From 2a387e4c9abf83d75fde29f361f13bee1355ffdf Mon Sep 17 00:00:00 2001
From: S12cybersecurity <79543461+S12cybersecurity@users.noreply.github.com>
Date: Tue, 27 May 2025 21:21:10 +0200
Subject: [PATCH] Create ghost_files.yar

---
 ghost_files.yar | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 ghost_files.yar

diff --git a/ghost_files.yar b/ghost_files.yar
new file mode 100644
index 0000000..cdfd97f
--- /dev/null
+++ b/ghost_files.yar
@@ -0,0 +1,20 @@
+rule GhostFile_Detection_0x12_DarkDev
+{
+    meta:
+        author = "0x12 Dark Development"
+        description = "Detects ghost files loaded in memory with PE headers"
+        version = "1.0"
+        date = "2025-05-27"
+        category = "memory"
+        technique = "FILE_FLAG_DELETE_ON_CLOSE with section mapping"
+        note = "Intended for use with memory scanners that can detect if file is NOT mapped from existing disk path (ghost file)"
+
+    strings:
+        $mz = { 4D 5A }         // 'MZ' header for PE files
+        $pe = { 50 45 00 00 }   // 'PE\0\0' signature
+
+    condition:
+        $mz at 0 and
+        uint32(0x3C) < filesize and
+        $pe at uint32(0x3C)
+}