100DaysOfYARA
100DaysOfYARA copied to clipboard
3vangel1st
This repository is monitoring and recording interesting links of the 100 Days of YARA Challenge 2022
Blogs & Links:
-
G-leg's Github: where he records his YARA rules: https://github.com/g-les/100DaysofYARA
-
SHellcromancer: - YARA vs Crypto Algorithms: https://gist.github.com/shellcromancer
-
Willi Ballentin: - YARA traverse the TEB/PEB/LDR data: https://gist.github.com/williballenthin/08891865082a8bd5bf921b58fa312ada#file-peb_parsing-yara
-
Thomas Barabosch: Detecting API hashing with YARA: https://0xc0decafe.com/apihash-to-yara/
-
Droogy: RTF documents with embedded objects: https://gist.github.com/Droogy/b5e0480815e6a960c2858ec4b1f9ba84
-
@xorhex' blogs on YARA following along with the challenge: https://blog.xorhex.com/blog/onehundreddiscontiguousdaysofyara-day6/
-
Schrodyn: Dump .NET MemberRef Table as a Yara Rule: https://github.com/schrodyn/memberref2yara
-
Instacyber: YARA rule to detect B64 Windows commands: https://github.com/instacyber/yara/blob/main/b64_windows_recon_cmds.yara
-
Droogy: Colection of hunting rules: https://gist.github.com/Droogy/b5e0480815e6a960c2858ec4b1f9ba84
-
R00ten: vti-cosplay: Low Budget VirusTotal Intelligence Cosplay https://r00tten.com/vti-cosplay/
-
@Secman_pl : Hunting for OpenSSL: https://github.com/secman-pl/yaras/blob/main/hunt_PE_openssl_statically_compiled.yar
-
Scrodyn: Hunting Linux kernel module: https://gist.github.com/schrodyn/8b8b78da076b04b86767f311cd149384
Tools:
-
Binlex: https://github.com/c3rb3ru5d3d53c/binlex by @c3rb3ru5d3d53c
-
@cocaman: Yara Scan Service - free Retrohunt-like service on 100GB+ of samples https://riskmitigation.ch/yara-scan/
-
Schrodyn: Steezy: a python tool for ghetto generation of Yara rules from the VA of a function in a compiled executable. https://github.com/schrodyn/steezy
-
Steezy: YARA Rule generation tool: https://github.com/schrodyn/steezy
3vangel1st