Fnord

Fnord Fnord is a pattern extractor for obfuscated code Description Fnord has two main functions: 1. Extract byte sequences and create some statistics 2. Use these statistics, combine length, number of occurrences, similarity and keywords to create a YARA rule 1. Statistics Fnord processes the fil...

CVE-2025-32433-Detection

CVE-2025-32433 Detection Author: te0rwx Created: 2025-08-27 Upt. 2026-08-16 Description A custom YARA rule for detecting known artifacts associated with CVE-2025-32433 , an Erlang/OTP SSH pre-authentication remote code execution RCE vulnerability. The rule was developed and validated against publ...

detect-cve-2024-4367

Detect CVE-2024-4367 Quick-and-dirty YARA detection rule for CVE-2024-4367 arbitrary javascript execution in PDF.js. Usage $ yara explpdfjscve20244367.yar pocgeneralizedCVE-2024-4367.pdf EXPLPDFJSCVE20244367 pocgeneralizedCVE-2024-4367.pdf Credits POC and disclosure from...

Kalim_Backdoor

Kalim Backdoor Malware Analysis Report This Report will talk about the functionality of Kalim Backdoor Malware. Table of Contents: - What is Backdoor? - Technical Analysis. - Summary. - Tactics & Technique MITRE ATT&CK. - IOCs. - Yara Rule. What does Backdoor mean? A backdoor is a hidden...

cobaltstrike-sleepmask-yara

cobaltstrike-sleepmask-yara Just a git repo for the sleepmask detection rule i found in https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs tl;dr The tl;dr of it is that these bytes are part of the sleep mask kit unobfuscated .text section itsel...

BruteRatel-DetectionTools

BruteRatel-DetectionTools A collection of Tools and Rules for decoding Brute Ratel C4 badgers All tools and rules are based on samples identified by PaloAlto in their report https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ Yara Rule The yara rule has been tested against the samples includ...

cs_yara

csyara Check Cobalt Strike Yara Rules 参考链接 https://github.com/CCob/BeaconEye BeaconEye Bug Fix: https://wbglil.gitbook.io/cobalt-strike/cobalt-strike-gong-ji-fang-yu/untitled-1 rule from https://raw.githubusercontent.com/CCob/BeaconEye/master/BeaconEye.cs beaconEye.yar rule CobaltStrike strings:...

detect_CVE-2026-21509

Detections for the CVE-2026-21509 vulnerability in MS Office This repository contains a YARA rule to detect RTF documents with a potential exploit for CVE-2026-21509, and a Python script to check if MS Office files contain Shell.Explorer.1 OLE objects, which is related to that vulnerability. See...

keepass_CVE-2023-24055_yara_rule

keepassCVE-2023-24055yararule Contains a simple yara rule to hunt for possible compromised KeePass config files How-to Use a yara rule scanner, like yara, loki or thor-lite to scan systems with this rule. The default location for the local KeePass config file is...

CVE-2022-26134-Exploit-Detection

Confluence RCE CVE-2022-26134 Exploit Detection Pre-requisites 1. ClamAV Clone this repository or download the Yara rule on your confluence server We are using the Yara rule provided by volexity/threat-intel who first unveiled this vulnerability. Git Clone git clone...

Detectar-Backdoor-en-liblzma-de-XZ-utils-CVE-2024-3094-

Detect-Backdoor-in-liblzma-of-XZ-utils-CVE-2024-3094- The following YARA rule helps detect the presence of the backdoor in the compromised liblzma library on systems using versions 5.6.0 and 5.6.1 of the XZ compression tool. This provides a mechanism to identify vulnerable systems that could be...

Malicious code in react-refresh-update (npm)

Package contains highly obfuscated code with dynamic execution using eval, a strong indicator of malicious intent. YARA rule matches confirm. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68cf0c0bd6ed2a8c07bc175b5c0cc7f86a49133e67dd5d8f68f37309c5f1a463 The...

Exploit for Reliance on Untrusted Inputs in a Security Decision in Microsoft

Detections for the CVE-2026-21509 vulnerability in MS Office...

Malicious code in @yoobic/jpeg-camera-es6 (npm)

Suspicious postinstall script executing bundle.js and the presence of unsignedbitwisemathexcess YARA rule match indicates malware. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38de35c3ae3f0f156a77b94484f3774c14c293d3e37531ec74c8277fde1ad5c7 Any computer that has...

MAL-2025-47230 Malicious code in yoo-styles (npm)

Suspicious postinstall script executing bundle.js and YARA rule unsignedbitwisemathexcess match strongly suggests malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b064ef82c07e5538a3269d44de4c6750b224f665f808a5099715143c8be21e4 Any computer that h...

Malicious code in yoo-styles (npm)

Suspicious postinstall script executing bundle.js and YARA rule unsignedbitwisemathexcess match strongly suggests malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b064ef82c07e5538a3269d44de4c6750b224f665f808a5099715143c8be21e4 Any computer that h...

Malicious code in @operato/styles (npm)

Suspicious postinstall script executing bundle.js and unsignedbitwisemathexcess YARA rule match indicates malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f85f761f5ad599532a97a4c4c64bea4910004e56178cd4081fefb3b113ed8d6d Any computer that has this...

MAL-2025-47220 Malicious code in @operato/styles (npm)

Suspicious postinstall script executing bundle.js and unsignedbitwisemathexcess YARA rule match indicates malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f85f761f5ad599532a97a4c4c64bea4910004e56178cd4081fefb3b113ed8d6d Any computer that has this...

Malicious code in @things-factory/integration-marketplace (npm)

Suspicious postinstall script executing bundle.js and YARA rule match on bundle.js suggests malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 707cb5e2a466e8a099c5ffaaf71fd576d658e67702737dd3dfef8dc62127aa8f Any computer that has this package...

MAL-2025-47224 Malicious code in @things-factory/integration-marketplace (npm)

Suspicious postinstall script executing bundle.js and YARA rule match on bundle.js suggests malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 707cb5e2a466e8a099c5ffaaf71fd576d658e67702737dd3dfef8dc62127aa8f Any computer that has this package...