Loader by RSMudge 2016-04-21 10:31:41 +02:00
Florian Roth
e5c22901fe Signature Update 
- RTF Anti Analysis Tricks
 2016-04-20 09:28:13 +02:00
Florian Roth
9151ffd103 Signature Updates 
- Four Element Sword
- THOR inverse matching utilman.exe
- CN Webshell rule cosmetics
 2016-04-20 09:26:09 +02:00
Florian Roth
fa93e8eec1 Typo in comment 2016-04-13 01:04:53 +02:00
Florian Roth
9429919561 Fixed indentation 2016-04-13 00:55:43 +02:00
Florian Roth
fd38e39b7d Mimikatz Rule - apply to memory too 2016-04-13 00:52:06 +02:00
Florian Roth
aad907f7ee RTF Anti-Analysis 
http://decalage.info/rtf_tricks
 2016-04-13 00:51:44 +02:00
Florian Roth
62f3edda9f False Positives with Common File Sizes 2016-04-13 00:51:08 +02:00
Florian Roth
65bb44d764 APT6 Malware Signature 2016-04-09 12:55:32 +02:00
Florian Roth
dd4cb5d8a9 Linux Postscanner Shark 
- Replaced older hack tool rule that matched also on goodware
 2016-04-02 02:06:19 +02:00
Florian Roth
b632c0ddde Signature Update 
- Project M APT malware
- TempRacer Priv Esc Tool
- Winshells
 2016-04-01 16:51:30 +02:00
Florian Roth
26c66878b6 Petya Ransomware 2016-03-25 00:29:51 +01:00
Thomas Patzke
4f503dcb92 Decomposition of $hex_api_call in lsadump rule for Yara compatibility reasons 2016-03-23 10:29:05 +01:00
Florian Roth
7b2101bde0 False Positive with old mstsc 2016-03-23 10:05:57 +01:00
Florian Roth
838cdbe318 Bugfix PSAttack Rule 2016-03-09 14:06:18 +01:00
Florian Roth
4d200832eb PSAttack Signature 2016-03-09 14:05:06 +01:00
Florian Roth
085572e77f New Signatures 2016-03-09 13:40:49 +01:00
Florian Roth
8e4dec9f8d Derusbi ELF / Win32 Turbo Campaign 2016-02-29 20:32:42 +01:00
Florian Roth
02d2b41836 False Positives 
- software_reporter_tool.exe
https://www.virustotal.com/en/file/4d83a4250113aabc303b29c99c26da1decc85
e7866db1922dc312799dccb8302/analysis/
- spoolsv.exe anomaly
 2016-02-29 13:46:21 +01:00
Florian Roth
3da4a289e5 Locky Ransomware 2016-02-17 18:03:58 +01:00
Florian Roth
e923b8d0db OTX Signatures Update 17.02.2016 
- Also removed sublime-workspace file
 2016-02-17 10:21:26 +01:00
Florian Roth
3a61922ceb signatures > yara 2016-02-15 12:31:27 +01:00