utils · 6d3fa17156000bea1b495c82897812403de119b4 · fact-depend / rules · GitLab

History Find file

Add detection for hex encoded text PEs · 6d3fa171

References:
https://blog.reversinglabs.com/blog/rats-in-the-library
https://twitter.com/ItsReallyNick/status/1222985472139579392

authored 5 years ago

Name	Last commit	Last update
..
yara-forensics @ a3d03742
README	Create README	8 years ago
base64.yar	Moved Crypto/base64.yar to utils/base64.yar according to #239 and regenerated the index	7 years ago
domain.yar	Added domain and URL rules	8 years ago
ip.yar	Added folder utils and rule to detect IPs	8 years ago
magic.yar	moving rule maldoc_OLE_file_magic_number to utils/magic.yar	7 years ago
suspicious_strings.yar	Add detection for hex encoded text PEs	5 years ago
url.yar	Added domain and URL rules	8 years ago
virustotal.yar	Update virustotal.yar	8 years ago

Note that some ot these rules are not enabled, you have to enabled them