Sign in

100 Days Of YARA

@100daysofyara.bsky.social
41 followers 5 following 11 posts

BSky profile dedicated to 100 Days Of YARA github.com/100DaysofYARA

PostsRepliesMedia
Reposted by 100 Days Of YARA
Matt Green @mgreen27.bsky.social · 30/01/2025
Messing with a couple of anomaly rules for #100daysofyara 1. Packer related API strings and no import Rule: github.com/mgreen27/100... 2. Downloader related API strings and no import Rule: github.com/mgreen27/100...
052
Reposted by 100 Days Of YARA
Matt Green @mgreen27.bsky.social · 24/01/2025
#100daysofyara hunting inspired from a sample share from VT 1. Microsoft Teams without a MS cert 2. Detect cert metadata github.com/mgreen27/100... 3. Anomaly detection for PE files with large difference between physical and virtual size of a section github.com/mgreen27/100...
173
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 23/01/2025
#100DaysofYara Day 23 Socks5Systemz, sample from the bazaar. 32 bit installer for the tool, based on the compilation information, strings for "\silent" and "\verysilent", and mentions of Inno Setup, used to create windows installers. www.bitsight.com/blog/unveili... github.com/augustvansic...
032
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 25/01/2025
#100DaysOfYara Day 24 A QakBot spotted in the wild (2025) Some easy strings for dangerous api calls for encryption and WSA calls for connection functionality, an ip that upon review looks like it’s hosting a C2 (web ports with firewall deny all w/exceptions likely) github.com/augustvansic...
052
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 14/01/2025
#100DaysofYara Day 14 This sample is a PE32 DLL that is designed for the I386 arch, in C++. I used some more hex strings this time, looks like this is either mimicking a game DLL or pretending to be. Sample was tagged to WannaCry. github.com/augustvansic...
github.com
022
Reposted by 100 Days Of YARA
Matt Green @mgreen27.bsky.social · 14/01/2025
#100daysofyara more yara-x > Dumping a RedCurl malware pe I saw Rich Header and thought I would give it a try. Rule: github.com/mgreen27/100...
yara-x dump
032
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 13/01/2025
#100DaysOfYara Day 13 A MacOS Macho binary from MalwareZoo: Backdoor/Worm Some of the api calls are not core library referenced and could prevent inclusion in the App Store, so I added them as ascii strings. Also added some dylib strings github.com/augustvansic...
052
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 12/01/2025
#100DaysOfYara Day 12 Today's sample was a PE32 DLL tagged to DarkTortilla. Strings, strings and more strings made this one easy to make a rule, didn't need to throw it in Binja. A couple rules were based on environmental condition requests, signs of host enumeration. github.com/augustvansic...
github.com
2025_100DaysofYara/Day12_PE32_DLL_DarkTortilla.yar at main · augustvansickle/2025_100DaysofYara
Contribute to augustvansickle/2025_100DaysofYara development by creating an account on GitHub.
012
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 11/01/2025
#100DaysOfYara Day 11 I got some exposure to Android APK Lua Malware. Interesting file struture and execution flow, I used this resource for some help on understanding the basics and learn about some specialized tools: par.nsf.gov/servlets/pur... and Rule: github.com/augustvansic...
012
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 11/01/2025
#100DaysOfYara Day 10 Todays sample was a sample of Storm Kitty Open source Stealer/Keylogger written in C++, logs are sent to a telegram address which you can see in the strings. malpedia.caad.fkie.fraunhofer.de/details/win.... github.com/augustvansic...
001
Reposted by 100 Days Of YARA
Matt Green @mgreen27.bsky.social · 10/01/2025
#100daysofyara sometimes simple rules work really well! In an IR last week, we discovered and stopped an in progress exfil. This process rule detects the in memory renamed rclone - should be cross platform. Rule: github.com/mgreen27/100...
021
Reposted by 100 Days Of YARA
Matt Green @mgreen27.bsky.social · 15/01/2025
#100daysofyara This rule detects PE files with SUBSYSTEM_WINDOWS_GUI and no Window API function import. Rule: github.com/mgreen27/100...
032
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 15/01/2025
#100DaysOfYara Day 15 I had more to say than what allows in a post here so it’s on medium @ : medium.com/@august.vans...
022
Reposted by 100 Days Of YARA
Matt Green @mgreen27.bsky.social · 16/01/2025
#100daysofyara MSC files appear to store their icons inside a BinaryStorage field. Todays rule hits on a suspicious PDF icon. Rule: github.com/mgreen27/100...
032
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 17/01/2025
#100DaysOfYara Day 16 Todays Sample: a PE64 EXE tagged to SpyLyRAT Some unique loads in this directly from github. And some common API calls that are commonly used for manipulating processes. github.com/augustvansic...
032
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 17/01/2025
#100DaysOfYara Day 17 Sliver Beacon EXE Sliver uses MinGW to compile beacons, and it was definitely in strings, so I added that rule. String for sleep - time based evasion, a couple of other hardcoded strings. I did some dynamic analysis and the domain drops payloads too.
042
Reposted by 100 Days Of YARA
Matt Green @mgreen27.bsky.social · 18/01/2025
This #100daysofyara rule looking for a PE with unusual NumberofRVAandSizes attribute github.com/mgreen27/100...
022
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 18/01/2025
#100DaysOfYara Day 18 Happy Saturday (Go Chiefs) Today I did a quick rule for a sample of Redline, a 32 bit PE. A lot was obfuscated with this sample, but there were some C## .NET calls to use for rules. github.com/augustvansic...
github.com
2025_100DaysofYara/Day18_PE32_RedLIne.yar at ecabc490af6a452c436659bfc5dc928a22be8bbe · augustvansickle/2025_100DaysofYara
Contribute to augustvansickle/2025_100DaysofYara development by creating an account on GitHub.
022
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 19/01/2025
#100DaysOfYara Day 19 PE64 DLL with a lot of capability, tagged to legion loader. github.com/augustvansic...
github.com
2025_100DaysofYara/Day19_PE64_DLL_LEGIONLOADER.yar at 491bf3357679e801dff43a91ca508904ae7972e8 · augustvansickle/2025_100DaysofYara
Contribute to augustvansickle/2025_100DaysofYara development by creating an account on GitHub.
022
Reposted by 100 Days Of YARA
Matt Green @mgreen27.bsky.social · 21/01/2025
Todays #100daysofyara rule looks for a PE file with an unusual debug info type. Yara doesnt directly expose these debug structures so had to search for the RSDS header and find type field by offset. github.com/mgreen27/100...
042
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 22/01/2025
#100DaysOfYara Day 21 Cobalt Strike Beacon of the EXE flavor References from Tech Company from China in strings, debugger enum, executable called and a close handle on a variable. Interesting: Icon for binary is apple, compiled for Windows/PE64 and Windows API LIbs github.com/augustvansic...
042
Reposted by 100 Days Of YARA
Matt Green @mgreen27.bsky.social · 22/01/2025
#100daysofyara todays rule is detecting patched clr.dll in memory AmsiScanBuffer bypass. My @velocidex Windows.System.VAD artifact can be used to target clr.dll mapped sections for an easy detection. Rule: github.com/mgreen27/100... VQL: github.com/mgreen27/100...
065
Reposted by 100 Days Of YARA
IntelCorgi @intelcorgi.bsky.social · 22/01/2025
I finally got around to making my first contribution to #100DaysofYARA 2025 with two YARA rules. My first rule looks to detect Qbit Stealer, a Golang stealer which never really took off. My second rule is designed to hunt various "calling cards" the developer left, which might find related malware.
my first yara rule for 100daysofyara 2025, designed to detect qbit stealer.Second qbit rule, designed to detect calling cards from the developer.
132
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 22/01/2025
#100DaysOfYara Day 22 Today I dug into Binlex. Binlex extracts instructions, basic blocks, and functions from binary files and organizes them into a structured hierarchy. Im still working on learning the rule syntax with blyara to create rules. github.com/augustvansic...
062
Reposted by 100 Days Of YARA
Paul Burbage @hexlax.bsky.social · 13/01/2025
Introducing: What is this stealer? A new repository that allows for you to identify Stealer family by the system information text file format commonly included in stealer malware exfiltration logs. Includes Yara rules! Check it out and contribute! github.com/MalBeacon/wh...
github.com
GitHub - MalBeacon/what-is-this-stealer: A repository of credential stealer formats
A repository of credential stealer formats . Contribute to MalBeacon/what-is-this-stealer development by creating an account on GitHub.
052
Reposted by 100 Days Of YARA
Greg Lesnewich @greg-l.bsky.social · 07/01/2025
#100DaysofYARA wanna track DPRK Macho maldevs but don't wanna dump strings or reverse anything? track their dependency and permission preferences! github.com/100DaysofYAR...
193
Reposted by 100 Days Of YARA
Greg Lesnewich @greg-l.bsky.social · 10/01/2025
#100DaysofYARA throwback to @0xkyle.bsky.social and I finding a weird payload getting dropped by UNK_SweetSpector - it was like a weird cross-mutation of SugarGh0st and what Unit42 called TunnelSpecter and SweetSpecter. payload uses Incognito framework for token forgery github.com/100DaysofYAR...
1112
Reposted by 100 Days Of YARA
Matt Green @mgreen27.bsky.social · 07/01/2025
#100daysofyara todays post is generic and looking at LNK files. Finding samples with specific attributes that may not be parsed (or dumped by yara-x) can be difficult. This rule finds LNK files with the rare in field CodePage language setting. Rules: github.com/mgreen27/100...
1103
100 Days Of YARA @100daysofyara.bsky.social · 05/01/2025
x: @RustyNoob619 #100DaysofYARA Day 5 Added a couple of new YARA rules for TTPs 🐧 First is to detect embedded Windows PE payloads in a file as Base 64 encoding Second is to spot modification of memory protect flags which is typically used for code injection/unpacking github.com/RustyNoob-61...
github.com
100-Days-of-YARA-2025/Day5.yara at main · RustyNoob-619/100-Days-of-YARA-2025
100 Days of YARA is a challenge to write a YARA rule every day for 100 days - RustyNoob-619/100-Days-of-YARA-2025
021
Reposted by 100 Days Of YARA
Matt Green @mgreen27.bsky.social · 05/01/2025
Rule: github.com/mgreen27/100...
github.com
100daysofyara/2025/SUS_Renamed_QEMU_Jan25.yar at main · mgreen27/100daysofyara
A scratchpad for 100daysofyara. Contribute to mgreen27/100daysofyara development by creating an account on GitHub.
031
Reposted by 100 Days Of YARA
Matt Green @mgreen27.bsky.social · 05/01/2025
crossposting here #100daysofyara continuing to explore yara-x today I tried to detect a renamed QEMU exe using pe attributes and a dynamic variable.
173
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 04/01/2025
#100DaysOfYara Day 3 Another Macho binary, tagged to Lazarus github.com/augustvansic... ALSO I wrote a basic Rev Shell in C. Included a video to show functionality but the hardcoded IP/Port is local, so it will benign. Feel free to use for a rule: github.com/augustvansic...
142
100 Days Of YARA @100daysofyara.bsky.social · 05/01/2025
x: @mgreen27 #100daysofyara yesterday I checked out a LNK that was associated with a BYO tinycore linux image . Todays rule covers an interesting way to detect the image with MBR specific signature. (1/2)
120
100 Days Of YARA @100daysofyara.bsky.social · 04/01/2025
x: @RustyNoob619 #100DaysofYara Day 4 YARA rules for the LNK, VBS & HTA files used in the UAC-0099 infection chain reported by @_CERT_UA against Ukrainian Gov entities in Nov-Dec 2024 The rules reference the ruleset from Day3, so please use it in combo for it to work 🐧 github.com/RustyNoob-61...
github.com
100-Days-of-YARA-2025/Day4.yara at main · RustyNoob-619/100-Days-of-YARA-2025
100 Days of YARA is a challenge to write a YARA rule every day for 100 days - RustyNoob-619/100-Days-of-YARA-2025
020
100 Days Of YARA @100daysofyara.bsky.social · 03/01/2025
x: @RustyNoob619 #100DaysofYara Day 3 Continuing from yesterday on UAC-0099, I have taken a different approach to detecting LNK, VBS & HTA files used in their infection chain 🐧 There were many TTPs that were common between those files, so here is a ruleset... github.com/RustyNoob-61...
github.com
100-Days-of-YARA-2025/Day3.yara at main · RustyNoob-619/100-Days-of-YARA-2025
100 Days of YARA is a challenge to write a YARA rule every day for 100 days - RustyNoob-619/100-Days-of-YARA-2025
020
Reposted by 100 Days Of YARA
Greg Lesnewich @greg-l.bsky.social · 03/01/2025
#100DaysofYARA we're brute forcing Steve's prompt with regular expressions :P github.com/100DaysofYAR...
3142
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 03/01/2025
#100DaysOfYara Day 3 Thought this was an meterpreter implant but I compared it to an implant I made; much more functionality for the ITW sample. Rule = unique win32 api calls, IP’s, imports.
053
Reposted by 100 Days Of YARA
Tony Lambert @forensicitguy.bsky.social · 03/01/2025
New blog post for #100DaysofYARA , in this one I look at a VenomRAT sample and create rules based on PE metadata and an encryption salt value. forensicitguy.github.io/exploring-ve... #malware
forensicitguy.github.io
Exploring VenomRAT Metadata and Encryption with YARA - #100DaysOfYara
It’s that time of year again - 100 Days of YARA! In this post I want to walk through how I use YARA to document malware analysis findings. YARA has loads of different use cases:
0134
100 Days Of YARA @100daysofyara.bsky.social · 03/01/2025
x: @cioaonk Day Two: @Volexity's reporting on the "Nearest Neighbor Attack" ranks high on most intriguing cyber attacks of 2024 for me personally. Today's #100DaysofYARA is a simple detection of the windows native Cipher tool used to clean up artifacts on systems.
031
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 02/01/2025
#100DaysOfYara Day 2: LBB.exe, Lockbit 4 PE github.com/augustvansic...
063
100 Days Of YARA @100daysofyara.bsky.social · 02/01/2025
x: @cioaonk Day One of #100DaysOfYara Complete! Inspired by @delivr_to's recent report on image-less QR Codes rendered in HTML: blog.delivr.to/delivr-tos-t...
blog.delivr.to
delivr.to’s Top 10 Payloads (Dec ‘24): Pastejacking, Image-less QR codes and Concatenated Zip…
Our Top 10 brings together novel research, attack evolution and newly-popularised methods embraced by adversaries to achieve initial…
031
100 Days Of YARA @100daysofyara.bsky.social · 02/01/2025
x: @RustyNoob619 #100DaysofYara Wrote a YARA rule for UAC-0099 group RAR/EXE malware samples that were reported by @_CERT_UA to be used in campaign against Ukraine Gov entities between Nov & Dec 2024 🐧 First rule in challenge this year leveraging the PE YARA module :) github.com/RustyNoob-61...
github.com
100-Days-of-YARA-2025/Day2.yara at main · RustyNoob-619/100-Days-of-YARA-2025
100 Days of YARA is a challenge to write a YARA rule every day for 100 days - RustyNoob-619/100-Days-of-YARA-2025
071
Reposted by 100 Days Of YARA
Kyle Eaton @0xkyle.bsky.social · 19/11/2024
Yara rule to match concatenated zip files. I like this one (biased) because of how we are able to avoid matching nested zip files. More info: x.com/threatinsigh... #yara github.com/EmergingThre...
github.com
threatresearch/yara/zip_file.yara at master · EmergingThreats/threatresearch
I wanted to call this repo "Nuclear Football Codes". I was outvoted.. - EmergingThreats/threatresearch
2137
Reposted by 100 Days Of YARA
Greg Lesnewich @greg-l.bsky.social · 02/01/2025
shout out to Lars for his rule last year that I took inspiration from and shouts to @0xkyle.bsky.social for teaching me all of the ZIP structure things
media.tenor.com
two men are sitting next to each other and one of them is saying teamwork
ALT: two men are sitting next to each other and one of them is saying teamwork
151
Reposted by 100 Days Of YARA
Greg Lesnewich @greg-l.bsky.social · 02/01/2025
#100DaysofYARA day 2 - one cluster in my portfolio, TA427 really likes to use password-protected ZIP files with an MSC file as the only embedded file (used to use .VBS files) lets look for ZIPs that match those features! github.com/100DaysofYAR...
1102
100 Days Of YARA @100daysofyara.bsky.social · 02/01/2025
Day 2 of #100DaysOfYARA - I believe we have people posting on both BSky and X, we'll be reposting their stuff here too!
010
Reposted by 100 Days Of YARA
Tony Lambert @forensicitguy.bsky.social · 02/01/2025
#100daysofyara I like taking the approach of having multiple YARA rules to detect the same thing from different perspectives, like these rules for Cronos Crypter. One looks for just strings, another a string + encryption salt, 3rd for assembly name
083
Reposted by 100 Days Of YARA
denice @fullofche3se.bsky.social · 01/01/2025
Powered the VM up and ready to start my first entry to #100DaysOfYARA 2025 edition! 🔥
2101
Reposted by 100 Days Of YARA
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 01/01/2025
Ok day 1 of #100DaysofYara: I assigned some strings based on the less common lines from the Lockbit 4 loader that would likely be common in malicious code and not typically in normal admin, as well as a hex string for the PE itself
143
Reposted by 100 Days Of YARA
qutluch.bsky.social @qutluch.bsky.social · 01/01/2025
Gonna take a hangover day & start #100DaysOfYara late. Couldn't keep up last year & I'll see how it goes this year. I don't have the creativity of @greg-l.bsky.social Might do some scripting & play more with yara-x like @stvemillertime.bsky.social I have a half written gRPC service for file scanning
291