Showing posts with label yara. Show all posts
Showing posts with label yara. Show all posts
Monday, April 27, 2020

phishingkit email phishing yara rule

›
/*     Phishing Kit Emails */ rule PhishingKitEmail {     strings:         $domain1 = "@gmail.com"         $domain2 = ...
1 comment:
Friday, April 10, 2020

Find all Malware in a Folder with a Single String in it

›
# the keyword string to search for $stringToSearchFor = "http://nsis.sf.net/NSIS_Error"; # run strings on all malware *.bin fil...
1 comment:

Use Powershell to Run Yara against entire Folder of Malware

›
# run "myrules.yar" against all *.bin files in a folder and print to standard output get-childitem \ -filter *.bin |select fullna...
1 comment:

Yara Basics - Regular Expression

›
rule HasUrls { strings: $urlregex = /http(s|):\/\/[^\s]+\.[^\s]{2,5}/ $urlregexwide = /http(s|):\/\/[^\s]+\.[^\s]{2,5}/ wide cond...
1 comment:

Yara Basics - Unicode wide

›
rule IsNullsoftInstaller { strings: $nullsoft = "http://nsis.sf.net/NSIS_Error" wide condition: any of them }
2 comments:

Yara Basics - Magic Text

›
rule IsExecutable {     strings:         $exe = { 4D 5A }     condition:         $exe at 0 }
1 comment:
Thursday, December 5, 2019

yaraOneLiner.py

›
# Run Yara Rules against a file ONE LINE AT A TIME instead of against the whole file import os import subprocess import traceback impor...

Neo23x0 Sigma Proxy Rules converted to simple Yara

›
rule Neo23x0SigmaUserAgentMatch { meta:  author = "@neonprimetime"  description = "@Neo23x0 Proxy User Agent Rules https:...

Generic Triage Yara Rules

›
rule RemoteControlUrlAccessed { meta:  author = "@neonprimetime"  description = "Cloud Remote Control Url Accessed" ...
Wednesday, November 6, 2019

Python IoT search with Wget and Yara Rules

›
# Given a list of urls, determine what type of IoT device (or any device for that matter) they are based on you plugging in Yara rules into ...
Monday, February 18, 2019

malware yara rules

›
/* ------------------------- ------ NanoCore ------------ --------------------------- */ rule NanoCoreByName { meta: author = "@neonp...