Commits · 1384b6381008ee4d6086f1a4c3cd23ae46438ec3 · fact-depend / rules

21 Sep, 2020 1 commit

Marking Surtr referenced rules RSharedStrings, RemoteStrings, and… · 1384b638

Marking Surtr referenced rules RSharedStrings, RemoteStrings, and GmRemoteStrings as private to limit false alerts.

RSharedStrings alerts on Microsoft signed wininet.dll 6B39A43271B0A631EAEFDAFDD51D17E3
SharedStrings alerts on Microsoft signed ntoskrnl.exe 68762D4C4412B4BB52BE2FC11F977503

Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>

authored Sep 21, 2020

1384b638 Browse Files

11 Sep, 2020 1 commit
- change file type comment from exe to jar for JavaDropper : RAT · 0364f63b
```
Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>
```
  Ryan B authored Sep 11, 2020
  0364f63b Browse Files
10 Jul, 2020 2 commits
- Index updated · 6636eafa
  yararules authored Jul 10, 2020
  
  6636eafa Browse Files
- Merge pull request #385 from wesinator/patch-1 · 32e25597
```
rename contentis_base64 to contains
```
  Jaume Martin authored Jul 10, 2020
  32e25597 Browse Files
08 Jul, 2020 1 commit
- rename contentis_base64 to contains · 580272c0
  Ԝеѕ authored Jul 08, 2020
  
  580272c0 Browse Files
01 Jul, 2020 8 commits
- Update README.md · cbb724a5
  Jaume Martin authored Jul 01, 2020
  
  cbb724a5 Browse Files
- Fixing issues · a4a25120
  Xumeiquer authored Jul 01, 2020
  
  a4a25120 Browse Files
- Update Email_fake_it_maintenance_bulletin.yar · 9d49e981
  Jaume Martin authored Jul 01, 2020
  
  9d49e981 Browse Files
- Index updated · 46dd6fd6
  yararules authored Jul 01, 2020
  
  46dd6fd6 Browse Files
- Merge pull request #383 from RandomRhythm/master · 15d44334
```
Move MicrosoftVisualCV80 rule from packer.yar
```
  Jaume Martin authored Jul 01, 2020
  15d44334 Browse Files
- Merge branch 'master' into master · a64cb680
  Jaume Martin authored Jul 01, 2020
  
  a64cb680 Browse Files
- Index updated · 2995d667
  yararules authored Jul 01, 2020
  
  2995d667 Browse Files
- Merge pull request #384 from lcol3117/master · 1e2a195c
```
add .yar extensions and fix a typo
```
  Jaume Martin authored Jul 01, 2020
  1e2a195c Browse Files
30 Jun, 2020 18 commits
- add .yar extension · 2221a82d
  lcol3117 authored Jun 30, 2020
  
  2221a82d Browse Files
- add .yar extension · 05f0684e
  lcol3117 authored Jun 30, 2020
  
  05f0684e Browse Files
- add .yar extension · 43fbf2e4
  lcol3117 authored Jun 30, 2020
  
  43fbf2e4 Browse Files
- add .yar extension · e514042b
  lcol3117 authored Jun 30, 2020
  
  e514042b Browse Files
- add .yar extension · e8e9a5c1
  lcol3117 authored Jun 30, 2020
  
  e8e9a5c1 Browse Files
- add .yar extension · 86cf4c1c
  lcol3117 authored Jun 30, 2020
  
  86cf4c1c Browse Files
- add .yar extension · 6fc3a568
  lcol3117 authored Jun 30, 2020
  
  6fc3a568 Browse Files
- add .yar extension · 95d2648f
  lcol3117 authored Jun 30, 2020
  
  95d2648f Browse Files
- fix typo, there is a space in the reference · 75f29f14
```
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/
is mentioned as the reference, and the picture has a space between “the” and “decryption”.
```
  lcol3117 authored Jun 30, 2020
  75f29f14 Browse Files
- add .yar extension · 33dd74c8
  lcol3117 authored Jun 30, 2020
  
  33dd74c8 Browse Files
- add .yar extension · 994d3dec
  lcol3117 authored Jun 30, 2020
  
  994d3dec Browse Files
- add .yar extension · 1edbe8e0
  lcol3117 authored Jun 30, 2020
  
  1edbe8e0 Browse Files
- add .yar extension · 724127d7
  lcol3117 authored Jun 30, 2020
  
  724127d7 Browse Files
- add .yar extension · 0dceaf7b
  lcol3117 authored Jun 30, 2020
  
  0dceaf7b Browse Files
- add .yar extension · 7a02b74f
  lcol3117 authored Jun 30, 2020
  
  7a02b74f Browse Files
- add .yar extension · cb219040
  lcol3117 authored Jun 30, 2020
  
  cb219040 Browse Files
- add .yar extension · 91173e61
  lcol3117 authored Jun 30, 2020
  
  91173e61 Browse Files
- add .yar extension · af96d415
  lcol3117 authored Jun 30, 2020
  
  af96d415 Browse Files
29 Jun, 2020 2 commits
- add .yar extension to Maldoc_hancitor_dropper and add to index · 3d0cd31b
```
Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>
```
  Ryan B authored Jun 29, 2020
  3d0cd31b Browse Files
- Rename Maldoc_APT19_CVE-2017-1099.yar to correct CVE number. · 84039586
```
Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>
```
  Ryan B authored Jun 29, 2020
  84039586 Browse Files
28 Jun, 2020 3 commits
- remove spaces before "rule Retefe" in MALW_Retefe.yar · e59cdda7
```
Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>
```
  Ryan B authored Jun 28, 2020
  e59cdda7 Browse Files
- add .yar extension to ransom rules and add to index · a696d670
```
Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>
```
  Ryan B authored Jun 28, 2020
  a696d670 Browse Files
- rename malware rules missing .yar extension and add to index. · 2e9fc310
```
Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>
```
  Ryan B authored Jun 27, 2020
  2e9fc310 Browse Files
27 Jun, 2020 1 commit

Move MicrosoftVisualCV80 rule from packer.yar to packer_complier_signatures.yar… · 0de1aee4

Move MicrosoftVisualCV80 rule from packer.yar to packer_complier_signatures.yar replacing the commented out rule.

Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>

authored Jun 27, 2020

0de1aee4 Browse Files

21 Jun, 2020 3 commits
- Index updated · be978081
  yararules authored Jun 21, 2020
  
  be978081 Browse Files
- Merge pull request #361 from wesinator/patch-1 · 396f1f86
```
fix blackhole php regex
```
  Jaume Martin authored Jun 22, 2020
  396f1f86 Browse Files
- Merge pull request #377 from baderj/asyncrat · 84fcc938
```
new yara rule for AsyncRAT
```
  Jaume Martin authored Jun 22, 2020
  84fcc938 Browse Files