Commits · 608de9dfa679822aae825de184b18c4e7928341b · fact-depend / rules

28 Dec, 2020 6 commits
- Merge pull request #388 from Xyl2k/patch-4 · 608de9df
```
Create MALW_PurpleWave.yar
```
  Jaume Martin authored Dec 28, 2020
  608de9df Browse Files
- Merge pull request #389 from Xyl2k/patch-3 · f36eca9d
```
Create Email_PHP_Mailer.yar
```
  Jaume Martin authored Dec 28, 2020
  f36eca9d Browse Files
- Merge pull request #390 from RandomRhythm/master · f590ac80
```
change file type comment from exe to jar for JavaDropper : RAT
```
  Jaume Martin authored Dec 28, 2020
  f590ac80 Browse Files
- Merge pull request #392 from sylvainpelissier/master · a1f31484
```
Add rules for SipHash and Aria
```
  Jaume Martin authored Dec 28, 2020
  a1f31484 Browse Files
- Index updated · 6b7daa90
  yararules authored Dec 28, 2020
  
  6b7daa90 Browse Files
- Merge pull request #393 from jinwoov/jk-stuxnet-rule · 0b00b5cb
```
Stuxnet python rule
```
  Jaume Martin authored Dec 28, 2020
  0b00b5cb Browse Files
24 Dec, 2020 3 commits
- trying to pass the CI pipeline · 2e531cc2
  Jin Kim authored Dec 23, 2020
  
  2e531cc2 Browse Files
- added stuxnet python source code rule · c7c91400
  Jin Kim authored Dec 23, 2020
  
  c7c91400 Browse Files
- added rule for python stuxnet source code. · 4f362cca
  Jin Kim authored Dec 23, 2020
  
  4f362cca Browse Files
17 Dec, 2020 1 commit
- Add rules for SipHash and Aria, remove duplicate rule and update Chacha rule · 821bcff2
  Sylvain Pelissier authored Dec 17, 2020
  
  821bcff2 Browse Files
21 Sep, 2020 1 commit

Marking Surtr referenced rules RSharedStrings, RemoteStrings, and… · 1384b638

Marking Surtr referenced rules RSharedStrings, RemoteStrings, and GmRemoteStrings as private to limit false alerts.

RSharedStrings alerts on Microsoft signed wininet.dll 6B39A43271B0A631EAEFDAFDD51D17E3
SharedStrings alerts on Microsoft signed ntoskrnl.exe 68762D4C4412B4BB52BE2FC11F977503

Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>

authored Sep 21, 2020

1384b638 Browse Files

11 Sep, 2020 1 commit
- change file type comment from exe to jar for JavaDropper : RAT · 0364f63b
```
Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>
```
  Ryan B authored Sep 11, 2020
  0364f63b Browse Files
02 Aug, 2020 2 commits
- Create MALW_PurpleWave.yar · 1ef31958
```
yara rule to detect PurpleWave
```
  Steven K authored Aug 02, 2020
  1ef31958 Browse Files
- Create Email_PHP_Mailer.yar · 7fc9ade2
```
rule to attempt to find webmailers sent from compromised hosts.
```
  Steven K authored Aug 02, 2020
  7fc9ade2 Browse Files
10 Jul, 2020 2 commits
- Index updated · 6636eafa
  yararules authored Jul 10, 2020
  
  6636eafa Browse Files
- Merge pull request #385 from wesinator/patch-1 · 32e25597
```
rename contentis_base64 to contains
```
  Jaume Martin authored Jul 10, 2020
  32e25597 Browse Files
08 Jul, 2020 1 commit
- rename contentis_base64 to contains · 580272c0
  Ԝеѕ authored Jul 08, 2020
  
  580272c0 Browse Files
01 Jul, 2020 8 commits
- Update README.md · cbb724a5
  Jaume Martin authored Jul 01, 2020
  
  cbb724a5 Browse Files
- Fixing issues · a4a25120
  Xumeiquer authored Jul 01, 2020
  
  a4a25120 Browse Files
- Update Email_fake_it_maintenance_bulletin.yar · 9d49e981
  Jaume Martin authored Jul 01, 2020
  
  9d49e981 Browse Files
- Index updated · 46dd6fd6
  yararules authored Jul 01, 2020
  
  46dd6fd6 Browse Files
- Merge pull request #383 from RandomRhythm/master · 15d44334
```
Move MicrosoftVisualCV80 rule from packer.yar
```
  Jaume Martin authored Jul 01, 2020
  15d44334 Browse Files
- Merge branch 'master' into master · a64cb680
  Jaume Martin authored Jul 01, 2020
  
  a64cb680 Browse Files
- Index updated · 2995d667
  yararules authored Jul 01, 2020
  
  2995d667 Browse Files
- Merge pull request #384 from lcol3117/master · 1e2a195c
```
add .yar extensions and fix a typo
```
  Jaume Martin authored Jul 01, 2020
  1e2a195c Browse Files
30 Jun, 2020 15 commits
- add .yar extension · 2221a82d
  lcol3117 authored Jun 30, 2020
  
  2221a82d Browse Files
- add .yar extension · 05f0684e
  lcol3117 authored Jun 30, 2020
  
  05f0684e Browse Files
- add .yar extension · 43fbf2e4
  lcol3117 authored Jun 30, 2020
  
  43fbf2e4 Browse Files
- add .yar extension · e514042b
  lcol3117 authored Jun 30, 2020
  
  e514042b Browse Files
- add .yar extension · e8e9a5c1
  lcol3117 authored Jun 30, 2020
  
  e8e9a5c1 Browse Files
- add .yar extension · 86cf4c1c
  lcol3117 authored Jun 30, 2020
  
  86cf4c1c Browse Files
- add .yar extension · 6fc3a568
  lcol3117 authored Jun 30, 2020
  
  6fc3a568 Browse Files
- add .yar extension · 95d2648f
  lcol3117 authored Jun 30, 2020
  
  95d2648f Browse Files
- fix typo, there is a space in the reference · 75f29f14
```
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/
is mentioned as the reference, and the picture has a space between “the” and “decryption”.
```
  lcol3117 authored Jun 30, 2020
  75f29f14 Browse Files
- add .yar extension · 33dd74c8
  lcol3117 authored Jun 30, 2020
  
  33dd74c8 Browse Files
- add .yar extension · 994d3dec
  lcol3117 authored Jun 30, 2020
  
  994d3dec Browse Files
- add .yar extension · 1edbe8e0
  lcol3117 authored Jun 30, 2020
  
  1edbe8e0 Browse Files
- add .yar extension · 724127d7
  lcol3117 authored Jun 30, 2020
  
  724127d7 Browse Files
- add .yar extension · 0dceaf7b
  lcol3117 authored Jun 30, 2020
  
  0dceaf7b Browse Files
- add .yar extension · 7a02b74f
  lcol3117 authored Jun 30, 2020
  
  7a02b74f Browse Files