Commits · 51be7dbf63797ab10944a562bec17bba7491502f · fact-depend / rules

27 Feb, 2021 3 commits
- PHP and ASPX China Chopper · 51be7dbf
```
Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>
```
  Ryan B authored Feb 27, 2021
  51be7dbf Browse Files
- Merge remote-tracking branch 'upstream/master' into master · f1ea16a6
  Ryan B authored Feb 27, 2021
  
  f1ea16a6 Browse Files
- Include license text · e3e442d4
```
Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>
```
  Ryan B authored Feb 27, 2021
  e3e442d4 Browse Files
26 Feb, 2021 2 commits
- Index updated · 85cb1fad
  yararules authored Feb 26, 2021
  
  85cb1fad Browse Files
- Update README.md · cc76f933
  Jaume Martin authored Feb 26, 2021
  
  cc76f933 Browse Files
05 Feb, 2021 2 commits
- Index updated · e388b607
  yararules authored Feb 05, 2021
  
  e388b607 Browse Files
- Merge pull request #400 from 2d4d/master · 5021ddc1
```
add TOOLKIT_Redteam_Tools_by_Name.yar, TOOLKIT_Redteam_Tools_by_GUID.…
```
  Jaume Martin authored Feb 05, 2021
  5021ddc1 Browse Files
23 Jan, 2021 1 commit

add TOOLKIT_Redteam_Tools_by_Name.yar, TOOLKIT_Redteam_Tools_by_GUID.yar,… · 1605470d

add TOOLKIT_Redteam_Tools_by_Name.yar, TOOLKIT_Redteam_Tools_by_GUID.yar, TOOLKIT_Solarwinds_credential_stealer.yar

rules to detect 339 hacktools, mostly c#

authored Jan 23, 2021

1605470d Browse Files

28 Dec, 2020 7 commits
- Index updated · d3b9d62e
  yararules authored Dec 28, 2020
  
  d3b9d62e Browse Files
- Merge pull request #388 from Xyl2k/patch-4 · 608de9df
```
Create MALW_PurpleWave.yar
```
  Jaume Martin authored Dec 28, 2020
  608de9df Browse Files
- Merge pull request #389 from Xyl2k/patch-3 · f36eca9d
```
Create Email_PHP_Mailer.yar
```
  Jaume Martin authored Dec 28, 2020
  f36eca9d Browse Files
- Merge pull request #390 from RandomRhythm/master · f590ac80
```
change file type comment from exe to jar for JavaDropper : RAT
```
  Jaume Martin authored Dec 28, 2020
  f590ac80 Browse Files
- Merge pull request #392 from sylvainpelissier/master · a1f31484
```
Add rules for SipHash and Aria
```
  Jaume Martin authored Dec 28, 2020
  a1f31484 Browse Files
- Index updated · 6b7daa90
  yararules authored Dec 28, 2020
  
  6b7daa90 Browse Files
- Merge pull request #393 from jinwoov/jk-stuxnet-rule · 0b00b5cb
```
Stuxnet python rule
```
  Jaume Martin authored Dec 28, 2020
  0b00b5cb Browse Files
24 Dec, 2020 3 commits
- trying to pass the CI pipeline · 2e531cc2
  Jin Kim authored Dec 23, 2020
  
  2e531cc2 Browse Files
- added stuxnet python source code rule · c7c91400
  Jin Kim authored Dec 23, 2020
  
  c7c91400 Browse Files
- added rule for python stuxnet source code. · 4f362cca
  Jin Kim authored Dec 23, 2020
  
  4f362cca Browse Files
17 Dec, 2020 1 commit
- Add rules for SipHash and Aria, remove duplicate rule and update Chacha rule · 821bcff2
  Sylvain Pelissier authored Dec 17, 2020
  
  821bcff2 Browse Files
21 Sep, 2020 1 commit

Marking Surtr referenced rules RSharedStrings, RemoteStrings, and… · 1384b638

Marking Surtr referenced rules RSharedStrings, RemoteStrings, and GmRemoteStrings as private to limit false alerts.

RSharedStrings alerts on Microsoft signed wininet.dll 6B39A43271B0A631EAEFDAFDD51D17E3
SharedStrings alerts on Microsoft signed ntoskrnl.exe 68762D4C4412B4BB52BE2FC11F977503

Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>

authored Sep 21, 2020

1384b638 Browse Files

11 Sep, 2020 1 commit
- change file type comment from exe to jar for JavaDropper : RAT · 0364f63b
```
Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>
```
  Ryan B authored Sep 11, 2020
  0364f63b Browse Files
02 Aug, 2020 2 commits
- Create MALW_PurpleWave.yar · 1ef31958
```
yara rule to detect PurpleWave
```
  Steven K authored Aug 02, 2020
  1ef31958 Browse Files
- Create Email_PHP_Mailer.yar · 7fc9ade2
```
rule to attempt to find webmailers sent from compromised hosts.
```
  Steven K authored Aug 02, 2020
  7fc9ade2 Browse Files
10 Jul, 2020 2 commits
- Index updated · 6636eafa
  yararules authored Jul 10, 2020
  
  6636eafa Browse Files
- Merge pull request #385 from wesinator/patch-1 · 32e25597
```
rename contentis_base64 to contains
```
  Jaume Martin authored Jul 10, 2020
  32e25597 Browse Files
08 Jul, 2020 1 commit
- rename contentis_base64 to contains · 580272c0
  Ԝеѕ authored Jul 08, 2020
  
  580272c0 Browse Files
01 Jul, 2020 8 commits
- Update README.md · cbb724a5
  Jaume Martin authored Jul 01, 2020
  
  cbb724a5 Browse Files
- Fixing issues · a4a25120
  Xumeiquer authored Jul 01, 2020
  
  a4a25120 Browse Files
- Update Email_fake_it_maintenance_bulletin.yar · 9d49e981
  Jaume Martin authored Jul 01, 2020
  
  9d49e981 Browse Files
- Index updated · 46dd6fd6
  yararules authored Jul 01, 2020
  
  46dd6fd6 Browse Files
- Merge pull request #383 from RandomRhythm/master · 15d44334
```
Move MicrosoftVisualCV80 rule from packer.yar
```
  Jaume Martin authored Jul 01, 2020
  15d44334 Browse Files
- Merge branch 'master' into master · a64cb680
  Jaume Martin authored Jul 01, 2020
  
  a64cb680 Browse Files
- Index updated · 2995d667
  yararules authored Jul 01, 2020
  
  2995d667 Browse Files
- Merge pull request #384 from lcol3117/master · 1e2a195c
```
add .yar extensions and fix a typo
```
  Jaume Martin authored Jul 01, 2020
  1e2a195c Browse Files
30 Jun, 2020 6 commits
- add .yar extension · 2221a82d
  lcol3117 authored Jun 30, 2020
  
  2221a82d Browse Files
- add .yar extension · 05f0684e
  lcol3117 authored Jun 30, 2020
  
  05f0684e Browse Files
- add .yar extension · 43fbf2e4
  lcol3117 authored Jun 30, 2020
  
  43fbf2e4 Browse Files
- add .yar extension · e514042b
  lcol3117 authored Jun 30, 2020
  
  e514042b Browse Files
- add .yar extension · e8e9a5c1
  lcol3117 authored Jun 30, 2020
  
  e8e9a5c1 Browse Files
- add .yar extension · 86cf4c1c
  lcol3117 authored Jun 30, 2020
  
  86cf4c1c Browse Files