Commit Graph

Select branches

Hide Pull Requests

master

#1

#21

#24

#25

#26

Mono Color

• e76c93dcde Add new rule master ditekshen 2024-11-01 09:29:35 +03:00
• cd99e732c8 Update indicator_rmm ditekshen 2024-10-04 09:44:02 +03:00
• ee5945d7a8 Add new rules ditekshen 2024-10-04 08:07:30 +03:00
• 6bba6f5266 Add and update rules in rmm and tools indicators ditekshen 2024-09-25 18:35:57 +03:00
• 085f534be2 Add new rules ditekshen 2024-09-23 15:42:55 +03:00
• 56f976ff24 Add new rules ditekshen 2024-09-21 09:03:05 +03:00
• 5784a57044 Dedup and update rule ditekshen 2024-09-06 16:45:07 +03:00
• ea89528820 Disable performance hog indicator_office rules fixing #29, add new rules ditekshen 2024-09-06 16:36:32 +03:00
• 6419013759 Fix #30 diˈtekSHən 2024-07-19 09:16:13 +03:00
• 2ddbbe14ee FP: Disable INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL diˈtekSHən 2024-06-08 11:46:45 +03:00
• 7c2d40d839 Relax houdini match condition diˈtekSHən 2024-05-28 16:28:05 +03:00
• 3e5b6d03c7 Add Houdini diˈtekSHən 2024-05-28 16:18:59 +03:00
• 7a20810fb6 Update malware.yar diˈtekSHən 2024-05-28 15:15:48 +03:00
• f57369c1c6 Add ScoutElite and Landroid from back-in-2017 diˈtekSHən 2024-05-28 10:14:00 +03:00
• 9876b5a1a1 Update malware.yar diˈtekSHən 2024-05-27 14:45:37 +03:00
• c37b067259 Fix FNs for INDICATOR_RTF_EXPLOIT_CVE_2017_11882_1 ditekshen 2024-02-22 18:04:22 +03:00
• a896a95adc Add and update rules ditekshen 2024-02-22 15:26:54 +03:00
• 5fc671f9f4 Add rules ditekshen 2024-01-23 15:15:43 +03:00
• e6a95b7968 Fix false detection ditekshen 2023-12-30 21:11:45 +03:00
• 59bcc4cdd6 Fix error in INDICATOR_OLE_ObjectPool_Embedded_Files ditekshen 2023-12-29 12:07:16 +03:00
• a9ef14211d Add and update rules ditekshen 2023-12-29 12:03:54 +03:00
• 045ba6f813 Add detection against simda/shifu ditekshen 2023-12-27 09:54:01 +03:00
• e3f2c56070 Update rules ditekshen 2023-12-26 11:50:19 +03:00
• a0de2f7cca Fix FPs ditekshen 2023-12-19 14:43:20 +03:00
• e5d86022d9 Fixes ditekshen 2023-12-19 14:39:35 +03:00
• 7ffd5b0512 Add and updates rules in malware and office ditekshen 2023-12-19 13:29:22 +03:00
• 859b6c7a67 Add and update rules ditekshen 2023-12-17 12:22:18 +03:00
• febe5f51f1 Update .yara-ci ditekshen 2023-12-08 12:23:20 +03:00
• 87cdb8e5e3 Fix #23 and add rules to indicator_knownbad_certs ditekshen 2023-12-08 12:08:09 +03:00
• 369627fad5 Fix errors ditekshen 2023-11-30 10:40:32 +03:00
• d838fb41c7 Add signatures ditekshen 2023-11-30 10:38:17 +03:00
• e83e7ff38f Merge pull request #21 from iam-py-test/patch-1 diˈtekSHən 2023-11-18 18:38:29 +03:00
• d53924bbc1 Minor changes iam-py-test 2023-11-18 10:23:18 -05:00
• 91ebea452d Add signatures ditekshen 2023-11-16 14:31:52 +03:00
• 8a781cd417 Fix #19 ditekshen 2023-10-26 09:28:42 +03:00
• 0519f0af59 Add and update rules. Fix #17 ditekshen 2023-10-13 13:08:32 +03:00
• e657959077 Add indicator_suspicious detection for service interfaces ditekshen 2023-09-11 10:03:24 +03:00
• c47b8d0405 Small updates ditekshen 2023-09-05 18:28:11 +03:00
• d150d8dcf0 Add Snort detection against CVE-2023-36844 ditekshen 2023-08-29 13:58:39 +03:00
• 033a1d897b Add multiple detections ditekshen 2023-08-29 13:07:08 +03:00
• 1ea379e46d Add new detection for malware and rmm ditekshen 2023-08-25 12:20:08 +03:00
• 80623ed98a Disable INDICATOR_RMM_MeshCentral_CERT ditekshen 2023-08-23 14:43:54 +03:00
• 7442eeef89 Fixes and updates to RMM yara, calmav and invenotry ditekshen 2023-08-23 14:33:56 +03:00
• 61a0009bbb Disable FP until fixed ditekshen 2023-08-22 16:54:01 +03:00
• 9062a7ff71 Add new INDICATOR_RMM category and RMM inventory, add new detection in malware and indicator_tools ditekshen 2023-08-22 16:36:58 +03:00
• c12acd0081 Add detection against Rhysida,JanelaRAT,PovertyStealer,TelegramRAT/ToxicEye,QwixxRAT ditekshen 2023-08-15 15:59:33 +03:00
• 33a1aba357 Add Yara detection against LOLKEK,Spacecolon and ClamAV and Snort detecction against LummaStealer ditekshen 2023-08-13 19:07:48 +03:00
• acbc315234 Update Fiber of other variants ditekshen 2023-08-11 12:51:24 +03:00
• c5edde1e74 Remove FP and addd Fiber injector ditekshen 2023-08-10 16:13:43 +03:00
• 342c77c241 Add associated ClamAV signatures ditekshen 2023-08-10 15:15:36 +03:00
• fad3f76071 Add various malware and indicator_suspicious rules ditekshen 2023-08-10 14:57:40 +03:00
• e5113d2971 Add more signatures ditekshen 2023-08-03 19:19:09 +03:00
• e00023f038 Add various signatures in malware and indicator_tools ditekshen 2023-08-03 18:25:38 +03:00
• b07b207a3a Add detection against Bagle and Rage/Priv8 ditekshen 2023-07-27 20:36:08 +03:00
• 8d641c3f0f Remove clamav_sig meta from Yara rules that did not have a clamav sig ditekshen 2023-07-24 15:46:03 +03:00
• fa3b66857e Add and update rules in yara and clamav ditekshen 2023-07-24 15:17:28 +03:00
• 4ded0ba657 Update and add rules ditekshen 2023-07-22 15:36:22 +03:00
• 88ca8d34f3 Update several rules ditekshen 2023-07-21 11:42:55 +03:00
• 14099a1ff4 Update LummaStealer and Amaday to reduce FNs ditekshen 2023-07-20 20:32:00 +03:00
• 8bf0a32f6d Add detection against ARCrypt and RootTeam Stealer ditekshen 2023-07-17 18:56:50 +03:00
• 7548169851 Add DarkCloud signature ditekshen 2023-07-15 14:29:43 +03:00
• ce5df37e50 Fix FPs ditekshen 2023-07-14 10:55:26 +03:00
• d6e4228cdb Add RomCom,STEALDEAL,Underground and update indicator suspicious ditekshen 2023-07-14 10:04:53 +03:00
• e4a3a1d3b9 Add ModiLoader, Akira in malware and DWAgent RAT in indicator_tools ditekshen 2023-07-10 19:13:01 +03:00
• 7405f48923 Update malwar.yar ditekshen 2023-07-07 15:12:56 +03:00
• 04983c224c Add G0Crypt / BRG0SNet / NovaGP ditekshen 2023-07-06 12:07:17 +03:00
• b36f7c0879 Add and update signatures ditekshen 2023-07-06 09:38:17 +03:00
• 5f7168ef88 Update yara-ci ditekshen 2023-07-04 16:06:03 +03:00
• 1a2ee26229 Add various signatures ditekshen 2023-07-04 15:46:03 +03:00
• ef4757a4af Add detection against ArrowRAT and DuckTail in malware | more Ngrok in indicator_tools ditekshen 2023-06-30 14:52:29 +03:00
• 2513ca159b add detection against cybersyealer and update indicator_suspicious ditekshen 2023-06-29 18:13:53 +03:00
• 3eb4223454 Add detection against sqlrecon and atlasreaper in indicator_tools ditekshen 2023-06-29 14:45:35 +03:00
• 6587628747 Add dotRunpeX detection in malware ditekshen 2023-06-28 23:41:08 +03:00
• a720dab6db Update indicator_packed ditekshen 2023-06-28 20:27:22 +03:00
• 4650de861d Update malware.yar ditekshen 2023-06-28 19:43:48 +03:00
• 266799294b add ClipBanker in malware and UNC_Regex in indicator_suspicious ditekshen 2023-06-28 18:57:01 +03:00
• 41eb763076 Fix indicator_suspicious.yar ditekshen 2023-06-27 21:49:41 +03:00
• 86c88cb39a Add XWorm in malware | DontSleep, NSudo, Ligolo, ExtPassword, Ngrok in tools ditekshen 2023-06-27 21:47:25 +03:00
• cf65580c41 Add TrueBot and LummaStealer in malware | azbelt, revsocks, NanoDump and SharpShares in tools | update indicator_knownbad_certs.yar and indicator_packed.yar ditekshen 2023-06-26 10:53:20 +03:00
• badddda9bc add raccoon stealer 2.0, aka recordbreaker ditekshen 2023-06-23 23:03:33 +03:00
• 005d0e16f0 Fix rules titles in indicator_suspicious ditekshen 2023-06-23 12:06:39 +03:00
• 15c9479e62 add 'in2al5d p3in4er' yara and clamav sigs ditekshen 2023-06-23 11:51:13 +03:00
• 2f9970566c Add and updates malware and indicator_suspicious rules ditekshen 2023-06-23 11:17:34 +03:00
• b97fa8e548 disable INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets until further review ditekshen 2023-06-20 21:01:40 +03:00
• 8352499a64 few updates admin 2023-06-20 20:50:03 +03:00
• 2ce6878bd7 Fix certificate rules FPs ditekshen 2022-03-11 10:18:57 +03:00
• 91ec485282 Add new signtures ditekshen 2022-02-18 14:58:18 +03:00
• acd2c4e685 Add and update signatures ditekshen 2022-02-04 11:12:41 +03:00
• caaf09eec3 Fix FP ditekshen 2022-01-27 18:19:21 +03:00
• cee6e0ee80 Add and update signatures ditekshen 2022-01-27 18:12:01 +03:00
• f3e3ad2dd3 Add and update signatures ditekshen 2021-12-31 11:56:27 +03:00
• 76863acf15 Fix FP diˈtekSHən 2021-12-18 20:52:23 +03:00
• 99773a4eb5 Fix MALWARE_Win_Khonsari ditekSHen 2021-12-17 10:25:41 +03:00
• deb33a377a Add and update signatures ditekSHen 2021-12-17 10:18:46 +03:00
• 0930675fa1 Add and update signatures, remove FPs ditekSHen 2021-12-10 12:48:47 +03:00
• 25055fe48d Add and update signatures ditekSHen 2021-12-03 10:07:08 +03:00
• 35378ae340 Add Tardigrade signature ditekSHen 2021-11-30 20:37:22 +03:00
• 299c8e0972 Add and update signatures ditekSHen 2021-11-30 18:30:53 +03:00
• 6aa3754c9d Add known bad certs signatures ditekSHen 2021-11-24 21:45:38 +03:00
• d05d303529 Add and update signatures ditekSHen 2021-11-24 21:37:42 +03:00