bbot
bbot copied to clipboard
Collection of Default YARA Rules
We should have a collection of default YARA rules as .yaml files. These would do useful things like:
- Tagging events (e.g. login pages)
- Raising findings (e.g. verbose errors / serialized objects)
Basically, any rules that are simple enough to express in YAML, we should keep as separate files so they're more easily maintainable and don't take up space in excavate.py.
@liquidsec
I feel like @SpamFaux and team could help determine what would be useful for this