Yara-rules

About What is this? A repo containing some of my privately developed Yara rules. Why? To contribute to the community. Can I use these rules? Of course! That's why I created this repo. You can use them in your detection systems. For example, CAPE sandbox, MalwareBazaar, UnPac.me and VirusTotal mus...

CVE-2023-21716_YARA_Results

This repository does not have a README...

SentinelThread-Forensics

🛡️ Sentinel Thread Pro The High-Speed Windows Forensic Triage Platform 📋 The Mission In modern SOC operations, manual EVTX analysis is a death sentence for your MTTR Mean Time to Respond. Sentinel Thread Pro is built to bridge the gap between massive raw event logs and actionable forensic...

CVE-2026-33057---Mesop-Unauthenticated-RCE-PoC-and-yara-rules

CVE-2026-33057---Mesop-Unauthenticated-RCE-PoC-and-yara-rules CVE-2026-33057 - Mesop Unauthenticated RCE PoC and yara rules Realistically, I'm not sure if it will work, it probably won't work, but you try it anyway... BİO and DONATES : https://guns.lol/hackpatato cve prof:...

Malware

YARA rules, programs for ransomware families: Akira Babuk Beast BlackByte BlackCat ALPHV BlackMatter BlueLocker MemeCryptor Cerber Conti DarkBit DeadBolt Dharma Enmity GarrantyDecrypt GlobeImposter / NewBomani GoodMorning / SD HardBit Hive / Hunters International HsHarada / Rapture Hunters...

Sigma-Rules

Sigma-Rules A repository of my own Sigma detection rules...

EnableWindowsLogSettings

Yamato Security's Windows Event Log Configuration Guide For DFIR And Threat Hunting English | 日本語 This is yet another guide on properly configuring and monitoring Windows event logs with an emphasis on logging for sigma rules. This is a work in progress, so check back please periodically for...

yararules

yararules Yara rulez; rules too. This is a repository of my own YARA rules grouped together with publicly available YARA rules, collected from open sources, polished and QA tested by me. Contact: craiu at protonmail.ch...

2024

100 Days of YARA 2024 Welcome to 100 Days of YARA! This repository will act as the store for all YARA ideas created during this time. Any fun scripts, tools, or rules you write can be committed to this GitHub repository! For now, any associated blogging, walkthroughs, or other musing can be hoste...

WindowsFirewallRuleset

Windows Firewall Ruleset !Alt Textcorporate firewall Table of Contents Windows Firewall Ruleset Table of Contents About Windows Firewall Ruleset Firewall rules Firewall framework The vision of this firewall License Requirements Requirements details I don't meet the requirements First time user...

super

SUPER Android Analyzer Secure, Unified, Powerful and Extensible Rust Android Analyzer SUPER is a command-line application that can be used in Windows, MacOS X and Linux, that analyzes .apk files in search for vulnerabilities. It does this by decompressing APKs and applying a series of rules to...

Hob0Rules

Hob0Rules Password cracking rules for Hashcat based on statistics and industry patterns. The following blog posts on passwords explain the statistical signifigance of these rulesets: Statistics Will Crack Your Password Praetorian Password Cracking Rules Released Useful wordlists to utilize with...

raptor

Raptor is a web-based web-serivce + UI github centric source-vulnerability scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans every-time you commit or merge a pull request. The scan is done asynchonously and the results are available...

naxsi

Project Status This is a project status update regarding Naxsi. As you may have noticed, the development of Naxsi has been stopped and the repository will be archived for historical reasons. This means that no new updates or bug fixes will be released for this version. However, if you wish to...

dirtyfrag-detection-rules

dirtyfrag-detection-rules Detection rules and analysis for Dirty Frag CVE-2026-43284/CVE-2026-43500 Linux kernel LPE vulnerability. Based on community research and health probe configurations...

CrowdFMS

Copyright C 2013 CrowdStrike, Inc. This file is subject to the terms and conditions of the BSD License. See the file LICENSE in the main directory for details CrowdFMS is a framework for automating collection and processing of samples from VirusTotal, by leveraging the Private API system. This...

halogen

Halogen is a tool to automate the creation of yara rules based on the image files embedded within a malicious document. This can assist cyber security professionals in writing detection rules for malicious threats as well as help responders in identifying with particular threat they are dealing...

halogen

Halogen es una herramienta para automatizar la creación de reglas YARA basadas en los archivos de imagen incrustados dentro de un documento malicioso. Esto puede ayudar a los profesionales de ciberseguridad a escribir reglas de detección para amenazas maliciosas, así como ayudar a los respondedor...

stacs

Escáner Estático de Tokens y Credenciales ¿Qué es? STACS es un escáner estático de credenciales impulsado por YARA que admite formatos de archivo binarios, análisis de archivos anidados, conjuntos de reglas y listas de ignorados componibles, e informes SARIF. ¿Qué soporta STACS? Actualmente, STAC...

heyserial

HEY SERIAL! Author: Alyssa Rahman @ramen0x3f Created: 2021-10-27 Last Updated: 2021-12-02 Blog: https://www.mandiant.com/resources/hunting-deserialization-exploits For more details on this tool and the research process behind it, check out our blog! Description Programmatically create hunting rul...