 ditekshen
|
7442eeef89
|
Fixes and updates to RMM yara, calmav and invenotry
|
2023-08-23 14:33:56 +03:00 |
|
|
ditekshen
|
61a0009bbb
|
Disable FP until fixed
|
2023-08-22 16:54:01 +03:00 |
|
|
ditekshen
|
9062a7ff71
|
Add new INDICATOR_RMM category and RMM inventory, add new detection in malware and indicator_tools
|
2023-08-22 16:36:58 +03:00 |
|
|
ditekshen
|
c12acd0081
|
Add detection against Rhysida,JanelaRAT,PovertyStealer,TelegramRAT/ToxicEye,QwixxRAT
|
2023-08-15 15:59:33 +03:00 |
|
|
ditekshen
|
33a1aba357
|
Add Yara detection against LOLKEK,Spacecolon and ClamAV and Snort detecction against LummaStealer
|
2023-08-13 19:07:48 +03:00 |
|
|
ditekshen
|
acbc315234
|
Update Fiber of other variants
|
2023-08-11 12:51:24 +03:00 |
|
|
ditekshen
|
c5edde1e74
|
Remove FP and addd Fiber injector
|
2023-08-10 16:13:43 +03:00 |
|
|
ditekshen
|
342c77c241
|
Add associated ClamAV signatures
|
2023-08-10 15:15:36 +03:00 |
|
|
ditekshen
|
fad3f76071
|
Add various malware and indicator_suspicious rules
|
2023-08-10 14:57:40 +03:00 |
|
|
ditekshen
|
e5113d2971
|
Add more signatures
|
2023-08-03 19:19:09 +03:00 |
|
|
ditekshen
|
e00023f038
|
Add various signatures in malware and indicator_tools
|
2023-08-03 18:25:38 +03:00 |
|
|
ditekshen
|
b07b207a3a
|
Add detection against Bagle and Rage/Priv8
|
2023-07-27 20:36:08 +03:00 |
|
|
ditekshen
|
8d641c3f0f
|
Remove clamav_sig meta from Yara rules that did not have a clamav sig
|
2023-07-24 15:46:03 +03:00 |
|
|
ditekshen
|
fa3b66857e
|
Add and update rules in yara and clamav
|
2023-07-24 15:17:28 +03:00 |
|
|
ditekshen
|
4ded0ba657
|
Update and add rules
|
2023-07-22 15:36:22 +03:00 |
|
|
ditekshen
|
88ca8d34f3
|
Update several rules
|
2023-07-21 11:42:55 +03:00 |
|
|
ditekshen
|
14099a1ff4
|
Update LummaStealer and Amaday to reduce FNs
|
2023-07-20 20:32:00 +03:00 |
|
|
ditekshen
|
8bf0a32f6d
|
Add detection against ARCrypt and RootTeam Stealer
|
2023-07-17 18:56:50 +03:00 |
|
|
ditekshen
|
7548169851
|
Add DarkCloud signature
|
2023-07-15 14:29:43 +03:00 |
|
|
ditekshen
|
ce5df37e50
|
Fix FPs
|
2023-07-14 10:55:26 +03:00 |
|
|
ditekshen
|
d6e4228cdb
|
Add RomCom,STEALDEAL,Underground and update indicator suspicious
|
2023-07-14 10:04:53 +03:00 |
|
|
ditekshen
|
e4a3a1d3b9
|
Add ModiLoader, Akira in malware and DWAgent RAT in indicator_tools
|
2023-07-10 19:13:01 +03:00 |
|
|
ditekshen
|
7405f48923
|
Update malwar.yar
|
2023-07-07 15:12:56 +03:00 |
|
|
ditekshen
|
04983c224c
|
Add G0Crypt / BRG0SNet / NovaGP
|
2023-07-06 12:07:17 +03:00 |
|
|
ditekshen
|
b36f7c0879
|
Add and update signatures
|
2023-07-06 09:38:17 +03:00 |
|
|
ditekshen
|
5f7168ef88
|
Update yara-ci
|
2023-07-04 16:06:03 +03:00 |
|
|
ditekshen
|
1a2ee26229
|
Add various signatures
|
2023-07-04 15:46:03 +03:00 |
|
|
ditekshen
|
ef4757a4af
|
Add detection against ArrowRAT and DuckTail in malware | more Ngrok in indicator_tools
|
2023-06-30 14:52:29 +03:00 |
|
|
ditekshen
|
2513ca159b
|
add detection against cybersyealer and update indicator_suspicious
|
2023-06-29 18:13:53 +03:00 |
|
|
ditekshen
|
3eb4223454
|
Add detection against sqlrecon and atlasreaper in indicator_tools
|
2023-06-29 14:45:35 +03:00 |
|
|
ditekshen
|
6587628747
|
Add dotRunpeX detection in malware
|
2023-06-28 23:41:08 +03:00 |
|
|
ditekshen
|
a720dab6db
|
Update indicator_packed
|
2023-06-28 20:27:22 +03:00 |
|
|
ditekshen
|
4650de861d
|
Update malware.yar
|
2023-06-28 19:43:48 +03:00 |
|
|
ditekshen
|
266799294b
|
add ClipBanker in malware and UNC_Regex in indicator_suspicious
|
2023-06-28 18:57:01 +03:00 |
|
|
ditekshen
|
41eb763076
|
Fix indicator_suspicious.yar
|
2023-06-27 21:49:41 +03:00 |
|
|
ditekshen
|
86c88cb39a
|
Add XWorm in malware | DontSleep, NSudo, Ligolo, ExtPassword, Ngrok in tools
|
2023-06-27 21:47:25 +03:00 |
|
|
ditekshen
|
cf65580c41
|
Add TrueBot and LummaStealer in malware | azbelt, revsocks, NanoDump and SharpShares in tools | update indicator_knownbad_certs.yar and indicator_packed.yar
|
2023-06-26 10:53:20 +03:00 |
|
|
ditekshen
|
badddda9bc
|
add raccoon stealer 2.0, aka recordbreaker
|
2023-06-23 23:03:33 +03:00 |
|
|
ditekshen
|
005d0e16f0
|
Fix rules titles in indicator_suspicious
|
2023-06-23 12:06:39 +03:00 |
|
|
ditekshen
|
15c9479e62
|
add 'in2al5d p3in4er' yara and clamav sigs
|
2023-06-23 11:51:13 +03:00 |
|
|
ditekshen
|
2f9970566c
|
Add and updates malware and indicator_suspicious rules
|
2023-06-23 11:17:34 +03:00 |
|
|
ditekshen
|
b97fa8e548
|
disable INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets until further review
|
2023-06-20 21:01:40 +03:00 |
|
|
admin
|
8352499a64
|
few updates
|
2023-06-20 20:50:03 +03:00 |
|
|
ditekshen
|
2ce6878bd7
|
Fix certificate rules FPs
|
2022-03-11 10:18:57 +03:00 |
|
|
ditekshen
|
91ec485282
|
Add new signtures
|
2022-02-18 14:58:18 +03:00 |
|
|
ditekshen
|
acd2c4e685
|
Add and update signatures
|
2022-02-04 11:12:41 +03:00 |
|
|
ditekshen
|
caaf09eec3
|
Fix FP
|
2022-01-27 18:19:21 +03:00 |
|
|
ditekshen
|
cee6e0ee80
|
Add and update signatures
|
2022-01-27 18:12:01 +03:00 |
|
|
ditekshen
|
f3e3ad2dd3
|
Add and update signatures
|
2021-12-31 11:56:27 +03:00 |
|
|
diˈtekSHən
|
76863acf15
|
Fix FP
INDICATOR_KB_CERT_3300000187721772155940c709000000000187 \
|
2021-12-18 20:52:23 +03:00 |
|