valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-07 10:28:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
287 Commits 2 Branches 1 Tag 33 MiB
ba81dfbebf
Commit Graph

287 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Florian Roth
2ecac1d2c1 CKnife Webshell - by Levi 2016-07-20 13:31:11 +02:00
Florian Roth
37f8738c9e Mimikittenz 2016-07-20 13:30:10 +02:00
Florian Roth
0c6838db9a OTX False Positives 2016-07-20 13:29:53 +02:00
Florian Roth
7a68156e21 Furtims Parent 
https://sentinelone.com/blogs/sfg-furtims-parent/
 2016-07-17 12:59:29 +02:00
Florian Roth
09c01737cc Filename IOCs 2016-07-16 11:19:40 +02:00
Florian Roth
e63f5f890d Furtim Malware 2016-07-16 11:03:15 +02:00
Florian Roth
69f96e2011 Stuxnet Rules 
- YARA Rules
- Hash IOCs
 2016-07-11 19:48:03 +02:00
Florian Roth
13ab3e4876 Power PE Reflective Injection Rule by Benjamin Delpy 2016-07-11 19:47:37 +02:00
Florian Roth
e264d66a8e Bugfix in Duqu2 Rule 2016-07-02 19:35:33 +02:00
Florian Roth
76791e7254 False Positive Reduction 2016-07-02 19:32:50 +02:00
Florian Roth
5f664abbd0 SysScan Rules by Kaspersky 2016-07-02 19:32:36 +02:00
Florian Roth
37c1835ae7 Fancy / Cozy Bear Sigs 2016-07-02 19:32:02 +02:00
Florian Roth
652a44d586 Duqu2 Sigs 2016-07-02 19:31:34 +02:00
Florian Roth
669bb122ec OTX Update 2016-07-02 19:31:25 +02:00
Florian Roth
a248f3d8a9 Bugfix in prikormka Rules 2016-06-17 17:24:28 +02:00
Florian Roth
a1927bb1e5 FoxIT Mofang IOCs and YARA Rules 
https://goo.gl/t3uUTG
 2016-06-15 18:58:10 +02:00
Florian Roth
a3323e83aa Sofacy Samples June 2016 
http://researchcenter.paloaltonetworks.com/2016/06/unit42-new-sofacy-att
acks-against-us-government-agency/
 2016-06-15 06:54:30 +02:00
Florian Roth
65ee46b9c9 Turla Rules - RUAG APT 
https://goo.gl/N5MEj0
 2016-06-13 10:41:59 +02:00
Florian Roth
b3a3556dcc SharpCat YARA Signature 2016-06-10 18:14:26 +02:00
Florian Roth
1b9ba2eb17 Dubnium YARA Signatures 
https://blogs.technet.microsoft.com/mmpc/2016/06/09/reverse-engineering-
dubnium-2/
 2016-06-10 17:03:29 +02:00
Florian Roth
a27d6ee020 Sickly Nidiran Trojan YARA Signatures 2016-06-09 09:37:59 +02:00
Florian Roth
f23819ce94 Adjusted YARA Rule 2016-06-08 21:08:44 +02:00
Florian Roth
21cb4b1a45 PlugX Rules for Sample Set June 2016 2016-06-08 20:54:12 +02:00
Florian Roth
3b0ad587a7 Minor Changes to YARA Rules 2016-06-08 11:28:42 +02:00
Florian Roth
16de1a3b72 OTX Update 
- Removed some Sofacy C2 False Positives
 2016-06-08 11:28:22 +02:00
Florian Roth
f6c188143d Merge branch 'master' of https://github.com/Neo23x0/signature-base 2016-06-04 17:39:00 +02:00
Florian Roth
bfdf1bba60 FireEye IronGate APT Yara Rules & File Name IOCs 2016-06-04 17:32:21 +02:00
Florian Roth
b6afdd9631 FireEye IronGate APT File Name IOCs 2016-06-04 17:16:55 +02:00
Florian Roth
0787a28332 FireEye IronGate APT Yara Rules 2016-06-04 17:07:54 +02:00
Florian Roth
dfb6a2b964 Signature Update 2016-06-04 17:07:38 +02:00
Florian Roth
b302b84740 Danti and SVCMONDR Malware Rules 
PWC Report
http://pwc.blogs.com/cyber_security_updates/2016/05/exploring-cve-2015-2
545-and-its-users.html
Kaspersky Blog Post
https://securelist.com/analysis/publications/74828/cve-2015-2545-overvie
w-of-current-threats/
 2016-05-25 16:14:11 -06:00
Florian Roth
902f434811 RUAG APT Case YARA Signatures 
- Signatures based on descriptions in report > not the actual samples
 2016-05-24 07:29:20 -06:00
Florian Roth
8ac0ec1535 Kerberoast 2016-05-24 07:28:42 -06:00
Florian Roth
b95e46c943 No Powershell 2016-05-24 07:28:29 -06:00
Florian Roth
8ae745cf49 ESET: Operation Groundbait, Prikormka malware 2016-05-18 09:34:49 -06:00
Florian Roth
8125a96e68 dnscat2 hacktool 2016-05-18 09:34:18 -06:00
Florian Roth
99a0bada53 Signature Update 
- New PoisonIvy Rule
- ONHAT proxy tool (htran like)
- BeepService APT group hack tool
- Sofacy Adjustments
 2016-05-13 06:06:18 -06:00
Florian Roth
358f4efd8e OTX Hash IOCs 2016-04-27 13:38:08 +02:00
Florian Roth
f6dcff1e51 False Positive Reduction 2016-04-27 13:37:54 +02:00
Florian Roth
ece1450481 Gh0st Dragon RAT 2016-04-27 13:36:53 +02:00
Florian Roth
2f6f765ca9 Microsoft Platinum YARA Rules 2016-04-27 13:36:39 +02:00
Florian Roth
f3fd2022d8 False Positive Reduction 2016-04-27 13:36:17 +02:00
Florian Roth
728ff9d6f3 File Type Signature Update 
- lowercase XML
 2016-04-26 10:08:37 +02:00
Florian Roth
c7d168f5f9 Regsvr32 issue signature 2016-04-26 10:05:17 +02:00
Florian Roth
e3f04a6e71 False Positive Fixes 2016-04-26 10:04:19 +02:00
Florian Roth
b1a5fb6b18 Nano core Rule 
Adjusted Nanocore Rule
 2016-04-25 10:26:46 +02:00
Florian Roth
5533cfb5ab Updated Nanocore Rules 
- Removed Base64 encoded EXE string
 2016-04-24 21:13:18 +02:00
Florian Roth
be8609a15c Adjusted Nanocore Rule 
- false positives with certain IRC DLL
 2016-04-22 17:43:58 +02:00
Florian Roth
83d080688e Nanocore RAT 2016-04-22 17:04:04 +02:00
Florian Roth
0ccd098b6a Removed Anti-Analysis RTF Rule 2016-04-21 13:31:29 +02:00