valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 18:15:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
Signature base for my scanner tools
734 Commits 2 Branches 1 Tag 33 MiB
YARA 99%
Python 1%
55aa4639d2
Go to file
Florian Roth 55aa4639d2 TA18-149A YARA signatures 
https://www.us-cert.gov/ncas/alerts/TA18-149A
2018-06-01 09:25:27 +02:00
iocs False Positive Hash 2018-05-29 14:22:28 +02:00
misc Mimikatz log file type 2017-12-20 15:48:00 +01:00
threatintel False Positive Reduction 2018-04-06 12:45:37 +02:00
vendor/yara Added AirBnb / BinaryAlert YARA rules in new vendor directory 2017-10-20 11:21:49 +02:00
yara TA18-149A YARA signatures 2018-06-01 09:25:27 +02:00
.gitignore Travis Tests and makefile 2017-08-11 16:00:44 +02:00
.travis.yml Travis Tests and makefile 2017-08-11 16:00:44 +02:00
build-rules.py Python 3 support in build script 2018-01-24 20:26:34 +01:00
LICENSE Initial commit 2016-02-15 10:16:53 +01:00
makefile Makefile adjusted to reflect prebuilt YARA 3.6.2 features 2017-08-15 21:14:31 +02:00
README.md Updated README - YARA rules with external vars 2018-03-12 13:44:40 +01:00

README.md

Build Status

Signature-Base

signature-base is a submodule for my scanner tools LOKI and SPARK

Directory Structure

  • iocs - Simple IOC files (CSV)
  • yara - YARA rules
  • threatintel - Threat Intel API Receiver (MISP, OTX)
  • misc - Other input files (not IOCs or signatures)

External Variables in YARA Rules

Using the YARA rules in a tool other than LOKI will cause errors stating an undefined identifier. The rules that make use of external variables have been moved to the following 4 rule set files:

  • ./yara/generic_anomalies.yar
  • ./yara/general_cloaking.yar
  • ./yara/thor_inverse_matches.yar
  • ./yara/yara_mixed_ext_vars.yar

License

The signature-base repository is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This signature-base is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICLAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with the signature-base repository. If not, see http://www.gnu.org/licenses/.