8f4cfc2196
rule HKTL_NET_GUID_Manager {
rule HKTL_NET_GUID_neo_ConfuserEx {
rule HKTL_NET_GUID_SharpAllowedToAct {
rule HKTL_NET_GUID_SuperSQLInjectionV1 {
rule HKTL_NET_GUID_ADSearch {
rule HKTL_NET_GUID_privilege_escalation_awesome_scripts_suite {
rule HKTL_NET_GUID_CVE_2020_1206_POC {
rule HKTL_NET_GUID_DInvoke {
rule HKTL_NET_GUID_SharpChisel {
rule HKTL_NET_GUID_SharpScribbles {
rule HKTL_NET_GUID_SharpReg {
rule HKTL_NET_GUID_MemeVM {
rule HKTL_NET_GUID_SharpDir {
rule HKTL_NET_GUID_AtYourService {
rule HKTL_NET_GUID_LockLess {
rule HKTL_NET_GUID_EasyNet {
rule HKTL_NET_GUID_SharpByeBear {
rule HKTL_NET_GUID_SharpHide {
rule HKTL_NET_GUID_SharpSvc {
rule HKTL_NET_GUID_SharpCrashEventLog {
rule HKTL_NET_GUID_DotNetToJScript_LanguageModeBreakout {
rule HKTL_NET_GUID_SharPermission {
rule HKTL_NET_GUID_RegistryStrikesBack {
rule HKTL_NET_GUID_CloneVault {
rule HKTL_NET_GUID_donut {
rule HKTL_NET_GUID_SharpHandler {
rule HKTL_NET_GUID_Driver_Template {
rule HKTL_NET_GUID_NashaVM {
|
||
|---|---|---|
| iocs | ||
| misc | ||
| threatintel | ||
| vendor/yara | ||
| yara | ||
| _config.yml | ||
| .gitignore | ||
| .travis.yml | ||
| .yara-ci.yml | ||
| build-rules.py | ||
| LICENSE | ||
| makefile | ||
| README.md | ||
| sig-base-rules.csv | ||
Signature-Base
Signature-Base is the YARA signature and IOC database for our scanners LOKI and THOR Lite
Focus of Signature-Base
- High quality YARA rules and IOCs with minimal false positives
- Clear structure
- Consistent rule format
Directory Structure
- iocs - Simple IOC files (CSV)
- yara - YARA rules
- threatintel - Threat Intel API Receiver (MISP, OTX)
- misc - Other input files (not IOCs or signatures)
External Variables in YARA Rules
Using the YARA rules in a tool other than LOKI or THOR Lite will cause errors stating an undefined identifier. The rules that make use of external variables have been moved to the following 4 rule set files:
- ./yara/generic_anomalies.yar
- ./yara/general_cloaking.yar
- ./yara/thor_inverse_matches.yar
- ./yara/yara_mixed_ext_vars.yar
High Quality YARA Rules Feed
If you liked my rules, please check our commercial rule set and rule feed service, which contains better and 20 times the number of rules.
FAQs
How can I report false positives?
Use the issues section of this repository.
How can I provide a YARA rule or IOCs?
I accept pull requests. See this thread for some help on how to create such a request.
What are the differences between THOR Lite and LOKI?
See our comparison table here.
License
All signatures and IOC files in this repository, except the YARA rules created by 3rd parties, are licensed under the Creative Commons Attribution-NonCommercial 4.0 International License.
The license of this repository changed in August 2018. All forks or copies of this repository that were created before August 26th of 2018 are licensed under GPL 3.0. you can find the last GPL version in the release section.