Florian Roth
892b159c00
First commit of TA18-074A rules
2018-03-16 16:32:11 +01:00
Florian Roth
d37c5f6b98
False Positive
...
https://github.com/Neo23x0/Loki/issues/101#issuecomment-373337359
2018-03-15 12:36:37 +01:00
Florian Roth
65d45e5638
Fixed false positives in Slingshot APT sigs
2018-03-12 15:26:00 +01:00
Florian Roth
5334216f73
Prone to false positives
...
https://www.virustotal.com/en/file/8e928dc79b4dd5695b1b3fcd4592b7179c2e2857a82d325d49237977636b21d2/analysis/
2018-03-12 14:56:19 +01:00
Florian Roth
2ce3e0bbaf
Fix to avoid too many false positives
2018-03-12 14:49:03 +01:00
Florian Roth
117270469f
Moved all rules that use ext vars to a new rule set
2018-03-12 13:47:40 +01:00
Florian Roth
ff9c4850c5
Updated README - YARA rules with external vars
2018-03-12 13:44:40 +01:00
Florian Roth
3018b8b551
Extended the APT15 rules by NCCGroups rules (revised)
...
https://github.com/nccgroup/Royal_APT/blob/master/signatures/apt15.yara
2018-03-12 12:55:33 +01:00
Florian Roth
07b44fe78a
APT15 YARA signatures
...
https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
2018-03-12 09:40:31 +01:00
Florian Roth
125a220411
Slingshot APT YARA signatures
...
https://securelist.com/apt-slingshot/84312/
2018-03-10 12:20:04 +01:00
Florian Roth
9f06d34539
Slingshot APT file hashes
...
https://securelist.com/apt-slingshot/84312/
2018-03-09 16:58:04 +01:00
Florian Roth
3fe8f66d3b
Bigfix: missing "pe" import
2018-03-09 15:35:38 +01:00
Florian Roth
d99e4b859e
NSA’s perspective on APT landscape - file name IOCs
...
https://blog.crysys.hu/2018/03/territorial-dispute-nsas-perspective-on-apt-landscape/
2018-03-09 15:30:19 +01:00
Florian Roth
9c5765484d
DonotTeam YTYFramework YARA sig
...
https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/
2018-03-09 15:29:45 +01:00
Florian Roth
b031d55469
Crimson RAT
2018-03-08 18:56:38 +01:00
Florian Roth
cecd779892
Updated generic dump files : gesecdump output
2018-03-08 18:48:55 +01:00
Florian Roth
b0f6890de1
TSCookie RAT
2018-03-08 18:48:55 +01:00
Florian Roth
9152a81c7e
Merge pull request #27 from JohnLaTwC/patch-3
...
finds powershell commands obfuscated by unicorn
2018-03-08 18:26:22 +01:00
Florian Roth
62ff9d53f5
PowerShell payload obfuscated by Unicorn toolkit
2018-03-08 18:24:10 +01:00
JohnLaTwC
70c1a24de4
finds powershell commands obfuscated by unicorn
...
I see unicorn samples uploaded to VT a few times a day. Here is a rule for it.
Unicorn toolkit: https://github.com/trustedsec/unicorn/
Example hashes:
14c708d8577eafc56fa8af4d45aaedfbba185aee6ffc22650b2b5b4a58c6ae0f
19c8d44fe80cfbd61e30f9aeef3f7433473e6ae66d7b2e26bae22ed9b338a755
1f1990d08ae6ac2480e2ba4fcc4f00105aa2eb8606fa5b23be450922a705a637
211c690cded91446b43ec2bd89a8071df8b96442b3fa9762a91945c8987996db
4b877196a90b2ad62fe795fff63d36742d9099ae677fe5e44ef47e6a9919adc4
5239c2de70c82b70ce3dac0669b4b4ec95b5d5fd0286bad8e3ec960217e20627
Also https://twitter.com/JohnLaTwC/status/971536587388407809
2018-03-07 17:29:36 -08:00
Florian Roth
37ccc0a471
Merge pull request #26 from JohnLaTwC/patch-2
...
yara rule for encoded python payloads for adware
2018-03-07 23:07:08 +01:00
JohnLaTwC
7cab502150
yara rule for encoded python payloads for adware
...
Ran it through a retrohunt earlier and has good true positive track record in VT. Very interesting python samples that it is a part of.
2018-03-07 08:45:57 -08:00
Florian Roth
5110a57cd5
Minor changes: performance reasons, reference, hashes split up
2018-03-05 15:41:51 +01:00
Florian Roth
7c4b9b1725
Merge pull request #24 from JohnLaTwC/patch-1
...
generic python reverse shell
2018-03-05 15:36:05 +01:00
Florian Roth
27442f03b0
Operation Honey Bee Malware YARA sigs
...
https://securingtomorrow.mcafee.com/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/
2018-03-03 16:12:34 +01:00
Florian Roth
77281d4ea2
Generic dropper PDB string
2018-03-03 12:15:31 +01:00
Florian Roth
0b21871f52
IceFog malware
...
https://twitter.com/ClearskySec/status/968104465818669057
2018-03-03 10:15:24 +01:00
Florian Roth
51f7b978a1
FinFisher IOCs
2018-03-02 17:04:34 +01:00
Florian Roth
e9eac4fdc6
Merge pull request #25 from jantdm/patch-1
...
Link broken
2018-03-02 13:46:54 +01:00
Florian Roth
c41806f2cf
False Positive Reduction
2018-03-01 19:13:20 +01:00
Florian Roth
aefa8e8af7
Bugfix and extended Sofacy rule
2018-03-01 09:34:03 +01:00
Florian Roth
4bdcf3c64b
Sofacy IOCs and YARA signature
2018-03-01 09:29:57 +01:00
Florian Roth
c6807a024d
Dumper False Positive Reduction
2018-03-01 09:29:35 +01:00
Jan Tiedemann
786fe0bffb
Link broken
...
Link to DCSO Apache Struts Vulns was broken (https://goo.gl/t4FKT5 ). Fixed that for you (https://goo.gl/7jGkpV ).
2018-02-28 20:44:59 +01:00
Florian Roth
9fca4d3b9c
Fixed OTX IOCs / getall() retrieved IOCs from authors I wasn't subscribed to
2018-02-28 08:25:05 +01:00
Florian Roth
3a7554d535
MuddyWater Doc Dropper
2018-02-27 09:54:05 +01:00
JohnLaTwC
865ac9ce04
generic python reverse shell
...
seen in:
1b97cb64e9be8db9d5e959d183f4c5469f7eafab0e34198be784f2e54a9cc768
22b33d5f2028eff3b11a68c8971cfcc6b57509efecf0af7ac6f9aa33e3929f93
25bd4762908751d19b4d27479470cb442319a1419af559bc5c31b83bece20ad4
26b8b960f08fea6d9f18a7ff7a44f46c90972d0fd48332ea90c32f8293266088
528bf356946abd82ce4639e1f66bd71bbad2fadfc83df1c4ff92ffd61e5e8a2c
5eb14f86ab101c5b78d8397a89e7c5a775464565dc5ed6af30eef14f264e0a62
640c80a36f387026871aa2d5e8447f990ec5b18395eb46f453c4215aee0d1846
6623f7f5a326c932ea893419509eac8c243363fea5eadbb940da0d3f949c79a6
6ca26484201218eb0352ce50f1937ec84f09f5187b882c23d2c9a67015d6aedb
743b5192bfe88e67dd1d2259a3ce5b02250b47fefa01274a88eb063a4746b378
b42309e69b8066bdb54faf425d19f5c84e5a00959e641609590cd6607a4601d6
b4e7f9a84ba3ad5f88ced24b43f5ba9bcc98976c45ae74b3e8c47921590e27f7
b8fd4dfe91708511ca87a83b3ee97da0dd4b5cc1e106e2ea6cb93ccddd3b7b17
bfb5c622a3352bb71b86df81c45ccefaa68b9f7cc0a3577e8013aad951308f12
c365c6d27f04637804f4d28c5aa5166342db1aa8712d94488bc518a21f408f53
f3b443d83488c35d5c11ff9eda98d460bf650071235561d3290f7f25c4c76405
fadb468f0324666a4b8eeb3bb499e84b11daa32efac2ae8ccaddf3941c5e25b1
2018-02-24 14:52:23 -08:00
Florian Roth
3ed59d8f58
False Positive WinPcap
2018-02-24 21:41:10 +01:00
Florian Roth
d85ae13956
OSX malware by @JohnLaTwC
...
https://ghostbin.com/paste/mz5nf
2018-02-24 10:08:40 +01:00
Florian Roth
328024dfd0
Turla Mosquito YARA Sigs
...
https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf
2018-02-23 11:50:35 +01:00
Florian Roth
8c2e553b72
Turla Mosquito Filename IOCs
2018-02-23 09:08:45 +01:00
Florian Roth
41e27b5786
False Positive
2018-02-22 10:35:09 +01:00
Florian Roth
5741438d48
Wscript.Shell rule false positive reduction
2018-02-20 20:12:00 +01:00
Florian Roth
2bdfedfd1a
NanoCore RAT update
2018-02-20 20:11:09 +01:00
Florian Roth
4bc10e04b4
False Posiitives
2018-02-19 14:40:39 +01:00
Florian Roth
2a46ed46e6
False Positives
2018-02-19 14:36:50 +01:00
Florian Roth
1cd914cb2b
New format not yet ready
2018-02-15 20:53:15 +01:00
Florian Roth
3d116ff009
False Positive Reduction
2018-02-15 17:08:17 +01:00
Florian Roth
898deba325
Loki Bot and Dropper (Feb variant)
2018-02-15 17:08:01 +01:00
Florian Roth
1af4d4347c
New CVE-2017-11882 detection rule
2018-02-14 08:51:45 +01:00
