 Jaume Martin
|
23261cec5f
|
Fixes #419
|
2021-08-26 00:10:58 +02:00 |
|
|
Ryan B
|
f1ea16a62c
|
Merge remote-tracking branch 'upstream/master' into master
|
2021-02-27 15:02:11 -07:00 |
|
|
Ryan B
|
e3e442d4bc
|
Include license text
Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>
|
2021-02-27 15:02:06 -07:00 |
|
|
Steven K
|
7fc9ade2a1
|
Create Email_PHP_Mailer.yar
rule to attempt to find webmailers sent from compromised hosts.
|
2020-08-02 19:40:10 +02:00 |
|
|
Xumeiquer
|
a4a251208d
|
Fixing issues
|
2020-07-01 22:52:12 +02:00 |
|
|
Jaume Martin
|
9d49e981a7
|
Update Email_fake_it_maintenance_bulletin.yar
|
2020-07-01 12:31:57 +02:00 |
|
|
Ryan B
|
1a3d24256d
|
add .yar extension to the following rules and add to indexes:
Email_fake_it_maintenance_bulletin
Email_generic_phishing.yar
Email_quota_limit_warning.yar
Signed-off-by: Ryan B <randomrhythm@rhythmengineering.com>
|
2020-06-09 21:48:46 -06:00 |
|
|
Milann SHRESTHA
|
a079d8ba05
|
Create extortion_email.yar
|
2020-05-12 09:38:05 +05:45 |
|
|
Wan-Ping Tsai
|
e27ca3de04
|
Update Email_generic_phishing
<class 'yara.SyntaxError'>: unreferenced string "$
|
2018-01-03 15:04:53 +08:00 |
|
|
Jaume Martin
|
46f7018eb4
|
Update Email_generic_phishing
|
2017-09-19 09:05:20 +02:00 |
|
|
Tyler
|
653646f83d
|
Update Email_generic_phishing
|
2017-06-23 16:22:21 -06:00 |
|
|
Tyler
|
f0eb721273
|
Update Email_generic_phishing
changed condition to correct string
|
2017-06-23 16:21:23 -06:00 |
|
|
Tyler
|
c7e6acc3f8
|
Create Email_generic_phishing
Generic rule to identify phishing emails
|
2017-06-23 16:19:29 -06:00 |
|
|
Antonio Sánchez
|
82b90f7ac4
|
Merge pull request #251 from Tlinne2/Tlinne2-patch-1
Create Email_fake_it_maintenance_bulletin
|
2017-06-22 09:52:55 +02:00 |
|
|
Tyler Linne
|
bde8e6f072
|
Create Email_fake_it_maintenance_bulletin
Rule to prevent against known phishing campaign targeting American companies using Microsoft Exchange.
|
2017-06-21 18:19:25 -06:00 |
|
|
Tyler Linne
|
2cfc2a7e63
|
Update Email_quota_limit_warning
Added $eml strings and condition. Set condition value higher for $body, requiring more string matches to avoid FP.
|
2017-06-16 07:14:27 -06:00 |
|
|
Tyler Linne
|
3d29d980cd
|
Create Email_quota_limit_warning
YARA Rule for known phishing campaign affecting multiple American companies.
|
2017-06-15 15:54:07 -06:00 |
|
|
Antonio Sánchez
|
6b3e91a72b
|
Create urls.yar
|
2017-06-13 11:07:34 +02:00 |
|
|
Michal Ambroz
|
b850f3898d
|
Add eml context to given rules to avoid matching these for every single file
|
2017-06-12 15:53:39 +02:00 |
|
|
mmorenog
|
39206a310e
|
Update urls.yar
|
2016-03-29 13:19:25 +02:00 |
|
|
mmorenog
|
cceef54309
|
Update scam.yar
|
2016-03-29 13:19:11 +02:00 |
|
|
mmorenog
|
2bfc93e54b
|
Update image.yar
|
2016-03-29 13:18:55 +02:00 |
|
|
mmorenog
|
5a11fef9d2
|
Update email_Ukraine_BE_powerattack.yar
|
2016-03-29 13:18:40 +02:00 |
|
|
mmorenog
|
ba695c6132
|
Update attachment.yar
|
2016-03-29 13:18:15 +02:00 |
|
|
mmorenog
|
9c43090c02
|
Update bank_rule.yar
|
2016-03-29 13:17:53 +02:00 |
|
|
mmorenog
|
bcc4dc9010
|
Update EMAIL_Cryptowall.yar
|
2016-02-27 15:33:44 +01:00 |
|
|
mmorenog
|
368746c492
|
Update email_Ukraine_BE_powerattack.yar
|
2016-02-04 15:11:18 +01:00 |
|
|
mmorenog
|
0d66a6c63a
|
Update email_Ukraine_BE_powerattack.yar
|
2016-02-04 14:16:17 +01:00 |
|
|
mmorenog
|
881c1ad542
|
Update email_Ukraine_BE_powerattack.yar
|
2016-02-04 13:48:09 +01:00 |
|
|
mmorenog
|
f764aaa1bd
|
Create email_Ukraine_BE_powerattack.yar
|
2016-02-04 13:22:07 +01:00 |
|
|
Antonio S
|
ce12e9fadd
|
Added ruleset to detect a type of scam
|
2016-02-01 10:04:18 +01:00 |
|
|
Jose Vila
|
5d94f30cce
|
Deleted email_ruleset.yar
|
2016-01-28 09:04:00 +01:00 |
|
|
mmorenog
|
b1a176d2c5
|
Create EMAIL_Cryptowall.yar
|
2015-12-25 19:42:09 +01:00 |
|
|
Antonio S
|
65a48377b3
|
Some rules to detect features in emails
|
2015-11-30 09:06:42 +01:00 |
|