9b53a9dde4
Merge pull request #410 from cod3nym/article-unc1549-may26
...
Add rules and IOCs for UNC1549 article
2026-06-01 17:01:35 +02:00
653634f9d3
Update susp_generic_rules_may26.yar
...
Add blog post reference and company name to author
2026-06-01 15:48:41 +02:00
32b00a95ed
Update apt_apt35_malware_may26.yar
...
Add blog post references and company name to author tag
2026-06-01 15:47:27 +02:00
1d702a2483
Update apt_apt35_malware_may26.yar
...
Remove highly specific marker to match SUSP nature of the rule
2026-06-01 14:26:33 +02:00
34395034bb
Add IOCs for UNC1549 campaign
2026-06-01 12:19:44 +02:00
709edc7061
Add IOCs for UNC1549
2026-06-01 12:17:24 +02:00
c903507676
Create susp_generic_rules_may26.yar
2026-06-01 12:09:21 +02:00
7d18bdf4cf
Create apt_apt35_malware_may26.yar
2026-06-01 12:08:05 +02:00
c6cd90267d
fix: fps with MRT
2026-05-26 11:12:28 +02:00
a33f158ce1
fix: fps with MRT
2026-05-26 11:05:05 +02:00
2f2378d5ff
chore: uuid clean-up
2026-05-15 19:21:48 +02:00
cd323c8621
Update expl_lnx_dirtyfrag.yar
2026-05-08 17:25:48 +02:00
8382a43db0
Create expl_lnx_dirtyfrag.yar
2026-05-08 17:21:29 +02:00
6d52302aa7
Merge branch 'master' of https://github.com/Neo23x0/signature-base
2026-05-08 13:42:45 +02:00
2c9381be2b
dirtyfrag IOC
2026-05-08 13:39:08 +02:00
8a2be134c8
Merge pull request #405 from cod3nym/report_daemon_tools_lite_compromise_may26
...
Add YARA rules and IOCs for the DAEMON Tools Lite supplychain compromise
2026-05-05 20:05:27 +02:00
a379cecce9
fix: unescaped dot character in filename IOCs
2026-05-05 17:52:11 +02:00
d8dcdaa68b
Add DAEMON Tools Lite supplychain compromise IOCs
2026-05-05 17:36:31 +02:00
c86468d165
Add IOCs for DAEMON Tools Lite supplychain compromise
2026-05-05 17:33:15 +02:00
e7129ee269
Add IOCs for # DAEMON Tools Lite supplychain comrpomise
2026-05-05 17:31:38 +02:00
7b9412bdeb
Create threat_compromised_daemon_tools_lite_may26.yar
2026-05-05 17:28:44 +02:00
08ce994ce0
Create hktl_edge_pwd_dumper_may25.yar
2026-05-05 09:26:24 +02:00
682f9b011a
Update expl_copy_fail_cve_2026_31431.yar
2026-04-30 22:09:31 +02:00
7fbabb745d
Update expl_copy_fail_cve_2026_31431.yar
2026-04-30 22:07:55 +02:00
b7f4b024cb
docs: add reference
2026-04-30 12:32:20 +02:00
ad939d59f1
Update expl_copy_fail_cve_2026_31431.yar
2026-04-30 12:27:12 +02:00
f3d2bdea81
refactor: extend expression to avoid fps
2026-04-30 12:09:20 +02:00
3c2986014c
Merge branch 'master' of https://github.com/Neo23x0/signature-base
2026-04-30 12:04:00 +02:00
d31c31b2c8
renamed file
2026-04-30 12:03:52 +02:00
188db8b65e
Merge pull request #404 from Neo23x0/copy-fail-rules
...
YARA rules to detect Copy Fail POCs CVE-2026-31431
2026-04-30 11:00:51 +02:00
5e66f1c0ca
Create expl_copy_fail_cve_2026_31431.yar
2026-04-30 10:51:50 +02:00
a63a834c1a
Merge pull request #401 from Neo23x0/codex/yara-syntax-checks
...
ci: validate YARA syntax on pull requests
2026-04-20 13:53:51 +02:00
8bd8325f2d
ci: share YARA external-variable allowlist
2026-04-17 15:32:27 +02:00
6d56b531f0
ci: validate YARA syntax on pull requests
2026-04-17 13:44:50 +02:00
eaf65c0c2c
Merge branch 'master' of https://github.com/Neo23x0/signature-base
2026-04-17 12:54:28 +02:00
e841376c5a
fix: FPs
2026-04-17 12:54:26 +02:00
08fc0da840
Merge pull request #400 from cod3nym/patch-6
...
Add rule for RedSun privilege escalation POC
2026-04-17 12:52:11 +02:00
cfcb4a1767
Update hktl_redsun_apr26.yar
2026-04-17 12:51:39 +02:00
e19927bc33
Add rule for RedSun privilege escalation POC
2026-04-17 10:51:19 +02:00
8a89b3bf54
Merge pull request #399 from FarghlyMal/patch-1
...
Update BlueHammer_tool.yar
2026-04-09 14:00:32 +02:00
134421494a
Update BlueHammer_tool.yar
2026-04-08 20:43:04 +02:00
3bd3738ead
Merge pull request #398 from FarghlyMal/FarghlyMal-patch-1
...
Create BlueHammer_tool.yar
2026-04-08 20:40:09 +02:00
2058ff231c
Create BlueHammer_tool.yar
2026-04-08 20:33:41 +02:00
5b7aa6a9f3
Merge pull request #396 from RuneCode14/fix/certutil-fp-awscli
...
fix: add FP exclusion for AWS CLI docs in Certutil_Decode_OR_Download
2026-04-01 09:41:10 +02:00
c14386a452
fix: correct modified date to 2026
2026-04-01 08:30:22 +02:00
9103ccdfbd
fix: add FP exclusion for AWS CLI docs in Certutil_Decode_OR_Download
...
Add false positive exclusion for AWS CLI documentation (.rst files)
that contain legitimate certutil -decode usage examples.
The string 'https://docs.aws.amazon.com ' appears in all affected
documentation files (awscli pip package) and excludes them from
detection without weakening the rule for actual malicious scripts.
2026-04-01 08:27:05 +02:00
49761a39df
Merge pull request #395 from marius-benthin/axios-supply-chain-attack
...
new: rules for axios supply chain attack
2026-03-31 15:25:47 +02:00
6550f146ab
new: rules for axios supply chain attack
2026-03-31 13:22:19 +02:00
46a5060187
Merge pull request #392 from ruppde/improve-performance-webshell-rule
...
Update gen_webshells.yar
2026-03-31 12:26:08 +02:00
cdf3c40286
Merge pull request #394 from marius-benthin/teampcp
...
new: rules for litellm and telnyx
2026-03-31 12:25:47 +02:00
Florian Roth