diff --git a/utils/domain.yar b/utils/domain.yar new file mode 100644 index 0000000..593c979 --- /dev/null +++ b/utils/domain.yar @@ -0,0 +1,13 @@ +/* + This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as + long as you use it under this license. +*/ + +rule domain { + meta: + author = "Antonio S. " + strings: + $domain_regex = /([\w\.-]+)/ wide ascii + condition: + $domain_regex +} diff --git a/utils/url.yar b/utils/url.yar new file mode 100644 index 0000000..462ae50 --- /dev/null +++ b/utils/url.yar @@ -0,0 +1,13 @@ +/* + This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as + long as you use it under this license. +*/ + +rule url { + meta: + author = "Antonio S. " + strings: + $url_regex = /https?:\/\/([\w\.-]+)([\/\w \.-]*)/ wide ascii + condition: + $url_regex +}