https://github.com/mattulm/sfiles_yara

A collection of YARA signatures that I have found around the web.
https://github.com/mattulm/sfiles_yara

Last synced: 3 months ago
JSON representation

A collection of YARA signatures that I have found around the web.

• Host: GitHub
• URL: https://github.com/mattulm/sfiles_yara
• Owner: mattulm
• Created: 2016-02-01T16:49:47.000Z (about 9 years ago)
• Default Branch: master
• Last Pushed: 2016-04-29T00:41:58.000Z (almost 9 years ago)
• Last Synced: 2024-08-04T23:11:03.463Z (6 months ago)
• Size: 10.6 MB
• Stars: 10
• Watchers: 5
• Forks: 8
• Open Issues: 1
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-security-collection - **6**星

README

        
# sigs

So far this is just a collection of YARA signatures I found on the web, through various sources. I have tried to deduplicate as much as possible, but there could be a few that I have missed. Also, I have tried to make sure that no private, or commercial rules have been included in this listing. These should all be Open Source and available to all.

I have given credit to the authors where and when I have it. If there is a rule of yours that you wish to not be included in this repository, please let me know, and I will remove it. If you have some rules that you would like included in this repository;

	1. first, thank you!!!

	2. I will add them, once I have been able to test, and verify it works and is not a duplicate of previous included rules.

	

Currently in the collection:

	android 	- Many of these require the androguard module. These haev been placed in a seperate folder.

	constants 	- A collection of signatures to detect specific constants. These could include file types, crypto 

				  signatures, types of packers and compilers, debugging, sandboxes, etc.

	linux		- Not too many of these, but I have included what I have been able to find.

	mac			- Not too many of these, but I have included what I have been able to find.

	network 	- For now, this is various signatures to detect specific types of network activity not related to malware. 

				  Dynamic DNS domains are included in here. A few signatures based on generic network activity as well.