From 2ddbbe14eea1f342bca2cfd09a643a40ae2fcaf6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?di=CB=88tekSH=C9=99n?=
 <43088607+ditekshen@users.noreply.github.com>
Date: Sat, 8 Jun 2024 11:46:45 +0300
Subject: [PATCH] FP: Disable INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

---
 yara/indicator_suspicious.yar | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/yara/indicator_suspicious.yar b/yara/indicator_suspicious.yar
index d2ec646..3dadfb6 100644
--- a/yara/indicator_suspicious.yar
+++ b/yara/indicator_suspicious.yar
@@ -986,6 +986,7 @@ rule INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File {
         uint16(0) == 0x5a4d and 1 of them
 }
 
+/*
 rule INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL {
      meta:
         author = "ditekSHen"
@@ -997,6 +998,7 @@ rule INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL {
     condition:
         uint16(0) == 0x5a4d and (($url1 and $raw) or ($url2))
 }
+*/
 
 rule INDICATOR_SUSPICIOUS_EXE_RawPaste_URL {
      meta: