Adding rule from Cylance https://www.cylance.com/en_us/blog/threat-spotlight-inside-the-wannacry-attack.html

Create RANSOM_DoublePulsar_Petya.yar

Booz Allen Hamilton YARA rule on Petya from https://www.boozallen.com/s/insight/publication/the-petya-ransomware-outbreak.html

Email_generic_phishing

Create RANSOM_Erebus.yar

Creating ransomware_PetrWrap.yar

Create Ransomware_Petya_MS17_010

From https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html

New ransomware rule created by kaspersky

changed condition to correct string

Generic rule to identify phishing emails

Create Email_fake_it_maintenance_bulletin

Rule to prevent against known phishing campaign targeting American companies using Microsoft Exchange.

CREATE MALW_LuaBot.yar

Create Email_quota_limit_warning

Added $eml strings and condition. Set condition value higher for $body, requiring more string matches to avoid FP.

YARA Rule for known phishing campaign affecting multiple American companies.

added apt28 downdelph rules

https://www.us-cert.gov/ncas/alerts/TA17-164A?platform=hootsuite

Add eml context to Yara-rules/email to avoid matching these for every file

Updates to PDF rules