mirror of
https://github.com/S12cybersecurity/YaraRules
synced 2026-06-08 12:22:33 +00:00
be86905cd12fba7ea0184c0894c6f86869951402
This rule detects custom DLL loading techniques through NTDLL functions, focusing on specific strings and conditions.
YaraRules
This repository contains a collection of YARA rules created and maintained by S12cybersecurity.
As a malware developer, I use this space to publish detection rules for the techniques I implement during research and experimentation.
These rules can help analysts, researchers, and security teams detect and study specific malicious behaviors.
📌 Purpose
- Share custom YARA rules focused on malware techniques.
- Support detection, hunting, and reverse engineering efforts.
- Provide practical resources for the cybersecurity community.
📂 Repository Structure
- Each file corresponds to one or more detection rules.
- Rules are organized by technique or malware functionality.
- Updated as new techniques are tested and published.
🚀 Usage
-
Clone this repository:
git clone https://github.com/S12cybersecurity/YaraRules.git -
Use the rules with your YARA installation:
yara -r rule_file.yar target_file_or_directory -
Integrate them into your own workflows (threat hunting, malware analysis, sandboxing, etc.).
🤝 Contributions
- Contributions, suggestions, and improvements are welcome.
- Please open a pull request or submit an issue if you would like to collaborate.
Description
Languages
YARA
100%