dutchpsycho 6e2a9f5f2c ui/analysis: add YARA rules bundle for signature intel scanning ...

Ship two default detection rules: a direct-syscall stub byte sequence
(T1106, severity 7) and common AMSI patch byte patterns (T1562.001,
severity 6). The JSON manifest at Rules/SignatureIntel/signature-rules.json
maps each YARA rule name to its detection label, severity, and MITRE
technique so the scanning engine can produce structured heuristic hits.
Refs #9, #10.

2026-04-15 13:00:00 +00:00

..

default-rules.yar

ui/analysis: add YARA rules bundle for signature intel scanning

2026-04-15 13:00:00 +00:00

signature-rules.json

ui/analysis: add YARA rules bundle for signature intel scanning

2026-04-15 13:00:00 +00:00