detect-cve-2024-4367

检测 CVE-2024-4367 用于检测 PDF.js 中 CVE-2024-4367 任意 JavaScript 执行的快速简陋 YARA 规则。 使用 root@kitploit: $ yara explpdfjscve20244367.yar pocgeneralizedCVE-2024-4367.pdf EXPLPDFJSCVE20244367 pocgeneralizedCVE-2024-4367.pdf 致谢 POC 和披露来自...

Fnord

Fnord Fnord is a pattern extractor for obfuscated code Description Fnord has two main functions: 1. Extract byte sequences and create some statistics 2. Use these statistics, combine length, number of occurrences, similarity and keywords to create a YARA rule 1. Statistics Fnord processes the fil...

Detectar-Backdoor-en-liblzma-de-XZ-utils-CVE-2024-3094-

检测 XZ-utils 的 liblzma 中的后门 CVE-2024-3094- 下面的 YARA 规则有助于检测在使用了 XZ 压缩工具 5.6.0 和 5.6.1 版本的系统中，liblzma 库中存在的后门。 这提供了一种识别可能因该漏洞而被利用的易受攻击系统的机制。通过在受影响系统上使用此规则，安全管理员可以搜索受损迹象，并采取纠正措施以降低后门被利用的风险。...

cs_yara

csyara Comprueba las reglas Yara de Cobalt Strike Enlaces de referencia https://github.com/CCob/BeaconEye Corrección de errores de BeaconEye: https://wbglil.gitbook.io/cobalt-strike/cobalt-strike-gong-ji-fang-yu/untitled-1 regla obtenida de...

detect_CVE-2026-21509

Detecciones para la vulnerabilidad CVE-2026-21509 en MS Office Este repositorio contiene una regla YARA para detectar documentos RTF con una posible explotación de CVE-2026-21509, y un script de Python para comprobar si los archivos de MS Office contienen objetos OLE Shell.Explorer.1, que están...

Kalim_Backdoor

Kalim Backdoor Malware Analysis Report This Report will talk about the functionality of Kalim Backdoor Malware. Table of Contents: - What is Backdoor? - Technical Analysis. - Summary. - Tactics & Technique MITRE ATT&CK. - IOCs. - Yara Rule. What does Backdoor mean? A backdoor is a hidden...

CVE-2025-32433-Detection

CVE-2025-32433 检测 作者: te0rwx 创建日期: 2025-08-27 更新于 2026-08-16 描述 一个自定义的 YARA 规则，用于检测与 CVE-2025-32433 相关的已知工件，这是一个 Erlang/OTP SSH 预认证远程代码执行（RCE）漏洞。 该规则是针对公开的概念验证（PoC）工件和受控实验室生成的网络数据包进行开发和验证的。 检测范围 该规则检测与 CVE-2025-32433 相关的已知指标，包括： 公开的 PoC 工件 Erlang 命令执行（os:cmd） Erlang 文件写入操作（file:writefile） SSH...

keepass_CVE-2023-24055_yara_rule

keepassCVE-2023-24055yararule 包含一个简单的 yara 规则，用于搜索可能被入侵的 KeePass 配置文件 如何使用 使用 yara 规则扫描器（如 yara、loki 或 thor-lite）以该规则扫描系统。本地 KeePass 配置文件的默认位置为 %APPDATA%\Roaming\KeePass\KeePass.config.xml。...

CVE-2022-26134-Exploit-Detection

Confluence RCE CVE-2022-26134 漏洞利用检测 先决条件 1. ClamAV 克隆此仓库或下载Yara规则到您的Confluence服务器 我们使用的是由volexity/threat-intel提供的Yara规则，他们最先公开了这个漏洞。 Git克隆 root@kitploit: git clone https://github.com/th3b3ginn3r/CVE-2022-26134-Exploit-Detection.git 原始文件下载 CVE-2022-26134.yar:...

BruteRatel-DetectionTools

BruteRatel-DetectionTools Una colección de herramientas y reglas para decodificar badgers de Brute Ratel C4 Todas las herramientas y reglas se basan en muestras identificadas por PaloAlto en su informe https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ Regla Yara La regla Yara ha sido proba...

cobaltstrike-sleepmask-yara

cobaltstrike-sleepmask-yara Solo un repositorio git para la regla de detección de sleepmask que encontré en https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs tl;dr En resumen, estos bytes forman parte del sleep mask kit sección .text sin ofusc...

Malicious code in react-refresh-update (npm)

Package contains highly obfuscated code with dynamic execution using eval, a strong indicator of malicious intent. YARA rule matches confirm. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68cf0c0bd6ed2a8c07bc175b5c0cc7f86a49133e67dd5d8f68f37309c5f1a463 The...

Exploit for Reliance on Untrusted Inputs in a Security Decision in Microsoft

Detections for the CVE-2026-21509 vulnerability in MS Office...

Malicious code in @yoobic/jpeg-camera-es6 (npm)

Suspicious postinstall script executing bundle.js and the presence of unsignedbitwisemathexcess YARA rule match indicates malware. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38de35c3ae3f0f156a77b94484f3774c14c293d3e37531ec74c8277fde1ad5c7 Any computer that has...

Malicious code in yoo-styles (npm)

Suspicious postinstall script executing bundle.js and YARA rule unsignedbitwisemathexcess match strongly suggests malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b064ef82c07e5538a3269d44de4c6750b224f665f808a5099715143c8be21e4 Any computer that h...

MAL-2025-47230 Malicious code in yoo-styles (npm)

Suspicious postinstall script executing bundle.js and YARA rule unsignedbitwisemathexcess match strongly suggests malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b064ef82c07e5538a3269d44de4c6750b224f665f808a5099715143c8be21e4 Any computer that h...

Malicious code in @operato/styles (npm)

Suspicious postinstall script executing bundle.js and unsignedbitwisemathexcess YARA rule match indicates malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f85f761f5ad599532a97a4c4c64bea4910004e56178cd4081fefb3b113ed8d6d Any computer that has this...

MAL-2025-47220 Malicious code in @operato/styles (npm)

Suspicious postinstall script executing bundle.js and unsignedbitwisemathexcess YARA rule match indicates malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f85f761f5ad599532a97a4c4c64bea4910004e56178cd4081fefb3b113ed8d6d Any computer that has this...

Malicious code in @things-factory/integration-marketplace (npm)

Suspicious postinstall script executing bundle.js and YARA rule match on bundle.js suggests malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 707cb5e2a466e8a099c5ffaaf71fd576d658e67702737dd3dfef8dc62127aa8f Any computer that has this package...

MAL-2025-47224 Malicious code in @things-factory/integration-marketplace (npm)

Suspicious postinstall script executing bundle.js and YARA rule match on bundle.js suggests malicious behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 707cb5e2a466e8a099c5ffaaf71fd576d658e67702737dd3dfef8dc62127aa8f Any computer that has this package...