Marked GlassesCode rule private to prevent alerting. Modified Glasses rule to require both GlassesCode and GlassesStrings to limit alerting. Added a reference URL and a reference file hash value to the rules. Updated the last modified dates. Tested rules against the reference hash file with both GlassesStrings and Glasses producing detections.

Fixes #422

now it only detects documents

Add BLS12-381 subgroup order

Added msql database usage checker

Create MALW_MacGyver.yar

rule to detect smard-card related hacktool/malwares

Added Rule for tweetable-polyglot-png

Include license text

Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>

Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>

add TOOLKIT_Redteam_Tools_by_Name.yar, TOOLKIT_Redteam_Tools_by_GUID.…

add TOOLKIT_Redteam_Tools_by_Name.yar, TOOLKIT_Redteam_Tools_by_GUID.yar, TOOLKIT_Solarwinds_credential_stealer.yar

rules to detect 339 hacktools, mostly c#

Create MALW_PurpleWave.yar

Create Email_PHP_Mailer.yar

change file type comment from exe to jar for JavaDropper : RAT

Add rules for SipHash and Aria

Stuxnet python rule

Marking Surtr referenced rules RSharedStrings, RemoteStrings, and GmRemoteStrings as private to limit false alerts.

RSharedStrings alerts on Microsoft signed wininet.dll	6B39A43271B0A631EAEFDAFDD51D17E3
SharedStrings alerts on Microsoft signed ntoskrnl.exe 68762D4C4412B4BB52BE2FC11F977503

Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>