S12cybersecurity be86905cd1 Add rule for detecting custom DLL loading via NTDLL
This rule detects custom DLL loading techniques through NTDLL functions, focusing on specific strings and conditions.
2026-01-12 10:17:29 +01:00
2025-10-07 21:24:36 +02:00
2025-08-26 21:45:19 +02:00
2025-05-27 21:21:10 +02:00
2025-09-25 21:55:58 +02:00
2025-07-22 21:46:48 +02:00
2025-10-02 10:41:04 +02:00
2025-10-01 21:38:05 +02:00

YaraRules

This repository contains a collection of YARA rules created and maintained by S12cybersecurity.

As a malware developer, I use this space to publish detection rules for the techniques I implement during research and experimentation.
These rules can help analysts, researchers, and security teams detect and study specific malicious behaviors.


📌 Purpose

  • Share custom YARA rules focused on malware techniques.
  • Support detection, hunting, and reverse engineering efforts.
  • Provide practical resources for the cybersecurity community.

📂 Repository Structure

  • Each file corresponds to one or more detection rules.
  • Rules are organized by technique or malware functionality.
  • Updated as new techniques are tested and published.

🚀 Usage

  1. Clone this repository:

    git clone https://github.com/S12cybersecurity/YaraRules.git
    
  2. Use the rules with your YARA installation:

    yara -r rule_file.yar target_file_or_directory
    
  3. Integrate them into your own workflows (threat hunting, malware analysis, sandboxing, etc.).


🤝 Contributions

  • Contributions, suggestions, and improvements are welcome.
  • Please open a pull request or submit an issue if you would like to collaborate.
S
Description
Automated archival mirror of github.com/S12cybersecurity/YaraRules
Readme 163 KiB
Languages
YARA 100%