detect-cve-2024-4367

Обнаружение CVE-2024-4367 Быстрое и простое правило обнаружения YARA для CVE-2024-4367 — произвольное выполнение JavaScript в PDF.js. Использование root@kitploit: $ yara explpdfjscve20244367.yar pocgeneralizedCVE-2024-4367.pdf EXPLPDFJSCVE20244367 pocgeneralizedCVE-2024-4367.pdf Благодарности POC...

CVE-2022-26134-Exploit-Detection

Confluence RCE CVE-2022-26134 Détection d'exploit Prérequis 1. ClamAV Clonez ce dépôt ou téléchargez la règle Yara sur votre serveur Confluence Nous utilisons la règle Yara fournie par volexity/threat-intel, qui a été le premier à dévoiler cette vulnérabilité. Git Clone root@kitploit: git clone...

Fnord

Fnord Fnord est un extracteur de motifs pour code obfusqué Description Fnord a deux fonctions principales : 1. Extraire des séquences d'octets et créer des statistiques 2. Utiliser ces statistiques, combiner la longueur, le nombre d'occurrences, la similarité et des mots-clés pour créer une règle...

Detectar-Backdoor-en-liblzma-de-XZ-utils-CVE-2024-3094-

XZ 유틸리티 liblzma 백도어 탐지 - CVE-2024-3094 다음 YARA 규칙은 압축 도구 XZ 버전 5.6.0 및 5.6.1을 사용하는 시스템에서 손상된 liblzma 라이브러리에 백도어가 존재하는지 탐지하는 데 도움이 됩니다. 이는 이 취약점으로 인해 악용될 수 있는 취약한 시스템을 식별하는 메커니즘을 제공합니다. 영향을 받는 시스템에서 이 규칙을 사용함으로써 보안 관리자는 손상 징후를 찾고 백도어 악용 위험을 완화하기 위한 시정 조치를 취할 수 있습니다...

cobaltstrike-sleepmask-yara

cobaltstrike-sleepmask-yara Просто git-репозиторий для правила обнаружения sleepmask, которое я нашёл в https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs tl;dr Суть в том, что эти байты являются частью sleep mask kit необфусцированной секции...

cs_yara

csyara Cobalt Strike Yara 규칙 확인 참고 링크 https://github.com/CCob/BeaconEye BeaconEye 버그 수정: https://wbglil.gitbook.io/cobalt-strike/cobalt-strike-gong-ji-fang-yu/untitled-1 규칙 출처: https://raw.githubusercontent.com/CCob/BeaconEye/master/BeaconEye.cs beaconEye.yar root@kitploit: rule CobaltStrike...

Kalim_Backdoor

Kalim Backdoor Malware Analysis Report Этот отчет расскажет о функциональности вредоносного ПО Kalim Backdoor. Оглавление: - Что такое бэкдор? - Технический анализ. - Резюме. - Тактики и техники MITRE ATT&CK. - IOCs. - Yara правило...

CVE-2025-32433-Detection

Обнаружение CVE-2025-32433 Автор: te0rwx Создано: 2025-08-27 Обновл. 2026-08-16 Описание Пользовательское правило YARA для обнаружения известных артефактов, связанных с CVE-2025-32433 , уязвимостью удаленного выполнения кода RCE в Erlang/OTP SSH до этапа аутентификации. Правило было разработано и...

BruteRatel-DetectionTools

BruteRatel-DetectionTools Une collection d'outils et de règles pour décoder les badgers Brute Ratel C4 Tous les outils et règles sont basés sur des échantillons identifiés par PaloAlto dans leur rapport https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ Règle Yara La règle Yara a été testée...

keepass_CVE-2023-24055_yara_rule

keepassCVE-2023-24055yararule Contient une simple règle yara pour rechercher d'éventuels fichiers de configuration KeePass compromis Comment faire Utilisez un scanner de règles yara, comme yara, loki ou thor-lite pour scanner les systèmes avec cette règle. L'emplacement par défaut du fichier de...

Malicious code in react-refresh-update (npm)

Package contains highly obfuscated code with dynamic execution using eval, a strong indicator of malicious intent. YARA rule matches confirm. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68cf0c0bd6ed2a8c07bc175b5c0cc7f86a49133e67dd5d8f68f37309c5f1a463 The...

Exploit for Reliance on Untrusted Inputs in a Security Decision in Microsoft

Detections for the CVE-2026-21509 vulnerability in MS Office...

Malicious code in @yoobic/jpeg-camera-es6 (npm)

Suspicious postinstall script executing bundle.js and the presence of unsignedbitwisemathexcess YARA rule match indicates malware. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38de35c3ae3f0f156a77b94484f3774c14c293d3e37531ec74c8277fde1ad5c7 Any computer that has...

Malicious code in yoo-styles (npm)

Suspicious postinstall script executing bundle.js and YARA rule unsignedbitwisemathexcess match strongly suggests malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b064ef82c07e5538a3269d44de4c6750b224f665f808a5099715143c8be21e4 Any computer that h...

MAL-2025-47230 Malicious code in yoo-styles (npm)

Suspicious postinstall script executing bundle.js and YARA rule unsignedbitwisemathexcess match strongly suggests malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b064ef82c07e5538a3269d44de4c6750b224f665f808a5099715143c8be21e4 Any computer that h...

Malicious code in @operato/styles (npm)

Suspicious postinstall script executing bundle.js and unsignedbitwisemathexcess YARA rule match indicates malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f85f761f5ad599532a97a4c4c64bea4910004e56178cd4081fefb3b113ed8d6d Any computer that has this...

MAL-2025-47220 Malicious code in @operato/styles (npm)

Suspicious postinstall script executing bundle.js and unsignedbitwisemathexcess YARA rule match indicates malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f85f761f5ad599532a97a4c4c64bea4910004e56178cd4081fefb3b113ed8d6d Any computer that has this...

Malicious code in @things-factory/integration-marketplace (npm)

Suspicious postinstall script executing bundle.js and YARA rule match on bundle.js suggests malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 707cb5e2a466e8a099c5ffaaf71fd576d658e67702737dd3dfef8dc62127aa8f Any computer that has this package...

MAL-2025-47224 Malicious code in @things-factory/integration-marketplace (npm)

Suspicious postinstall script executing bundle.js and YARA rule match on bundle.js suggests malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 707cb5e2a466e8a099c5ffaaf71fd576d658e67702737dd3dfef8dc62127aa8f Any computer that has this package...

Malicious code in @operato/headroom (npm)

Suspicious postinstall script executing bundle.js and YARA rule match unsignedbitwisemathexcess indicate malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71e970ada08943ee1043ac40c48714a5f5c29ae9c3c5d925c6dbfff9bcc47719 Any computer that has this...