From 68997abce53bc0e63fe350404ce7e5b6ba7e408d Mon Sep 17 00:00:00 2001
From: Update third-party rules
<41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 14 Sep 2026 00:22:22 +0000
Subject: [PATCH] Update third-party rules as of 2026-09-14
---
...af5d0e2031551f9f1a70b6db475ba71b2.elf.json | 4 +-
.../2023.3CX/libffmpeg.change_decrease.mdiff | 8 +-
.../2023.3CX/libffmpeg.change_increase.mdiff | 8 +-
tests/macOS/2023.3CX/libffmpeg.dirty.mdiff | 8 +-
tests/macOS/2023.3CX/libffmpeg.increase.mdiff | 8 +-
.../2024.aspdasdksa2/callback.bat.json | 4 +-
third_party/yara/YARAForge/RELEASE | 2 +-
.../yara/YARAForge/yara-rules-full.yar | 25412 ++++++++--------
third_party/yara/update.sh | 4 +-
9 files changed, 12932 insertions(+), 12526 deletions(-)
diff --git a/tests/linux/2024.sliver/de33b8d9694b6b4c44e3459b2151571af5d0e2031551f9f1a70b6db475ba71b2.elf.json b/tests/linux/2024.sliver/de33b8d9694b6b4c44e3459b2151571af5d0e2031551f9f1a70b6db475ba71b2.elf.json
index a62e823b3..1f34328f3 100644
--- a/tests/linux/2024.sliver/de33b8d9694b6b4c44e3459b2151571af5d0e2031551f9f1a70b6db475ba71b2.elf.json
+++ b/tests/linux/2024.sliver/de33b8d9694b6b4c44e3459b2151571af5d0e2031551f9f1a70b6db475ba71b2.elf.json
@@ -26,10 +26,10 @@
],
"RiskScore": 4,
"RiskLevel": "CRITICAL",
- "RuleURL": "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_gobfuscate.yar#L2-L18",
+ "RuleURL": "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_gobfuscate.yar#L2-L18",
"ReferenceURL": "https://github.com/unixpickle/gobfuscate",
"RuleAuthor": "James Quinn, Paul Hager (merged with new similar pattern)",
- "RuleLicenseURL": "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE",
+ "RuleLicenseURL": "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE",
"ID": "3P/YARAForge/signature_susp_gobfuscate",
"RuleName": "SIGNATURE_BASE_SUSP_Gobfuscate_May21"
},
diff --git a/tests/macOS/2023.3CX/libffmpeg.change_decrease.mdiff b/tests/macOS/2023.3CX/libffmpeg.change_decrease.mdiff
index 87dd4f33f..fdb677dad 100644
--- a/tests/macOS/2023.3CX/libffmpeg.change_decrease.mdiff
+++ b/tests/macOS/2023.3CX/libffmpeg.change_decrease.mdiff
@@ -5,10 +5,10 @@
| RISK | KEY | DESCRIPTION | EVIDENCE |
|:--|:--|:--|:--|
| -CRITICAL | [3P/YARAForge/sekoia_downloader_smooth](https://github.com/SEKOIA-IO/Community/blob/fa3a9630ef9ce484fb1b945480a43f989e6865d4/yara_rules/downloader_mac_smooth_operator.yar#L1-L16) | Detect the Smooth_Operator malware, by [Sekoia.io](https://github.com/SEKOIA-IO/Community) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)
[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code) |
-| -CRITICAL | [3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275) | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)
[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)
`$op1`
`$op2`
`$sa1`
`$sa2` |
-| -CRITICAL | [3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214) | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`
`$xc2`
`$xc3` |
-| -CRITICAL | [3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_xor_hunting.yar#L2-L25) | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
-| -CRITICAL | [3P/YARAForge/volexity_iconic](https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-03-30%203CX/indicators/rules.yar#L32-L50) | [Detects the MACOS version of the ICONIC loader.](https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/), by threatintel@volexity.com | `$str1`
`$str2`
`$str3` |
+| -CRITICAL | [3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275) | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)
[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)
`$op1`
`$op2`
`$sa1`
`$sa2` |
+| -CRITICAL | [3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214) | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`
`$xc2`
`$xc3` |
+| -CRITICAL | [3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_xor_hunting.yar#L2-L25) | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
+| -CRITICAL | [3P/YARAForge/volexity_iconic](https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-03-30%203CX/indicators/rules.yar#L32-L50) | [Detects the MACOS version of the ICONIC loader.](https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/), by threatintel@volexity.com | `$str1`
`$str2`
`$str3` |
| -CRITICAL | [anti-static/xor/user_agent](https://github.com/chainguard-dev/malcontent/blob/main/rules/anti-static/xor/xor-user_agent.yara#L1) | XOR'ed user agent, often found in backdoors, by Florian Roth | [xor_mozilla::$Mozilla_5_0](https://github.com/search?q=xor_mozilla%3A%3A%24Mozilla_5_0&type=code) |
| -CRITICAL | [impact/remote_access/net_exec](https://github.com/chainguard-dev/malcontent/blob/main/rules/impact/remote_access/net_exec.yara#L118) | executes programs, sets permissions, sleeps, makes HTTP requests | [NSMutableURLRequest](https://github.com/search?q=NSMutableURLRequest&type=code)
[gethostname](https://github.com/search?q=gethostname&type=code)
[localtime](https://github.com/search?q=localtime&type=code)
[sprintf](https://github.com/search?q=sprintf&type=code)
[strncpy](https://github.com/search?q=strncpy&type=code)
[pclose](https://github.com/search?q=pclose&type=code)
[chmod](https://github.com/search?q=chmod&type=code)
[flock](https://github.com/search?q=flock&type=code)
[popen](https://github.com/search?q=popen&type=code)
[sleep](https://github.com/search?q=sleep&type=code)
[rand](https://github.com/search?q=rand&type=code) |
| -HIGH | [exec/shell/arbitrary_command_dev_null](https://github.com/chainguard-dev/malcontent/blob/main/rules/exec/shell/arbitrary_command-dev_null.yara#L13) | runs quoted templated commands, discards output | ["%s" >/dev/null](https://github.com/search?q=%22%25s%22+%3E%2Fdev%2Fnull&type=code) |
diff --git a/tests/macOS/2023.3CX/libffmpeg.change_increase.mdiff b/tests/macOS/2023.3CX/libffmpeg.change_increase.mdiff
index af1cf6e37..2ce0517dc 100644
--- a/tests/macOS/2023.3CX/libffmpeg.change_increase.mdiff
+++ b/tests/macOS/2023.3CX/libffmpeg.change_increase.mdiff
@@ -5,10 +5,10 @@
| RISK | KEY | DESCRIPTION | EVIDENCE |
|:--|:--|:--|:--|
| +CRITICAL | **[3P/YARAForge/sekoia_downloader_smooth](https://github.com/SEKOIA-IO/Community/blob/fa3a9630ef9ce484fb1b945480a43f989e6865d4/yara_rules/downloader_mac_smooth_operator.yar#L1-L16)** | Detect the Smooth_Operator malware, by [Sekoia.io](https://github.com/SEKOIA-IO/Community) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)
[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code) |
-| +CRITICAL | **[3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275)** | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)
[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)
`$op1`
`$op2`
`$sa1`
`$sa2` |
-| +CRITICAL | **[3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214)** | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`
`$xc2`
`$xc3` |
-| +CRITICAL | **[3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_xor_hunting.yar#L2-L25)** | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
-| +CRITICAL | **[3P/YARAForge/volexity_iconic](https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-03-30%203CX/indicators/rules.yar#L32-L50)** | [Detects the MACOS version of the ICONIC loader.](https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/), by threatintel@volexity.com | `$str1`
`$str2`
`$str3` |
+| +CRITICAL | **[3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275)** | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)
[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)
`$op1`
`$op2`
`$sa1`
`$sa2` |
+| +CRITICAL | **[3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214)** | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`
`$xc2`
`$xc3` |
+| +CRITICAL | **[3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_xor_hunting.yar#L2-L25)** | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
+| +CRITICAL | **[3P/YARAForge/volexity_iconic](https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-03-30%203CX/indicators/rules.yar#L32-L50)** | [Detects the MACOS version of the ICONIC loader.](https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/), by threatintel@volexity.com | `$str1`
`$str2`
`$str3` |
| +CRITICAL | **[anti-static/xor/user_agent](https://github.com/chainguard-dev/malcontent/blob/main/rules/anti-static/xor/xor-user_agent.yara#L1)** | XOR'ed user agent, often found in backdoors, by Florian Roth | [xor_mozilla::$Mozilla_5_0](https://github.com/search?q=xor_mozilla%3A%3A%24Mozilla_5_0&type=code) |
| +CRITICAL | **[impact/remote_access/net_exec](https://github.com/chainguard-dev/malcontent/blob/main/rules/impact/remote_access/net_exec.yara#L118)** | executes programs, sets permissions, sleeps, makes HTTP requests | [NSMutableURLRequest](https://github.com/search?q=NSMutableURLRequest&type=code)
[gethostname](https://github.com/search?q=gethostname&type=code)
[localtime](https://github.com/search?q=localtime&type=code)
[sprintf](https://github.com/search?q=sprintf&type=code)
[strncpy](https://github.com/search?q=strncpy&type=code)
[pclose](https://github.com/search?q=pclose&type=code)
[chmod](https://github.com/search?q=chmod&type=code)
[flock](https://github.com/search?q=flock&type=code)
[popen](https://github.com/search?q=popen&type=code)
[sleep](https://github.com/search?q=sleep&type=code)
[rand](https://github.com/search?q=rand&type=code) |
| +HIGH | **[exec/shell/arbitrary_command_dev_null](https://github.com/chainguard-dev/malcontent/blob/main/rules/exec/shell/arbitrary_command-dev_null.yara#L13)** | runs quoted templated commands, discards output | ["%s" >/dev/null](https://github.com/search?q=%22%25s%22+%3E%2Fdev%2Fnull&type=code) |
diff --git a/tests/macOS/2023.3CX/libffmpeg.dirty.mdiff b/tests/macOS/2023.3CX/libffmpeg.dirty.mdiff
index af1cf6e37..2ce0517dc 100644
--- a/tests/macOS/2023.3CX/libffmpeg.dirty.mdiff
+++ b/tests/macOS/2023.3CX/libffmpeg.dirty.mdiff
@@ -5,10 +5,10 @@
| RISK | KEY | DESCRIPTION | EVIDENCE |
|:--|:--|:--|:--|
| +CRITICAL | **[3P/YARAForge/sekoia_downloader_smooth](https://github.com/SEKOIA-IO/Community/blob/fa3a9630ef9ce484fb1b945480a43f989e6865d4/yara_rules/downloader_mac_smooth_operator.yar#L1-L16)** | Detect the Smooth_Operator malware, by [Sekoia.io](https://github.com/SEKOIA-IO/Community) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)
[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code) |
-| +CRITICAL | **[3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275)** | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)
[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)
`$op1`
`$op2`
`$sa1`
`$sa2` |
-| +CRITICAL | **[3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214)** | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`
`$xc2`
`$xc3` |
-| +CRITICAL | **[3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_xor_hunting.yar#L2-L25)** | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
-| +CRITICAL | **[3P/YARAForge/volexity_iconic](https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-03-30%203CX/indicators/rules.yar#L32-L50)** | [Detects the MACOS version of the ICONIC loader.](https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/), by threatintel@volexity.com | `$str1`
`$str2`
`$str3` |
+| +CRITICAL | **[3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275)** | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)
[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)
`$op1`
`$op2`
`$sa1`
`$sa2` |
+| +CRITICAL | **[3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214)** | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`
`$xc2`
`$xc3` |
+| +CRITICAL | **[3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_xor_hunting.yar#L2-L25)** | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
+| +CRITICAL | **[3P/YARAForge/volexity_iconic](https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-03-30%203CX/indicators/rules.yar#L32-L50)** | [Detects the MACOS version of the ICONIC loader.](https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/), by threatintel@volexity.com | `$str1`
`$str2`
`$str3` |
| +CRITICAL | **[anti-static/xor/user_agent](https://github.com/chainguard-dev/malcontent/blob/main/rules/anti-static/xor/xor-user_agent.yara#L1)** | XOR'ed user agent, often found in backdoors, by Florian Roth | [xor_mozilla::$Mozilla_5_0](https://github.com/search?q=xor_mozilla%3A%3A%24Mozilla_5_0&type=code) |
| +CRITICAL | **[impact/remote_access/net_exec](https://github.com/chainguard-dev/malcontent/blob/main/rules/impact/remote_access/net_exec.yara#L118)** | executes programs, sets permissions, sleeps, makes HTTP requests | [NSMutableURLRequest](https://github.com/search?q=NSMutableURLRequest&type=code)
[gethostname](https://github.com/search?q=gethostname&type=code)
[localtime](https://github.com/search?q=localtime&type=code)
[sprintf](https://github.com/search?q=sprintf&type=code)
[strncpy](https://github.com/search?q=strncpy&type=code)
[pclose](https://github.com/search?q=pclose&type=code)
[chmod](https://github.com/search?q=chmod&type=code)
[flock](https://github.com/search?q=flock&type=code)
[popen](https://github.com/search?q=popen&type=code)
[sleep](https://github.com/search?q=sleep&type=code)
[rand](https://github.com/search?q=rand&type=code) |
| +HIGH | **[exec/shell/arbitrary_command_dev_null](https://github.com/chainguard-dev/malcontent/blob/main/rules/exec/shell/arbitrary_command-dev_null.yara#L13)** | runs quoted templated commands, discards output | ["%s" >/dev/null](https://github.com/search?q=%22%25s%22+%3E%2Fdev%2Fnull&type=code) |
diff --git a/tests/macOS/2023.3CX/libffmpeg.increase.mdiff b/tests/macOS/2023.3CX/libffmpeg.increase.mdiff
index af1cf6e37..2ce0517dc 100644
--- a/tests/macOS/2023.3CX/libffmpeg.increase.mdiff
+++ b/tests/macOS/2023.3CX/libffmpeg.increase.mdiff
@@ -5,10 +5,10 @@
| RISK | KEY | DESCRIPTION | EVIDENCE |
|:--|:--|:--|:--|
| +CRITICAL | **[3P/YARAForge/sekoia_downloader_smooth](https://github.com/SEKOIA-IO/Community/blob/fa3a9630ef9ce484fb1b945480a43f989e6865d4/yara_rules/downloader_mac_smooth_operator.yar#L1-L16)** | Detect the Smooth_Operator malware, by [Sekoia.io](https://github.com/SEKOIA-IO/Community) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)
[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code) |
-| +CRITICAL | **[3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275)** | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)
[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)
`$op1`
`$op2`
`$sa1`
`$sa2` |
-| +CRITICAL | **[3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214)** | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`
`$xc2`
`$xc3` |
-| +CRITICAL | **[3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_xor_hunting.yar#L2-L25)** | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
-| +CRITICAL | **[3P/YARAForge/volexity_iconic](https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-03-30%203CX/indicators/rules.yar#L32-L50)** | [Detects the MACOS version of the ICONIC loader.](https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/), by threatintel@volexity.com | `$str1`
`$str2`
`$str3` |
+| +CRITICAL | **[3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275)** | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)
[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)
`$op1`
`$op2`
`$sa1`
`$sa2` |
+| +CRITICAL | **[3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214)** | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`
`$xc2`
`$xc3` |
+| +CRITICAL | **[3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_xor_hunting.yar#L2-L25)** | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
+| +CRITICAL | **[3P/YARAForge/volexity_iconic](https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-03-30%203CX/indicators/rules.yar#L32-L50)** | [Detects the MACOS version of the ICONIC loader.](https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/), by threatintel@volexity.com | `$str1`
`$str2`
`$str3` |
| +CRITICAL | **[anti-static/xor/user_agent](https://github.com/chainguard-dev/malcontent/blob/main/rules/anti-static/xor/xor-user_agent.yara#L1)** | XOR'ed user agent, often found in backdoors, by Florian Roth | [xor_mozilla::$Mozilla_5_0](https://github.com/search?q=xor_mozilla%3A%3A%24Mozilla_5_0&type=code) |
| +CRITICAL | **[impact/remote_access/net_exec](https://github.com/chainguard-dev/malcontent/blob/main/rules/impact/remote_access/net_exec.yara#L118)** | executes programs, sets permissions, sleeps, makes HTTP requests | [NSMutableURLRequest](https://github.com/search?q=NSMutableURLRequest&type=code)
[gethostname](https://github.com/search?q=gethostname&type=code)
[localtime](https://github.com/search?q=localtime&type=code)
[sprintf](https://github.com/search?q=sprintf&type=code)
[strncpy](https://github.com/search?q=strncpy&type=code)
[pclose](https://github.com/search?q=pclose&type=code)
[chmod](https://github.com/search?q=chmod&type=code)
[flock](https://github.com/search?q=flock&type=code)
[popen](https://github.com/search?q=popen&type=code)
[sleep](https://github.com/search?q=sleep&type=code)
[rand](https://github.com/search?q=rand&type=code) |
| +HIGH | **[exec/shell/arbitrary_command_dev_null](https://github.com/chainguard-dev/malcontent/blob/main/rules/exec/shell/arbitrary_command-dev_null.yara#L13)** | runs quoted templated commands, discards output | ["%s" >/dev/null](https://github.com/search?q=%22%25s%22+%3E%2Fdev%2Fnull&type=code) |
diff --git a/tests/windows/2024.aspdasdksa2/callback.bat.json b/tests/windows/2024.aspdasdksa2/callback.bat.json
index dc91fc9c9..395305dfc 100644
--- a/tests/windows/2024.aspdasdksa2/callback.bat.json
+++ b/tests/windows/2024.aspdasdksa2/callback.bat.json
@@ -12,11 +12,11 @@
],
"RiskScore": 4,
"RiskLevel": "CRITICAL",
- "RuleURL": "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_susp.yar#L52-L91",
+ "RuleURL": "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_susp.yar#L52-L91",
"ReferenceURL": "Internal%20Research",
"RuleAuthor": "Florian Roth (Nextron Systems)",
"RuleLicense": "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE",
- "RuleLicenseURL": "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE",
+ "RuleLicenseURL": "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE",
"ID": "3P/YARAForge/signature_powershell_webdownload",
"RuleName": "SIGNATURE_BASE_Suspicious_Powershell_Webdownload_1"
},
diff --git a/third_party/yara/YARAForge/RELEASE b/third_party/yara/YARAForge/RELEASE
index 3a7846ef2..15c8f6800 100644
--- a/third_party/yara/YARAForge/RELEASE
+++ b/third_party/yara/YARAForge/RELEASE
@@ -1 +1 @@
-20260906
+20260913
diff --git a/third_party/yara/YARAForge/yara-rules-full.yar b/third_party/yara/YARAForge/yara-rules-full.yar
index 28747fc7a..d716dc349 100644
--- a/third_party/yara/YARAForge/yara-rules-full.yar
+++ b/third_party/yara/YARAForge/yara-rules-full.yar
@@ -12,9 +12,9 @@
* Force Exclude Importance Level: 0
* Minimum Age (in days): 0
* Minimum Score: 40
- * Creation Date: 2026-09-06
- * Number of Rules: 12390
- * Skipped: 0 (age), 238 (quality), 8 (score), 0 (importance)
+ * Creation Date: 2026-09-13
+ * Number of Rules: 12402
+ * Skipped: 0 (age), 229 (quality), 8 (score), 0 (importance)
*/
import "console"
@@ -30,7 +30,7 @@ import "string"
* YARA Rule Set
* Repository Name: ReversingLabs
* Repository: https://github.com/reversinglabs/reversinglabs-yara-rules/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: e0a0be54aa1e11ccfd6854e4f19e9476f328fd84
* Number of Rules: 1240
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -29871,8 +29871,8 @@ rule REVERSINGLABS_Linux_Virus_Vit : TC_DETECTION MALICIOUS MALWARE FILE
description = "Yara rule that detects Vit virus."
author = "ReversingLabs"
id = "4515fe43-4c5a-521d-82b7-273823f0c64e"
- date = "2026-09-06"
- date = "2026-09-06"
+ date = "2026-09-13"
+ date = "2026-09-13"
modified = "2023-06-07"
reference = "ReversingLabs"
source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/e0a0be54aa1e11ccfd6854e4f19e9476f328fd84/yara/virus/Linux.Virus.Vit.yara#L3-L36"
@@ -34159,8 +34159,8 @@ rule REVERSINGLABS_Win32_Ransomware_ONI : TC_DETECTION MALICIOUS MALWARE FILE
description = "Yara rule that detects Oni ransomware."
author = "ReversingLabs"
id = "9190aee2-1119-546e-82ca-a7aba44a9d7f"
- date = "2026-09-06"
- date = "2026-09-06"
+ date = "2026-09-13"
+ date = "2026-09-13"
modified = "2020-12-07"
reference = "ReversingLabs"
source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/e0a0be54aa1e11ccfd6854e4f19e9476f328fd84/yara/ransomware/Win32.Ransomware.Oni.yara#L1-L82"
@@ -59995,8 +59995,8 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Oct : TC_DETECTION MALICIOUS MALWARE
description = "Yara rule that detects Oct ransomware."
author = "ReversingLabs"
id = "e811a0ba-52df-5e88-ab71-df91d5cb584a"
- date = "2026-10-06"
- date = "2026-10-06"
+ date = "2026-10-13"
+ date = "2026-10-13"
modified = "2021-08-12"
reference = "ReversingLabs"
source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/e0a0be54aa1e11ccfd6854e4f19e9476f328fd84/yara/ransomware/ByteCode.MSIL.Ransomware.Oct.yara#L1-L68"
@@ -60236,7 +60236,7 @@ rule REVERSINGLABS_Win32_Ransomware_Saturn : TC_DETECTION MALICIOUS MALWARE FILE
* YARA Rule Set
* Repository Name: R3c0nst
* Repository: https://github.com/fboldewin/YARA-rules/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 54e9e6899b258b72074b2b4db6909257683240c2
* Number of Rules: 26
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -60995,8 +60995,8 @@ rule R3C0NST_ATM_Malware_Atmspitter : FILE
* YARA Rule Set
* Repository Name: CAPE
* Repository: https://github.com/kevoreilly/CAPEv2
- * Retrieval Date: 2026-09-06
- * Git Commit: 7a1952ebc127edc3622789243a5243e41b1dd2a0
+ * Retrieval Date: 2026-09-13
+ * Git Commit: 471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0
* Number of Rules: 190
* Skipped: 0 (age), 18 (quality), 3 (score), 0 (importance)
*
@@ -61678,8 +61678,8 @@ rule CAPE_Risepro : FILE
date = "2023-12-16"
modified = "2023-12-16"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/RisePro.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/RisePro.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "1b69a1dd5961241b926605f0a015fa17149c3b2759fb077a30a22d4ddcc273f6"
logic_hash = "055ca8328923b91f93c116e4a856366356fa11155f4e9fde95da31129b51386a"
score = 75
@@ -61704,8 +61704,8 @@ rule CAPE_Lumma : FILE
date = "2024-01-05"
modified = "2024-05-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Lumma.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Lumma.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "a8f9212b619796f91f14c4164e4d2f30c66b51118f22f3d6c310841b6707b7b0"
score = 75
quality = 70
@@ -61730,8 +61730,8 @@ rule CAPE_Lummaremap
date = "2024-01-05"
modified = "2024-05-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Lumma.yar#L16-L27"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Lumma.yar#L16-L27"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "51093379fbd041f75bdfe161bc9dfcc7d782c23ce16d625ca558bb58d8d57713"
score = 75
quality = 70
@@ -61754,8 +61754,8 @@ rule CAPE_Cargobayloader : FILE
date = "2023-02-20"
modified = "2023-02-20"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/CargoBayLoader.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/CargoBayLoader.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "75e975031371741498c5ba310882258c23b39310bd258239277708382bdbee9c"
logic_hash = "1d5c4ca79f97e1fac358189a8c6530be12506974fc2fb42f63b0b621536a45c9"
score = 75
@@ -61779,8 +61779,8 @@ rule CAPE_Ursnifv3
date = "2021-06-17"
modified = "2023-03-23"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/UrsnifV3.yar#L1-L16"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/UrsnifV3.yar#L1-L16"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "d679546e37ee58087fce75920b2ce4e6d2b9ae55fb1ef80d14ec14309396757c"
score = 75
quality = 70
@@ -61807,8 +61807,8 @@ rule CAPE_Modiloader : FILE
date = "2023-10-19"
modified = "2025-01-31"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/ModiLoader.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/ModiLoader.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "1f0cbf841a6bc18d632e0bc3c591266e77c99a7717a15fc4b84d3e936605761f"
logic_hash = "9e64e0c40192cc832a1ffa7b3ac65a704596af82515d03706cd7aa1f4498f32f"
score = 75
@@ -61832,8 +61832,8 @@ rule CAPE_Modiloaderold : FILE
date = "2023-10-19"
modified = "2025-01-31"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/ModiLoader.yar#L15-L53"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/ModiLoader.yar#L15-L53"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "fc006377e6d41515503b0b234ff87f59d930a7d9f8b32d2e072de79b9c52ddc4"
score = 75
quality = 66
@@ -61877,8 +61877,8 @@ rule CAPE_Icedidsyscallwritemem : FILE
date = "2021-03-30"
modified = "2023-11-28"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/IcedID.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/IcedID.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "6b068106b038e9efeb9057cadf314d400c1ada1a1cc70336d3272da3a212c993"
score = 75
quality = 70
@@ -61902,8 +61902,8 @@ rule CAPE_Icedidhook
date = "2021-03-30"
modified = "2023-11-28"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/IcedID.yar#L15-L25"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/IcedID.yar#L15-L25"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "fd62e0ed6f2a18472fa9336daee0e8a3a55e21779a8385394e85f96da928e24f"
score = 75
quality = 70
@@ -61925,8 +61925,8 @@ rule CAPE_Icedidpackera : FILE
date = "2021-03-30"
modified = "2023-11-28"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/IcedID.yar#L27-L40"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/IcedID.yar#L27-L40"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "fbad60002286599ca06d0ecb3624740efbf13ee5fda545341b3e0bf4d5348cfe"
logic_hash = "aa0681e7794546355e6d61f739c49035a493cdfca7e666531d74e3835ec44408"
score = 75
@@ -61951,8 +61951,8 @@ rule CAPE_Icedidpackerb : FILE
date = "2021-03-30"
modified = "2023-11-28"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/IcedID.yar#L42-L56"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/IcedID.yar#L42-L56"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "6517ef2c579002ec62ddeb01a3175917c75d79ceca355c415a4462922c715cb6"
logic_hash = "fde1e2c0124d180b2fa3d0675b35e8d78fdd7b06cd27e9228c148aa29ce30ee7"
score = 75
@@ -61977,8 +61977,8 @@ rule CAPE_Icedidpackerc : FILE
date = "2021-03-30"
modified = "2023-11-28"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/IcedID.yar#L58-L71"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/IcedID.yar#L58-L71"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "c06805b6efd482c1a671ec60c1469e47772c8937ec0496f74e987276fa9020a5"
hash = "265c1857ac7c20432f36e3967511f1be0b84b1c52e4867889e367c0b5828a844"
logic_hash = "f1e75e380ab0947fdfda012b7a5077a1c2ef51163239846ab2dc29cac95ba166"
@@ -62003,8 +62003,8 @@ rule CAPE_Icedidpackerd : FILE
date = "2021-03-30"
modified = "2023-11-28"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/IcedID.yar#L73-L86"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/IcedID.yar#L73-L86"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "7b226f8cc05fa7d846c52eb0ec386ab37f9bae04372372509daa6bacc9f885d8"
logic_hash = "6685e0246f5a11ce0ca33447837de06506b447a5f8591423e2b76f2ab0274dc7"
score = 75
@@ -62029,8 +62029,8 @@ rule CAPE_Icedsleep : FILE
date = "2021-03-30"
modified = "2023-11-28"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/IcedID.yar#L88-L99"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/IcedID.yar#L88-L99"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "0b1a8be95b1b8a3b066837f9e47561ee8202d741b39d64e626c0461c2fbf7c70"
score = 75
quality = 70
@@ -62053,8 +62053,8 @@ rule CAPE_Slowloader
date = "2024-09-23"
modified = "2024-09-23"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/SlowLoader.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/SlowLoader.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "f07528c646ebd980a5e843caa4a4715e31b22c3cd091576600e9fe45d7fc2fe4"
score = 75
quality = 70
@@ -62077,8 +62077,8 @@ rule CAPE_Guloaderprecursor : FILE
date = "2020-12-29"
modified = "2023-10-02"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Guloader.yar#L17-L28"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Guloader.yar#L17-L28"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "ea05c352739366a03da302074b01537382ba26f7fd5049004f156e47d284f070"
score = 75
quality = 70
@@ -62101,8 +62101,8 @@ rule CAPE_Pikahook : FILE
date = "2024-03-07"
modified = "2024-03-12"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Pikabot.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Pikabot.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "2a50a5f2d905122a5b7ac8ca3666b47caa24d325e246841129e53807daf2a1dd"
score = 75
quality = 70
@@ -62127,8 +62127,8 @@ rule CAPE_Pikexport : FILE
date = "2024-03-07"
modified = "2024-03-12"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Pikabot.yar#L16-L28"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Pikabot.yar#L16-L28"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646"
logic_hash = "33f58703a0e40c2361343dbdcc17111aafbf5cc912393edda79005c6ec566f42"
score = 75
@@ -62152,8 +62152,8 @@ rule CAPE_Gettickcountantivm
date = "2021-12-14"
modified = "2022-02-25"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/GetTickCountAntiVM.yar#L1-L20"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/GetTickCountAntiVM.yar#L1-L20"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "662bc7839ed7ddd82d5fdafa29fafd9a9ec299c28820fe4104fbba9be1a09c42"
hash = "00f1537b13933762e1146e41f3bac668123fac7eacd0aa1f7be0aa37a91ef3ce"
hash = "549bca48d0bac94b6a1e6eb36647cd007fed5c0e75a0e4aa315ceabdafe46541"
@@ -62184,8 +62184,8 @@ rule CAPE_Stealcanti : FILE
date = "2023-02-22"
modified = "2025-09-01"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Stealc.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Stealc.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "77d6f1914af6caf909fa2a246fcec05f500f79dd56e5d0d466d55924695c702d"
logic_hash = "4132e8094b0b49a89e9f40a8b1a6abbf105bbb04e4ddf3ce739e39fc2baf0d13"
score = 75
@@ -62209,8 +62209,8 @@ rule CAPE_Stealcstrings : FILE
date = "2023-02-22"
modified = "2025-09-01"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Stealc.yar#L15-L26"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Stealc.yar#L15-L26"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "6d402446a979c00b6257ace9924db381d98c530b22968bd2776c66d58c7faefc"
score = 75
quality = 70
@@ -62233,8 +62233,8 @@ rule CAPE_Stealcv2Strings : FILE
date = "2023-02-22"
modified = "2025-09-01"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Stealc.yar#L28-L43"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Stealc.yar#L28-L43"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "923f70edb3ad70957576994008729bf7a087479eed1973c42161aa96fa694baa"
score = 75
quality = 70
@@ -62261,8 +62261,8 @@ rule CAPE_Stealcv2Datecheck : FILE
date = "2023-02-22"
modified = "2025-09-01"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Stealc.yar#L45-L56"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Stealc.yar#L45-L56"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "f074aceb7c111156752891acac8690c00dad7c26240fb0752cc12a9a65aa3d30"
score = 75
quality = 70
@@ -62285,8 +62285,8 @@ rule CAPE_Singlestepantihook
date = "2021-08-26"
modified = "2021-08-26"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/SingleStepAntiHook.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/SingleStepAntiHook.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "fc9f36b0ecc13192fe8b6caaff256ac52c1f14480223d629a38ba84e90dd0809"
score = 75
quality = 70
@@ -62308,8 +62308,8 @@ rule CAPE_Formhooka
date = "2021-03-07"
modified = "2026-05-15"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Formbook.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Formbook.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "21b8101a7039cfad0e9d49cc1f055bc23a2eb4c973dcda2a81a007e452d77a6d"
score = 75
quality = 70
@@ -62334,8 +62334,8 @@ rule CAPE_Formconfa
date = "2021-03-07"
modified = "2026-05-15"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Formbook.yar#L32-L44"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Formbook.yar#L32-L44"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "b0aa4cec55a21245d8104380c531dd6cc0fdef64fbefd79616eadfb4e95b2d75"
score = 75
quality = 70
@@ -62359,8 +62359,8 @@ rule CAPE_Formhelper
date = "2021-03-07"
modified = "2026-05-15"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Formbook.yar#L46-L58"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Formbook.yar#L46-L58"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "e049fba8e53934587f97bda5108cf9cece4169a8ff65a5d2788a98f709a68dc0"
score = 75
quality = 70
@@ -62384,8 +62384,8 @@ rule CAPE_Formconfb
date = "2021-03-07"
modified = "2026-05-15"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Formbook.yar#L60-L75"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Formbook.yar#L60-L75"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "c8bf1d3c242a02ae8bee42d570010c8b4a881db64d82b157fc4ac18f71e11f71"
score = 75
quality = 70
@@ -62412,8 +62412,8 @@ rule CAPE_Agentteslav4Jit
date = "2023-09-13"
modified = "2024-02-27"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/AgentTesla.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/AgentTesla.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "8f7144d2a989ce8d291af926b292f5f0f7772e707b0e49797eba13ecf91b90bc"
score = 75
quality = 70
@@ -62438,8 +62438,8 @@ rule CAPE_Agentteslav3Jit
date = "2023-09-13"
modified = "2024-02-27"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/AgentTesla.yar#L16-L26"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/AgentTesla.yar#L16-L26"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "62a49cf4295df637f96ba7c127cfc4aeb9af2fcced497fdf34d726a062edc1ec"
score = 75
quality = 70
@@ -62461,8 +62461,8 @@ rule CAPE_Hijackloaderstub
date = "2026-01-26"
modified = "2026-01-26"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/HijackLoader.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/HijackLoader.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "686a19a416b94f6ccdd1891ff027452c84b2171ee4268ff971f490e18948a6f5"
score = 75
quality = 70
@@ -62486,8 +62486,8 @@ rule CAPE_Blister : FILE
date = "2022-05-10"
modified = "2024-05-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Blister.yar#L1-L17"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Blister.yar#L1-L17"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "aba379b93c85241cf250829832b2c8a5eaafb3abd0ff955dbaf0d06489c00deb"
score = 75
quality = 70
@@ -62515,8 +62515,8 @@ rule CAPE_Doomedloader : FILE
date = "2024-04-12"
modified = "2024-07-25"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/DoomedLoader.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/DoomedLoader.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "54a5962ef49ebf987908c4ea1559788f7c96a7e4ea61d2973636e998a0239c77"
score = 75
quality = 70
@@ -62540,8 +62540,8 @@ rule CAPE_Vbcrypter
date = "2021-03-28"
modified = "2021-03-28"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/VBCrypter.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/VBCrypter.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "a62bca62ab624ab1a2c2e612c5b7e6d543006026a49c07c46800499e31e41c4e"
score = 75
quality = 70
@@ -62563,8 +62563,8 @@ rule CAPE_Anticuckoo : FILE
date = "2023-03-17"
modified = "2023-03-17"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/AntiCuckoo.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/AntiCuckoo.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "ad5e52f144bb4a1dae3090978c6ecb4c7732538c9b62a6cedd32eccee6094be5"
logic_hash = "a039aeca2dae44980e8bffafacfda90975e107001be50f11ac916b35ad43592e"
score = 75
@@ -62587,8 +62587,8 @@ rule CAPE_Zloader : FILE
date = "2021-03-12"
modified = "2024-05-03"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Zloader.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Zloader.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "319adca805083c7f5854fe840447cf961addbd748f1f25eb8ec8cdeed7af38aa"
score = 75
quality = 70
@@ -62611,8 +62611,8 @@ rule CAPE_Zloader_2024 : FILE
date = "2021-03-12"
modified = "2024-05-03"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Zloader.yar#L14-L26"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Zloader.yar#L14-L26"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "38d555ef5f613cf7ca043697c479100a7a22e7f043acf8b6a46f8009eb92fd7e"
score = 75
quality = 70
@@ -62636,8 +62636,8 @@ rule CAPE_Bruteratelsyscall
date = "2024-07-11"
modified = "2024-07-22"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/BruteRatel.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/BruteRatel.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "5ed054b3cd5d2659c250945d55d6adac90945963c34ad2af0f8d7436141e86b6"
score = 75
quality = 70
@@ -62660,8 +62660,8 @@ rule CAPE_Bruteratelpacker
date = "2024-07-11"
modified = "2024-07-22"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/BruteRatel.yar#L14-L26"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/BruteRatel.yar#L14-L26"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "2ccb17efe378d034df34d20d7580c58171d0fd11c18fef6c9a23f1ba238514e6"
score = 75
quality = 70
@@ -62685,8 +62685,8 @@ rule CAPE_Bruterateldate
date = "2024-07-11"
modified = "2024-07-22"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/BruteRatel.yar#L28-L39"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/BruteRatel.yar#L28-L39"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "88589b2d08aea03565668ff1b9af20b6fe11cda50d867c60db7cb4d1826b0fd7"
score = 75
quality = 70
@@ -62709,8 +62709,8 @@ rule CAPE_Bruteratelconfig
date = "2024-07-11"
modified = "2024-07-22"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/BruteRatel.yar#L41-L51"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/BruteRatel.yar#L41-L51"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "b1815aafec940ab6c8daafc68ccf294845221ada260de5209dcb7e49ccd061c7"
score = 75
quality = 70
@@ -62732,8 +62732,8 @@ rule CAPE_Socks5Systemz : FILE
date = "2024-05-22"
modified = "2025-05-23"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Socks5Systemz.yar#L1-L19"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Socks5Systemz.yar#L1-L19"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "7e324bacd1ea57585435b6a5a4c93bda63ca146c100f2361a1c5530b87668299"
score = 75
quality = 70
@@ -62763,8 +62763,8 @@ rule CAPE_Remus : FILE
date = "2026-07-31"
modified = "2026-08-19"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Remus.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Remus.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "836b4219141a17ba963155881d8d166fe528fcb8804135ceac4141de03796601"
score = 75
quality = 70
@@ -62790,8 +62790,8 @@ rule CAPE_Rhadamanthys
date = "2023-01-25"
modified = "2025-11-11"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Rhadamanthys.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Rhadamanthys.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "3c8fbfe14f81e099fc900023d9c856e3f45b99af38889ed952b2ac67a636f51d"
score = 75
quality = 70
@@ -62816,8 +62816,8 @@ rule CAPE_Rhadaanti
date = "2023-01-25"
modified = "2025-11-11"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Rhadamanthys.yar#L15-L24"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Rhadamanthys.yar#L15-L24"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "b54fd25e3297d358f2a8ec3a868bb4d233ee32d6942f21a53c3d25d35164530b"
score = 75
quality = 70
@@ -62839,8 +62839,8 @@ rule CAPE_Rhadunhook
date = "2023-01-25"
modified = "2025-11-11"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Rhadamanthys.yar#L26-L36"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Rhadamanthys.yar#L26-L36"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "f2da2f1ee6b0a3b9fe58b2c35ccf0a0f6dee44228ec92659370d30defdef7ea3"
score = 75
quality = 70
@@ -62864,8 +62864,8 @@ rule CAPE_Xworm
date = "2023-11-07"
modified = "2023-11-07"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/XWorm.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/XWorm.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "d8e103f3470e83d71cd4992b74698c0721b8a69d764fdb7a4543997b2853014a"
score = 75
quality = 70
@@ -62887,8 +62887,8 @@ rule CAPE_Latrodectus : FILE
date = "2024-02-26"
modified = "2024-02-26"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Latrodectus.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Latrodectus.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "378d220bc863a527c2bca204daba36f10358e058df49ef088f8b1045604d9d05"
logic_hash = "c2c9f23e287253d766425c05eb774f6e07bdcbabc259e04b723a1a87c8b91fbd"
score = 75
@@ -62911,8 +62911,8 @@ rule CAPE_Smokeinjector : FILE
date = "2023-02-06"
modified = "2025-11-19"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/SmokeLoader.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/SmokeLoader.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "757a2bf8aceb92bee839bfcaba3b1a8bc4c037812b969e0f493e4f7a4ddc9ede"
score = 75
quality = 70
@@ -62935,8 +62935,8 @@ rule CAPE_Emotetpacker : FILE
date = "2022-03-31"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/EmotetPacker.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/EmotetPacker.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "5a95d1d87ce69881b58a0e3aafc1929861e2633cdd960021d7b23e2a36409e0d"
logic_hash = "5f27d9d18884f7e0805f69960869b332c1577bf8be8ac103285e8bf98cda0ffd"
score = 75
@@ -62960,8 +62960,8 @@ rule CAPE_Bumblebee : FILE
date = "2022-04-21"
modified = "2023-02-08"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/BumbleBee.yar#L34-L46"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/BumbleBee.yar#L34-L46"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "0a632a0b30b28d544880eb1cfdd85e95f455c343d60f8d6922d4196ef7415961"
score = 75
quality = 70
@@ -62985,8 +62985,8 @@ rule CAPE_Amatera : FILE
date = "2025-06-25"
modified = "2025-06-25"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Amatera.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Amatera.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "35eb93548a0c037d392f870c05e0e9fb1aeff3a5a505e1d4a087f7465ed1f6af"
logic_hash = "1c02f04846568b85acbd4101b2e944dc824179f7cff1bceaec1c657939b610d5"
score = 75
@@ -63011,8 +63011,8 @@ rule CAPE_Heavenssyscall : FILE
date = "2024-03-25"
modified = "2024-03-25"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/HeavensSyscall.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/HeavensSyscall.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "aeb981fcba0936ff8b1be4c601445fd45e5d3b74856a9439d351edd57f5a50c3"
score = 75
quality = 70
@@ -63036,8 +63036,8 @@ rule CAPE_Privateloader
date = "2024-10-04"
modified = "2024-10-04"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/PrivateLoader.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/PrivateLoader.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "204a86bb3743f19fed0fe55ff5ccd716661f7f315b5966a29e434ccb3e160526"
score = 75
quality = 70
@@ -63060,8 +63060,8 @@ rule CAPE_Loadersyscall
date = "2024-10-29"
modified = "2025-07-23"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/NitrogenLoader.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/NitrogenLoader.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "3c7ffd8b95032cffecff7fa7e5f5f561cce13e1109f6a9b30bc743642b495e45"
score = 75
quality = 70
@@ -63085,8 +63085,8 @@ rule CAPE_Nitrogenloaderaes
date = "2024-10-29"
modified = "2025-07-23"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/NitrogenLoader.yar#L15-L27"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/NitrogenLoader.yar#L15-L27"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "de8ed0e98948cfadfd579e334fd9ce9f777ddbd988de897529ba71cb5eb2d396"
score = 75
quality = 70
@@ -63110,8 +63110,8 @@ rule CAPE_Nitrogenloaderbypass
date = "2024-10-29"
modified = "2025-07-23"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/NitrogenLoader.yar#L29-L41"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/NitrogenLoader.yar#L29-L41"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "3a034d3ddd18723ea1f91814c8c2a2c47a749dfd1496a5d4777d8ff8bfab3457"
score = 75
quality = 70
@@ -63135,8 +63135,8 @@ rule CAPE_Nitrogenloaderconfig
date = "2024-10-29"
modified = "2025-07-23"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/NitrogenLoader.yar#L43-L66"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/NitrogenLoader.yar#L43-L66"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "06d49ebf3f67476c83a77734dff0245a51027a35d92e5af07bb9146db5b156ca"
score = 75
quality = 70
@@ -63171,8 +63171,8 @@ rule CAPE_Darkgateloader
date = "2023-08-09"
modified = "2025-04-07"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/DarkGateLoader.yar#L1-L15"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/DarkGateLoader.yar#L1-L15"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "00692123615d2f7eaf8aea07754fc9439cf58e1fb8eb4f44f0428b362f27e794"
score = 75
quality = 70
@@ -63198,8 +63198,8 @@ rule CAPE_Darkgate
date = "2024-02-26"
modified = "2024-02-26"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/DarkGate.yar#L1-L17"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/DarkGate.yar#L1-L17"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "c1d35921f4fc3bac681a3d5148f517dc0ec90ab8c51e267c8c6cd5b1ca3dc085"
logic_hash = "25c0e77a83676c6a18445f8df0b1f7a9148de5f64eeb532f9a4f4d4652dd8191"
score = 75
@@ -63227,8 +63227,8 @@ rule CAPE_Qakbot5 : FILE
date = "2022-03-16"
modified = "2024-02-16"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/QakBot.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/QakBot.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "303ea2d8d1a7f0fd0ca5508dae2c1b83c03b1e3e975760f15d36d93bcc152767"
score = 75
quality = 70
@@ -63252,8 +63252,8 @@ rule CAPE_Qakbot4 : FILE
date = "2022-03-16"
modified = "2024-02-16"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/QakBot.yar#L15-L29"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/QakBot.yar#L15-L29"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "ad75b07b9b786f634fd46cbe6dc089d3f732673320e70714e8ab058f0392c9f5"
score = 75
quality = 70
@@ -63279,8 +63279,8 @@ rule CAPE_Qakbotloader : FILE
date = "2022-03-16"
modified = "2024-02-16"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/QakBot.yar#L31-L46"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/QakBot.yar#L31-L46"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "6f99171c95a8ed5d056eeb9234dbbee123a6f95f481ad0e0a966abd2844f0e1a"
logic_hash = "00869c0a9bf62cde3f46ca915b0ef689557b09dc58d6de34609e3998abfa7e98"
score = 75
@@ -63307,8 +63307,8 @@ rule CAPE_Qakbotantivm
date = "2022-03-16"
modified = "2024-02-16"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/QakBot.yar#L48-L59"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/QakBot.yar#L48-L59"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "e269497ce458b21c8427b3f6f6594a25d583490930af2d3395cb013b20d08ff7"
logic_hash = "20f1cd28f38945a3aa328e77e78525fb1ffc47ecf54d5a40c2f18264c3973989"
score = 75
@@ -63331,8 +63331,8 @@ rule CAPE_Rdtscpantivm
date = "2021-12-11"
modified = "2021-12-11"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/RdtscpAntiVM.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/RdtscpAntiVM.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "be0f9b52fb630730a38160f4ad2d50b6b4bea5edd82e3ea4d1e257cf7b090910"
score = 75
quality = 70
@@ -63354,8 +63354,8 @@ rule CAPE_Dridexloader : FILE
date = "2021-03-09"
modified = "2021-03-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/DridexLoader.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/DridexLoader.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "00a3e4e80a2558ee52035f091e2339fa2dad6f6515b9dc099f2f3800e4c70bce"
score = 75
quality = 70
@@ -63377,8 +63377,8 @@ rule CAPE_Themida : FILE
date = "2024-09-10"
modified = "2024-09-11"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/Themida.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/Themida.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "c4f1e01a3fe3cb66062ce03253bfe9edc09dc6f1a77db99b281106e8ceff9257"
score = 75
quality = 70
@@ -63401,8 +63401,8 @@ rule CAPE_Buerloader : FILE
date = "2021-03-13"
modified = "2021-03-13"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/BuerLoader.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/BuerLoader.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "6f9f9b4c01251c0643c61701084cca2bdfeea08ca95f982355565cf05483d940"
score = 75
quality = 70
@@ -63424,8 +63424,8 @@ rule CAPE_Mysterysnail
date = "2021-10-16"
modified = "2021-10-16"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/MysterySnail.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/MysterySnail.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "9402dbbbfdd286e2309ee83fc08194f70f73657a3a4e3785dfbcb564dbee86a8"
score = 75
quality = 70
@@ -63447,8 +63447,8 @@ rule CAPE_Aurastealerbypass
date = "2025-09-02"
modified = "2025-09-02"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/analyzer/windows/data/yara/AuraStealer.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/analyzer/windows/data/yara/AuraStealer.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "ae174c96c262b1734c58bd6c5f7112221b08596c180612e4970acada35dbd070"
score = 75
quality = 70
@@ -63473,8 +63473,8 @@ rule CAPE_Stxratloader : FILE
date = "2026-04-11"
modified = "2026-04-14"
reference = "https://www.esentire.com/blog/stx-rat-a-new-rat-in-2026-with-infostealer-capabilities"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/STXRat.yar#L1-L47"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/STXRat.yar#L1-L47"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "e9e9ab77424cfb9a18b5363cde78a953505b7ddd97a057068195510fae7117e0"
score = 75
quality = 45
@@ -63524,8 +63524,8 @@ rule CAPE_Stxrat : FILE
date = "2026-04-11"
modified = "2026-04-14"
reference = "https://www.esentire.com/blog/stx-rat-a-new-rat-in-2026-with-infostealer-capabilities"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/STXRat.yar#L49-L120"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/STXRat.yar#L49-L120"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "f82b832e6bf936ff936332c059b1d3b981ce387bf82964ecf64a9cb12cda955d"
score = 75
quality = 70
@@ -63598,8 +63598,8 @@ rule CAPE_Cerber : FILE
date = "2019-10-30"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Cerber.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Cerber.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "16a8f808c28d3b142c079a305aba7f553f2452e439710bf610a06f8f2924d5a3"
score = 75
quality = 70
@@ -63621,8 +63621,8 @@ rule CAPE_Nemty : FILE
date = "2020-04-03"
modified = "2020-04-03"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Nemty.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Nemty.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "a05974b561c67b4f1e0812639b74831edcf65686a06c0d380f0b45739e342419"
score = 75
quality = 70
@@ -63646,8 +63646,8 @@ rule CAPE_Lumma_1 : FILE
date = "2024-01-05"
modified = "2025-07-08"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Lumma.yar#L1-L16"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Lumma.yar#L1-L16"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "ca7822292c58af68e7a1610362bf0b5d27c93e3222ceec8d216e05a442008f37"
score = 75
quality = 70
@@ -63674,8 +63674,8 @@ rule CAPE_Ursnifv3_1 : FILE
date = "2022-05-31"
modified = "2023-03-23"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/UrsnifV3.yar#L1-L18"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/UrsnifV3.yar#L1-L18"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "501cd52388aba16f9d33b4555f310e1ad58326916b15358a485c701acb87abd8"
score = 75
quality = 70
@@ -63705,8 +63705,8 @@ rule CAPE_Nighthawk
date = "2022-12-03"
modified = "2022-12-05"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Nighthawk.yar#L3-L24"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Nighthawk.yar#L3-L24"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "2d77912678e06503ffef0e8ed84aa4f9ac74357480d57742fbae619acebfb5f2"
score = 75
quality = 70
@@ -63730,8 +63730,8 @@ rule CAPE_Lockbit : FILE
date = "2020-05-14"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Lockbit.yar#L1-L15"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Lockbit.yar#L1-L15"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "80ab705c8246a0bd5b3de65146cf32b102f39bf9444bdf1d366b5a794c1229b9"
score = 75
quality = 70
@@ -63757,8 +63757,8 @@ rule CAPE_Salat : FILE
date = "2026-04-17"
modified = "2026-04-17"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Salat.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Salat.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "162a7398e0b2a83029bc3369127330636dce2b4f0874a17049cd90995ad89911"
score = 75
quality = 70
@@ -63783,8 +63783,8 @@ rule CAPE_Rcsession
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/RCSession.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/RCSession.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "ebd1e9e615a91c35b36332cad55519607323469df738cec4464288b45787630d"
score = 75
quality = 70
@@ -63807,8 +63807,8 @@ rule CAPE_Badrabbit : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/BadRabbit.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/BadRabbit.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "309e14ab4ea2f919358631f9d8b2aaff1f51e7708b6114e4e6bf4a9d9a5fc86c"
score = 75
quality = 70
@@ -63832,8 +63832,8 @@ rule CAPE_Tclient : FILE
date = "2019-10-30"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/TClient.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/TClient.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "6edcd01e4722b367723ed77d9596877d16ee35dc4c160885d125f83e45cee24d"
score = 75
quality = 70
@@ -63855,8 +63855,8 @@ rule CAPE_Icedid
date = "2019-10-30"
modified = "2021-12-16"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/IcedID.yar#L1-L18"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/IcedID.yar#L1-L18"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "e60ccbab7a360020744eba65961156ca3e2ae9cf23671014f913d71c1a96a331"
score = 75
quality = 45
@@ -63885,8 +63885,8 @@ rule CAPE_Gandcrab : FILE
date = "2019-10-30"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Gandcrab.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Gandcrab.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "354ed566dbafbe8e9531bb771d9846952eb8c0e70ee94c26d09368159ce4142c"
score = 75
quality = 70
@@ -63911,8 +63911,8 @@ rule CAPE_Cryptoshield : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Cryptoshield.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Cryptoshield.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "46064b4c69cb1af01330c5d194ef50728e0f0479e9fbf72828822935f8e37ac6"
score = 75
quality = 70
@@ -63936,8 +63936,8 @@ rule CAPE_Nanolocker : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/NanoLocker.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/NanoLocker.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "fe6c8a4e259c3c526f8f50771251f6762b2b92a4df2e8bfc705f282489f757db"
score = 75
quality = 70
@@ -63961,8 +63961,8 @@ rule CAPE_Zeuspanda : FILE
date = "2019-10-30"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/ZeusPanda.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/ZeusPanda.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "43d8a56cae9fd23c053f6956851734d3270b46a906236854502c136e3bb1e761"
score = 75
quality = 70
@@ -63985,8 +63985,8 @@ rule CAPE_Vidar : FILE
date = "2019-10-30"
modified = "2026-06-08"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Vidar.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Vidar.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "35f2aa1e2a3f233b3c25893fdb447f11b2ff9f6fdaab1bc1499a12b25c8cb3ee"
score = 75
quality = 70
@@ -64009,8 +64009,8 @@ rule CAPE_Vidarold : FILE
date = "2019-10-30"
modified = "2026-06-08"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Vidar.yar#L14-L35"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Vidar.yar#L14-L35"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "5d4c030536ed41cf4e0dcb77b2fe4553d789ee2b8095a4b3e050692335a8709d"
score = 75
quality = 70
@@ -64043,8 +64043,8 @@ rule CAPE_Zerot : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/ZeroT.yar#L1-L15"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/ZeroT.yar#L1-L15"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "f60ae25ac3cd741b8bdc5100b5d3c474b5d9fbe8be88bfd184994bae106c3803"
score = 75
quality = 68
@@ -64070,8 +64070,8 @@ rule CAPE_Hancitor : FILE
date = "2019-10-30"
modified = "2020-10-20"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Hancitor.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Hancitor.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "84003542a2f587b5fbd43731c4240759806f8ee46df2bd96aae4a3c09d97e41c"
score = 75
quality = 70
@@ -64096,8 +64096,8 @@ rule CAPE_Vipkeylogger : FILE
date = "2025-09-11"
modified = "2025-09-11"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/VIPKeyLogger.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/VIPKeyLogger.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "b9dba7562bba4807c0789692d44650996e62c8d0c4031dedd65773877621b1de"
score = 75
quality = 70
@@ -64122,8 +64122,8 @@ rule CAPE_Eternalromance : FILE
date = "2019-10-30"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/EternalRomance.yar#L1-L33"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/EternalRomance.yar#L1-L33"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "5390fae3e2411a715cdc965df8648c0c4c511d53d5f76031714f1b784b58eb0d"
score = 75
quality = 68
@@ -64167,8 +64167,8 @@ rule CAPE_Locky : FILE
date = "2019-10-30"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Locky.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Locky.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "9786c54a2644d9581fefe64be11b26e22806398e54e961fa4f19d26eae039cd7"
score = 75
quality = 70
@@ -64192,8 +64192,8 @@ rule CAPE_Tscookie : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/TSCookie.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/TSCookie.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "0461c7fd14c74646437654f0a63a4a89d4efad620e197a8ca1e8d390618842c3"
score = 75
quality = 70
@@ -64217,8 +64217,8 @@ rule CAPE_Jaff : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Jaff.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Jaff.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "6806a5eeee04b7436ff694addc334bfc0f1ee611116904d57be9506acfd47418"
score = 75
quality = 70
@@ -64243,8 +64243,8 @@ rule CAPE_Mykings : FILE
date = "2025-10-24"
modified = "2025-10-26"
reference = "https://x.com/YungBinary/status/1981108948498333900"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/MyKings.yar#L1-L23"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/MyKings.yar#L1-L23"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "82647dd23c0247faa045893ec1cf111da2a30528a1b737b59ce1b71172a64473"
score = 75
quality = 70
@@ -64278,8 +64278,8 @@ rule CAPE_Stealc : FILE
date = "2023-02-22"
modified = "2025-08-21"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Stealc.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Stealc.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "77d6f1914af6caf909fa2a246fcec05f500f79dd56e5d0d466d55924695c702d"
logic_hash = "a6165168b7c74761b91d1691465688c748227b830813067edb4e9bdc934271c4"
score = 75
@@ -64303,8 +64303,8 @@ rule CAPE_Stealcv2 : FILE
date = "2023-02-22"
modified = "2025-08-21"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Stealc.yar#L15-L32"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Stealc.yar#L15-L32"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "911c6a7f63e91a788898f3cc6e66396e39d5bd48f8fbaac49ee5dbbdaa64d5a0"
score = 75
quality = 70
@@ -64333,8 +64333,8 @@ rule CAPE_Hermes : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Hermes.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Hermes.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "9bc974173f39a57e7adfbf8ae106a20d960557696b4c3ce16e9b4e47d3e9e95b"
score = 75
quality = 70
@@ -64358,8 +64358,8 @@ rule CAPE_Ursnif : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Ursnif.yar#L1-L19"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Ursnif.yar#L1-L19"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "46e79fde81ff5352314618021e394b2e0322df07170c7279363290b7134935fd"
score = 75
quality = 70
@@ -64388,8 +64388,8 @@ rule CAPE_Formbook
date = "2019-10-30"
modified = "2023-10-13"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Formbook.yar#L1-L18"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Formbook.yar#L1-L18"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "63ee4dd6fe5ed2a3e5ee88ba7de48d2c9e0024961a550d0fdb68891c9885e05e"
score = 75
quality = 70
@@ -64418,8 +64418,8 @@ rule CAPE_Darkcloud : FILE
date = "2025-10-16"
modified = "2025-10-16"
reference = "https://x.com/YungBinary/status/1971585972912689643"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/DarkCloud.yar#L1-L39"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/DarkCloud.yar#L1-L39"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "e9a67fce4c1e4ffa7322c225522263aa4db94ae9f29113a81f5216fb4fa68b57"
score = 75
quality = 68
@@ -64463,8 +64463,8 @@ rule CAPE_Agent_Tesla
date = "2019-10-30"
modified = "2026-01-14"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AgentTesla.yar#L1-L17"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AgentTesla.yar#L1-L17"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "3945754129dcc58e0abfd7485f5ff0c0afdd1078ae2cf164ca8f59a6f79db1be"
score = 75
quality = 70
@@ -64490,8 +64490,8 @@ rule CAPE_Agenttesla : FILE
date = "2019-10-30"
modified = "2026-01-14"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AgentTesla.yar#L19-L41"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AgentTesla.yar#L19-L41"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "1bf9b26c4cf87e674ddffabe40aba5a45499c6a04d4ff3e43c3cda4cbcb4d188"
score = 75
quality = 70
@@ -64523,8 +64523,8 @@ rule CAPE_Agentteslav2 : FILE
date = "2019-10-30"
modified = "2026-01-14"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AgentTesla.yar#L43-L67"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AgentTesla.yar#L43-L67"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "b45296b3b94fa1ff32de48c94329a17402461fb6696e9390565c4dba9738ed78"
score = 75
quality = 70
@@ -64560,8 +64560,8 @@ rule CAPE_Agentteslav3 : FILE
date = "2019-10-30"
modified = "2026-01-14"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AgentTesla.yar#L69-L115"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AgentTesla.yar#L69-L115"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "cc9bbbcf3608b49a76b098acf846ff03eae5e9cb107697627d62661fa1be36c2"
score = 75
quality = 70
@@ -64599,8 +64599,8 @@ rule CAPE_Agentteslav4 : FILE
date = "2019-10-30"
modified = "2026-01-14"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AgentTesla.yar#L117-L130"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AgentTesla.yar#L117-L130"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "0a39036f408728ab312a54ff3354453d171424f57f9a8f3b42af867be3037ca9"
score = 75
quality = 70
@@ -64625,8 +64625,8 @@ rule CAPE_Doppelpaymer : FILE
date = "2019-11-15"
modified = "2022-06-27"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/DoppelPaymer.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/DoppelPaymer.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "73a2575671bafc31a70af3ce072d6f94ae172b12202baebba586a02524cb6f9d"
score = 75
quality = 70
@@ -64649,8 +64649,8 @@ rule CAPE_Blister_1 : FILE
date = "2022-05-10"
modified = "2023-09-20"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Blister.yar#L1-L17"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Blister.yar#L1-L17"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "afb77617a4ca637614c429440c78da438e190dd1ca24dc78483aa731d80832c2"
hash = "d3eab2a134e7bd3f2e8767a6285b38d19cd3df421e8af336a7852b74f194802c"
logic_hash = "f26d85fdf0eb07e67fe38c43c5f6d024bfb7b2a333cb3411f5cdcff6bf5db12d"
@@ -64678,8 +64678,8 @@ rule CAPE_Megacortex : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/MegaCortex.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/MegaCortex.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "5de1d8241260070241c91b97f18feb2a90069e3b158e863e2d9f568799c244e6"
score = 75
quality = 70
@@ -64703,8 +64703,8 @@ rule CAPE_Nitrobunnydownloader : FILE
date = "2025-10-28"
modified = "2025-11-05"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/NitroBunnyDownloader.yar#L1-L18"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/NitroBunnyDownloader.yar#L1-L18"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "960e59200ec0a4b5fb3b44e6da763f5fec4092997975140797d4eec491de411b"
logic_hash = "dcc1348c1d1af0c854376cf6331538951362b43d8d76c0ad73bbbdeb1ab4c135"
score = 75
@@ -64733,8 +64733,8 @@ rule CAPE_Pikabotloader : FILE
date = "2023-02-13"
modified = "2024-03-13"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/PikaBot.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/PikaBot.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "7e5f1f2911545ee6bd36b54f2627fbdec1b957f4b91df901dd1c6cbd4dff0231"
score = 75
quality = 70
@@ -64758,8 +64758,8 @@ rule CAPE_Pikabot : FILE
date = "2023-02-13"
modified = "2024-03-13"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/PikaBot.yar#L15-L28"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/PikaBot.yar#L15-L28"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "ed07217c373831a9a67d914854154988696e6fcea70dedabf333385f0e7bb8b7"
score = 75
quality = 70
@@ -64784,8 +64784,8 @@ rule CAPE_Pik23 : FILE
date = "2023-02-13"
modified = "2024-03-13"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/PikaBot.yar#L30-L44"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/PikaBot.yar#L30-L44"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1"
logic_hash = "71a71df2f2a075294941c54eed06cafaaa4d3294e45b3a0098c1cffddd0438bc"
score = 75
@@ -64811,8 +64811,8 @@ rule CAPE_Xenorat
date = "2024-10-09"
modified = "2024-10-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/XenoRAT.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/XenoRAT.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "26f520fb69a52d05786fac0e9e38f5db9601da0a3e7768e00975a9684f3560ef"
score = 75
quality = 66
@@ -64839,8 +64839,8 @@ rule CAPE_Arkei : FILE
date = "2019-10-30"
modified = "2025-01-10"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Arkei.yar#L1-L50"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Arkei.yar#L1-L50"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "296e420880d8d2f24424d0411e7ef4939e18147689557512f410da48498a44c9"
score = 75
quality = 70
@@ -64896,8 +64896,8 @@ rule CAPE_Seduploader : FILE
date = "2019-10-30"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Seduploader.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Seduploader.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "d70c886699169d4dafc5b063c93682a34af5667df6d293b52256ddc19ab9c516"
score = 75
quality = 70
@@ -64919,8 +64919,8 @@ rule CAPE_Rokrat : FILE
date = "2019-10-30"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/RokRat.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/RokRat.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "2aaa7de7ccd59e0da690f4bc0c7deaacf61314d61f8d2aa3ce6f6892f50612ec"
score = 75
quality = 70
@@ -64943,8 +64943,8 @@ rule CAPE_Obfuscar : FILE
date = "2025-03-07"
modified = "2025-03-07"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Obfuscar.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Obfuscar.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "54581e83e5fa13fae4bda74016b3fa1d18c92e2659f493ebe54d70fd5f77bba5"
score = 75
quality = 70
@@ -64965,8 +64965,8 @@ rule CAPE_Mole : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Mole.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Mole.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "8be4d190d554a610360c0e04b33da59eb00319395e5b2000d580546ce6503786"
score = 75
quality = 70
@@ -64990,8 +64990,8 @@ rule CAPE_Zloader_1 : FILE
date = "2020-04-04"
modified = "2025-12-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Zloader.yar#L1-L18"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Zloader.yar#L1-L18"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "adbd0c7096a7373be82dd03df1aae61cb39e0a155c00bbb9c67abc01d48718aa"
logic_hash = "525670973b67aac048199529c97d6be00b0a8cca9bc90deb647366d92a5ea540"
score = 75
@@ -65020,8 +65020,8 @@ rule CAPE_Zloader2024 : FILE
date = "2020-04-04"
modified = "2025-12-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Zloader.yar#L20-L34"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Zloader.yar#L20-L34"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "49405370a33abbf131c5d550cebe00780cc3fd3cbe888220686582ae88f16af7"
logic_hash = "27d883f6d6cab07e602f97a0a032a152386693f79dabf1bb87b0a8a053a38b03"
score = 75
@@ -65047,8 +65047,8 @@ rule CAPE_Zloader2025 : FILE
date = "2020-04-04"
modified = "2025-12-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Zloader.yar#L36-L49"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Zloader.yar#L36-L49"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "86ffd411b42d8d06bdb294f48e79393adeea586c56c5c75c1a68ce6315932881"
logic_hash = "cc9c39f0b5e7e8c8853982d9c896bbaac5a36bb0f501c8901d8854f2d5e1a19c"
score = 75
@@ -65073,8 +65073,8 @@ rule CAPE_Kpot : FILE
date = "2020-10-19"
modified = "2020-10-19"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Kpot.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Kpot.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "75abaab9a10e8ac8808425c389238285ab9bd9cb76f0cd03cc1e35b3ea0a1b0f"
score = 75
quality = 70
@@ -65098,8 +65098,8 @@ rule CAPE_Rozena
date = "2024-03-13"
modified = "2024-03-15"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Rozena.yar#L1-L10"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Rozena.yar#L1-L10"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "c415a8108b58a125a604031bb8d73b58a8aae5429b5b765e35fa8a4add9cd135"
score = 75
quality = 70
@@ -65122,8 +65122,8 @@ rule CAPE_Gootkit : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Gootkit.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Gootkit.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "26704b6b0adca51933fc9d5e097930320768fd0e9355dcefc725aee7775316e7"
score = 75
quality = 70
@@ -65145,8 +65145,8 @@ rule CAPE_Magniber : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Magniber.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Magniber.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "1875754bdf98c1886f31f6c6e29992a98180f74d8fa168ae391e2c660d760618"
score = 75
quality = 70
@@ -65168,8 +65168,8 @@ rule CAPE_Kronos : FILE
date = "2019-10-30"
modified = "2020-07-02"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Kronos.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Kronos.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "52ce9caf3627efe8ae86df6ca59e51e9f738e13ac0265f797e8d70123dbcaeb3"
score = 75
quality = 70
@@ -65194,8 +65194,8 @@ rule CAPE_Scarab : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Scarab.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Scarab.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "0d8fa7ab4c8e5699f17f9e9444e85a42563a840a8e7ee9eda54add3a6845d1c6"
score = 75
quality = 70
@@ -65219,8 +65219,8 @@ rule CAPE_Wanacry : FILE
date = "2019-10-30"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/WanaCry.yar#L1-L16"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/WanaCry.yar#L1-L16"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "16d5e39f043d27bbf22f8f21e13971b7e0709b07e44746dd157d11ee4cc51944"
score = 75
quality = 70
@@ -65246,8 +65246,8 @@ rule CAPE_Bruteratel
date = "2024-07-11"
modified = "2024-07-11"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/BruteRatel.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/BruteRatel.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "0984977c716d6f8e068c045166eb5db77c9fbce27513e555dceca348375f1a66"
score = 75
quality = 70
@@ -65272,8 +65272,8 @@ rule CAPE_Koiloader
date = "2024-10-25"
modified = "2024-10-25"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/KoiLoader.yar#L1-L35"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/KoiLoader.yar#L1-L35"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "b462e3235c7578450b2b56a8aff875a3d99d22f6970a01db3ba98f7ecb6b01a0"
logic_hash = "264a536632f8f11c904b00c9d2e505b3263c733ad8fbc2ef19c25a5ad58cef90"
score = 75
@@ -65317,8 +65317,8 @@ rule CAPE_Adaptixbeacon
date = "2025-06-16"
modified = "2025-10-28"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AdaptixBeacon.yar#L1-L18"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AdaptixBeacon.yar#L1-L18"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "f78f5803be5704420cbb2e0ac3c57fcb3d9cdf443fbf1233c069760bee115b5d"
logic_hash = "2c1d09cd5e19e5a09dde65411691afd5922959d4a7b5232b28ebf56f26d2f07d"
score = 75
@@ -65347,8 +65347,8 @@ rule CAPE_Rhadamanthys_1
date = "2023-01-25"
modified = "2025-12-19"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Rhadamanthys.yar#L1-L19"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Rhadamanthys.yar#L1-L19"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "3ccfc97202690dd996ffd2b4f09d31e6ee322bf9f0b7759f9b8c455164995f84"
score = 75
quality = 70
@@ -65378,8 +65378,8 @@ rule CAPE_Rhadamanthysloader
date = "2023-01-25"
modified = "2025-12-19"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Rhadamanthys.yar#L21-L33"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Rhadamanthys.yar#L21-L33"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "5505c9ba1f0c6cb9aa9c212bf8bc2c49ad544e99996a1f4c1fa79a27a14d4c7f"
score = 75
quality = 70
@@ -65403,8 +65403,8 @@ rule CAPE_Nightshadec2 : FILE
date = "2025-09-04"
modified = "2025-09-12"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/NightshadeC2.yar#L1-L20"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/NightshadeC2.yar#L1-L20"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d"
logic_hash = "f9fabc391e21180a1c92abea0a5ded6d7669e8d8f2330b69d6c1227c9b4237a0"
score = 75
@@ -65434,8 +65434,8 @@ rule CAPE_Oyster
date = "2024-03-01"
modified = "2024-05-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Oyster.yar#L1-L19"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Oyster.yar#L1-L19"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "8bae0fa9f589cd434a689eebd7a1fde949cc09e6a65e1b56bb620998246a1650"
logic_hash = "23ab1518712dbce8319b87785d7ffc0c2b61de82c2bbf533ebf0aae39ec33540"
score = 75
@@ -65465,8 +65465,8 @@ rule CAPE_Varenyky : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Varenyky.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Varenyky.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "602f1b8b60b29565eabe2171fde4eb58546af68f8acecad402a7a51ea9a08ed9"
score = 75
quality = 70
@@ -65488,8 +65488,8 @@ rule CAPE_Emotetloader : FILE
date = "2022-05-31"
modified = "2022-05-31"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/EmotetLoader.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/EmotetLoader.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "410872d25ed3a89a2cba108f952d606cd1c3bf9ccc89ae6ab3377b83665c2773"
score = 75
quality = 70
@@ -65511,8 +65511,8 @@ rule CAPE_Petya : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Petya.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Petya.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "f819261bb34f3b2eb7dc2f843b56be25105570fe902a77940a632a54fbe0d014"
score = 75
quality = 70
@@ -65536,8 +65536,8 @@ rule CAPE_Latrodectus_1
date = "2024-01-18"
modified = "2025-05-10"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Latrodectus.yar#L1-L16"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Latrodectus.yar#L1-L16"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "a547cff9991a713535e5c128a0711ca68acf9298cc2220c4ea0685d580f36811"
logic_hash = "a8430299930f4c8de0a88c6836d4821871f7183cc5ff44ea9be84fbea47bbb13"
score = 75
@@ -65564,8 +65564,8 @@ rule CAPE_Latrodectus_AES
date = "2024-01-18"
modified = "2025-05-10"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Latrodectus.yar#L18-L34"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Latrodectus.yar#L18-L34"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "5cecb26a3f33c24b92a0c8f6f5175da0664b21d7c4216a41694e4a4cad233ca8"
logic_hash = "058d278c16527969066d1b4ea7f0e3ab2809d5480cdab06ec476b465e0c4795a"
score = 75
@@ -65593,8 +65593,8 @@ rule CAPE_Dreambot : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Dreambot.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Dreambot.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "29c6d648d5d38667c5824c2d20a83a20448c2ae6054ddddb2b2b7f8bdb69f74b"
score = 75
quality = 70
@@ -65619,8 +65619,8 @@ rule CAPE_Amadey : FILE
date = "2021-02-18"
modified = "2025-08-15"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Amadey.yar#L1-L15"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Amadey.yar#L1-L15"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "988258716d5296c1323303e8fe4efd7f4642c87bfdbe970fe9a3bb3f410f70a4"
logic_hash = "5a7405a174b63826500f3b04c6f10bc9b40d5b49e85377bef027204e75dd1e9e"
score = 75
@@ -65646,8 +65646,8 @@ rule CAPE_Bazar : FILE
date = "2021-08-26"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Bazar.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Bazar.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "9375f59b56e47fd0b90b089afdf3be8f16f960038fc625523a2e2d5509ab099d"
score = 75
quality = 70
@@ -65670,8 +65670,8 @@ rule CAPE_Smokeloader
date = "2019-10-30"
modified = "2025-11-19"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/SmokeLoader.yar#L1-L16"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/SmokeLoader.yar#L1-L16"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "8e2f95af9b25ccfd8ad7b56f75a37bb085bde1b2feda2e6502568e86c928ed68"
score = 75
quality = 70
@@ -65698,8 +65698,8 @@ rule CAPE_Kovter : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Kovter.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Kovter.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "888fccb8fbfbe6c05ec63bc5658b4743f8e10a96ef51b3868c2ff94afec76f2d"
score = 75
quality = 70
@@ -65724,8 +65724,8 @@ rule CAPE_Bumblebeeshellcode_1
date = "2022-04-21"
modified = "2024-10-29"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/BumbleBee.yar#L18-L33"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/BumbleBee.yar#L18-L33"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "d56f8c4e491d0d1b34e396e73750bef9917ca4f708fb6a2681de772a65c13a40"
score = 75
quality = 70
@@ -65752,8 +65752,8 @@ rule CAPE_Bumblebee2024
date = "2022-04-21"
modified = "2024-10-29"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/BumbleBee.yar#L52-L68"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/BumbleBee.yar#L52-L68"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "db58272c1ba74bc6e6a90bdacf7e8feec94be5da2b5123e0475ce86448f3edb2"
score = 75
quality = 70
@@ -65781,8 +65781,8 @@ rule CAPE_Azorult : FILE
date = "2019-10-30"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Azorult.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Azorult.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "4691cf48d513d1965416b0cce1b6e19c8f7b393a940afd68b7c6ca8c0d125d90"
score = 75
quality = 70
@@ -65805,8 +65805,8 @@ rule CAPE_Fareit : FILE
date = "2019-10-30"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Fareit.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Fareit.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "ed35391ffc949219f380da3f22bc8397a7d5c742bd68e227c3becdebcab5cf83"
score = 75
quality = 70
@@ -65828,8 +65828,8 @@ rule CAPE_Bitpaymer : FILE
date = "2019-11-27"
modified = "2019-11-27"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/BitPaymer.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/BitPaymer.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "6ae0dc9a36da13e483d8d653276b06f59ecc15c95c754c268dcc91b181677c4c"
score = 75
quality = 70
@@ -65852,8 +65852,8 @@ rule CAPE_Cobaltstrikestager
date = "2023-01-18"
modified = "2023-01-18"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/CobaltStrikeStager.yar#L1-L15"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/CobaltStrikeStager.yar#L1-L15"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "6a55b0c3ab5f557dfb7a3f8bd616ede1bd9b93198590fc9d52aa19c1154388c5"
score = 75
quality = 70
@@ -65878,8 +65878,8 @@ rule CAPE_Ryuk : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Ryuk.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Ryuk.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "b4463993d8956e402b927a3dcfa2ca9693a959908187f720372f2d3a40e6db0c"
score = 75
quality = 70
@@ -65904,8 +65904,8 @@ rule CAPE_Nitrogenloader : FILE
date = "2024-10-29"
modified = "2026-05-04"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/NitrogenLoader.yar#L1-L36"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/NitrogenLoader.yar#L1-L36"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "7b603d63a23201ff0b6ffa9acdd650df9caa1731837d559d93b3d8ce1d82a962"
hash = "50c2afd792bfe2966133ee385054eaae1f73b04e013ef3434ef2407f99d7f037"
hash = "4926dee7da0da522c34ffeebb32f28703fd689a52543332c8d28ccfea223f43a"
@@ -65951,8 +65951,8 @@ rule CAPE_Monsterv2 : FILE
date = "2025-09-06"
modified = "2025-09-12"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/MonsterV2.yar#L1-L21"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/MonsterV2.yar#L1-L21"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "d4e65f860e69b2eee8a818a4146d91b84ce6da30c8fa27593587932e4f0847a8"
score = 75
quality = 70
@@ -65984,8 +65984,8 @@ rule CAPE_Remcos : FILE
date = "2019-10-30"
modified = "2022-05-10"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Remcos.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Remcos.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "38142e784ad437d9592353b924f74777bb62e5ed176c811230a2021a437d4710"
score = 75
quality = 68
@@ -66010,8 +66010,8 @@ rule CAPE_Carbanak : FILE
date = "2023-11-30"
modified = "2024-03-18"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Carbanak.yar#L1-L14"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Carbanak.yar#L1-L14"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "c9c1b06cb9c9bd6fc4451f5e2847a1f9524bb2870d7bb6f0ee09b9dd4e3e4c84"
logic_hash = "8ed5ab07f1635dc7cdf296e86a71a0a99d0b2faef8fc460f43d426b24b8c8367"
score = 75
@@ -66036,8 +66036,8 @@ rule CAPE_Azer : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Azer.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Azer.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "48bd4a4e071f10d1911c4173a0cd39c69fed7a3b29eb92beffe709899f4cefa5"
score = 75
quality = 70
@@ -66061,8 +66061,8 @@ rule CAPE_Codoso : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Codoso.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Codoso.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "32c9ed2ac29e8905266977a9ee573a252442d96fb9ec97d88642180deceec3f8"
score = 75
quality = 70
@@ -66086,8 +66086,8 @@ rule CAPE_Qakbot5_1 : FILE
date = "2019-10-30"
modified = "2024-04-28"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/QakBot.yar#L1-L15"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/QakBot.yar#L1-L15"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "59559e97962e40a15adb2237c4d01cfead03623aff1725616caeaa5a8d273a35"
logic_hash = "cc23a92f45619d44af824128b743c259dd9dfa7cb5106932f3425f3dfd1dccdf"
score = 75
@@ -66113,8 +66113,8 @@ rule CAPE_Qakbot4_1 : FILE
date = "2019-10-30"
modified = "2024-04-28"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/QakBot.yar#L17-L35"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/QakBot.yar#L17-L35"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "b2870e33abffbb3ff49b7891b0f5c538ab48ee63da5553929d4e37dec921344f"
score = 75
quality = 70
@@ -66144,8 +66144,8 @@ rule CAPE_Conti : FILE
date = "2020-10-19"
modified = "2021-03-15"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Conti.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Conti.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "c9842f93d012d0189b9c6f10ad558b37ae66226bbb619ad677f6906ccaf0e848"
score = 75
quality = 70
@@ -66169,8 +66169,8 @@ rule CAPE_Aurorastealer : FILE
date = "2022-12-14"
modified = "2023-03-31"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AuroraStealer.yar#L1-L74"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AuroraStealer.yar#L1-L74"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "51c153501e991f6ce4901e6d9578d0c8"
hash = "3816f17052b28603855bde3e57db77a8455bdea4"
hash = "c148c449e1f6c4c53a7278090453d935d1ab71c3e8b69511f98993b6057f612d"
@@ -66249,11 +66249,11 @@ rule CAPE_Asyncrat_Kingrat
date = "2024-10-09"
modified = "2025-02-03"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AsyncRAT.yar#L1-L30"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AsyncRAT.yar#L1-L30"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "1400d2029dfb66d8f2dc34db8643d6301f3af9bd356639f883d2c10bcc0c3947"
score = 75
- quality = 33
+ quality = 58
tags = ""
cape_type = "AsyncRAT Payload"
@@ -66288,8 +66288,8 @@ rule CAPE_Stormkitty : FILE
date = "2024-10-09"
modified = "2025-02-03"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AsyncRAT.yar#L32-L57"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AsyncRAT.yar#L32-L57"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "258f5d9da80ff912459194b1139f062491df21a44456942951e2bd98e4b86c9b"
score = 75
quality = 41
@@ -66324,11 +66324,11 @@ rule CAPE_Worldwind : FILE
date = "2024-10-09"
modified = "2025-02-03"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AsyncRAT.yar#L60-L82"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AsyncRAT.yar#L60-L82"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "9bb04fad460193cd877ea7f2de9337f69aadda01aee6c79f0a23cdf564b1e6c8"
score = 75
- quality = 45
+ quality = 70
tags = "FILE"
cape_type = "WorldWind Payload"
@@ -66360,11 +66360,11 @@ rule CAPE_Prynt : FILE
date = "2024-10-09"
modified = "2025-02-03"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AsyncRAT.yar#L85-L107"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AsyncRAT.yar#L85-L107"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "84f2b33285ab1d129a62940a02990639cc8f7c92d490d7257e6aed9170d1e34e"
score = 75
- quality = 45
+ quality = 70
tags = "FILE"
cape_type = "Prynt Payload"
@@ -66396,11 +66396,11 @@ rule CAPE_Xworm_1 : FILE
date = "2024-10-09"
modified = "2025-02-03"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AsyncRAT.yar#L110-L136"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AsyncRAT.yar#L110-L136"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "5a86c2f0a188135e53d86c176806a208abbe3dd830bde364016859ffa5294bd7"
score = 75
- quality = 43
+ quality = 68
tags = "FILE"
cape_type = "XWorm Payload"
@@ -66436,8 +66436,8 @@ rule CAPE_Xworm_Kingrat
date = "2024-10-09"
modified = "2025-02-03"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AsyncRAT.yar#L138-L155"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AsyncRAT.yar#L138-L155"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "3914be652bb7271e5e6b89d05edf10a54f8ddaf9e22d194b60501aa2cdd495d3"
score = 75
quality = 66
@@ -66468,11 +66468,11 @@ rule CAPE_Dcrat : FILE
date = "2024-10-09"
modified = "2025-02-03"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AsyncRAT.yar#L157-L222"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AsyncRAT.yar#L157-L222"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "5a02dcc2b9c7eb3efdba39047e37886240b45fb7e2db3b82aa5b4b9526dfb7f8"
score = 75
- quality = 20
+ quality = 45
tags = "FILE"
cape_type = "DCRat Payload"
@@ -66542,8 +66542,8 @@ rule CAPE_Dcrat_Kingrat
date = "2024-10-09"
modified = "2025-02-03"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AsyncRAT.yar#L224-L243"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AsyncRAT.yar#L224-L243"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "73ac27c3f0fc71d053e89690b5a7d29c1f8b0ea0a22e8595148a9001799fae54"
score = 75
quality = 62
@@ -66575,8 +66575,8 @@ rule CAPE_Quasarrat : FILE
date = "2024-10-09"
modified = "2025-02-03"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AsyncRAT.yar#L245-L266"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AsyncRAT.yar#L245-L266"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "556b19dc0980761198ea31a285f281adae084463d24bff1eda15326436ad562b"
score = 75
quality = 70
@@ -66610,8 +66610,8 @@ rule CAPE_Quasarrat_Kingrat
date = "2024-10-09"
modified = "2025-02-03"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AsyncRAT.yar#L268-L287"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AsyncRAT.yar#L268-L287"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "1f4296a592134edbe52e256dc353143af02e897ff1afad98f3dac0c5ab13f3f7"
score = 75
quality = 70
@@ -66643,8 +66643,8 @@ rule CAPE_Masslogger : FILE
date = "2020-10-20"
modified = "2020-11-24"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/MassLogger.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/MassLogger.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "c8d82694810aafbdc6a35a661e7431e9536035e2f7fef90b9359064c4209b66c"
score = 75
quality = 70
@@ -66667,8 +66667,8 @@ rule CAPE_Dridexloader_1 : FILE
date = "2019-11-12"
modified = "2021-03-10"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/DridexLoader.yar#L1-L17"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/DridexLoader.yar#L1-L17"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "20696b1f14539c8ecf21bffc696596040c20b1ee2fcedc173945482c0baca588"
score = 75
quality = 70
@@ -66695,8 +66695,8 @@ rule CAPE_Squirrelwaffle : FILE
date = "2021-09-22"
modified = "2021-10-13"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/SquirrelWaffle.yar#L1-L11"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/SquirrelWaffle.yar#L1-L11"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "5f799333398421d537ec7a87ca94f6cc9cf1e53e55b353036a5132440990e500"
score = 75
quality = 70
@@ -66719,8 +66719,8 @@ rule CAPE_Trickbot
date = "2019-10-30"
modified = "2023-02-07"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/TrickBot.yar#L1-L20"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/TrickBot.yar#L1-L20"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "47cc2070b43957601a72745329a9d14fb3fbfd4d2b31cacc35d4ac750dde31ea"
score = 75
quality = 70
@@ -66751,8 +66751,8 @@ rule CAPE_Trickbot_Permadll_UEFI_Module
date = "2019-10-30"
modified = "2023-02-07"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/TrickBot.yar#L22-L38"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/TrickBot.yar#L22-L38"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
hash = "491115422a6b94dc952982e6914adc39"
logic_hash = "564055f56fd19bed8900e6d451ba050b4e9013a9208a3bdc3d3d563567d225d2"
score = 75
@@ -66780,8 +66780,8 @@ rule CAPE_Chaosbot : FILE
date = "2025-10-16"
modified = "2025-10-16"
reference = "https://x.com/YungBinary/status/1976580501508182269"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/ChaosBot.yar#L1-L24"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/ChaosBot.yar#L1-L24"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "fcb04697dbef62497421318d5dfe7cdf5533b432975ebbfb3bd64ebbfeb4a592"
score = 75
quality = 62
@@ -66815,8 +66815,8 @@ rule CAPE_Phantomstealer : FILE
date = "2026-07-28"
modified = "2026-07-28"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/PhantomStealer.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/PhantomStealer.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "2f6051f4653aca8f6db27b2ecf7156913f5d18542fdcd58ebc4b4bb41c1c3fb2"
score = 75
quality = 70
@@ -66840,8 +66840,8 @@ rule CAPE_Lokibot : FILE
date = "2022-02-01"
modified = "2022-02-01"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/LokiBot.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/LokiBot.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "a5b3d518371138740e913d2d6ce4fa22d3da5cea7e034c7d6b4b502e6bf44b06"
score = 75
quality = 70
@@ -66864,8 +66864,8 @@ rule CAPE_Buerloader_1 : FILE
date = "2020-10-29"
modified = "2022-05-31"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/BuerLoader.yar#L1-L12"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/BuerLoader.yar#L1-L12"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "05c1f008f0a2bb8232867977fb23a5ae8312f10f0637c6265561052596319c29"
score = 75
quality = 70
@@ -66889,8 +66889,8 @@ rule CAPE_Petrwrap : FILE
date = "2019-10-30"
modified = "2022-06-09"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/PetrWrap.yar#L1-L15"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/PetrWrap.yar#L1-L15"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "6dd1cf5639b63d0ab41b24080dad68d285f2e3969ad34fd724c83e7a0dd4b968"
score = 75
quality = 70
@@ -66915,8 +66915,8 @@ rule CAPE_Ramnit : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Ramnit.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Ramnit.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "6f661f47bdf8377b0fb96f190fcb964c0ed2b43ce7ae7880f9dfce9e43837efd"
score = 75
quality = 70
@@ -66940,8 +66940,8 @@ rule CAPE_Atlas : FILE
date = "2019-10-30"
modified = "2019-10-30"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/Atlas.yar#L1-L13"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/Atlas.yar#L1-L13"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "c3f73b29df5caf804dbfe3e6ac07a9e2c772bd2a126f0487e4a65e72bd501e6e"
score = 75
quality = 70
@@ -66965,8 +66965,8 @@ rule CAPE_Aurastealer
date = "2025-09-02"
modified = "2025-09-02"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/AuraStealer.yar#L1-L18"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/AuraStealer.yar#L1-L18"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "960b83639a898509dc272f3235822401a8f861fa6607991993285b618b882d8b"
score = 75
quality = 70
@@ -66995,8 +66995,8 @@ rule CAPE_Dridexv4 : FILE
date = "2019-10-30"
modified = "2022-05-31"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/DridexV4.yar#L1-L15"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/DridexV4.yar#L1-L15"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "cb103fe5f2d4792e3c612db4e2d84a4c8b0ce0f9a8443e9147e2c345f1dbdff6"
score = 75
quality = 70
@@ -67023,8 +67023,8 @@ rule CAPE_Netsupport : FILE
date = "2025-10-17"
modified = "2025-10-17"
reference = "https://github.com/kevoreilly/CAPEv2"
- source_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/data/yara/CAPE/NetSupport.yar#L3-L16"
- license_url = "https://github.com/kevoreilly/CAPEv2/blob/7a1952ebc127edc3622789243a5243e41b1dd2a0/LICENSE"
+ source_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/data/yara/CAPE/NetSupport.yar#L3-L16"
+ license_url = "https://github.com/kevoreilly/CAPEv2/blob/471ee4bb422ec4aa0f1aa1089540a1ad0b7d84f0/LICENSE"
logic_hash = "d12e46d74ae0ba9f599d27dc2f55ff92a6648accbcd1a43cc3f1a9a2755e5fc7"
score = 75
quality = 70
@@ -67044,7 +67044,7 @@ rule CAPE_Netsupport : FILE
* YARA Rule Set
* Repository Name: BinaryAlert
* Repository: https://github.com/airbnb/binaryalert/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: a9c0f06affc35e1f8e45bb77f835b92350c68a0b
* Number of Rules: 78
* Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
@@ -69455,7 +69455,7 @@ rule BINARYALERT_Hacktool_Macos_Keylogger_B4Rsby_Swiftlog
* YARA Rule Set
* Repository Name: DeadBits
* Repository: https://github.com/deadbits/yara-rules/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: d002f7ecee23e09142a3ac3e79c84f71dda3f001
* Number of Rules: 19
* Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
@@ -69478,7 +69478,7 @@ rule DEADBITS_Godlua_Linux : LINUXMALWARE FILE
license_url = "N/A"
logic_hash = "70a8078f261648f050807e82009493e39fa32c0748576b3df76d8aaaa117103e"
score = 75
- quality = 26
+ quality = 51
tags = "LINUXMALWARE, FILE"
Author = "Adam M. Swanda"
@@ -69668,7 +69668,7 @@ rule DEADBITS_Crescentcore_DMG : INSTALLER MACOSMALWARE FILE
license_url = "N/A"
logic_hash = "819f01fdacea1e95f0f4d4f8e59ebae97ff9489a1be2c60e33253580a8f9e418"
score = 75
- quality = 26
+ quality = 51
tags = "INSTALLER, MACOSMALWARE, FILE"
Author = "Adam M. Swanda"
@@ -69803,7 +69803,7 @@ rule DEADBITS_Watchdog_Botnet : BOTNET LINUXMALWARE EXPLOITATION CVE_2019_11581
license_url = "N/A"
logic_hash = "aea8afdf118b79f701941ddd4306ee0f1c947ea59de5485ff977beff95e06d35"
score = 75
- quality = 53
+ quality = 78
tags = "BOTNET, LINUXMALWARE, EXPLOITATION, CVE_2019_11581, CVE_2019_10149"
Author = "Adam M. Swanda"
@@ -69854,7 +69854,7 @@ rule DEADBITS_Jsworm : MALWARE FILE
license_url = "N/A"
logic_hash = "99074e25ec15c5b25fa41bef19203f5ddc227acd51fadca1e2c3ece538b3da01"
score = 75
- quality = 53
+ quality = 78
tags = "MALWARE, FILE"
strings:
@@ -70167,7 +70167,7 @@ rule DEADBITS_Acbackdoor_ELF : LINUX MALWARE BACKDOOR
description = "No description has been set in the source file - DeadBits"
author = "Adam M. Swanda"
id = "82eb41bf-cd1d-5b00-973b-31a79c75cfc0"
- date = "2019-11-06"
+ date = "2019-11-13"
modified = "2019-12-04"
reference = "https://www.intezer.com/blog-acbackdoor-analysis-of-a-new-multiplatform-backdoor/"
source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/ACBackdoor_Linux.yara#L1-L41"
@@ -70308,7 +70308,7 @@ rule DEADBITS_KPOT_V2 : WINMALWARE INFOSTEALER FILE
* YARA Rule Set
* Repository Name: DelivrTo
* Repository: https://github.com/delivr-to/detections
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: f85e1d0c477cbf4689d1cfe4a80049c465673b23
* Number of Rules: 12
* Skipped: 0 (age), 3 (quality), 0 (score), 0 (importance)
@@ -70589,7 +70589,7 @@ rule DELIVRTO_SUSP_ZPAQ_Archive_Nov23 : FILE
license_url = "N/A"
logic_hash = "348144ee7137def00b37e074507e8148e51d34c484802a56bcd6e090d4628f18"
score = 40
- quality = 55
+ quality = 80
tags = "FILE"
strings:
@@ -70603,7 +70603,7 @@ rule DELIVRTO_SUSP_ZPAQ_Archive_Nov23 : FILE
* YARA Rule Set
* Repository Name: ESET
* Repository: https://github.com/eset/malware-ioc
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 812c573dc8c354210893775b2de97d1fbf29be1b
* Number of Rules: 99
* Skipped: 0 (age), 8 (quality), 1 (score), 0 (importance)
@@ -72332,7 +72332,7 @@ rule ESET_Apt_Windows_TA410_Flowcloud_Header_Decryption : FILE
description = "Matches the function used to decrypt resources headers in TA410 FlowCloud"
author = "ESET Research"
id = "403c1845-bc25-5a49-8553-8a0be18d6970"
- date = "2026-01-06"
+ date = "2026-01-13"
modified = "2022-04-27"
reference = "https://github.com/eset/malware-ioc/"
source_url = "https://github.com/eset/malware-ioc/blob/812c573dc8c354210893775b2de97d1fbf29be1b/ta410/ta410.yar#L417-L496"
@@ -74199,7 +74199,7 @@ rule ESET_Carbon_Metadata
* YARA Rule Set
* Repository Name: FireEye-RT
* Repository: https://github.com/mandiant/red_team_tool_countermeasures/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 3561b71724dbfa3e2bb78106aaa2d7f8b892c43b
* Number of Rules: 166
* Skipped: 0 (age), 5 (quality), 0 (score), 0 (importance)
@@ -74630,7 +74630,7 @@ rule FIREEYE_RT_APT_Loader_MSIL_LUALOADER_2 : FILE
license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
logic_hash = "700927768669eda6976071306e991bfaae136279f4265980521597c699fbed88"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -74659,7 +74659,7 @@ rule FIREEYE_RT_APT_Loader_MSIL_LUALOADER_1 : FILE
license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
logic_hash = "2d73d434ac39ebde990aca817a54208cd04bfbce33f1bcadcf48a50d9389658c"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -74712,7 +74712,7 @@ rule FIREEYE_RT_Hacktool_PY_Impacketobfuscation_1
hash = "0b1e512afe24c31531d6db6b47bac8ee"
logic_hash = "45a4c0426b29b8c8bede9c4e8292131da7e756d48fc3ac4a07d08fd52383d21e"
score = 75
- quality = 50
+ quality = 75
tags = ""
rev = 1
@@ -75396,7 +75396,7 @@ rule FIREEYE_RT_Hacktool_PY_Impacketobfuscation_2
hash = "f3dd8aa567a01098a8a610529d892485"
logic_hash = "ccbbe507798f16c7acf0780770fdb81b2e7dc333ab8bc51e6216816276c3f14b"
score = 75
- quality = 50
+ quality = 75
tags = ""
rev = 2
@@ -75476,7 +75476,7 @@ rule FIREEYE_RT_Hacktool_MSIL_Puppyhound_1 : FILE
hash = "eeedc09570324767a3de8205f66a5295"
logic_hash = "39073bbfef15ecd28c1772e5d01e54c3d5774ecb4c90f0076bda5dc400abacba"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
rev = 6
@@ -75578,7 +75578,7 @@ rule FIREEYE_RT_APT_Builder_PY_MATRYOSHKA_1
hash = "25a97f6dba87ef9906a62c1a305ee1dd"
logic_hash = "71b26f4b319429ac356b55d22bccd1da85894d61f8c96452422de78d2d893420"
score = 75
- quality = 50
+ quality = 75
tags = ""
rev = 1
@@ -75879,7 +75879,7 @@ rule FIREEYE_RT_FE_APT_Loader_MSIL_REVOLVER_1 : FILE
license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
logic_hash = "1231f4c961dec122ebcb142052c2c7c03acf9b556cdb71a3efabde6bcf50a939"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -75950,7 +75950,7 @@ rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_3 : FILE
license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
logic_hash = "41cc6a4c7765b1e5e88d12660b69e434c83938ca974b9ccf6545b4dd5dd78378"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -75975,7 +75975,7 @@ rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_2 : FILE
license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
logic_hash = "5a2e0559e3b47c1957a42929fbbeba7a53c21619125381b01dcd8453b6ec4802"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -75999,7 +75999,7 @@ rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_1 : FILE
license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
logic_hash = "56237d686b954950849adeedc87d5f9fbff2335a0ff033ba8571b3e3b93f587c"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -77597,7 +77597,7 @@ rule FIREEYE_RT_APT_Loader_Win_PGF_1 : FILE
hash = "013c7708f1343d684e3571453261b586"
logic_hash = "9dede268d33a38e980026917bd01bc47a72bfe60ba4a999c91eb727a2f377462"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
rev = 6
@@ -78867,7 +78867,7 @@ rule FIREEYE_RT_APT_Loader_Raw64_REDFLARE_1 : FILE
* YARA Rule Set
* Repository Name: GCTI
* Repository: https://github.com/chronicle/GCTI
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 1c5fd42b1895098527fde00c2d9757edf6b303bb
* Number of Rules: 90
* Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
@@ -82084,7 +82084,7 @@ rule GCTI_Cobaltstrike__Resources_Browserpivot_Bin_V1_48_To_V3_14_And_Sleeve_Bro
* YARA Rule Set
* Repository Name: Malpedia
* Repository: https://github.com/malpedia/signator-rules/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: c901f97b7df03e41917da74c2a84b04c227316c2
* Number of Rules: 1629
* Skipped: 0 (age), 17 (quality), 0 (score), 0 (importance)
@@ -149479,10 +149479,10 @@ rule MALPEDIA_Win_Hardrain_Auto : FILE
* YARA Rule Set
* Repository Name: Trellix ARC
* Repository: https://github.com/advanced-threat-research/Yara-Rules/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 1919562a59f190bda60c982424f6a24c542ee3e0
- * Number of Rules: 163
- * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
+ * Number of Rules: 164
+ * Skipped: 0 (age), 3 (quality), 0 (score), 0 (importance)
*
*
* LICENSE
@@ -151941,6 +151941,36 @@ rule TRELLIX_ARC_Rovnix_Downloader : DOWNLOADER
condition:
$mz in ( 0 .. 2 ) and all of ( $sink* ) and $boot
}
+rule TRELLIX_ARC_Vbs_Mykins_Botnet : BOTNET FILE
+{
+ meta:
+ description = "Rule to detect the VBS files used in Mykins botnet"
+ author = "Marc Rivero | McAfee ATR Team"
+ id = "de0e5284-41c2-5baf-99f5-23ef27d6ed91"
+ date = "2018-01-24"
+ modified = "2020-08-14"
+ reference = "https://blog.netlab.360.com/mykings-the-botnet-behind-multiple-active-spreading-botnets/"
+ source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_vbs_mykins_botnet.yar#L1-L29"
+ license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
+ logic_hash = "ee48a2961e40c6be96b007794f585547ef337a46ca003152f15470069e2d2580"
+ score = 60
+ quality = 40
+ tags = "BOTNET, FILE"
+ rule_version = "v1"
+ malware_type = "botnet"
+ malware_family = "Botnet:W32/MyKins"
+ actor_type = "Cybercrime"
+ actor_group = "Unknown"
+
+ strings:
+ $s1 = /fso\.DeleteFile\(WScript\.ScriptFullName\)/ fullword ascii
+ $s2 = /Set ws = CreateObject\("Wscript\.Shell"\)/ fullword ascii
+ $s3 = /Set fso = CreateObject\("Scripting\.Filesystemobject"\)/ fullword ascii
+ $r = /Windows\\ime|web|inf|\\c[0-9].bat/
+
+ condition:
+ uint16( 0 ) == 0x6553 and filesize < 1KB and any of ( $s* ) and $r
+}
rule TRELLIX_ARC_Rtf_Bluetea_Builder : MALDOC FILE
{
meta:
@@ -154852,7 +154882,7 @@ rule TRELLIX_ARC_Anatova_Ransomware : RANSOMWARE FILE
hash = "97fb79ca6fc5d24384bf5ae3d01bf5e77f1d2c0716968681e79c097a7d95fb93"
logic_hash = "4fce15ad0ef2d3cb39f6092677f117308f847815cb2a5a491290a1f9d09776df"
score = 75
- quality = 45
+ quality = 70
tags = "RANSOMWARE, FILE"
rule_version = "v1"
malware_type = "ransomware"
@@ -155373,7 +155403,7 @@ rule TRELLIX_ARC_STEALER_Credstealesy : STEALER
* YARA Rule Set
* Repository Name: Arkbird SOLG
* Repository: https://github.com/StrangerealIntel/DailyIOC
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: a873ff1298c43705e9c67286f3014f4300dd04f7
* Number of Rules: 215
* Skipped: 0 (age), 11 (quality), 0 (score), 0 (importance)
@@ -162482,7 +162512,7 @@ rule ARKBIRD_SOLG_Exp_CVE_2021_36934_July_2021_1 : FILE
* YARA Rule Set
* Repository Name: Telekom Security
* Repository: https://github.com/telekom-security/malware_analysis/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 755efb66586f53fea34926f78a8d2054a8e8e74b
* Number of Rules: 12
* Skipped: 0 (age), 5 (quality), 0 (score), 0 (importance)
@@ -162850,9 +162880,9 @@ rule TELEKOM_SECURITY_Win_Systembc_20220311 : FILE
* YARA Rule Set
* Repository Name: Volexity
* Repository: https://github.com/volexity/threat-intel
- * Retrieval Date: 2026-09-06
- * Git Commit: a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de
- * Number of Rules: 97
+ * Retrieval Date: 2026-09-13
+ * Git Commit: f340f93e4ca5c749342da331900aad2bfc377caf
+ * Number of Rules: 100
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
*
*
@@ -162877,8 +162907,8 @@ rule VOLEXITY_Apt_Malware_Win_Flipflop_Ldr : COZYLARCH FILE MEMORY
date = "2021-05-25"
modified = "2025-05-21"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L3-L26"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L3-L26"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330"
logic_hash = "a79d2b0700ae14f7a2af23c8f7df3df3564402b1137478008ccabefea0f543ad"
score = 75
@@ -162909,8 +162939,8 @@ rule VOLEXITY_Malware_Win_Cobaltstrike_D : FILE MEMORY
date = "2021-05-25"
modified = "2024-11-22"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L27-L54"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L27-L54"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c"
logic_hash = "751b6832f2952d369cb616b28ac009d7bfcc4d92bf2db36d87d69bc1e9fa6c75"
score = 75
@@ -162946,8 +162976,8 @@ rule VOLEXITY_Apt_Malware_Win_Freshfire : COZYLARCH FILE
date = "2021-05-27"
modified = "2025-05-21"
reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L55-L87"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L55-L87"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "ad67aaa50fd60d02f1378b4155f69cffa9591eaeb80523489a2355512cc30e8c"
logic_hash = "69cd73f5812ba955c1352fb1552774d5cf49019d6b65a304fd1e33f852e678ba"
score = 75
@@ -162980,8 +163010,8 @@ rule VOLEXITY_Apt_Malware_Win_Dolphin : INKYPINE FILE MEMORY
date = "2021-06-21"
modified = "2025-01-27"
reference = "https://www.welivesecurity.com/2022/11/30/whos-swimming-south-korean-waters-meet-scarcrufts-dolphin/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar#L1-L77"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar#L1-L77"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "837eaf7b736583497afb8bbdb527f70577901eff04cc69d807983b233524bfed"
logic_hash = "785a92087efc816c88c6eed6363c432d8d45198fbd5cef84c04dabd36b6316a6"
score = 75
@@ -163055,8 +163085,8 @@ rule VOLEXITY_Apt_Malware_Win_Bluelight : INKYPINE FILE MEMORY
date = "2021-04-23"
modified = "2025-02-18"
reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar#L78-L120"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar#L78-L120"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "7c40019c1d4cef2ffdd1dd8f388aaba537440b1bffee41789c900122d075a86d"
hash = "94b71ee0861cc7cfbbae53ad2e411a76f296fd5684edf6b25ebe79bf6a2a600a"
hash = "485246b411ef5ea9e903397a5490d106946a8323aaf79e6041bdf94763a0c028"
@@ -163102,8 +163132,8 @@ rule VOLEXITY_Malware_Win_Backwash_Cpp : WHEELEDASH FILE MEMORY
date = "2021-11-17"
modified = "2023-11-13"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-12-06 - XEGroup/indicators/yara.yar#L3-L26"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-12-06 - XEGroup/indicators/yara.yar#L3-L26"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "0cf93de64aa4dba6cec99aa5989fc9c5049bc46ca5f3cb327b49d62f3646a852"
logic_hash = "c8ed2d3103aa85363acd7f5573aeb936a5ab5a3bacbcf1f04e6b298299f24dae"
score = 75
@@ -163134,8 +163164,8 @@ rule VOLEXITY_Malware_Win_Iis_Shellsave : WHEELEDASH FILE MEMORY
date = "2021-11-17"
modified = "2023-08-17"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-12-06 - XEGroup/indicators/yara.yar#L27-L49"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-12-06 - XEGroup/indicators/yara.yar#L27-L49"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "21683e02e11c166d0cf616ff9a1a4405598db7f4adfc87b205082ae94f83c742"
logic_hash = "f34d6f4ecaa4cde5965f6b0deac55c7133a2be96f5c466f34775be6e7f730493"
score = 75
@@ -163165,8 +163195,8 @@ rule VOLEXITY_Malware_Win_Backwash_Iis_Scout : WHEELEDASH FILE MEMORY
date = "2021-11-17"
modified = "2023-08-17"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-12-06 - XEGroup/indicators/yara.yar#L50-L78"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-12-06 - XEGroup/indicators/yara.yar#L50-L78"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "6f44a9c13459533a1f3e0b0e698820611a18113c851f763797090b8be64fd9d5"
logic_hash = "18c4e338905ff299d75534006037e63a8f9b191f062cc97b0592245518015f88"
score = 75
@@ -163202,8 +163232,8 @@ rule VOLEXITY_Malware_Js_Xeskimmer : WHEELEDASH FILE
date = "2021-11-17"
modified = "2023-11-14"
reference = "https://github.com/MBThreatIntel/skimmers/blob/master/null_gif_skimmer.js"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-12-06 - XEGroup/indicators/yara.yar#L79-L114"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-12-06 - XEGroup/indicators/yara.yar#L79-L114"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "92f9593cfa0a28951cae36755d54de63631377f1b954a4cb0474fa0b6193c537"
logic_hash = "cc46e9fab5f408fde13c3897d378a1a2e4acb448f40ca4935c19024ebdc252d7"
score = 75
@@ -163238,8 +163268,8 @@ rule VOLEXITY_Malware_Win_Backwash_Iis : WHEELEDASH FILE MEMORY
date = "2020-09-04"
modified = "2023-08-17"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-12-06 - XEGroup/indicators/yara.yar#L181-L208"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-12-06 - XEGroup/indicators/yara.yar#L181-L208"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "98e39573a3d355d7fdf3439d9418fdbf4e42c2e03051b5313d5c84f3df485627"
logic_hash = "95a7f9e0afb031b49cd0da66b5a887d26ad2e06cce625bc45739b4a80e96ce9c"
score = 75
@@ -163272,12 +163302,12 @@ rule VOLEXITY_Apt_Malware_Rb_Rokrat_Loader : INKYPINE FILE MEMORY
date = "2021-06-22"
modified = "2024-08-22"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L1-L32"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L1-L32"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "5bc52f6c1c0d0131cee30b4f192ce738ad70bcb56e84180f464a5125d1a784b2"
logic_hash = "30ae14fd55a3ab60e791064f69377f3b9de9b871adfd055f435df657f89f8007"
score = 75
- quality = 55
+ quality = 80
tags = "INKYPINE, FILE, MEMORY"
os = "win"
os_arch = "all"
@@ -163309,8 +163339,8 @@ rule VOLEXITY_Apt_Malware_Py_Bluelight_Ldr : INKYPINE FILE
date = "2021-06-22"
modified = "2025-02-18"
reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L33-L61"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L33-L61"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "80269413be6ad51b8b19631b2f5559c9572842e789bbce031babe6e879d2e120"
logic_hash = "6987f5903561da8d4fa32c8d824593f601a49e13edfa2d617952d57ba3444f76"
score = 75
@@ -163343,8 +163373,8 @@ rule VOLEXITY_Apt_Malware_Win_Decrok : INKYPINE FILE MEMORY
date = "2021-06-23"
modified = "2023-09-28"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L62-L90"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L62-L90"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "6a452d088d60113f623b852f33f8f9acf0d4197af29781f889613fed38f57855"
logic_hash = "a551700943d5abc95af00fc4fefd416ace8d59037852c6bc5caf1d6bd09afd63"
score = 75
@@ -163377,8 +163407,8 @@ rule VOLEXITY_Apt_Malware_Win_Rokload : INKYPINE FILE
date = "2021-06-23"
modified = "2025-05-21"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L91-L112"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L91-L112"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "85cd5c3bb028fe6931130ccd5d0b0c535c01ce2bcda660a3b72581a1a5382904"
logic_hash = "8d65d32fd5bc055ca0e3831d3db88299e7c99f8547a170d3c53ec2c4001496a3"
score = 75
@@ -163407,8 +163437,8 @@ rule VOLEXITY_Webshell_Aspx_Regeorgtunnel : FILE MEMORY
date = "2021-03-02"
modified = "2024-10-18"
reference = "https://github.com/sensepost/reGeorg/blob/master/tunnel.aspx"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L26-L56"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L26-L56"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928"
logic_hash = "ea3d0532cb609682922469e8272dc8061efca3b3ae27df738ef2646e30404c6f"
score = 75
@@ -163443,8 +163473,8 @@ rule VOLEXITY_Apt_Webshell_Aspx_Sportsball : FILE MEMORY
date = "2021-03-01"
modified = "2025-07-24"
reference = "https://github.com/misterch0c/APT34/blob/e62f3d14ec78bea5c98d3c895162ca1e47676c18/Webshells_and_Panel/HyperShell/HyperShell/Shell/simple.aspx"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L57-L89"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L57-L89"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a"
logic_hash = "5ec5e52922e97a3080d397b69b2f42f09daa995271e218ea085fa2ec4e3abad2"
score = 75
@@ -163480,8 +163510,8 @@ rule VOLEXITY_Webshell_Jsp_Converge : FILE MEMORY CVE_2022_26134
date = "2022-06-01"
modified = "2024-09-20"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L1-L21"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L1-L21"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
logic_hash = "bb48516342eddd48c35e6db0eb74f95e116dc723503552b99ba721b5bdb391e5"
score = 75
quality = 80
@@ -163509,8 +163539,8 @@ rule VOLEXITY_Webshell_Java_Realcmd : FILE MEMORY
date = "2022-06-01"
modified = "2024-07-30"
reference = "https://github.com/Freakboy/Behinder/blob/master/src/main/java/vip/youwe/sheller/payload/java/RealCMD.java"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L61-L84"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L61-L84"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "a9a30455d6f3a0a8cd0274ae954aa41674b6fd52877fafc84a9cb833fd8858f6"
logic_hash = "e09f2a23674fd73296dd4d1fabf1a2c812bfe69ff02abc96a4be35af6a18e512"
score = 75
@@ -163541,8 +163571,8 @@ rule VOLEXITY_Webshell_Java_Behinder_Shellservice : FILE MEMORY
date = "2022-03-18"
modified = "2024-07-30"
reference = "https://github.com/MountCloud/BehinderClientSource/blob/master/src/main/java/net/rebeyond/behinder/core/ShellService.java"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L1-L29"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L1-L29"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "9a9882f9082a506ed0fc4ddaedd50570c5762deadcaf789ac81ecdbb8cf6eff2"
logic_hash = "373a8d4ef81e9bbbf1f24ebf0389e7da4b73f88786cc8e1d286ccc9f4c36debc"
score = 75
@@ -163577,8 +163607,8 @@ rule VOLEXITY_Malware_Golang_Pantegana : FILE MEMORY
date = "2022-03-30"
modified = "2025-03-21"
reference = "https://github.com/elleven11/pantegana"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L90-L120"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L90-L120"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "8297c99391aae918f154077c61ea94a99c7a339166e7981d9912b7fdc2e0d4f0"
logic_hash = "791a664a6b4b98051cbfacb451099de085cbab74d73771709377ab68a5a23d2b"
score = 75
@@ -163613,8 +163643,8 @@ rule VOLEXITY_Malware_Any_Pupyrat_B : FILE MEMORY
date = "2022-04-07"
modified = "2025-03-21"
reference = "https://github.com/n1nj4sec/pupy"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L121-L158"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L121-L158"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "7474a6008b99e45686678f216af7d6357bb70a054c6d9b05e1817c8d80d536b4"
logic_hash = "f5b5f35ee783ff1163072591c6d48a85894729156935650a0fd166ae22a2ea00"
score = 75
@@ -163654,8 +163684,8 @@ rule VOLEXITY_Susp_Php_Fileinput_Eval : FILE
date = "2021-06-16"
modified = "2024-12-12"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L159-L182"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L159-L182"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "1a34c43611ee310c16acc383c10a7b8b41578c19ee85716b14ac5adbf0a13bd5"
hash = "6e8874c756c009c63f715a44ca72d0cb31dc25d87d7df6ca2830fe8330580342"
logic_hash = "de376bfdfa5b6244c414454cb5d43d29e3dd75e049389f0c430c160f9d198965"
@@ -163686,8 +163716,8 @@ rule VOLEXITY_Susp_Php_Call_User_Func : FILE
date = "2021-06-16"
modified = "2024-07-30"
reference = "https://zhuanlan.zhihu.com/p/354906657"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L183-L205"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L183-L205"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "40b053a2f3c8f47d252b960a9807b030b463ef793228b1670eda89f07b55b252"
logic_hash = "46c999da97682023861e58f9cd2c8651480db990a0361c1985c6d5c35b5bf0ea"
score = 65
@@ -163716,12 +163746,12 @@ rule VOLEXITY_Webshell_Jsp_Godzilla : FILE MEMORY
date = "2021-11-08"
modified = "2024-07-30"
reference = "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L1-L34"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L1-L34"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "2786d2dc738529a34ecde10ffeda69b7f40762bf13e7771451f13a24ab7fc5fe"
logic_hash = "52cba9545f662da18ca6e07340d7a9be637b89e7ed702dd58cac545c702a00e3"
score = 75
- quality = 55
+ quality = 80
tags = "FILE, MEMORY"
os = "win,linux"
os_arch = "all"
@@ -163752,8 +163782,8 @@ rule VOLEXITY_Susp_Jsp_General_Runtime_Exec_Req : FILE MEMORY
date = "2022-02-02"
modified = "2024-07-30"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L35-L56"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L35-L56"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "4935f0c50057e28efa7376c734a4c66018f8d20157b6584399146b6c79a6de15"
logic_hash = "d3048aba80c1c39f1673931cd2d7c5ed83045603b0ad204073fd788d0103a6c8"
score = 65
@@ -163782,8 +163812,8 @@ rule VOLEXITY_Webshell_Jsp_Regeorg : FILE MEMORY
date = "2022-03-08"
modified = "2024-09-20"
reference = "https://github.com/SecWiki/WebShell-2/blob/master/reGeorg-master/tunnel.jsp"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L57-L86"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L57-L86"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "f9b20324f4239a8c82042d8207e35776d6777b6305974964cd9ccc09d431b845"
logic_hash = "cecb71605d9112d509823c26e40e1cf9cd6db581db448db5c9ffc63a2bfe529e"
score = 75
@@ -163817,8 +163847,8 @@ rule VOLEXITY_Apt_Malware_Win_Applejeus_Oct22 : LAZYPINE FILE MEMORY
date = "2022-11-03"
modified = "2025-05-21"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L1-L22"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L1-L22"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "82e67114d632795edf29ce1d50a4c1c444846d9e16cd121ce26e63c8dc4a1629"
logic_hash = "46f3325a7e8e33896862b1971f561f4871670842aecd46bcc7a5a1af869ecdc4"
score = 75
@@ -163847,8 +163877,8 @@ rule VOLEXITY_Apt_Malware_Win_Applejeus_B_Oct22 : LAZYPINE FILE MEMORY
date = "2022-11-03"
modified = "2025-05-21"
reference = "https://www.volexity.com/blog/2022/12/01/buyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L24-L54"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L24-L54"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "9352625b3e6a3c998e328e11ad43efb5602fe669aed9c9388af5f55fadfedc78"
logic_hash = "76f3c9692ea96d3cadbbcad03477ab6c53445935352cb215152b9b5483666d43"
score = 75
@@ -163880,8 +163910,8 @@ rule VOLEXITY_Apt_Malware_Win_Applejeus_C_Oct22 : LAZYPINE MEMORY
date = "2022-11-03"
modified = "2023-09-28"
reference = "https://www.volexity.com/blog/2022/12/01/buyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L57-L84"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L57-L84"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "a0db8f8f13a27df1eacbc01505f311f6b14cf9b84fbc7e84cb764a13f001dbbb"
logic_hash = "a9e635d9353c8e5c4992beba79299fb889a7a3d5bc3eaf191f8bb7f51258a6c6"
score = 75
@@ -163914,8 +163944,8 @@ rule VOLEXITY_Apt_Malware_Win_Applejeus_D_Oct22 : LAZYPINE FILE MEMORY
date = "2022-11-10"
modified = "2025-05-21"
reference = "https://www.volexity.com/blog/2022/12/01/buyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L87-L112"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L87-L112"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "a241b6611afba8bb1de69044115483adb74f66ab4a80f7423e13c652422cb379"
logic_hash = "23c0642e5be15a75a39d089cd52f2f14d633f7af6889140b9ec6e53c5c023974"
score = 75
@@ -163947,8 +163977,8 @@ rule VOLEXITY_Apt_Delivery_Macro_Lazypine_Jeus_B : LAZYPINE FILE
date = "2022-11-03"
modified = "2025-05-21"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L114-L139"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L114-L139"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b"
logic_hash = "e55199e6ad26894f98e930cd4716127ee868872d08ada1c44675e4db1ec27894"
score = 75
@@ -163981,8 +164011,8 @@ rule VOLEXITY_Apt_Delivery_Office_Macro_Lazypine_Jeus : LAZYPINE FILE
date = "2022-11-02"
modified = "2025-05-21"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L141-L165"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L141-L165"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b"
logic_hash = "54d5396b889a45d81122301eadf77f73135937fbe9647ad60491ac7856faf5ad"
score = 75
@@ -164014,8 +164044,8 @@ rule VOLEXITY_Apt_Malware_Js_Sharpext : SHARPPINE FILE MEMORY
date = "2021-09-14"
modified = "2025-05-21"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-07-28 SharpTongue SharpTongue Deploys Clever Mail-Stealing Browser Extension SHARPEXT/yara.yar#L1-L52"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-07-28 SharpTongue SharpTongue Deploys Clever Mail-Stealing Browser Extension SHARPEXT/yara.yar#L1-L52"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "1c9664513fe226beb53268b58b11dacc35b80a12c50c22b76382304badf4eb00"
hash = "6025c66c2eaae30c0349731beb8a95f8a5ba1180c5481e9a49d474f4e1bb76a4"
hash = "6594b75939bcdab4253172f0fa9066c8aee2fa4911bd5a03421aeb7edcd9c90c"
@@ -164064,8 +164094,8 @@ rule VOLEXITY_Apt_Malware_Macos_Gimmick : STORMBAMBOO FILE MEMORY
date = "2021-10-18"
modified = "2024-08-02"
reference = "https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-03-22 GIMMICK/indicators/yara.yar#L1-L59"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-03-22 GIMMICK/indicators/yara.yar#L1-L59"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f"
logic_hash = "00fba9df2212874a45d44b3d098a7b76c97fcd53ff083c76b784d2b510a4a467"
score = 75
@@ -164122,8 +164152,8 @@ rule VOLEXITY_Apt_Malware_Win_Gimmick_Dotnet_Base : STORMBAMBOO FILE MEMORY
date = "2020-03-16"
modified = "2024-08-19"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2022/2022-03-22 GIMMICK/indicators/yara.yar#L60-L86"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2022/2022-03-22 GIMMICK/indicators/yara.yar#L60-L86"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "b554bfe4c2da7d0ac42d1b4f28f4aae854331fd6d2b3af22af961f6919740234"
logic_hash = "39a38ea189d5e840f9334cb7ec8f390444139b39c6f426906a8845f9a1ada9f7"
score = 75
@@ -164157,8 +164187,8 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Modules : TRANSPARENTJASMINE FILE MEMO
date = "2024-02-22"
modified = "2024-07-05"
reference = "TIB-20240229"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L1-L24"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L1-L24"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "2abaae4f6794131108adf5b42e09ee5ce24769431a0e154feabe6052cfe70bf3"
logic_hash = "7880288e3230b688b780bdfbac2b0761fd7831b7df233672c2242c21a86e1297"
score = 75
@@ -164188,8 +164218,8 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Loader : TRANSPARENTJASMINE FILE MEMOR
date = "2024-02-22"
modified = "2024-07-05"
reference = "TIB-20240229"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L25-L47"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L25-L47"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "51a372fee89f885741515fa6fdf0ebce860f98145c9883f2e3e35c0fe4432885"
logic_hash = "d9be4846bab5fffcfd60eaec377443819404f30ec088905c2ee26bd3b7525832"
score = 75
@@ -164218,8 +164248,8 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Debug_String : TRANSPARENTJASMINE FILE
date = "2024-02-22"
modified = "2024-11-27"
reference = "TIB-20240229"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L48-L71"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L48-L71"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
logic_hash = "6bb130eead39bd8128983e0f2e76cfeff8865ce8ed3cb73b132ed32d68fc0db0"
score = 75
@@ -164249,8 +164279,8 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_2 : TRANSPARENTJASMINE FILE MEMORY
date = "2024-02-22"
modified = "2024-07-05"
reference = "TIB-20240229"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L72-L103"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L72-L103"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
logic_hash = "e03a774cca2946c1becdbd775ef465033dae089d578ea18a4f43fd7bdae9168e"
score = 75
@@ -164288,8 +164318,8 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_1 : TRANSPARENTJASMINE FILE MEMORY
date = "2024-02-22"
modified = "2024-07-05"
reference = "TIB-20240229"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L104-L131"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L104-L131"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
logic_hash = "dd3535079881ae9cfe25c129803668cb595be89b7f62eb82af19cc3839f92b6d"
score = 75
@@ -164323,8 +164353,8 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Bogus_Strings : TRANSPARENTJASMINE FIL
date = "2024-03-14"
modified = "2024-07-05"
reference = "TIB-20240318"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L132-L159"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L132-L159"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "8c8ef2d850bd9c987604e82571706e11612946122c6ab089bd54440c0113968e"
logic_hash = "0d8a2b371ffb182e60a8cc0cc500d1a9f906718a55f23f35f6c12f7faabbe971"
score = 75
@@ -164358,8 +164388,8 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Uevent_Seqnum : TRANSPARENTJASM
date = "2024-03-07"
modified = "2024-07-05"
reference = "TIB-20240318"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L160-L187"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L160-L187"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "98b24fb7aaaece7556aea2269b4e908dd79ff332ddaa5111caec49123840f364"
logic_hash = "e390e83d9fc15499c9f32ad47d1c526273105602bda7b3532720b0a3f6abc835"
score = 75
@@ -164393,8 +164423,8 @@ rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Lan_Conf : TRANSPARENTJASMINE F
date = "2024-03-07"
modified = "2024-07-05"
reference = "TIB-20240318"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L188-L215"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L188-L215"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "0b5cf9bd917f0af03dd694ff4ce39b0b34a97c9f41b87feac1dc884a684f60ef"
logic_hash = "2a19d5cff7adc9b1b92538a5df4e3cadea694f925f65080f5093fc5425e840f4"
score = 75
@@ -164428,8 +164458,8 @@ rule VOLEXITY_Malware_Golang_Discordc2_Bmdyy_1 : FILE MEMORY
date = "2024-03-28"
modified = "2024-07-05"
reference = "TIB-20240229"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L216-L243"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L216-L243"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "de32e96d1f151cc787841c12fad88d0a2276a93d202fc19f93631462512fffaf"
logic_hash = "22b3e5109d0738552fbc310344b2651ab3297e324bc883d5332c1e8a7a1df29b"
score = 75
@@ -164462,8 +164492,8 @@ rule VOLEXITY_Malware_Golang_Discordc2_Bmdyy : FILE MEMORY
date = "2024-02-22"
modified = "2024-07-05"
reference = "https://github.com/bmdyy/discord-c2"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L244-L267"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L244-L267"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
logic_hash = "38b860a43b9937351f74b01983888f18ad101cbe66560feb7455d46b713eba0f"
score = 75
@@ -164492,8 +164522,8 @@ rule VOLEXITY_Apt_Webshell_Pl_Complyshell : UTA0178 FILE MEMORY
date = "2023-12-13"
modified = "2024-01-12"
reference = "TIB-20231215"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L3-L25"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L3-L25"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "8bc8f4da98ee05c9d403d2cb76097818de0b524d90bea8ed846615e42cb031d2"
logic_hash = "ff46691f1add20cff30fe996e2fb199ce42408e86d5642a8a43c430f2245b1f5"
score = 75
@@ -164523,12 +164553,12 @@ rule VOLEXITY_Apt_Webshell_Aspx_Glasstoken : UTA0178 FILE MEMORY
date = "2023-12-12"
modified = "2024-09-30"
reference = "TIB-20231215"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L26-L52"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L26-L52"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "26cbb54b1feb75fe008e36285334d747428f80aacdb57badf294e597f3e9430d"
logic_hash = "6b8183ac1e87a86c58760db51f767ed278cc0c838ed89e7435af7d0373e58b26"
score = 75
- quality = 30
+ quality = 55
tags = "UTA0178, FILE, MEMORY"
os = "win"
os_arch = "all"
@@ -164554,8 +164584,8 @@ rule VOLEXITY_Webshell_Aspx_Regeorg : FILE MEMORY
date = "2018-08-29"
modified = "2024-01-09"
reference = "TIB-20231215"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L53-L86"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L53-L86"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "9d901f1a494ffa98d967ee6ee30a46402c12a807ce425d5f51252eb69941d988"
logic_hash = "4fed023e85a32052917f6db1e2e155c91586538938c03acc59f200a8264888ca"
score = 75
@@ -164590,8 +164620,8 @@ rule VOLEXITY_Hacktool_Py_Pysoxy : FILE MEMORY
date = "2024-01-09"
modified = "2024-01-09"
reference = "TIB-20240109"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L87-L114"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L87-L114"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "e192932d834292478c9b1032543c53edfc2b252fdf7e27e4c438f4b249544eeb"
logic_hash = "f73e9d3c2f64c013218469209f3b69fc868efafc151a7de979dde089bfdb24b2"
score = 75
@@ -164624,8 +164654,8 @@ rule VOLEXITY_Apt_Malware_Win_Deepdata_Module : BRAZENBAMBOO FILE MEMORY
date = "2024-07-30"
modified = "2024-11-14"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-11-15 BrazenBamboo/rules.yar#L1-L25"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-11-15 BrazenBamboo/rules.yar#L1-L25"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "c782346bf9e5c08a0c43a85d4991f26b0b3c99c054fa83beb4a9e406906f011e"
logic_hash = "d36f34343826daf7f7368118c7127c7181a54c99a01803016c9a6965abb309cb"
score = 75
@@ -164657,8 +164687,8 @@ rule VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_Core : BRAZENBAMBOO
date = "2024-02-15"
modified = "2024-07-03"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-11-15 BrazenBamboo/rules.yar#L244-L287"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-11-15 BrazenBamboo/rules.yar#L244-L287"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "80c0cdb1db961c76de7e4efb6aced8a52cd0e34178660ef34c128be5f0d587df"
logic_hash = "f0189c0a84c53e365130e9683f2f2b2f73c14412d8e4d0251a4780d0e80162d8"
score = 75
@@ -164707,8 +164737,8 @@ rule VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_C2_Strings : BRAZENB
date = "2024-02-15"
modified = "2024-11-14"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-11-15 BrazenBamboo/rules.yar#L288-L337"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-11-15 BrazenBamboo/rules.yar#L288-L337"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "80c0cdb1db961c76de7e4efb6aced8a52cd0e34178660ef34c128be5f0d587df"
logic_hash = "eeaaf6e16d4854a2279bd62596f75cb8b8ec1b05f3b050f5dac97254704b9005"
score = 75
@@ -164763,8 +164793,8 @@ rule VOLEXITY_Apt_Malware_Py_Upstyle : UTA0218 FILE MEMORY
date = "2024-04-11"
modified = "2024-04-12"
reference = "TIB-20240412"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L1-L34"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L1-L34"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac"
hash = "0d59d7bddac6c22230187ef6cf7fa22bca93759edc6f9127c41dc28a2cea19d8"
hash = "4dd4bd027f060f325bf6a90d01bfcf4e7751a3775ad0246beacc6eb2bad5ec6f"
@@ -164800,8 +164830,8 @@ rule VOLEXITY_Susp_Any_Jarischf_User_Path : FILE MEMORY
date = "2024-04-10"
modified = "2024-04-15"
reference = "TIB-20240412"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L59-L81"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L59-L81"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6"
logic_hash = "574d5b1fadb91c39251600e7d73d4993d4b16565bd1427a0e8d6ed4e7905ab54"
score = 50
@@ -164830,8 +164860,8 @@ rule VOLEXITY_Hacktool_Golang_Reversessh_Fahrj : FILE MEMORY
date = "2024-04-10"
modified = "2024-04-12"
reference = "TIB-20240412"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L82-L116"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L82-L116"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6"
logic_hash = "38b40cc7fc1e601da2c7a825f1c2eff209093875a5829ddd2f4c5ad438d660f8"
score = 75
@@ -164869,8 +164899,8 @@ rule VOLEXITY_Apt_Malware_Any_Reloadext_Plugin : STORMBAMBOO FILE MEMORY
date = "2024-02-23"
modified = "2024-08-02"
reference = "TIB-20240227"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-08-02 StormBamboo/rules.yar#L4-L36"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-08-02 StormBamboo/rules.yar#L4-L36"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "9d0928b3cc21ee5e1f2868f692421165f46b5014a901636c2a2b32a4c500f761"
logic_hash = "2b11f8fc5b6260ebf00bde83585cd7469709a4979ca579cdf065724bc15052fc"
score = 75
@@ -164903,8 +164933,8 @@ rule VOLEXITY_Apt_Malware_Macos_Reloadext_Installer : STORMBAMBOO FILE MEMORY
date = "2024-02-23"
modified = "2024-08-02"
reference = "TIB-20240227"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-08-02 StormBamboo/rules.yar#L37-L62"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-08-02 StormBamboo/rules.yar#L37-L62"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "07e3b067dc5e5de377ce4a5eff3ccd4e6a2f1d7a47c23fe06b1ededa7aed1ab3"
logic_hash = "8688796839202d95ded15e10262a7a7c7cbbae4a332b60305402e5984005d452"
score = 75
@@ -164936,8 +164966,8 @@ rule VOLEXITY_Apt_Malware_Any_Macma_A : STORMBAMBOO FILE MEMORY
date = "2021-11-12"
modified = "2024-08-02"
reference = "https://blog.google/threat-analysis-group/analyzing-watering-hole-campaign-using-macos-exploits/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-08-02 StormBamboo/rules.yar#L63-L111"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-08-02 StormBamboo/rules.yar#L63-L111"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "cf5edcff4053e29cb236d3ed1fe06ca93ae6f64f26e25117d68ee130b9bc60c8"
hash = "9b71fad3280cf36501fe110e022845b29c1fb1343d5250769eada7c36bc45f70"
hash = "623f99cbe20af8b79cbfea7f485d47d3462d927153d24cac4745d7043c15619a"
@@ -164990,8 +165020,8 @@ rule VOLEXITY_Apt_Malware_Win_Dustpan_Apihashes : STORMBAMBOO FILE
date = "2023-08-17"
modified = "2024-08-02"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-08-02 StormBamboo/rules.yar#L171-L205"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-08-02 StormBamboo/rules.yar#L171-L205"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "b77bcfb036f5a6a3973fdd68f40c0bd0b19af1246688ca4b1f9db02f2055ef9d"
logic_hash = "3edb66ade428c451c18aa152244f869f9f8c10e62ed942bf722b4d1cf1893e93"
score = 75
@@ -165031,8 +165061,8 @@ rule VOLEXITY_Apt_Malware_Win_Pocostick_Jul23 : STORMBAMBOO FILE MEMORY
date = "2023-07-24"
modified = "2024-08-02"
reference = "TIB-20231221"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-08-02 StormBamboo/rules.yar#L206-L235"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-08-02 StormBamboo/rules.yar#L206-L235"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "ec3e787c369ac4b28447e7cacc44d70a595e39d47f842bacb07d19b12cab6aad"
logic_hash = "19487db733c7f793be2a1287df32a165e46f6af0e940b13b389f4d675b5100c4"
score = 75
@@ -165068,8 +165098,8 @@ rule VOLEXITY_Apt_Malware_Py_Dustpan_Pyloader : STORMBAMBOO FILE MEMORY
date = "2023-07-21"
modified = "2024-08-02"
reference = "TIB-20231221"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-08-02 StormBamboo/rules.yar#L236-L270"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-08-02 StormBamboo/rules.yar#L236-L270"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
logic_hash = "bb3a70dad28181534e27abbbd618165652c137264bfd3726ae4480c642493a3b"
score = 75
quality = 80
@@ -165107,8 +165137,8 @@ rule VOLEXITY_Apt_Malware_Elf_Catchdns_Aug20_Memory : DRIFTINGBAMBOO FILE MEMORY
date = "2020-08-20"
modified = "2025-06-19"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-08-02 StormBamboo/rules.yar#L309-L383"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-08-02 StormBamboo/rules.yar#L309-L383"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "4f3d35f4f8b810362cbd4c59bfe5a961e559fe5713c9478294ccb3af2d306515"
logic_hash = "241fd5884b27269b9b07b891fb9e226c33c468276df796f91af98a68765a8b0d"
score = 75
@@ -165180,8 +165210,8 @@ rule VOLEXITY_Apt_Malware_Vbs_Basicstar_A : CHARMINGCYPRESS FILE MEMORY
date = "2024-01-04"
modified = "2025-05-21"
reference = "TIB-20240111"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-02-13 CharmingCypress/rules.yar#L69-L99"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-02-13 CharmingCypress/rules.yar#L69-L99"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "c6f91e5585c2cbbb8d06b7f239e30b271f04393df4fb81815f6556fa4c793bb0"
logic_hash = "977bb42553bb6585c8d0e1e89675644720ca9abf294eccd797e20d4bca516810"
score = 75
@@ -165216,8 +165246,8 @@ rule VOLEXITY_Apt_Malware_Ps1_Powerless_B : CHARMINGCYPRESS FILE MEMORY
date = "2023-10-25"
modified = "2024-01-29"
reference = "TIB-20231027"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-02-13 CharmingCypress/rules.yar#L100-L157"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-02-13 CharmingCypress/rules.yar#L100-L157"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "62de7abb39cf4c47ff120c7d765749696a03f4fa4e3e84c08712bb0484306ae1"
logic_hash = "eb9d199c1f7c2a42d711c1a44ab13526787169c18a77ce988568525baca043ef"
score = 75
@@ -165279,8 +165309,8 @@ rule VOLEXITY_Apt_Malware_Macos_Vpnclient_Cc_Oct23 : CHARMINGCYPRESS FILE MEMORY
date = "2023-10-17"
modified = "2023-10-27"
reference = "TIB-20231027"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-02-13 CharmingCypress/rules.yar#L246-L272"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-02-13 CharmingCypress/rules.yar#L246-L272"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "11f0e38d9cf6e78f32fb2d3376badd47189b5c4456937cf382b8a574dc0d262d"
hash = "31ca565dcbf77fec474b6dea07101f4dd6e70c1f58398eff65e2decab53a6f33"
logic_hash = "da5e9be752648b072a9aaeed884b8e1729a14841e33ed6633a0aaae1f11bd139"
@@ -165313,8 +165343,8 @@ rule VOLEXITY_Apt_Malware_Charmingcypress_Openvpn_Configuration : CHARMINGCYPRES
date = "2023-10-17"
modified = "2023-10-27"
reference = "TIB-20231027"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-02-13 CharmingCypress/rules.yar#L273-L298"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-02-13 CharmingCypress/rules.yar#L273-L298"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "d6d043973d8843a82033368c785c362f51395b1a1d475fa4705aff3526e15268"
hash = "31ca565dcbf77fec474b6dea07101f4dd6e70c1f58398eff65e2decab53a6f33"
logic_hash = "f4c5f13ac75504b14def9c37d3a41c6eea4c45845d4b54c50030b1f00691e4bf"
@@ -165346,8 +165376,8 @@ rule VOLEXITY_Apt_Delivery_Win_Charming_Openvpn_Client : CHARMINGCYPRESS FILE
date = "2023-10-17"
modified = "2023-10-27"
reference = "TIB-20231027"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-02-13 CharmingCypress/rules.yar#L299-L323"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-02-13 CharmingCypress/rules.yar#L299-L323"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "2d99755d5cd25f857d6d3aa15631b69f570d20f95c6743574f3d3e3e8765f33c"
logic_hash = "02596a62cb1ba17ecabef0ae93f434e4774b00422a6da2106a2bc4c59d2f8077"
score = 75
@@ -165378,8 +165408,8 @@ rule VOLEXITY_Apt_Malware_Ps1_Powerstar_Generic : CHARMINGCYPRESS FILE MEMORY
date = "2023-06-02"
modified = "2024-01-26"
reference = "TIB-20240126"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2024/2024-02-13 CharmingCypress/rules.yar#L324-L352"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2024/2024-02-13 CharmingCypress/rules.yar#L324-L352"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
logic_hash = "4da02190ffd16304eccbc0d12dfcc5637a6b785af0e3dc3dfcafcfe114597eb2"
score = 75
quality = 80
@@ -165403,6 +165433,136 @@ rule VOLEXITY_Apt_Malware_Ps1_Powerstar_Generic : CHARMINGCYPRESS FILE MEMORY
condition:
all of ( $http* ) or all of ( $json* )
}
+rule VOLEXITY_Apt_Malware_Js_Longtale : LONGTALE JUNGLEBAMBOO FILE MEMORY
+{
+ meta:
+ description = "Detection for LONGTALE, a chrome extension malware."
+ author = "threatintel@volexity.com"
+ id = "b97eaf48-8c4e-5fea-af7c-d1f559d334af"
+ date = "2026-09-08"
+ modified = "2026-09-08"
+ reference = "https://github.com/volexity/threat-intel"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-09-09 Chrome/rules.yar#L1-L37"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
+ hash = "5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3"
+ logic_hash = "194266bc6710943a421f1e3a65cf5345b061edd3777a9f555fa435fef41e7baa"
+ score = 75
+ quality = 80
+ tags = "LONGTALE, JUNGLEBAMBOO, FILE, MEMORY"
+ os = "all"
+ os_arch = "all"
+ scan_context = "file,memory"
+ severity = "critical"
+ report1 = "TIB-20260908B"
+ license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+ rule_id = 13428
+ version = 2
+
+ strings:
+ $f1 = "getPublicIP" ascii
+ $f2 = "captureCookies" ascii
+ $f3 = "recordFetch" ascii
+ $f4 = "injectRecorder" ascii
+ $f5 = "captureVisibleTab" ascii
+ $f6 = "buildIngestPayload" ascii
+ $case1 = "SET_KEYWORDS"
+ $case2 = "GET_KEYWORDS"
+ $case3 = "SCREENSHOT_NOW"
+ $case4 = "FETCH_HISTORY"
+ $case5 = "CAPTURE_STORAGE"
+ $case6 = "CAPTURE_COOKIES"
+ $case7 = "TOGGLE_RECORDING"
+
+ condition:
+ all of ( $f* ) or all of ( $case* )
+}
+rule VOLEXITY_Apt_Malware_Win_Superstomp : JUNGLEBAMBOO SUPERSTOMP FILE MEMORY
+{
+ meta:
+ description = "Detection for the SUPERSTOMP malware used by JungleBamboo."
+ author = "threatintel@volexity.com"
+ id = "7719e855-70d7-56a9-9888-9d6f6a9afc2f"
+ date = "2026-09-08"
+ modified = "2026-09-08"
+ reference = "https://github.com/volexity/threat-intel"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-09-09 Chrome/rules.yar#L38-L73"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
+ hash = "5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3"
+ logic_hash = "b1e4c1f0bf614dae29ca534205792efe24605a2807e3a9c67f8c6e99aa153bfa"
+ score = 75
+ quality = 80
+ tags = "JUNGLEBAMBOO, SUPERSTOMP, FILE, MEMORY"
+ os = "win"
+ os_arch = "all"
+ scan_context = "file,memory"
+ severity = "critical"
+ report1 = "TIB-20260908B"
+ license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+ rule_id = 13427
+ version = 3
+
+ strings:
+ $stomp_ua = "stomp/1.0" wide
+ $stomp_pem = "stomp_ext_key.pem" wide
+ $stomp_spki = "stomp_ext_key.spki" wide
+ $stomp_bak = "stomp.bak" wide
+ $xor_key = { 5a c3 17 8e f0 2b 96 41 7d 0a e8 33 b5 64 1f da }
+ $browser_secpref = "Secure Preferences" wide
+ $browser_extsettings = "extensions.settings." ascii
+ $browser_devmode = "extensions.ui.developer_mode" ascii
+ $browser_taskkill = "cmd.exe /c taskkill /F /IM " wide
+ $browser_restore = "--restore-last-session" wide
+
+ condition:
+ 3 of ( $stomp* ) or $xor_key or all of ( $browser* )
+}
+rule VOLEXITY_Apt_Malware_Js_Vm_Loader_Bug_Sep26 : CVE_2026_85046 FILE MEMORY
+{
+ meta:
+ description = "Detects the VM-obfuscated JavaScript loader used in a Chrome -> Win 0-day exploit campaign."
+ author = "threatintel@volexity.com"
+ id = "03f9e9ac-26b9-54c1-87b7-279fef0bc0ff"
+ date = "2026-09-03"
+ modified = "2026-09-09"
+ reference = "https://github.com/volexity/threat-intel"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-09-09 Chrome/rules.yar#L651-L704"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
+ hash = "337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d"
+ logic_hash = "6aa6508e063d1230f19e31d2da1bac9fe37c12a29227719f762cf48fd8dfff3a"
+ score = 75
+ quality = 53
+ tags = "CVE_2026_85046, FILE, MEMORY"
+ os = "win"
+ os_arch = "all"
+ scan_context = "file,memory"
+ severity = "critical"
+ report2 = "TIB-20260908"
+ report1 = "TIB-20260908B"
+ license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+ rule_id = 13417
+ version = 4
+
+ strings:
+ $vm_identifier_runtime = /vmT_[0-9a-f]{6}/ ascii
+ $vm_identifier_entry = /vmN_[0-9a-f]{6}/ ascii
+ $vm_internal_property = /_\$[A-Za-z0-9]{6}/ ascii
+ $vm_global_resolver = "typeof globalThis!=='undefined'?globalThis:typeof window!=='undefined'?window:typeof global!=='undefined'?global:typeof self!=='undefined'?self:void 0x0" ascii
+ $magic_string_mask = "0x9e3779b1" ascii nocase
+ $magic_flags_xor = "0x9459cffb" ascii nocase
+ $magic_slot_1 = "0xdbca3d28" ascii nocase
+ $magic_slot_2 = "0x4de7321d" ascii nocase
+ $magic_slot_3 = "0x7990561b" ascii nocase
+ $magic_layout = "0xe4ed" ascii nocase
+ $runtime_error_1 = "Unexpected\\x20yield\\x20in\\x20async\\x20context" ascii
+ $runtime_error_2 = "Unexpected\\x20signal\\x20in\\x20generator" ascii
+ $runtime_error_3 = "Unexpected\\x20signal\\x20in\\x20async\\x20generator" ascii
+ $runtime_error_4 = "Iterator\\x20result\\x20is\\x20not\\x20an\\x20object" ascii
+ $config_url = "CONFIG_URL" ascii
+ $config_daily_limit = "CONFIG_DAILY_LIMIT" ascii
+
+ condition:
+ $vm_global_resolver and all of ( $vm_identifier_* ) and #vm_internal_property > 20 and 5 of ( $magic_* ) and 2 of ( $runtime_error_* ) and all of ( $config_* )
+}
rule VOLEXITY_Apt_Malware_Any_Dotnet_Aot_Plenet : VERDANTBAMBOO PLENET FILE MEMORY
{
meta:
@@ -165412,8 +165572,8 @@ rule VOLEXITY_Apt_Malware_Any_Dotnet_Aot_Plenet : VERDANTBAMBOO PLENET FILE MEMO
date = "2025-09-22"
modified = "2025-10-30"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2026/2026-06-04 VerdantBamboo/rules.yar#L1-L31"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-06-04 VerdantBamboo/rules.yar#L1-L31"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "eb141a43958802727a6c813452450c10b92704bea4474ee5fd87c0a1be326e2e"
logic_hash = "67d8f7fbc2986b1068a9c557cf85ba83469e3fb7f2433bd10c7ad740a4b0e717"
score = 75
@@ -165451,8 +165611,8 @@ rule VOLEXITY_Apt_Malware_Elf_Verdantbamboo_Paths : VERDANTBAMBOO FILE MEMORY
date = "2025-09-22"
modified = "2026-01-27"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2026/2026-06-04 VerdantBamboo/rules.yar#L32-L54"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-06-04 VerdantBamboo/rules.yar#L32-L54"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "eb141a43958802727a6c813452450c10b92704bea4474ee5fd87c0a1be326e2e"
logic_hash = "aac17908a9d5e71d5db3fbdf9bb3307c74f5911bd253bb2060b05fbf238b2c3f"
score = 75
@@ -165482,8 +165642,8 @@ rule VOLEXITY_Apt_Malware_Golang_Brickstorm_B : VERDANTBAMBOO BRICKSTORM FILE ME
date = "2025-09-05"
modified = "2026-06-09"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2026/2026-06-04 VerdantBamboo/rules.yar#L56-L98"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-06-04 VerdantBamboo/rules.yar#L56-L98"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878"
logic_hash = "e91203a714a4bc9d1c70eae4670681e3f416257163cf44db20ad33380be5d39a"
score = 75
@@ -165524,8 +165684,8 @@ rule VOLEXITY_Apt_Malware_Golang_Brickstorm : VERDANTBAMBOO BRICKSTORM FILE MEMO
date = "2025-09-04"
modified = "2025-10-30"
reference = "https://blog.nviso.eu/wp-content/uploads/2025/04/NVISO-BRICKSTORM-Report.pdf"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2026/2026-06-04 VerdantBamboo/rules.yar#L100-L136"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-06-04 VerdantBamboo/rules.yar#L100-L136"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "40d264cf9c73923932c3dfd52d20f46ff602be3fea8dc6ecc71aca46e6067bf5"
hash = "e981fc4eaaa6417e6034e21438e55c0360773674a6fc0b63c1b95026449e5254"
logic_hash = "39e3403d90ad67072ae631273e89fe059ec48906ce1d57fe1afbb91304dc84f3"
@@ -165564,8 +165724,8 @@ rule VOLEXITY_Apt_Malware_Py_Agentpsd : VERDANTBAMBOO AGENTPSD MEMORY
date = "2025-09-05"
modified = "2025-10-30"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2026/2026-06-04 VerdantBamboo/rules.yar#L137-L171"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-06-04 VerdantBamboo/rules.yar#L137-L171"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "ee41e06ed96182ce80cd4544a6abd5d7719c4a5c0e5ddb266a83842d39b99b0a"
logic_hash = "dd0b957bc2a61ddebd392b86b35bae8c1052a285fa31ccd700e580c2ad9cce59"
score = 75
@@ -165605,8 +165765,8 @@ rule VOLEXITY_Apt_Malware_Any_Brickstorm_Rust : VERDANTBAMBOO BRICKSTORM FILE
date = "2026-02-24"
modified = "2026-02-24"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2026/2026-06-04 VerdantBamboo/rules.yar#L173-L202"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-06-04 VerdantBamboo/rules.yar#L173-L202"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "45313a6745803a7f57ff35f5397fdf117eaec008a76417e6e2ac8a6280f7d830"
logic_hash = "5f83f26188b7a8cab4bd548609c503371a18967342bd8dd6dede8e7a047e9508"
score = 75
@@ -165641,8 +165801,8 @@ rule VOLEXITY_Apt_Webshell_Java_Orangetail_B : UTA0533 ORANGETAIL FILE MEMORY
date = "2026-07-06"
modified = "2026-07-14"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2026/2026-07-17 SonicWall/rules.yar#L1-L25"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-07-17 SonicWall/rules.yar#L1-L25"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "1e1e68bbb899450a57274a8b12082ed4e2040a2aae77014f20431689d2b4edee"
hash = "ea9154e374e4f77bc2cf54282e23543573980342a85bc888cb23f20b8bbba081"
logic_hash = "e5ed25fb820dc4a18c374936c36d4321e2aba72d8b640cdb0d81abd764786918"
@@ -165674,8 +165834,8 @@ rule VOLEXITY_Apt_Webshell_Java_Orangetail : UTA0533 ORANGETAIL FILE MEMORY
date = "2026-07-06"
modified = "2026-07-14"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2026/2026-07-17 SonicWall/rules.yar#L26-L53"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-07-17 SonicWall/rules.yar#L26-L53"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "ea9154e374e4f77bc2cf54282e23543573980342a85bc888cb23f20b8bbba081"
logic_hash = "1a495df2bc13b1c2c61315d76d66b150452b923afa5847121429fa8ae9788a7b"
score = 75
@@ -165710,8 +165870,8 @@ rule VOLEXITY_Apt_Malware_Any_Uta0533_Ua : UTA0533 FILE MEMORY
date = "2026-07-06"
modified = "2026-07-14"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2026/2026-07-17 SonicWall/rules.yar#L54-L76"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-07-17 SonicWall/rules.yar#L54-L76"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "8c470301dcb7278f73e622f1950073567b34011c64b60cdfbb0f89803923a5a3"
logic_hash = "d4c0322080e853f5c5d495af05d43eaf3d375af6905e795cef718dec639a7092"
score = 75
@@ -165741,8 +165901,8 @@ rule VOLEXITY_Apt_Malware_Python_Knuckleball : UTA0533 KNUCKLEBALL FILE MEMORY
date = "2026-07-06"
modified = "2026-07-14"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2026/2026-07-17 SonicWall/rules.yar#L77-L109"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-07-17 SonicWall/rules.yar#L77-L109"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "8c470301dcb7278f73e622f1950073567b34011c64b60cdfbb0f89803923a5a3"
logic_hash = "306b5e0cc66af163c1dea29f8c55f0dbb396ddcefb63f22d62601d7cf1ea839d"
score = 75
@@ -165780,8 +165940,8 @@ rule VOLEXITY_Apt_Malware_Linux_Rootrun : UTA0533 ROOTRUN FILE MEMORY
date = "2026-07-06"
modified = "2026-07-14"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2026/2026-07-17 SonicWall/rules.yar#L110-L134"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2026/2026-07-17 SonicWall/rules.yar#L110-L134"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "81a9af3846bad3a1107164ff7cf0a08e020b31a3b32fd17866e17d4c1565f7f2"
logic_hash = "f14483c4a597e6cf66bb36dcfbbe8c87147a37d4c8a30de5738ced670c2a65cd"
score = 75
@@ -165813,8 +165973,8 @@ rule VOLEXITY_Apt_Malware_Golang_Govershell_Strings_UTA0388 : UTA0388 FILE MEMOR
date = "2025-06-30"
modified = "2025-10-08"
reference = "TIB-20250708B"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2025/2025-10-08 UTA0388/rules.yar#L74-L134"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2025/2025-10-08 UTA0388/rules.yar#L74-L134"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "a5ee55a78d420dbba6dec0b87ffd7ad6252628fd4130ed4b1531ede960706d2d"
hash = "fbade9d8a040ed643b68e25e19cba9562d2bd3c51d38693fe4be72e01da39861"
logic_hash = "74fa940002e0af9095790b1cf7260778661c97db4e3d316183eecde0e2b580a8"
@@ -165876,8 +166036,8 @@ rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate : EVILBAMBOO FILE
date = "2023-06-01"
modified = "2023-06-13"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L230-L255"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L230-L255"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "6aefc2b33e23f6e3c96de51d07f7123bd23ff951d67849a9bd32d446e76fb405"
logic_hash = "861d4e1c40847c6ade04eddb047370d645afea6d5c16d55155fa58a16111c39e"
score = 75
@@ -165908,8 +166068,8 @@ rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Stage2_Implant_May23 : EVILBAMBOO FILE
date = "2023-05-25"
modified = "2023-08-30"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L257-L285"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L257-L285"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "bf5f7fbf42236e89bcf663d2822d54bee89abaf3f247a54f371bf156e0e03629"
logic_hash = "2186369298ebfa0b892ecb14ebacc93c6d14c9c35012e8e6cdff077634cf3773"
score = 75
@@ -165943,8 +166103,8 @@ rule VOLEXITY_Apt_Delivery_Web_Js_Jmask_Str_Array_Variant : EVILBAMBOO FILE
date = "2023-06-27"
modified = "2023-09-21"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L408-L444"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L408-L444"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "7995c382263f8dbbfc37a9d62392aef8b4f89357d436b3dd94dea842f9574ecf"
logic_hash = "0ae7c96e0f866f21d66d7a23bf937d6ce48c9dd1ea19142dbb13487208780146"
score = 75
@@ -165984,8 +166144,8 @@ rule VOLEXITY_Apt_Delivery_Web_Js_Jmask : EVILBAMBOO FILE
date = "2023-06-15"
modified = "2023-09-21"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L446-L472"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L446-L472"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "efea95720853e0cd2d9d4e93a64a726cfe17efea7b17af7c4ae6d3a6acae5b30"
logic_hash = "64315ac05049954d36297a616a25ffdd7ce81c6313c0878d5ba4082da24c21bb"
score = 75
@@ -166016,8 +166176,8 @@ rule VOLEXITY_Apt_Malware_Win_Avburner : DEVIOUSBAMBOO FILE MEMORY
date = "2023-01-02"
modified = "2024-08-16"
reference = "https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-03-07 AVBurner/yara.yar#L1-L40"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-03-07 AVBurner/yara.yar#L1-L40"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "4b1b1a1293ccd2c0fd51075de9376ebb55ab64972da785153fcb0a4eb523a5eb"
logic_hash = "56ff6c8a4b737959a1219699a0457de1f0c34fead4299033840fb23c56a0caad"
score = 75
@@ -166059,8 +166219,8 @@ rule VOLEXITY_Apt_Win_Powerstar_Persistence_Batch : CHARMINGKITTEN
date = "2023-05-16"
modified = "2023-09-20"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L1-L19"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L1-L19"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "9777f106ac62829cd3cfdbc156100fe892cfc4038f4c29a076e623dc40a60872"
logic_hash = "9c3a45b759516959eae1cdf8e73bf540b682c90359a6232aa4782a8d1fe15b7d"
score = 75
@@ -166088,8 +166248,8 @@ rule VOLEXITY_Apt_Win_Powerstar_Memonly : CHARMINGKITTEN
date = "2023-05-16"
modified = "2023-09-20"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L20-L65"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L20-L65"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "977cf5cc1d0c61b7364edcf397e5c67d910fac628c6c9a41cf9c73b3720ce67f"
logic_hash = "d790ff204e4e8adeb3e887d9ebce743e958b523c48317d017487b1b0c6aebc11"
score = 75
@@ -166139,8 +166299,8 @@ rule VOLEXITY_Apt_Win_Powerstar_Logmessage : CHARMINGKITTEN
date = "2023-05-16"
modified = "2023-09-20"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L66-L79"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L66-L79"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
logic_hash = "539c9a8b3de24f2c8058d204900344756a8031822ebebc312612b8fb8422e341"
score = 75
quality = 80
@@ -166163,8 +166323,8 @@ rule VOLEXITY_Apt_Win_Powerstar_Lnk : CHARMINGKITTEN
date = "2023-05-16"
modified = "2023-09-20"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L80-L97"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L80-L97"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
logic_hash = "da53aeaf69e80f697068779f4741b8c23cff82dd1bfb0640916a1bcc98c4892f"
score = 75
quality = 80
@@ -166190,8 +166350,8 @@ rule VOLEXITY_Apt_Win_Powerstar_Decrypt_Function : CHARMINGKITTEN
date = "2023-05-16"
modified = "2023-09-20"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L98-L121"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L98-L121"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "b79d28fe5e3c988bb5aadb12ce442d53291dbb9ede0c7d9d64eec078beba5585"
logic_hash = "d022e363464488836a1c161f2b9c7463ac91ae6f60f14dfd574189233201c9aa"
score = 75
@@ -166221,8 +166381,8 @@ rule VOLEXITY_Apt_Win_Powerstar : CHARMINGKITTEN
date = "2021-10-13"
modified = "2023-09-20"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L122-L150"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L122-L150"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "de99c4fa14d99af791826a170b57a70b8265fee61c6b6278d3fe0aad98e85460"
logic_hash = "2cbf59eaee60a8f84b1ac35cec3b01592a2a0f56c92a2db218bb26a15be24bf3"
score = 75
@@ -166253,8 +166413,8 @@ rule VOLEXITY_Apt_Ico_Uta0040_B64_C2 : UTA0040 FILE
date = "2023-03-30"
modified = "2023-03-30"
reference = "https://github.com/volexity/threat-intel"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-03-30 3CX/indicators/rules.yar#L1-L31"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-03-30 3CX/indicators/rules.yar#L1-L31"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c"
logic_hash = "2667a36ce151c6e964f9ce9a6f587eedbffdd6ec76e451a23c5cfdd08248d15e"
score = 75
@@ -166279,8 +166439,8 @@ rule VOLEXITY_Apt_Mac_Iconic : UTA0040
date = "2023-03-30"
modified = "2023-03-30"
reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-03-30 3CX/indicators/rules.yar#L32-L50"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-03-30 3CX/indicators/rules.yar#L32-L50"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
logic_hash = "7b689c3931632b01869ac2f21a1edca0a5ca9007299fe7cd16962d6866c27558"
score = 75
@@ -166306,8 +166466,8 @@ rule VOLEXITY_Apt_Win_Iconicstealer : UTA0040
date = "2023-03-30"
modified = "2023-03-30"
reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-03-30 3CX/indicators/rules.yar#L51-L69"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-03-30 3CX/indicators/rules.yar#L51-L69"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423"
logic_hash = "ed7731d2361e7d96a6a35f8359b61a2af049b16bc457cf870db8831e142aebe2"
score = 75
@@ -166333,8 +166493,8 @@ rule VOLEXITY_Apt_Win_Iconic : UTA0040
date = "2023-03-30"
modified = "2023-03-30"
reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-03-30 3CX/indicators/rules.yar#L70-L93"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-03-30 3CX/indicators/rules.yar#L70-L93"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952"
logic_hash = "b62b1543c9af3afb8fc885f313e1a5d2fcb688657e3807cce72b31b56381681e"
score = 75
@@ -166364,8 +166524,8 @@ rule VOLEXITY_Apt_Win_3Cx_Backdoored_Lib : UTA0040
date = "2023-03-30"
modified = "2023-03-30"
reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-03-30 3CX/indicators/rules.yar#L94-L133"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-03-30 3CX/indicators/rules.yar#L94-L133"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
logic_hash = "40be2d46a318ff03724ea1f6628d78001c14c85a3ae6d032c0324ea849d707f2"
score = 75
@@ -166412,8 +166572,8 @@ rule VOLEXITY_Informational_Win_3Cx_Msi : UTA0040
date = "2023-03-30"
modified = "2023-03-30"
reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
- source_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/2023/2023-03-30 3CX/indicators/rules.yar#L134-L152"
- license_url = "https://github.com/volexity/threat-intel/blob/a7eaa9d97a5d0c193f4a3ac99a6239e6ccc211de/LICENSE.txt"
+ source_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/2023/2023-03-30 3CX/indicators/rules.yar#L134-L152"
+ license_url = "https://github.com/volexity/threat-intel/blob/f340f93e4ca5c749342da331900aad2bfc377caf/LICENSE.txt"
hash = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
logic_hash = "c04de2653ef587f27c7ebf058c6f6c345e16b67f36ccc4306bc49f8c4394728e"
score = 75
@@ -166434,7 +166594,7 @@ rule VOLEXITY_Informational_Win_3Cx_Msi : UTA0040
* YARA Rule Set
* Repository Name: JPCERTCC
* Repository: https://github.com/JPCERTCC/MalConfScan/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 19ec0d145535a6a4cfd37c0960114f455a8c343e
* Number of Rules: 30
* Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
@@ -167278,7 +167438,7 @@ rule JPCERTCC_Elf_Wellmess : FILE
* YARA Rule Set
* Repository Name: SecuInfra
* Repository: https://github.com/SIFalcon/Detection
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd
* Number of Rules: 45
* Skipped: 0 (age), 11 (quality), 0 (score), 0 (importance)
@@ -167532,7 +167692,7 @@ rule SECUINFRA_HUNT_RTF_CVE_2023_21716_Mar23 : CVE_2023_21716
license_url = "N/A"
logic_hash = "456008db725b8348f9f3851bb9aae9990e7613e1b9056846b121605c3e080297"
score = 50
- quality = 45
+ quality = 70
tags = "CVE-2023-21716"
tlp = "CLEAR"
@@ -168571,7 +168731,7 @@ rule SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1 : POWERSHELL DOWNLOAD
* YARA Rule Set
* Repository Name: RussianPanda
* Repository: https://github.com/RussianPanda95/Yara-Rules
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 790ec6378c8e8262a673603ef0172bedf0967d58
* Number of Rules: 110
* Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
@@ -169602,7 +169762,7 @@ rule RUSSIANPANDA_Smartapesg_JS_Dropper_Stage1 : FILE
hash = "8769d9ebcf14b24a657532cd96f9520f54aa0e799399d840285311dfebe3fb15"
logic_hash = "de7e4ec30c780699b46de7baf2a916fdb7331da2ee7c2d637422ea664cd03b82"
score = 75
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -171438,7 +171598,7 @@ rule RUSSIANPANDA_Lummac2 : FILE
* YARA Rule Set
* Repository Name: CadoSecurity
* Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
* Number of Rules: 8
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -171687,7 +171847,7 @@ rule CADOSECURITY_Whispergate_Stage_2 : FILE
* YARA Rule Set
* Repository Name: Check Point
* Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
* Number of Rules: 4
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -171901,7 +172061,7 @@ rule CHECK_POINT_Apt_Nazar_Component_Guids
* YARA Rule Set
* Repository Name: BlackBerry
* Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
* Number of Rules: 22
* Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
@@ -171948,7 +172108,7 @@ rule BLACKBERRY_Mal_Infostealer_MSI_Jupyter_Embedded_Powershell : FILE
license_url = "N/A"
logic_hash = "7528342e5aea1c35b59a458695c0e363c6d6c6e1c2df38614ff185c74085ac89"
score = 75
- quality = 60
+ quality = 85
tags = "FILE"
license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
@@ -172168,7 +172328,7 @@ rule BLACKBERRY_Mal_Infostealer_Powershell_Jupyter_Updated_Samples
license_url = "N/A"
logic_hash = "5a8e449316d41c2fa28c7137b18ec4c8ac72bb4a0923fae4da7dd89e844421cb"
score = 75
- quality = 33
+ quality = 58
tags = ""
license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
@@ -172556,7 +172716,7 @@ rule BLACKBERRY_Mal_Infostealer_MSI_EXE_Jupyter_Certificate : FILE
license_url = "N/A"
logic_hash = "5524f227e4c0090b923d7966223806dd384458178083b752ebd9e0981b3fba52"
score = 75
- quality = 58
+ quality = 83
tags = "FILE"
license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
@@ -172585,7 +172745,7 @@ rule BLACKBERRY_Mal_Infostealer_MSI_EXE_Jupyter_Certificate : FILE
* YARA Rule Set
* Repository Name: Cluster25
* Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
* Number of Rules: 9
* Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
@@ -172883,7 +173043,7 @@ rule CLUSTER25_Sidewinder_Apt_Rtf_Cve_2017_0199 : FILE
* YARA Rule Set
* Repository Name: Dragon Threat Labs
* Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
* Number of Rules: 7
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -173074,7 +173234,7 @@ rule DRAGON_THREAT_LABS_Apt_C16_Win_Swisyn : MEMORY FILE
* YARA Rule Set
* Repository Name: Microsoft
* Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
* Number of Rules: 21
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -173658,7 +173818,7 @@ rule MICROSOFT_Trojan_Win32_Plakpeer : PLATINUM
hash = "2155c20483528377b5e3fde004bb604198463d29"
logic_hash = "cc34ce9f12c95133872783090efd5813d3e2f44a1c726d29b2ba834509c9a1d5"
score = 75
- quality = 55
+ quality = 80
tags = "PLATINUM"
unpacked_sample_sha1 = "dc991ef598825daabd9e70bac92c79154363bab2"
activity_group = "Platinum"
@@ -173677,7 +173837,7 @@ rule MICROSOFT_Trojan_Win32_Plakpeer : PLATINUM
* YARA Rule Set
* Repository Name: NCSC
* Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
* Number of Rules: 17
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -174147,7 +174307,7 @@ rule NCSC_Sparrowdoor_Shellcode
* YARA Rule Set
* Repository Name: Dr4k0nia
* Repository: https://github.com/dr4k0nia/yara-rules
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8
* Number of Rules: 5
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -174325,7 +174485,7 @@ rule DR4K0NIA_MAL_MSIL_NET_Typhonlogger_Jul23 : FILE
* YARA Rule Set
* Repository Name: EmbeeResearch
* Repository: https://github.com/embee-research/Yara-detection-rules/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4
* Number of Rules: 39
* Skipped: 0 (age), 8 (quality), 0 (score), 0 (importance)
@@ -175406,7 +175566,7 @@ rule EMBEERESEARCH_Win_Qakbot_String_Decrypt_Nov_2022 : FILE
* YARA Rule Set
* Repository Name: AvastTI
* Repository: https://github.com/avast/ioc
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: a450ddabed95984422909c75ac52b6841f685983
* Number of Rules: 33
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -176269,7 +176429,7 @@ rule AVASTTI_Cobaltstrike_Beacon_Xored_X64
* YARA Rule Set
* Repository Name: SBousseaden
* Repository: https://github.com/sbousseaden/YaraHunts/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 71b27a2a7c57c2aa1877a11d8933167794e2b4fb
* Number of Rules: 37
* Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
@@ -177375,7 +177535,7 @@ rule SBOUSSEADEN_APT_Xdsspy_Xdupload : FILE
* YARA Rule Set
* Repository Name: Elceef
* Repository: https://github.com/elceef/yara-rulz
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 5683b294a12cf0c875b624933586029ae43a852f
* Number of Rules: 20
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -177442,7 +177602,7 @@ rule ELCEEF_Obfuscated_IP_Address_In_URL
license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE"
logic_hash = "ab2a2a3a56e6eed9f4a3a8f994c89a167f00b86ce442820c81d8ee673b0ab85c"
score = 75
- quality = 40
+ quality = 65
tags = ""
strings:
@@ -177802,7 +177962,7 @@ rule ELCEEF_OLE2_Autoopen_Reversed_Payload : FILE
license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE"
logic_hash = "425750e77d31ddc356f803ee6e2f192f93f64534a9633fef02da5caaa60dbcaf"
score = 65
- quality = 42
+ quality = 67
tags = "FILE"
strings:
@@ -177944,7 +178104,7 @@ rule ELCEEF_Outlook_CVE_2023_23397_Exploit : FILE
hash = "1867bc9f81e99a55103288ce10c5c05267119ebb13757686e59bfed156f62b51"
logic_hash = "695721ec276415c6a6a0f4ce6378ff2d11c15d28271f587966bc3d9d8c06f63a"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
strings:
@@ -177962,7 +178122,7 @@ rule ELCEEF_Outlook_CVE_2023_23397_Exploit : FILE
* YARA Rule Set
* Repository Name: GodModeRules
* Repository: https://github.com/Neo23x0/god-mode-rules/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 436dc682164cf17a123d6b09d1424e7e2acf0c25
* Number of Rules: 1
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -178186,7 +178346,7 @@ rule GODMODERULES_IDDQD_God_Mode_Rule
license_url = "https://github.com/Neo23x0/god-mode-rules//blob/436dc682164cf17a123d6b09d1424e7e2acf0c25/LICENSE"
logic_hash = "f2996ad7090a79c470e64c9e0ac43c2ba3fc1bf18e39686ecda9dc5b89744d7e"
score = 60
- quality = 1
+ quality = 26
tags = ""
importance = 60
@@ -178233,7 +178393,7 @@ rule GODMODERULES_IDDQD_God_Mode_Rule
* YARA Rule Set
* Repository Name: Cod3nym
* Repository: https://github.com/cod3nym/detection-rules/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 86a04c4594cb48895192aad4af164f21f568c136
* Number of Rules: 13
* Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
@@ -178673,7 +178833,7 @@ rule COD3NYM_MAL_NET_Limecrypter_Runpe_Jan24 : FILE
* YARA Rule Set
* Repository Name: craiu
* Repository: https://github.com/craiu/yararules
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 23cf0ca22021fa3684e180a18416b9ae1b695243
* Number of Rules: 13
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -179838,10 +179998,10 @@ rule CRAIU_Crime_Chaos_Ransomware_Gen : FILE
* YARA Rule Set
* Repository Name: DitekSHen
* Repository: https://github.com/ditekshen/detection
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: e76c93dcdedff04076380ffc60ea54e45b313635
- * Number of Rules: 1436
- * Skipped: 0 (age), 117 (quality), 0 (score), 0 (importance)
+ * Number of Rules: 1442
+ * Skipped: 0 (age), 111 (quality), 0 (score), 0 (importance)
*
*
* LICENSE
@@ -180036,7 +180196,7 @@ rule DITEKSHEN_MALWARE_Win_Obliquerat : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "0b8bbf031364b828a972c52e1a8985ff65601ca7413e6e7ae3a5be981f086b9e"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
strings:
@@ -180284,7 +180444,7 @@ rule DITEKSHEN_MALWARE_Linux_Hiddenwasp : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "a2aad022de41ba2633fc92a7dc5a5fa2efde9da2211cfc01fb2999e33365d6c9"
score = 75
- quality = 46
+ quality = 71
tags = "FILE"
clamav_sig1 = "MALWARE_Linux.Trojan.HiddenWasp-ELF"
clamav_sig2 = "MALWARE_Linux.Trojan.HiddenWasp-Script"
@@ -180684,7 +180844,7 @@ rule DITEKSHEN_MALWARE_Win_Robbinhood : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "f1c4226ed5cb1583418d5ef0efc2c2b5bc3cfe7f148f359c5d432fd660331a46"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
clamav_sig = "MALWARE.Win.Ransomware.Robbinhood"
@@ -181262,7 +181422,7 @@ rule DITEKSHEN_MALWARE_DOC_Koadicdoc : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "9f0538e1faee737a08d403a7f321ce45bdc70b390accfe378ba0d26292509fd7"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
strings:
@@ -181290,7 +181450,7 @@ rule DITEKSHEN_MALWARE_BAT_Koadicbat : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "1ee6c0189a5111c61af1dbe571524427bff95a7e3907f97ce51d272a8f701cf5"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
strings:
@@ -181348,7 +181508,7 @@ rule DITEKSHEN_MALWARE_Win_NETEAGLE : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "148de0ca332d3885d94eae8d15eb4aaa2bc4950c691c0e8817c816b7d4c55510"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -181441,7 +181601,7 @@ rule DITEKSHEN_MALWARE_Win_Pillowmint : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "ed2597fce1c56d2e110790e0eb89834b1bb9f6f52d39105157c9ffe2ede6cc7a"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -181783,7 +181943,7 @@ rule DITEKSHEN_MALWARE_Win_Taurus : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "6039c27e69b47dfcc1327c34306627d2d9bd57f6bd365bb80b47ad21f892ae8a"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -181862,7 +182022,7 @@ rule DITEKSHEN_MALWARE_Win_Slothfulmedia : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "6f742e8d9d555b44daaa09835f599c99e16cd39bb106c8f43fbbca7093de462e"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -181900,7 +182060,7 @@ rule DITEKSHEN_MALWARE_Win_Ircbot : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "1ea640202cfbd0c3425a192c45938f632dc644f41c7974118e7491b026122818"
score = 75
- quality = 42
+ quality = 67
tags = "FILE"
strings:
@@ -181972,7 +182132,7 @@ rule DITEKSHEN_MALWARE_Win_Osno : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "3df59c306017001467a5f237db2ab37d97c34116558e18420a6a1f01f08f520f"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -182143,7 +182303,7 @@ rule DITEKSHEN_MALWARE_Win_Cryptbot : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "6322b8b1ad210fac4475c194e060046538d4174f69a7c0e3618646d262cd33bd"
score = 75
- quality = 44
+ quality = 69
tags = "FILE"
snort2_sid = "920110"
snort3_sid = "920108"
@@ -182313,7 +182473,7 @@ rule DITEKSHEN_MALWARE_Win_Cobaltstrike : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "43513aef0ed715f0c214d7a14e465350f9c1bcadf87535e1c12561e976398bb3"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
strings:
@@ -182472,7 +182632,7 @@ rule DITEKSHEN_MALWARE_Win_Cratpluginkeylogger : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "58ef1f7466fcc871be2e74aa447c76970fd90c9d9d345a896fb8e6335114d189"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
clamav_sig = "MALWARE.Win.Trojan.CRAT"
@@ -182502,7 +182662,7 @@ rule DITEKSHEN_MALWARE_Win_Cratpluginclipboardmonitor : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "c3e692a06388e143a8e1053e75a6eb6a82da5bdf26d38e3a0e339bc20d8312a1"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -182531,7 +182691,7 @@ rule DITEKSHEN_MALWARE_Win_Cratpluginscreencapture : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "7b4378ae883d01338fabe2eb50a5509b722c661e63afc287afa07b263a0ebc42"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -182564,7 +182724,7 @@ rule DITEKSHEN_MALWARE_Win_Cratpluginransomhansom : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "b22f6d22630f311241634513eb051df2b36af84a938c1ae1f5284e5a5d7d3077"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -182836,7 +182996,7 @@ rule DITEKSHEN_MALWARE_Win_Snakekeylogger : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "7d787026b290c3c6a43c7de83233f22980733e7401260ff2f763e6f1b534ecba"
score = 75
- quality = 42
+ quality = 67
tags = "FILE"
clamav_sig = "MALWARE.Win.Trojan.SnakeKeylogger"
@@ -184020,7 +184180,7 @@ rule DITEKSHEN_MALWARE_Osx_Genieo : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "951dc8539435a52d9eea00b3fdaf98cf618c03867066819f2f9244165e57c675"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
clamav_sig = "MALWARE.Osx.Trojan.Genieo"
@@ -184283,7 +184443,7 @@ rule DITEKSHEN_MALWARE_Win_STOP : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "61f7e7c1139c56088b2f58b78ae132ffcfef0f931c15b67ea775b0d5e51d189d"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
snort2_sid = "920113"
snort3_sid = "920111"
@@ -184566,7 +184726,7 @@ rule DITEKSHEN_MALWARE_Win_Bobik : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "735dcb9e04956863305ca89a43686b8e48e3b20784ae9292cfc40d1c2c09d467"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
clamav_sig = "MALWARE.Win.Trojan.Bobik"
@@ -184818,7 +184978,7 @@ rule DITEKSHEN_MALWARE_Win_Babuk : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "5ca5c5106747cf8f4ccd5df4ddbc78321fea3c8f533cb807a704d270eb956007"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -185093,7 +185253,7 @@ rule DITEKSHEN_MALWARE_Win_Trickbotmodule : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "4d06653dad5f8a18598855212548364b3c3d2b68b99784846b494fcb1d1c8df9"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -185138,6 +185298,33 @@ rule DITEKSHEN_MALWARE_Win_Gaudox : FILE
condition:
uint16( 0 ) == 0x5a4d and all of them
}
+rule DITEKSHEN_MALWARE_Win_Phobos : FILE
+{
+ meta:
+ description = "Detects Phobos ransomware"
+ author = "ditekshen"
+ id = "7bf659ef-f2a1-5ee2-a334-c233e26a2526"
+ date = "2020-11-06"
+ modified = "2024-11-01"
+ reference = "https://github.com/ditekshen/detection"
+ source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3895-L3908"
+ license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
+ logic_hash = "bbf8eef0863e9d6423b3b0f938561b2be486b92b4f59b5d0b67f52dba536a582"
+ score = 75
+ quality = 25
+ tags = "FILE"
+
+ strings:
+ $x1 = /\\\\\?\\UNC\\\\\\e-/ fullword wide
+ $x2 = /\\\\\?\\ :/ fullword wide
+ $x3 = /POST/ fullword wide
+ $s1 = /ELVL/ fullword wide
+ $s2 = /SUP\d{3}/ fullword wide
+ $s3 = { 41 31 47 ?? 41 2b }
+
+ condition:
+ uint16( 0 ) == 0x5a4d and all of ( $x* ) and 1 of ( $s* )
+}
rule DITEKSHEN_MALWARE_Win_Ratty : FILE
{
meta:
@@ -185352,6 +185539,45 @@ rule DITEKSHEN_MALWARE_Win_WSHRATJS : FILE
condition:
filesize < 400KB and ( $charset_full or ( $charset_begin and $charset_end ) ) and 2 of ( $wsc_object* ) and 3 of ( $s* )
}
+rule DITEKSHEN_MALWARE_Win_Asyncrat : FILE
+{
+ meta:
+ description = "Detects AsyncRAT"
+ author = "ditekSHen"
+ id = "6465b50d-8f1a-5c09-84fd-cd1e5994e68f"
+ date = "2020-11-06"
+ modified = "2024-11-01"
+ reference = "https://github.com/ditekshen/detection"
+ source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4047-L4074"
+ license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
+ logic_hash = "073d4a8667fb1a48bf2bd503a551d7f78e38a6066feedc646d92c27fb7201fca"
+ score = 60
+ quality = 35
+ tags = "FILE"
+
+ strings:
+ $x1 = /AsyncRAT/ fullword ascii
+ $x2 = /AsyncRAT 0\./ wide
+ $x3 = /AsyncRAT\s[0-9]\.[0-9]\.[0-9][A-Z]/ fullword wide
+ $s1 = /\/create \/sc onlogon \/rl highest \/tn/ fullword wide
+ $s2 = /\/C choice \/C Y \/N \/D Y \/T 1 & Del "/ fullword wide
+ $s3 = /\{\{ ProcessId = \{0\}, Name = \{1\}, ExecutablePath = \{2\} \}\}/ fullword wide
+ $s4 = /Stub\.exe/ fullword ascii wide
+ $s5 = /\\nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS\\UCKH/ ascii wide
+ $s6 = /VirtualBox/ fullword ascii wide
+ $s7 = /\/target:winexe \/platform:x86 \/optimize\+/ fullword ascii wide
+ $s8 = /Win32_ComputerSystem/ ascii wide
+ $s9 = /Win32_Process Where ParentProcessID=/ ascii wide
+ $s10 = /etirWgeR\.llehShsW/ ascii wide
+ $s11 = /usbSpread/ fullword ascii wide
+ $cnc1 = /Mozilla\/5\.0 \(Windows NT 6\.1; Win64; x64; rv:66\.0\) Gecko\/20100101 Firefox\/66\.0/ fullword ascii wide
+ $cnc2 = /Mozilla\/5\.0 \(iPhone; CPU iPhone OS 11_4_1 like Mac OS X\) AppleWebKit\/605\.1\.15 \(KHTML, like Gecko\) Version\/11\.0 Mobile\/15E148 Safari\/604\.1/ fullword ascii wide
+ $cnc3 = /Mozilla\/5\.0 \(Windows NT 10\.0; Win64; x64\) AppleWebKit\/537\.36 \(KHTML, like Gecko\) Chrome\/60\.0\.3112\.113 Safari\/537\.36/ fullword ascii wide
+ $cnc4 = /POST \/ HTTP\/1\.1/ fullword ascii wide
+
+ condition:
+ (( uint16( 0 ) == 0x5a4d and filesize < 4000KB ) and ( 1 of ( $x* ) or 6 of ( $s* ) or all of ( $cnc* ) or ( 4 of ( $s* ) and 2 of ( $cnc* ) ) ) ) or ( 1 of ( $x* ) or 6 of ( $s* ) or all of ( $cnc* ) or ( 4 of ( $s* ) and 2 of ( $cnc* ) ) )
+}
rule DITEKSHEN_MALWARE_Win_Quilclipper
{
meta:
@@ -185500,7 +185726,7 @@ rule DITEKSHEN_MALWARE_Win_Corebot : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "518209458fc8912d47b0b99896178fda823c3174c37f21d5e9331349a69322d7"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
snort_sid = "920211-920212"
@@ -185647,7 +185873,7 @@ rule DITEKSHEN_MALWARE_Win_Arechclient2 : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "0d841f4d4664fb09801c51f7b65e897e4e698753ad67fc20e2b81d98c0b3d07d"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -186254,7 +186480,7 @@ rule DITEKSHEN_MALWARE_Win_EXEPWSH_Dlagent : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "6380359db1ac775cea3ebb93f7cf22a92d2f2e634c6aa724e2814c10d4ed42f5"
score = 60
- quality = 30
+ quality = 55
tags = "FILE"
strings:
@@ -186755,7 +186981,7 @@ rule DITEKSHEN_MALWARE_Win_Dlagent08 : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "0238c13b00e5778ef216b4e8576c321803da6e269c96c3051b9cc45a3ac6e567"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
snort2_sid = "920122"
snort3_sid = "920119"
@@ -187137,7 +187363,7 @@ rule DITEKSHEN_MALWARE_Win_Njrat : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "92d535a7c7f361b7a0901d0b99427ebc82a69577bfea73c04a7f9d51d2054b36"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -187292,7 +187518,7 @@ rule DITEKSHEN_MALWARE_Win_Karkoff : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "e9b6ba5be2b3cd0faa898347e57cee5a57b80b19842c3a1ddb42d620307c8b39"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -187475,7 +187701,7 @@ rule DITEKSHEN_MALWARE_Win_Ranumbot : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "a9c32445e62d072e4184d25497696ef6225edb176dc7a9743a54194d4ddb4b0c"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -188084,7 +188310,7 @@ rule DITEKSHEN_MALWARE_Win_Buterat : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "c3d93e8dc1bde8e77c11586c8d8b67d137ef2c4791e12269f1af310fbe14832b"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -188202,7 +188428,7 @@ rule DITEKSHEN_MALWARE_Win_Browsergrabber : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "c96a63566280758d8c32542bfab3c6faa7d21329430345f51ea4c2f0a6809dc2"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -188584,7 +188810,7 @@ rule DITEKSHEN_MALWARE_Win_Wingo : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "423b1631ad625fd46a9d10f0ecdf24931cf62a2c1694da3ebdd38daad0a4f724"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -188698,7 +188924,7 @@ rule DITEKSHEN_MALWARE_Win_Gelsevirine : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "60d41d6d789f1cd2a7040d6535f13c69ea58a489035838f047b886e8f1f37f63"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -188906,7 +189132,7 @@ rule DITEKSHEN_MALWARE_Win_Markirat : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "17b8bcfe8d2b4c87ff8e0bddb436e18029a3b28a5ad3994fe9bef359588d9cad"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -188979,7 +189205,7 @@ rule DITEKSHEN_MALWARE_Win_Xfiles : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "0c04a8f019aea36f4bba3ce8289c2d608c69d76bbf321052560b4ca2214be057"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -189191,7 +189417,7 @@ rule DITEKSHEN_MALWARE_Win_Mercurial : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "400f8f717a4e07bf4de508c02bbcd9e82bf21f3df84c989fc622378f33e192f0"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -189376,7 +189602,7 @@ rule DITEKSHEN_MALWARE_Win_RSJON : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "abfea2955bf0d0b0511ea820582cc15fbcfc38dbed71fb2a0050cd98a9311cda"
score = 75
- quality = 23
+ quality = 48
tags = "FILE"
strings:
@@ -189708,7 +189934,7 @@ rule DITEKSHEN_MALWARE_Win_Actionrat : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "1552cda3f02c08582e3dd97df98416635a25005081627097df181bfc6aac4665"
score = 75
- quality = 46
+ quality = 71
tags = "FILE"
strings:
@@ -190259,7 +190485,7 @@ rule DITEKSHEN_MALWARE_Win_Bluebot : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "04a19f649eb2fff7a5bc59ccead80cd0a04c4e5418cbc83e850045dba75b03e0"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -190365,7 +190591,7 @@ rule DITEKSHEN_MALWARE_Win_MB150 : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "a07535fc53912ddde6a0bed187c21ecdb2701d317d7de0cbdd2db37071bc9a21"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -190392,6 +190618,49 @@ rule DITEKSHEN_MALWARE_Win_MB150 : FILE
condition:
uint16( 0 ) == 0x5a4d and ( 4 of ( $x* ) or ( $go and 4 of ( $s* ) ) or ( 1 of ( $mac* ) and ( 2 of ( $x* ) or 3 of ( $s* ) ) ) )
}
+rule DITEKSHEN_MALWARE_Win_Chaos : FILE
+{
+ meta:
+ description = "Detects Chaos ransomware"
+ author = "ditekSHen"
+ id = "59d43cfb-72d8-5c17-87bf-f1f364d23bed"
+ date = "2020-11-06"
+ modified = "2024-11-01"
+ reference = "https://github.com/ditekshen/detection"
+ source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7404-L7433"
+ license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
+ logic_hash = "6203ab09745db817b9e909d70cf1d5be9769c414461ee5f7bb344b6959986537"
+ score = 75
+ quality = 44
+ tags = "FILE"
+
+ strings:
+ $s1 = // fullword wide
+ $s2 = // fullword wide
+ $s3 = /C:\\Users\\/ fullword wide
+ $s4 = /read_it\.txt/ fullword wide
+ $s5 = /#base64Image/ fullword wide
+ $s6 = /\(\?:\[13\]\{1\}\[a-km-zA-HJ-NP-Z1-9\]\{26,33\}\|bc1\[a-z0-9\]\{39,59\}\)/ fullword wide
+ $s7 = /check(Spread|Sleep|AdminPrivilage|deleteShadowCopies|disableRecoveryMode|deleteBackupCatalog)/ fullword ascii nocase
+ $s8 = /(delete|disable)(ShadowCopies|RecoveryMode|BackupCatalog)/ fullword ascii nocase
+ $s9 = /spreadName/ fullword ascii
+ $s10 = /processName/ fullword ascii
+ $s11 = /sleepOutOfTempFolder/ fullword ascii
+ $s12 = /AlreadyRunning/ fullword ascii
+ $s13 = /random_bytes/ fullword ascii
+ $s14 = /encryptDirectory/ fullword ascii nocase
+ $s15 = /EncryptFile/ fullword ascii nocase
+ $s16 = /intpreclp/ fullword ascii
+ $s17 = /bytesToBeEncrypted/ fullword ascii
+ $s18 = /textToEncrypt/ fullword ascii
+ $m1 = /Chaos is/ wide
+ $m2 = /Payment informationAmount:/ wide
+ $m3 = /Coinmama - hxxps:\/\/www\.coinmama\.com Bitpanda - hxxps:\/\/www\.bitpanda\.com/ wide
+ $m4 = /where do I get Bitcoin/ wide
+
+ condition:
+ uint16( 0 ) == 0x5a4d and 6 of ( $s* ) or all of ( $m* ) or ( 2 of ( $m* ) and 4 of ( $s* ) )
+}
rule DITEKSHEN_MALWARE_Win_Horuseyesrat : FILE
{
meta:
@@ -190405,7 +190674,7 @@ rule DITEKSHEN_MALWARE_Win_Horuseyesrat : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "c0f499e3a17923b391ed6b7fa723525a9d4aef0ce04a2c7abec60d5eda15888f"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -190894,7 +191163,7 @@ rule DITEKSHEN_MALWARE_Win_Darkcomet : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "444df3c914c47500018614af10036864b459e7873daf079b684352dbe52f0486"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
strings:
@@ -192050,7 +192319,7 @@ rule DITEKSHEN_MALWARE_Win_Rapid : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "c3f1bffeb402951da8bcccc899b2cdeb3c218b342d8338c750b9ff275537b4b5"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -192117,7 +192386,7 @@ rule DITEKSHEN_MALWARE_Win_Virlock : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "8d516a0d771d7134c0f917f010b3973ed53b4ee7e4a2cf0bb5daecf9867b0081"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -192219,7 +192488,7 @@ rule DITEKSHEN_MALWARE_Win_Kdcsponge : FILE
hash = "e391c2d3e8e4860e061f69b894cf2b1ba578a3e91de610410e7e9fa87c07304c"
logic_hash = "c891db94df9cde9eaa6096ad68d96c7b85a9c03e255ce43ccb8543a016bd3853"
score = 75
- quality = 40
+ quality = 65
tags = "FILE"
strings:
@@ -192322,7 +192591,7 @@ rule DITEKSHEN_MALWARE_Win_Tardigrade : FILE
hash = "4afd9f0dde092daeac3f3e6ffb0aee06682b3dba6005d2bd1a914eefd5cc6a30"
logic_hash = "2bd4f23f66844a320b6bed6242ba39096f66a08affb84abd78c342d433ed9fe6"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -192463,7 +192732,7 @@ rule DITEKSHEN_MALWARE_Win_Onlylogger : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "1b39a4d2a6d3a2633cfa98adc1dfe99d10d2493fd06c9f875c56ec7689b7a561"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
strings:
@@ -192692,7 +192961,7 @@ rule DITEKSHEN_MALWARE_Win_Chebka : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "cc8123a5d20fac51d4dfc225e743539456efb4d649060d078c3ed93e7724da01"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -192727,7 +192996,7 @@ rule DITEKSHEN_MALWARE_Win_Flagpro : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "c5e5944426b7be690ad62dd0d98a8fc6f8135cab0dbdd8a5aaf1670491eda59d"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -192813,7 +193082,7 @@ rule DITEKSHEN_MALWARE_Win_Garrantdecrypt : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "84b139e51f0ef0389c641d62409d702b0ae7ec6ecd2fa54baf2cf0c0078a8f5a"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -192841,7 +193110,7 @@ rule DITEKSHEN_MALWARE_Win_Locked : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "b838b996946fb268c66bac68d5e326ff3049340dfb08f2e0a77492df49915d5a"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -192948,7 +193217,7 @@ rule DITEKSHEN_MALWARE_Win_Lokilocker : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "bf78f5e8f40c1a19f6b078a85854e95d5ef1f321393a831edda17b0d65515da7"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -193050,7 +193319,7 @@ rule DITEKSHEN_MALWARE_Win_Lorenz : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "e9fc9d405b955c379ae40b1804d43b19999f6ea264fc645c897080fb020e8ae8"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -193094,7 +193363,7 @@ rule DITEKSHEN_MALWARE_Win_Blackcat : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "cd76e5b87f33d91c17fd032417583c3f68d0e310aaf6f08e26ec5d53844ed9d2"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -193115,6 +193384,38 @@ rule DITEKSHEN_MALWARE_Win_Blackcat : FILE
condition:
( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and ( all of ( $x* ) or 5 of ( $s* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) )
}
+rule DITEKSHEN_MALWARE_Win_Koxic : FILE
+{
+ meta:
+ description = "Detects Koxic ransomware"
+ author = "ditekSHen"
+ id = "6a82bf44-b155-5746-b798-20a13623a14a"
+ date = "2020-11-06"
+ modified = "2024-11-01"
+ reference = "https://github.com/ditekshen/detection"
+ source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9291-L9309"
+ license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
+ logic_hash = "d874c8ebf330814e52d159cbf71f8bc05ebeb4a9fb93d96c3f861b51e57925a3"
+ score = 75
+ quality = 25
+ tags = "FILE"
+
+ strings:
+ $c1 = / INFO: >> %TEMP%\\/ ascii wide
+ $c2 = /cmd \/c "wmic/ ascii wide
+ $c3 = /cmd \/c "echo/ ascii wide
+ $c4 = /cmd\.exe \/C ping 1\.1\.1\.1 -n 1 -w 3000 > Nul & Del \/f \/q "%s"/ fullword wide
+ $c5 = /sc config.{1,30}start=disabled/ fullword ascii wide
+ $s1 = /Container: %s/ fullword wide
+ $s2 = /Shotcut dir : %s/ fullword wide
+ $s3 = /\\Microsoft\\Windows\\Network Shortcuts\\/ fullword wide
+ $s4 = /Thread %d started\./ fullword ascii
+ $s5 = /ADD our TOXID:/ wide
+ $s6 = /\[Recommended\] Using an email/ wide
+
+ condition:
+ uint16( 0 ) == 0x5a4d and ( ( 4 of ( $s* ) and 1 of ( $c* ) ) or ( 2 of ( $s* ) and ( #c1 > 5 or #c2 > 5 or #c3 > 5 or #c5 > 5 ) ) )
+}
rule DITEKSHEN_MALWARE_Win_Timetime : FILE
{
meta:
@@ -193158,7 +193459,7 @@ rule DITEKSHEN_MALWARE_Win_Strifewater : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "ddb189dfe58af08d2c0682239551a5b9d82db94eedcefc02895316bcbbaca3f2"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -193197,7 +193498,7 @@ rule DITEKSHEN_MALWARE_Win_Surtr : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "a8db5588079d471d8904f0444973973a0c01dbec1ccbe3d43a34d41a0dde495d"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -193258,7 +193559,7 @@ rule DITEKSHEN_MALWARE_Win_Jesterstealer : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "c84df5d3ad2bc7a75a11c07995cc034c2a92b2f6f6f6943288add9c44c57bf6d"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -193465,7 +193766,7 @@ rule DITEKSHEN_MALWARE_Win_Bandit : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "e557f5a928b5da90f3ec878d6d8615a2d8b5f33e97954cd3278044f76b543386"
score = 75
- quality = 32
+ quality = 57
tags = "FILE"
strings:
@@ -193515,7 +193816,7 @@ rule DITEKSHEN_MALWARE_Win_Laplas : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "e4a1f39a539782118db9c4ab89d03e359420397ef970165389cc79e7ea0952b3"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
clamav_sig1 = "MALWARE.Win.LapLas-DotNET"
clamav_sig2 = "MALWARE.Win.LapLas-GoLang"
@@ -193555,7 +193856,7 @@ rule DITEKSHEN_MALWARE_Win_Mystic : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "26e0b85141df818d70124c0b19b5b6a05ac24ae679724d7a8ad94415a6462d17"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -193670,7 +193971,7 @@ rule DITEKSHEN_MALWARE_Win_Multi_Family_Infostealer : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "0fdd1cdc4f2e5bee6c763e6e6b2e79d85285e44e2b5e3168a56d7d360252ee99"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -193706,7 +194007,7 @@ rule DITEKSHEN_MALWARE_Win_Darkeye : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "5496dcbfe075a4030a446027765186e9dd1931561a29a481139281e1708ce87d"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -193833,7 +194134,7 @@ rule DITEKSHEN_MALWARE_Win_Lummastealer : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "74014c5bcc85977b90faed93b348c34e47ee033b06c2f145348ca9c54c27bda5"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
clamav1 = "MALWARE.Win.Trojan.LummaStealer"
@@ -193965,7 +194266,7 @@ rule DITEKSHEN_MALWARE_Win_Arrowrat : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "13e6d4fd274f75c50aa4110276812d02885c03cfc269dde480db66955e5f703a"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -194097,7 +194398,7 @@ rule DITEKSHEN_MALWARE_Win_Stealerium : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "a2834e7fe26ad0197a9e490ab517029ceed2e09506fcc37e6ddf0c1804fa6cb9"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -194192,7 +194493,7 @@ rule DITEKSHEN_MALWARE_Win_Hakunamatata_Builder : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "ac258851de38504cf63ba51fd06f8a9a3dfbe0096d199ba702e9763b5ecc43e4"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -194300,7 +194601,7 @@ rule DITEKSHEN_MALWARE_Win_Akira : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "73dd0a1b21be8ff7362536f6b6255cd19510632782effd67a56d7656bebf04ff"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -194391,7 +194692,7 @@ rule DITEKSHEN_MALWARE_Win_Romcom_Worker : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "488db046458585882a4709438042b57e02d7dbc06483fdfdfc463a64ee8db203"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -194505,7 +194806,7 @@ rule DITEKSHEN_MALWARE_Win_Arcrypt : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "cc9fa68d093fdf9745a06beb28e29108cb2ba846122ce097ad892213b1edba25"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -194545,7 +194846,7 @@ rule DITEKSHEN_MALWARE_Win_Rootteamstealer : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "d1693865253067527d58c980653d550b55d022d5a394b88090a958e5d5818143"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -194575,7 +194876,7 @@ rule DITEKSHEN_MALWARE_Win_Espioloader : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "8ad77a50db48f12e6f6465652b24fc1daa56375bb27e37e0eead1bea55b89e0c"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
clamav_sig = "MALWARE.Win.EspioLoader"
@@ -194629,7 +194930,7 @@ rule DITEKSHEN_MALWARE_Win_Blitzgrabber : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "8baceacf3c2af61e00b31e8106820b6f1ce2e7a9d98eaed965e698109ae08314"
score = 75
- quality = 46
+ quality = 71
tags = "FILE"
strings:
@@ -194780,7 +195081,7 @@ rule DITEKSHEN_MALWARE_Win_Phemedronestealer : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "74e150cc971f5648f9e3f6146afba162b1a29cf2744c862b2320db52c2efa930"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -194815,7 +195116,7 @@ rule DITEKSHEN_MALWARE_Win_WSHRAT : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "297bfe65815637a464e2a8fc23570c6e79694ffe0467d5898b7c845f1450de95"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -194847,7 +195148,7 @@ rule DITEKSHEN_MALWARE_Win_Rustystealer : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "e60e66360c8f97a31e75cd90a12519f75f3a672874fc985a8da1d4d02e185b4d"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -195025,7 +195326,7 @@ rule DITEKSHEN_MALWRE_Win_Darkgate : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "805a04bbb3915d539e76927393384a2786c25490e8b9fc151d5b12415247578b"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -195327,7 +195628,7 @@ rule DITEKSHEN_MALWARE_Win_Qwixxrat : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "e6e44697e393da35215f7835f122cb74b05dbeebb558345d5110d6fbc809f4dd"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -195353,7 +195654,7 @@ rule DITEKSHEN_MALWARE_Win_Toxiceye : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "ee01c107dd295b923801c0d1a77b1534d3a5f2abf8d2cfa93c6786a1b0553504"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -195412,7 +195713,7 @@ rule DITEKSHEN_MALWARE_Win_Krakenstealer : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "7f15823db706e6e51d8ea58fb026efb49f42234255d2f448614dc645d12648bb"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
snort = "923828002"
@@ -195539,7 +195840,7 @@ rule DITEKSHEN_MALWARE_Win_Agnianestealer : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "0031fbe6d76868819cbcfc638433d60a50e8f5cfd14ff25af88ed3dffefd7d62"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
snort = "923828001"
clamav = "ditekSHen.MALWARE.Win.AgnianeStealer"
@@ -195777,7 +196078,7 @@ rule DITEKSHEN_MALWARE_Win_Risepro : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "f6f1832f316df51ca108a3c75034bd53c3823cd3d9b16da120e12e252dbf90ff"
score = 75
- quality = 46
+ quality = 71
tags = "FILE"
strings:
@@ -195943,7 +196244,7 @@ rule DITEKSHEN_MALWARE_Win_Simda : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "3f06e86033e8f9534f9904a2a63c4717a9532eb235f6f4405ef1db7d9b93f036"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -195999,7 +196300,7 @@ rule DITEKSHEN_MALWARE_Win_Umbralstealer : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "1686e4626e4d6335f028d6cb6471c32dac747a77fc95d97b4c9dfd043ba975e9"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -196100,7 +196401,7 @@ rule DITEKSHEN_MALWARE_Win_Blackhunt : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "62e9bc505eff3e19ff0cdaf180e45e6d7917f0bec7cd9b007bee9fe1d9d09b66"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -196130,7 +196431,7 @@ rule DITEKSHEN_MALWARE_Win_Scoutelite : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "935bd891a9b68cb6ddad86db843de624f3a7ec0824f2b4c6ff0da56422b79668"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
strings:
@@ -196369,7 +196670,7 @@ rule DITEKSHEN_MALWARE_Win_Lighthand : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "4f06467a522b786045839e6b22b888cecc554b0f63cc20dc43dc0f8ec80f5654"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -196472,7 +196773,7 @@ rule DITEKSHEN_MALWARE_Win_Ktlvdoor : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "3ced9b558c7e17acd015cd2c9dd0c5d024bf9c31c7f2e7c9b7b937124109cf8b"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -196634,7 +196935,7 @@ rule DITEKSHEN_MALWARE_Win_Cicada3301 : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "b8b7596bc8ae01b89742e17bd3dbfcc1e2fad486cc6ea19c8de813fc677509f4"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
clamav1 = "MALWARE.Win.Ransomware.Cicada3301"
@@ -196674,7 +196975,7 @@ rule DITEKSHEN_MALWARE_Win_Fpspy : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "c26736c7f056f3d13c58e724fda601e88468e2386852b072a37c6646fb5ef8f9"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
clamav1 = "MALWARE.Win.Trojan.FPSpy"
@@ -197212,7 +197513,7 @@ rule DITEKSHEN_INDICATOR_RTF_Threadkit_Exploit_Builder_Document : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "f2308ac6ae5345e0c783871dd6b471397ec83ba7194db5cc74c8984d84c2c0c2"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -197511,6 +197812,29 @@ rule DITEKSHEN_INDICATOR_XML_Webrelframe_Remotetemplate : FILE
condition:
uint32( 0 ) == 0x6d783f3c and ( 1 of ( $target* ) and $mode )
}
+rule DITEKSHEN_INDICATOR_PDF_Ipdropper : FILE
+{
+ meta:
+ description = "Detects PDF documents with Action and URL pointing to direct IP address"
+ author = "ditekSHen"
+ id = "83368671-f1ec-5b09-9d55-6e45e576ebdb"
+ date = "2020-11-06"
+ modified = "2024-09-06"
+ reference = "https://github.com/ditekshen/detection"
+ source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L754-L763"
+ license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
+ logic_hash = "be37ee7ef5d8c980483f31bf5667c2dad4321d662be05c495ec6755362d33fd6"
+ score = 60
+ quality = 35
+ tags = "FILE"
+
+ strings:
+ $s1 = { 54 79 70 65 20 2f 41 63 74 69 6f 6e 0d 0a 2f 53 20 2f 55 52 49 0d 0a }
+ $s2 = /\/URI \(http(s)?:\/\/([0-9]{1,3}\.){3}[0-9]{1,3}\// ascii
+
+ condition:
+ uint32( 0 ) == 0x46445025 and all of them
+}
rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL1 : FILE
{
meta:
@@ -198089,7 +198413,7 @@ rule DITEKSHEN_INDICATOR_TOOL_PWS_Mimikatz : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "42c9c78c88bb7c427d5f0bf1d3b0113205780142b499eb17858037ded0f2971e"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -198217,7 +198541,7 @@ rule DITEKSHEN_INDICATOR_TOOL_Avbypass_Aviator : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "1fb497eec2b0cd4051b5ddd53463f1da511c0a7b72d54a0bc68736a99fdc6143"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -198282,7 +198606,7 @@ rule DITEKSHEN_INDICATOR_TOOL_LTM_Sharpexec : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "17ae5c9f0b22e8ecbbbcbe052e466d00cb7b62cff423688b5138209c52f0698d"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -198396,7 +198720,7 @@ rule DITEKSHEN_INDICATOR_TOOL_EXP_Eternalblue : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "63e56637118accb8c32c20e52465c027df2dbf83b3b663d316b453ce879572c8"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -199437,7 +199761,7 @@ rule DITEKSHEN_INDICATOR_TOOL_ANT_Sharpedrchecker : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "77a26ff5298dddebc669d9b6c39905a48a86884cf98adebdf935b94c62d36ddc"
score = 75
- quality = 23
+ quality = 48
tags = "FILE"
strings:
@@ -199482,7 +199806,7 @@ rule DITEKSHEN_INDICATOR_TOOL_ANT_Invizzzible : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "bd84015f9fdc160a6ed9010c5a5905fcf13987b1fdec6fdd9535e315dc3617e8"
score = 75
- quality = 48
+ quality = 73
tags = "FILE"
strings:
@@ -199599,7 +199923,7 @@ rule DITEKSHEN_INDICATOR_TOOL_EXP_Petitpotam01 : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "37a9477b41560904e8874ecaf93eb2667b9450b5d42665677abc1442538f9000"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
strings:
@@ -199838,7 +200162,7 @@ rule DITEKSHEN_INDICATOR_TOOL_ENUM_Sharpshares : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "8b35d6a692814e1b27ffc1db4ab124bf621c156aaf57f24796c422ec95a85715"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -200007,7 +200331,7 @@ rule DITEKSHEN_INDICATOR_TOOL_Extpassword : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "525530cb7e9f44be0408fd710306f90056b1b6b9a9e4779d8c1eb1ddef443fb0"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
strings:
@@ -200094,7 +200418,7 @@ rule DITEKSHEN_INDICATOR_TOOL_Atlasreaper : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "4a0436d5c3f1609d23b2b919bebdc56a7fd63e81b99e72dcda1022487cb88240"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
strings:
@@ -200669,7 +200993,7 @@ rule DITEKSHEN_INDICATOR_TOOL_Sharpghosttask : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "3de8d9fe7804e208ff556b6bedbd80eebfda1a730626403418a555ad9fbbb820"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -200899,7 +201223,7 @@ rule DITEKSHEN_INDICATOR_RMM_Connectwise_Screenconnect : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "43003f97c33c631a2806ce2b82b2367d2452ceb21b0267b5dfe78b350b66924a"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
clamav1 = "INDICATOR.Win.RMM.ConnectWise-ScreenConnect"
@@ -201247,7 +201571,7 @@ rule DITEKSHEN_INDICATOR_RMM_Atera : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "dbc37a941b38d36ea9bc31880c3cba6cd2b88b534583e86741f7686fcb410235"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
clamav1 = "INDICATOR.Win.RMM.Atera"
@@ -201428,7 +201752,7 @@ rule DITEKSHEN_INDICATOR_RMM_Dwagentsvc : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "590d41d2e433a7a1bb373fbd0b0d47818a9867bee0399101881b05e83b586f6e"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
clamav1 = "INDICATOR.Win.RMM.DWAgent-SVC"
@@ -201490,7 +201814,7 @@ rule DITEKSHEN_INDICATOR_RMM_Dwagent_Soundcapture : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "c0efa9f383373dec1c5b9d127c2b4c6f4906718ae8f62eea28d7a369001be5af"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
clamav1 = "INDICATOR.Win.RMM.DWAgent-SoundCapture"
@@ -215882,7 +216206,7 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_AHK_Downloader : FILE
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "8806d8c03adb4ea4cd9b806f8f8c21e561b39b5602c70d09ed193e35e1502d35"
score = 40
- quality = 20
+ quality = 45
tags = "FILE"
importance = 20
@@ -216123,6 +216447,35 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWSH_Asciiencoding_Pattern : FILE
condition:
1 of ( $enc* ) and 4 of ( $s* ) and filesize < 2500KB
}
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_JS_Hex_B64Encoded_EXE : FILE
+{
+ meta:
+ description = "Detects JavaScript files hex and base64 encoded executables"
+ author = "ditekSHen"
+ id = "37516c6b-0a77-5a20-a36f-5f8309b37362"
+ date = "2020-11-06"
+ modified = "2024-06-08"
+ reference = "https://github.com/ditekshen/detection"
+ source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_suspicious.yar#L726-L740"
+ license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
+ logic_hash = "60185e6ec96875085ffb7a6bf6eb8643368bbce42b89290ab987eb32c1e153bd"
+ score = 40
+ quality = 20
+ tags = "FILE"
+ importance = 20
+
+ strings:
+ $s1 = /\.SaveToFile/ ascii
+ $s2 = /\.Run/ ascii
+ $s3 = /ActiveXObject/ ascii
+ $s4 = /fromCharCode/ ascii
+ $s5 = /\\x66\\x72\\x6F\\x6D\\x43\\x68\\x61\\x72\\x43\\x6F\\x64\\x65/ ascii
+ $binary = /\\x54\\x56\\x71\\x51\\x41\\x41/ ascii
+ $pattern = /[\s\{\(\[=]_0x[0-9a-z]{3,6}/ ascii
+
+ condition:
+ $binary and $pattern and 2 of ( $s* ) and filesize < 2500KB
+}
rule DITEKSHEN_INDICATOR_SUSPICIOUS_WMIC_Downloader : FILE
{
meta:
@@ -216421,7 +216774,7 @@ rule DITEKSHEN_INDICATOR_SUSPICIOUS_Finger_Download_Pattern
license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
logic_hash = "04cbb1abc4c3d2990bae798ece052eb8aa1b5104b5712e98aeb80731316b9c57"
score = 40
- quality = 20
+ quality = 45
tags = ""
importance = 20
@@ -219382,7 +219735,7 @@ rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Blackhunt
* YARA Rule Set
* Repository Name: WithSecureLabs
* Repository: https://github.com/WithSecureLabs/iocs
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 1a8384468dd292c6d2c5114c32e42dc0da1f5ae1
* Number of Rules: 27
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -219653,7 +220006,7 @@ rule WITHSECURELABS_Andariel_Jelusrat_PDB : FILE
license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE"
logic_hash = "a14d808ff783b7c42f3e4600386d578d63c88a0cd7c492cb1a026e0580b551f3"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
strings:
@@ -219746,7 +220099,7 @@ rule WITHSECURELABS_Ducktail_Artifacts : FILE
hash = "b98170b18b906aee771dbd4dbd31e5963a90a50e"
logic_hash = "1daa5e654058c802826b6a306b5bfc9d0c05c4ee54607e94e618a8d409ce74d9"
score = 75
- quality = 50
+ quality = 75
tags = "FILE"
version = "1.0"
@@ -220172,7 +220525,7 @@ rule WITHSECURELABS_Kapeka_Backdoor : FILE
* YARA Rule Set
* Repository Name: HarfangLab
* Repository: https://github.com/HarfangLab/iocs
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: 3e2b674bf2f591ac46301420671ba553de094dea
* Number of Rules: 39
* Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
@@ -220784,7 +221137,7 @@ rule HARFANGLAB_Samecoin_Campaign_Tasksspreader : FILE
hash = "b447ba4370d9becef9ad084e7cdf8e1395bafde1d15e82e23ca1b9808fef13a7"
logic_hash = "61d602c343365608e5bc587ee9c7898e256f2411d78c7fe74c211e68bf4ab707"
score = 75
- quality = 53
+ quality = 78
tags = "FILE"
context = "file"
@@ -221323,7 +221676,7 @@ rule HARFANGLAB_Apt31_Rawdoor_Payload : FILE
hash = "fade96ec359474962f2167744ca8c55ab4e6d0700faa142b3d95ec3f4765023b"
logic_hash = "51bd04603419d5bc77f12618df986f6b31ea8ddea553c6bc7580698fa236b3ed"
score = 75
- quality = 55
+ quality = 80
tags = "FILE"
context = "file"
@@ -221357,7 +221710,7 @@ rule HARFANGLAB_Iis_Module_Hijackserver_Native : FILE
hash = "c1ca053e3c346513bac332b5740848ed9c496895201abc734f2de131ec1b9fb2"
logic_hash = "f0539a40958b34bb8372f8a8a6ca22617626fc7806556d6353175aa5f2ec0aea"
score = 75
- quality = 55
+ quality = 80
tags = "FILE"
context = "file"
@@ -221398,7 +221751,7 @@ rule HARFANGLAB_Iis_Module_Hijackserver_Dotnet : FILE
hash = "915441b7d7ddb7d885ecfe75b11eed512079b49875fc288cd65b023ce1e05964"
logic_hash = "83476157c66ac9586d28bf2e8614575c4950ab3e3538fd12d0a31fc451970686"
score = 75
- quality = 55
+ quality = 80
tags = "FILE"
context = "file"
@@ -221437,7 +221790,7 @@ rule HARFANGLAB_Apache_Module_Hijackserver_Php_Decoded : FILE
hash = "e107bf25abc1cff515b816a5d75530ed4d351fa889078e547d7381b475fe2850"
logic_hash = "bf40ee8ae3a491c311d5221cb96adef6bd55153d602f1d534f2cb42a12aa68ec"
score = 75
- quality = 55
+ quality = 80
tags = "FILE"
context = "file"
@@ -221474,7 +221827,7 @@ rule HARFANGLAB_Apache_Module_Hijackserver_Php : FILE
hash = "e107bf25abc1cff515b816a5d75530ed4d351fa889078e547d7381b475fe2850"
logic_hash = "fe503e8d30a354927c1d4e1cffa18411b4c3ac5058cd3aef8df0e7d87624fe43"
score = 75
- quality = 53
+ quality = 78
tags = "FILE"
context = "file"
@@ -221593,9 +221946,9 @@ rule HARFANGLAB_Custom_Ateraagent_Operator : FILE
* YARA Rule Set
* Repository Name: LOLDrivers
* Repository: https://github.com/magicsword-io/LOLDrivers/
- * Retrieval Date: 2026-09-06
- * Git Commit: 2ad986b10a5f0b859b22d52b1ad4afe4c4551532
- * Number of Rules: 791
+ * Retrieval Date: 2026-09-13
+ * Git Commit: 1c60ea1c8909396fe294c76aaafae4923b6dbea1
+ * Number of Rules: 792
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
*
*
@@ -221811,10 +222164,10 @@ rule LOLDRIVERS_MAL_Driver_501E
author = "Florian Roth"
id = "74880e73-3ec7-502d-adbc-3a64bf14a8cd"
date = "2026-08-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1-L16"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1-L16"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "501ea082774f29adc752887402af6df0edf49bf7b3816b93f6e52c06a79685bc"
hash = "962fb670510807fd5cab3a6e6f886aeb2b925c42054c29fa02f67011be935954"
logic_hash = "24ba91a218e2dd4c2b02a88f522d7bc72864f1be574abd403e6a457c32e6cbc9"
@@ -221839,8 +222192,8 @@ rule LOLDRIVERS_MAL_Driver_773B
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L18-L33"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L18-L33"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "773b4a1efb9932dd5116c93d06681990759343dfe13c0858d09245bc610d5894"
logic_hash = "5906a3c80fce46b8a546449ada8c70dfdfdfedcd516543c6584fb1c715be240a"
score = 70
@@ -221862,10 +222215,10 @@ rule LOLDRIVERS_MAL_Driver_Basil_Windivertsys_Windivertdriver_2F43
author = "Florian Roth"
id = "41f45e37-6102-5758-ad31-15f67bf89e48"
date = "2026-04-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L35-L56"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L35-L56"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2f43f4251be4d72dd56c91bf6cce475d379eb9ba6c4dda2be3022ea633d5e807"
hash = "8248306bcc5fae20fd4f3d5c44f962c85cddbe020b34a1799350ce2034154b7d"
hash = "8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2"
@@ -221894,10 +222247,10 @@ rule LOLDRIVERS_MAL_Driver_Basil_Windivertsys_Windivertdriver_8DA0
author = "Florian Roth"
id = "b2c5b02b-7fe2-5dcc-8c96-c67212780220"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L58-L79"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L58-L79"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2"
hash = "2f43f4251be4d72dd56c91bf6cce475d379eb9ba6c4dda2be3022ea633d5e807"
hash = "8248306bcc5fae20fd4f3d5c44f962c85cddbe020b34a1799350ce2034154b7d"
@@ -221928,8 +222281,8 @@ rule LOLDRIVERS_MAL_Driver_Chingachgukdengerk_Vusbbussys_Virtualusbbusdriver_B4F
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L81-L101"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L81-L101"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b4f33ffef069c18e8a8834eb448dd1f1dbdaae93b140cfff5a1db015eb3ada2f"
logic_hash = "178a4e8398ab6c663a1b6d1c810948a5efe1f9d97c2c9e2177d6763e0de3bc7d"
score = 70
@@ -221956,10 +222309,10 @@ rule LOLDRIVERS_MAL_Driver_Crowdstrikeinc_Csagentsys_Crowdstrikefalconsensor_06E
author = "Florian Roth"
id = "38c7c76c-3c1f-57ae-a667-5e3296258417"
date = "2026-04-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L103-L127"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L103-L127"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "06eccd102c9105957773b32538943531d9c39d0a504ceb3b9b155e97e3b0b134"
hash = "1e42c8cb410a7ed653cfe62bbd8cf191f31a47337fe1ffcc35232d03f2da05ef"
hash = "6a2a0f9c56ee9bf7b62e1d4e1929d13046cd78a93d8c607fe4728cc5b1e8d050"
@@ -221991,10 +222344,10 @@ rule LOLDRIVERS_MAL_Driver_Crowdstrikeinc_Csagentsys_Crowdstrikefalconsensor_94B
author = "Florian Roth"
id = "b3173c53-ef34-5722-8f49-dd596733c7fe"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L129-L152"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L129-L152"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "94b87b1cdaf1d86c2bc4eacef45608d0f16fdd3b981b88cdddc16b6bc64fe25d"
hash = "1e42c8cb410a7ed653cfe62bbd8cf191f31a47337fe1ffcc35232d03f2da05ef"
hash = "6a2a0f9c56ee9bf7b62e1d4e1929d13046cd78a93d8c607fe4728cc5b1e8d050"
@@ -222027,8 +222380,8 @@ rule LOLDRIVERS_MAL_Driver_Dwadsafeloadsys_E112
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L154-L174"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L154-L174"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e1123b59a801e243a64270d0c6ab1277e5e3afba9c19023807409f53c1b0204b"
logic_hash = "163d4ccfa2d9d46ef55e9d6fc28f832e390996757322f50c91afca95ce57db4a"
score = 70
@@ -222055,10 +222408,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_008F
author = "Florian Roth"
id = "e3793182-9875-566e-8237-70029c4e9072"
date = "2026-04-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L176-L217"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L176-L217"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "008fa89822b7a1f91e5843169083202ea580f7b06eb6d5cae091ba844d035f25"
hash = "02ebf848fa618eba27065db366b15ee6629d98f551d20612ac38b9f655f37715"
hash = "21617210249d2a35016e8ca6bd7a1edda25a12702a2294d56010ee8148637f5a"
@@ -222107,10 +222460,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_06DD
author = "Florian Roth"
id = "df9d437b-b65c-54ac-a4f1-515bc9cc1f5a"
date = "2026-04-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L219-L251"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L219-L251"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "06ddf49ac8e06e6b83fccba1141c90ea01b65b7db592c54ffe8aa6d30a75c0b8"
hash = "07759750fbb93c77b5c3957c642a9498fcff3946a5c69317db8d6be24098a4a0"
hash = "087270d57f1626f29ba9c25750ca19838a869b73a1f71af50bdf37d6ff776212"
@@ -222150,10 +222503,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_0740
author = "Florian Roth"
id = "d112acd2-b22a-503a-b30f-a47f24cd88fc"
date = "2026-04-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L253-L286"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L253-L286"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0740359baef32cbb0b14a9d1bd3499ea2e770ff9b1c85898cfac8fd9aca4fa39"
hash = "0f7bfa10075bf5c193345866333d415509433dbfe5a7d45664b88d72216ff7c3"
hash = "29348ebe12d872c5f40e316a0043f7e5babe583374487345a79bad0ba93fbdfe"
@@ -222194,10 +222547,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_07BE
author = "Florian Roth"
id = "d0393b38-9f92-5a9a-ab48-2f73a9420f84"
date = "2026-04-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L288-L322"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L288-L322"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "07beac65e28ee124f1da354293a3d6ad7250ed1ce29b8342acfd22252548a5af"
hash = "1d23ab46ad547e7eef409b40756aae9246fbdf545d13946f770643f19c715e80"
hash = "200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a"
@@ -222239,10 +222592,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_082A
author = "Florian Roth"
id = "bfb3b8e6-a13d-5fcc-a8e9-d0e012577c82"
date = "2026-04-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L324-L382"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L324-L382"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "082a79311da64b6adc3655e79aa090a9262acaac3b917a363b9571f520a17f6a"
hash = "083f821d90e607ed93221e71d4742673e74f573d0755a96ad17d1403f65a2254"
hash = "0f98492c92e35042b09032e3d9aedc357e4df94fc840217fa1091046f9248a06"
@@ -222308,10 +222661,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_0AAB
author = "Florian Roth"
id = "656f610e-4358-5c37-a940-32b041767b90"
date = "2026-04-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L384-L433"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L384-L433"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0aab2deae90717a8876d46d257401d265cf90a5db4c57706e4003c19eee33550"
hash = "14b89298134696f2fd1b1df0961d36fa6354721ea92498a349dc421e79447925"
hash = "15cf366f7b3ee526db7ce2b5253ffebcbfaa4f33a82b459237c049f854a97c0c"
@@ -222368,10 +222721,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_0F58
author = "Florian Roth"
id = "0531a88d-cb21-5055-b365-a80b6e99a6e9"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L435-L467"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L435-L467"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0f58e09651d48d2b1bcec7b9f7bb85a2d1a7b65f7a51db281fe0c4f058a48597"
hash = "087270d57f1626f29ba9c25750ca19838a869b73a1f71af50bdf37d6ff776212"
hash = "0d676baac43d9e2d05b577d5e0c516fba250391ab0cb11232a4b17fd97a51e35"
@@ -222411,10 +222764,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_14B8
author = "Florian Roth"
id = "a9965f8f-4969-52ae-953f-a06d8fabe951"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L469-L518"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L469-L518"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "14b89298134696f2fd1b1df0961d36fa6354721ea92498a349dc421e79447925"
hash = "36c65aeb255c06898ffe32e301030e0b74c8bca6fe7be593584b8fdaacd4e475"
hash = "673bbc7fa4154f7d99af333014e888599c27ead02710f7bc7199184b30b38653"
@@ -222471,10 +222824,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_28F5
author = "Florian Roth"
id = "233f1c4a-de22-5e72-bec4-dbe76ba2cda9"
date = "2026-04-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L520-L541"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L520-L541"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "28f5aa194a384680a08c0467e94a8fc40f8b0f3f2ac5deb42e0f51a80d27b553"
hash = "2fd43a749b5040ebfafd7cdbd088e27ef44341d121f313515ebde460bf3aaa21"
hash = "7824931e55249a501074a258b4f65cd66157ee35672ba17d1c0209f5b0384a28"
@@ -222503,10 +222856,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_2FD4
author = "Florian Roth"
id = "e77f1fc7-4700-5afe-908f-b0d206757365"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L543-L564"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L543-L564"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2fd43a749b5040ebfafd7cdbd088e27ef44341d121f313515ebde460bf3aaa21"
hash = "7824931e55249a501074a258b4f65cd66157ee35672ba17d1c0209f5b0384a28"
hash = "28f5aa194a384680a08c0467e94a8fc40f8b0f3f2ac5deb42e0f51a80d27b553"
@@ -222537,8 +222890,8 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_30E0
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L566-L587"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L566-L587"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "30e083cd7616b1b969a92fd18cf03097735596cce7fcf3254b2ca344e526acc2"
hash = "a906251667a103a484a6888dca3e9c8c81f513b8f037b98dfc11440802b0d640"
logic_hash = "0c302fd9d99a5d2fc73b34910a51c9bc064b2ad3143b6da4b8524c50f541c569"
@@ -222566,10 +222919,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_41AD
author = "Florian Roth"
id = "8a8887dd-0f3d-5ab4-a945-b47966789b99"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L589-L623"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L589-L623"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "41ad660820c41fc8b1860b13dc1fea8bc8cb2faceb36ed3e29d40d28079d2b1f"
hash = "a7a665a695ec3c0f862a0d762ad55aff6ce6014359647e7c7f7e3c4dc3be81b7"
hash = "9a42fa1870472c38a56c0a70f62e57a3cdc0f5bc142f3a400d897b85d65800ac"
@@ -222611,10 +222964,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_7662
author = "Florian Roth"
id = "2bb58484-03d2-5ccc-b165-cfe405f60f03"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L625-L666"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L625-L666"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7662187c236003308a7951c2f49c0768636c492f8935292d02f69e59b01d236d"
hash = "a85d3fd59bb492a290552e5124bfe3f9e26a3086d69d42ccc44737b5a66673ec"
hash = "60ee78a2b070c830fabb54c6bde0d095dff8fad7f72aa719758b3c41c72c2aa9"
@@ -222663,10 +223016,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_AAF0
author = "Florian Roth"
id = "57e5655e-1313-585f-931c-d892e8952d0e"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L668-L726"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L668-L726"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "aaf04d89fd15bc61265e545f8e1da80e20f59f90058ed343c62ee24358e3af9e"
hash = "4b97d63ebdeda6941bb8cef5e94741c6cca75237ca830561f2262034805f0919"
hash = "c42c1e5c3c04163bf61c3b86b04a5ec7d302af7e254990cef359ac80474299da"
@@ -222732,10 +223085,10 @@ rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_DDF4
author = "Florian Roth"
id = "0b38be06-60df-5b49-a748-eb175e1db33f"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L728-L761"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L728-L761"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ddf427ce55b36db522f638ba38e34cd7b96a04cb3c47849b91e7554bfd09a69a"
hash = "bcb774b6f6ff504d2db58096601bc5cb419c169bfbeaa3af852417e87d9b2aa0"
hash = "af4f42197f5ce2d11993434725c81ecb6f54025110dedf56be8ffc0e775d9895"
@@ -222778,8 +223131,8 @@ rule LOLDRIVERS_MAL_Driver_Gmer_Gmersys_Gmer_0052
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L763-L784"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L763-L784"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0052aa88e42055a2eed5ddd17c3499c692360155e5e031a211edfcef577acce3"
hash = "18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7"
logic_hash = "8b7692316b92194c57edb7cfa44a69441e9541414a59364cbeb87f070fa97e32"
@@ -222809,8 +223162,8 @@ rule LOLDRIVERS_MAL_Driver_Legalcorp_Pciexpressvideocapture_FD22
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L786-L805"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L786-L805"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8"
logic_hash = "46ff8b6469cbd4f4db4965f08a5df1a79d6c3f21d92d2b390df82e5807738798"
score = 70
@@ -222829,6 +223182,36 @@ rule LOLDRIVERS_MAL_Driver_Legalcorp_Pciexpressvideocapture_FD22
condition:
all of them
}
+rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ampgsys_Microsoftwindowsoperatingsystem_CACA
+{
+ meta:
+ description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ampg.sys. Investigate matches in context: expected filenames or standard vendor/system driver locations can be lower priority, while unexpected filenames or paths are more suspicious."
+ author = "Florian Roth"
+ id = "9c8ca76c-117c-5f80-8179-abd1ffa84ba9"
+ date = "2026-09-08"
+ modified = "2026-09-08"
+ reference = "https://github.com/magicsword-io/LOLDrivers"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L807-L826"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
+ hash = "cacaf0698c6371f8cc45fae85a13fb738f0b8ce0db716c5e4d0d12152de163e3"
+ logic_hash = "bf38019a154863d70321b8aa1380551bd96a42a5f0141d163543d4f16b66ea22"
+ score = 70
+ quality = 80
+ tags = ""
+
+ strings:
+ $ = { 460069006c0065004400650073006300720069007000740069006f006e00[1-8]53004400200043007200610073006800640075006d007000200050006f00720074002000440072006900760065007200 }
+ $ = { 43006f006d00700061006e0079004e0061006d006500[1-8]4d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e00 }
+ $ = { 460069006c006500560065007200730069006f006e00[1-8]310030002e0030002e00320036003100300030002e00340032003000320020002800570069006e004200750069006c0064002e003100360030003100300031002e0030003800300030002900 }
+ $ = { 500072006f006400750063007400560065007200730069006f006e00[1-8]310030002e0030002e00320036003100300030002e003400320030003200 }
+ $ = { 49006e007400650072006e0061006c004e0061006d006500[1-8]61006d00700067002e00730079007300 }
+ $ = { 500072006f0064007500630074004e0061006d006500[1-8]4d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d00 }
+ $ = { 4f0072006900670069006e0061006c00460069006c0065006e0061006d006500[1-8]61006d00700067002e00730079007300 }
+ $ = { 4c006500670061006c0043006f007000790072006900670068007400[1-8]a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e00 }
+
+ condition:
+ all of them
+}
rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ndislansys_Microsoftwindowsoperatingsystem_B0EB
{
meta:
@@ -222838,8 +223221,8 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ndislansys_Microsoftwindowsopera
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L807-L827"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L828-L848"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427"
logic_hash = "4032161d51e52d628e614970992fbae4f2294a8b2779160812233ccaef94e7f7"
score = 70
@@ -222866,10 +223249,10 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ntbiosys_Microsoftrwindowsrntope
author = "Florian Roth"
id = "cbf1f033-3c26-5aac-841e-881d0061b647"
date = "2026-04-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L829-L849"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L850-L870"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc"
hash = "c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c"
logic_hash = "139d8b63b53e2c6db2ceb2f0509599c23b854c2b4c02e37cc226ed36589ed5e9"
@@ -222897,10 +223280,10 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ntbiosys_Microsoftrwindowsrntope
author = "Florian Roth"
id = "f16b4b22-985a-5d39-ae51-709aa9a69d8d"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L851-L871"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L872-L892"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c"
hash = "96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc"
logic_hash = "74ad0b57644d82a77bc902786250156f5e3700671bdf9765055b5908dc345a67"
@@ -222930,8 +223313,8 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Srvnetsys_Microsoftwindowsoperat
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L873-L893"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L894-L914"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d"
logic_hash = "af5fe5f0852f2e654996aea7dccec8428dc8e9720797fc91d4243a0f480a0dc8"
score = 70
@@ -222958,10 +223341,10 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperati
author = "Florian Roth"
id = "34ade986-126e-5864-81ad-1e7588c95930"
date = "2026-04-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L895-L917"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L916-L938"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4"
hash = "8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce"
hash = "b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3"
@@ -222993,8 +223376,8 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperati
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L919-L939"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L940-L960"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f"
logic_hash = "bc1f89fd51c08995cdcf3090db6d3de1f96abc7193e6a71ac7d758f9c68f0def"
score = 70
@@ -223023,8 +223406,8 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperati
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L941-L961"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L962-L982"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1"
logic_hash = "5f24b13eb3f9a5c863e43fe39ff1bc6e6bb67928aa62b7179d315836a0421952"
score = 70
@@ -223051,10 +223434,10 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperati
author = "Florian Roth"
id = "5f883209-6887-5cb4-96bb-988898d47c09"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L963-L985"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L984-L1006"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e"
hash = "b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3"
hash = "8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce"
@@ -223084,10 +223467,10 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperat
author = "Florian Roth"
id = "b73da459-5c4d-5331-84da-2eabb9e0b478"
date = "2026-04-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L987-L1022"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1008-L1043"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f"
hash = "139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988"
hash = "32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d"
@@ -223130,10 +223513,10 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperat
author = "Florian Roth"
id = "05060e37-3c01-5b86-a3ee-6e141399164a"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1024-L1059"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1045-L1080"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77"
hash = "5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d"
hash = "ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620"
@@ -223176,10 +223559,10 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wintapixsys_Microsoftwindowsoper
author = "Florian Roth"
id = "de5ced23-fbe6-54cc-ba14-85d33a1738cf"
date = "2026-04-28"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1061-L1081"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1082-L1102"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e"
hash = "8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330"
logic_hash = "e60ece0c0d46a41696efb8bd55931e8f6368237fcd782d891fa84384fff2c7ce"
@@ -223207,10 +223590,10 @@ rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wintapixsys_Microsoftwindowsoper
author = "Florian Roth"
id = "0bb182e8-e64b-5b01-9ca5-105212ebeb51"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1083-L1103"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1104-L1124"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330"
hash = "1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e"
logic_hash = "dd85f0dc471425fe692e5a51580a97facdaea45505c48b5e01dd6dbc975f2ffe"
@@ -223240,8 +223623,8 @@ rule LOLDRIVERS_MAL_Driver_Mimidrv_Mimidrvmimikatz_2FAF
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1105-L1122"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1126-L1143"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2faf95a3405578d0e613c8d88d534aa7233da0a6217ce8475890140ab8fb33c8"
logic_hash = "4495d60de69a9e2928c8c8512ebadbd8bd9671c4848c756b1b2be7095000161b"
score = 70
@@ -223265,10 +223648,10 @@ rule LOLDRIVERS_MAL_Driver_Paloaltonetworksinc_Tdevfltsys_Cortexxdradvancedendpo
author = "Florian Roth"
id = "32233331-2e87-52f3-874a-93fe8747efaa"
date = "2026-07-10"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1124-L1143"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1145-L1164"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8284c8676cc22c4b2e66826ac16986da7ddecba1f2776b16771be17bfdc45dc2"
logic_hash = "46da747e7362e38544ec0e107a02614155b3c235d02add7846a3ffc7537418b5"
score = 70
@@ -223295,10 +223678,10 @@ rule LOLDRIVERS_MAL_Driver_Pinchinstechnologycoltd_Rwtkrlsys_Ransomwareterminato
author = "Florian Roth"
id = "5c1070f6-a282-5cee-b9bc-ea833b766e1f"
date = "2025-09-18"
- modified = "2026-08-28"
+ modified = "2026-09-08"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1145-L1165"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1166-L1186"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "090d409f86430e078694e621ad0bd5e458d32aa727f0eb99bda3961577df8d49"
hash = "04e1f364c0fcebaa1f0833c0595a976d0625ed3390441b4f2d1aedb314bf2497"
logic_hash = "079ccac2c3427b198a0873ee69ab4ce8631a4b35fa3829468883a0acf2852b94"
@@ -223328,8 +223711,8 @@ rule LOLDRIVERS_MAL_Driver_Pinchinstechnologycoltd_Rwtkrlsys_Ransomwareterminato
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1167-L1187"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1188-L1208"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "146b8f4fc91a4915e8f6aa6e0d871f7161a809c46760ef602bab534836142436"
logic_hash = "0e49dff13e48c047366391dd6e7114a093d3cfeb8b27ba0d66b0ce4983a1445e"
score = 70
@@ -223358,8 +223741,8 @@ rule LOLDRIVERS_MAL_Driver_Pinchinstechnologycoltd_Rwtkrlsys_Ransomwareterminato
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1189-L1209"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1210-L1230"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1a74c2bde0c9a76486657ccb9c79ea87c9891a32cdd4aa15c7542f7c9487a539"
logic_hash = "5e3e2880da2a9754d4b944617053b10e6c47b3115f544a82c2505ac6958ec193"
score = 70
@@ -223388,8 +223771,8 @@ rule LOLDRIVERS_MAL_Driver_Pinchinstechnologycoltd_Rwtkrlsys_Ransomwareterminato
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1211-L1231"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1232-L1252"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "930da474a6d1be97b54f2c81e883e14d62897aa58622e5b040e412bd36cee0a7"
logic_hash = "b4d25b7e1a98b006af44acae4dff17c1a401687add8e1554271b06e42a924f74"
score = 70
@@ -223418,8 +223801,8 @@ rule LOLDRIVERS_MAL_Driver_Sensecorp_42B2
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1233-L1250"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1254-L1271"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25"
logic_hash = "efa506290575bbc70909280080fd85a732c733339e7d984753010c0496aec348"
score = 70
@@ -223445,8 +223828,8 @@ rule LOLDRIVERS_MAL_Driver_Sensecorp_7F45
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1252-L1269"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1273-L1290"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6"
logic_hash = "e7fb00da35e8923567e443830650672094b18d8b49d614d138ed36726fee9019"
score = 70
@@ -223472,8 +223855,8 @@ rule LOLDRIVERS_MAL_Driver_Tonecinc_Idmtdisys_Internetdownloadmanager_2C1B
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1271-L1293"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1292-L1314"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2c1b65c2988b337182f1ba57b404793454e30a7fd328d34bc2e79857dc437a4a"
hash = "44ebb0f534e7cdfec06d5234358d219798a313219b214d72aa23afc5a57d7ea9"
hash = "77225a99b2e0e2b4007fb2f5a96d356e13deab45b9ef54c175d5452de8a211a7"
@@ -223504,8 +223887,8 @@ rule LOLDRIVERS_MAL_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwinddkdri
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_mal_drivers.yar#L1295-L1315"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_mal_drivers.yar#L1316-L1336"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "206006a11f233b9ae876952308f6d60d7a75c80b4d530a3e6146a0b4d8cd3e4f"
logic_hash = "228cc65de47535e5b1514db5c9d98c638013c45b65de75c74e4a8f1e2016a167"
score = 70
@@ -223534,8 +223917,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_3F20 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1-L18"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1-L18"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3f20ac5dac9171857fc5791865458fdb6eac4fab837d7eabc42cb0a83cb522fc"
logic_hash = "78d42eb67163a00876ac4ca33999011fd2e6f697cdce15f1d7b578d33c5e6334"
score = 40
@@ -223561,8 +223944,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Acculogicinc_Devmemdr_Integrator_B930 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L20-L39"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L20-L39"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b93020428f6d9ca700ab70a14911c7efcbcb1f9b659054add0dd3e7657511eb3"
logic_hash = "6af0edfc37d1f53231f9ee81e56f151a83716b2083f0146230f1a5799ff73ad9"
score = 40
@@ -223591,8 +223974,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Adlicesoftware_Adlicerootlaser_Adlicerootlaser_8
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L41-L60"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L41-L60"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "85b69f4e518c66b8ba7154ecb1ac1e8791dfe2fdf1e20b7c3a707f59639ac10d"
logic_hash = "32ec5e6f347f98b436a5ecad80e0061e97e892375e8349726677c098a439d5b1"
score = 40
@@ -223621,8 +224004,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Adlicesoftware_Truesight_Truesight_BFBF : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L62-L81"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L62-L81"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "bfbfcb7cae421739163e7630865009d3197f587265e9e5797142d93e1b72b191"
logic_hash = "5fadef45cac6593c7d752728f590208728f208397b6c22bc268b631f115dac89"
score = 40
@@ -223651,8 +224034,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Adlicesoftware_Truesight_Truesight_BFC2 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L83-L103"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L83-L103"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "bfc2ef3b404294fe2fa05a8b71c7f786b58519175b7202a69fe30f45e607ff1c"
logic_hash = "c980d39a2c2a85be67d38b21da210722774994bfaa502e65409ec96ca192345c"
score = 40
@@ -223681,8 +224064,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Adlink_Pxitrigsys_Pxitriggerioforwindowsx_56EC :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L105-L125"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L105-L125"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "56ece6b6b1d2da18458c9d8edc586bd2b9f7c4b092a9745fbed659238b2b3157"
logic_hash = "0ff39399012a8cd11602423be981c91b0392dcc399375aeb12a5e51bde600630"
score = 40
@@ -223711,8 +224094,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Adlinktechnologyinc_Adrmdrvsys_Adlinkresourceman
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L127-L147"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L127-L147"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a1f79a2e1441970bb3e7c838f8c14a8f3d39a46b0ff9648614e922ac475c743d"
logic_hash = "a1d418b8754da221bbb40eb80fb1b07db2625c005212c9f9711ef86a9798ecb7"
score = 40
@@ -223741,8 +224124,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdfieldfusing_1772 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L149-L166"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L149-L166"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "177227f68cc28ee7726381b95f7d2215da35be3750157ebcb7e113201059026c"
logic_hash = "7e7469c8ae96b88258181e15152fa92fa9ac0fb55b4f74244a9f1d0a565220e4"
score = 40
@@ -223769,8 +224152,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdfieldfusing_4E91 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L168-L185"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L168-L185"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4e913a99b38abea038202c95c6bc5d8d866a6e2869101a14a05079235346d9a1"
logic_hash = "726471c007288f0298084b78a6656ae10602888217bcf4382d97862ea46d538f"
score = 40
@@ -223797,8 +224180,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L187-L206"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L187-L206"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4a0d0034f6deabb9369f553d4d9f3a7aa6f87fa8f2292be576d7b42897c686bb"
logic_hash = "735f65da0f7911237964be4dddeddab8a76bdeb138e1fca601ac6ac1d29cbc66"
score = 40
@@ -223827,8 +224210,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L208-L228"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L208-L228"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d"
hash = "a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433"
logic_hash = "5c959c601fdc2e35c19c68fceccccf012661ba9da1bc31143b1e5490d1a4d423"
@@ -223858,8 +224241,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L230-L250"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L230-L250"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880"
logic_hash = "69fd30d5fb25ae78e7abc2870e6ca6faa687151a55264c80365a1f7b5425f3d3"
score = 40
@@ -223888,8 +224271,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L252-L272"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L252-L272"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194"
logic_hash = "623a1367b4e4ec47043da9aa53037774edb8e2f292c33604f88183d17f8493c1"
score = 40
@@ -223918,8 +224301,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L274-L294"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L274-L294"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433"
hash = "7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d"
logic_hash = "46c2abfe24d092b974e0916f7ccf53b71c12f3d438dff3e0ef9ffd1c253b0144"
@@ -223949,8 +224332,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L296-L316"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L296-L316"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a"
logic_hash = "bbeaf5b958b4e2e77a3dcb2df156f6597f1414bd6bb6b609db6ce34d7f16c01e"
score = 40
@@ -223979,8 +224362,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L318-L338"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L318-L338"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f"
logic_hash = "dc4a28fb009ecce62bc89a8649f304e2fd27fc6e85bbe51e9d5c5d4944462d52"
score = 40
@@ -224009,8 +224392,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amd
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L340-L360"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L340-L360"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5"
logic_hash = "ec396ef22c6c59c5dd3607d91ce12b03a4b841961af18878c529523a0e37ec21"
score = 40
@@ -224039,8 +224422,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdrivese
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L362-L382"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L362-L382"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "070ff602cccaaef9e2b094e03983fd7f1bf0c0326612eb76593eabbf1bda9103"
hash = "f4dc11b7922bf2674ca9673638e7fe4e26aceb0ebdc528e6d10c8676e555d7b2"
logic_hash = "c27612e322884411a5250191710753dd70c9ed5dfcdc84775901ac4f6ae7f6f1"
@@ -224070,8 +224453,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdrivese
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L384-L406"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L384-L406"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3c11dec1571253594d64619d8efc8c0212897be84a75a8646c578e665f58bf5d"
hash = "5a0b10a9e662a0b0eeb951ffd2a82cc71d30939a78daebd26b3f58bb24351ac9"
hash = "7a1105548bfc4b0a1b7b891cde0356d39b6633975cbcd0f2e2d8e31b3646d2ca"
@@ -224102,8 +224485,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdrivese
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L408-L428"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L408-L428"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "81d54ebef1716e195955046ffded498a5a7e325bf83e7847893aa3b0b3776d05"
logic_hash = "7e08a367b0c5fefe2ce20e4763b0b88dbcff46201d7d95f2d59fd12cbb7537e8"
score = 40
@@ -224132,8 +224515,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdrivese
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L430-L450"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L430-L450"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f4dc11b7922bf2674ca9673638e7fe4e26aceb0ebdc528e6d10c8676e555d7b2"
hash = "070ff602cccaaef9e2b094e03983fd7f1bf0c0326612eb76593eabbf1bda9103"
logic_hash = "6d49bcb5159d3be15ec42748089baff846ce661446a73d7986deb945e379a45f"
@@ -224163,8 +224546,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Amdicsys_Amdiccontroller
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L452-L471"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L452-L471"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "15e84d040c2756b2d1b6c3f99d5a1079dc8854844d3c24d740fafd8c668e5fb9"
logic_hash = "297d982963c528bf1bdf37c98cd2c8e2826c678ba1f9231de6afb4e65652ecae"
score = 40
@@ -224193,8 +224576,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Amdpowerprofilersys_Amdu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L473-L493"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L473-L493"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05"
logic_hash = "c1e9cc19931214667196952de3867aedca5e71b2eb29b2e2e9b73555ba5a53dd"
score = 40
@@ -224223,8 +224606,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowerdel
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L495-L516"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L495-L516"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0cf84400c09582ee2911a5b1582332c992d1cd29fcf811cb1dc00fcd61757db0"
hash = "f190919f1668652249fa23d8c0455acbde9d344089fde96566239b1a18b91da2"
logic_hash = "c2be31f5b5d275ece28823e8814847e3db7f2c8ceb3664b75b546fc757384910"
@@ -224254,8 +224637,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowerdel
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L518-L538"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L518-L538"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5df689a62003d26df4aefbaed41ec1205abbf3a2e18e1f1d51b97711e8fcdf00"
logic_hash = "bcd5341bf62d2c0a5ac714081fb1bfb528c3b80f3c4117e8cc7b71af1b349a8d"
score = 40
@@ -224284,8 +224667,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowerdel
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L540-L560"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L540-L560"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6945077a6846af3e4e2f6a2f533702f57e993c5b156b6965a552d6a5d63b7402"
logic_hash = "0ec94536488444a147c31855081c7fc670020c077bfd3e28acbfe5a2231ff246"
score = 40
@@ -224314,8 +224697,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Advantechcoltd_Advcare_Advcare_697D : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L562-L581"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L562-L581"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "697d3e6d215d1ed6dc2465334502db92e0ca77ad0b8392c945ac9e0f36509666"
logic_hash = "08faa846aec373aadb0e39eb0605fb54aa6708ca73a7563228430d3dd3ae9a48"
score = 40
@@ -224344,8 +224727,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ahnlabinc_Athpexntsys_Ahnlabsecurityproduct_FA09
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L583-L602"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L583-L602"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "fa0902daefbd9e716faaac8e854144ea0573e2a41192796f3b3138fe7a1d19f1"
logic_hash = "544e8c8c977d1ee420c63d292b4c80fd57035e599e9b68937db98ad571cab8e0"
score = 40
@@ -224374,8 +224757,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_0BD1 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L604-L624"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L604-L624"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0bd1523a68900b80ed1bccb967643525cca55d4ff4622d0128913690e6bb619e"
logic_hash = "9d66b1fe9f291ea2fe70d9b5c4bcbebc6a1babb4ff606fda9b0e23175c6b9aeb"
score = 40
@@ -224404,8 +224787,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_1E94 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L626-L646"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L626-L646"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1e94d4e6d903e98f60c240dc841dcace5f9e8bbb0802e6648a49ab80c23318cb"
logic_hash = "40e291464e75eb7587e0e75593b849ed6933beb4ef28f8c86de908f9aaba3a98"
score = 40
@@ -224434,8 +224817,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_88FB : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L648-L668"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L648-L668"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "88fb0a846f52c3b680c695cd349bf56151a53a75a07b8b0b4fe026ab8aa0a9af"
logic_hash = "8f8272dbc90847d7561c425f4e314a95e76bc1364be2ba43e8dbcd54e2a7d05b"
score = 40
@@ -224464,8 +224847,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_965D : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L670-L690"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L670-L690"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "965d4f981b54669a96c5ab02d09bf0a9850d13862425b8981f1a9271350f28bb"
logic_hash = "bc23e051fdd86a701d8d21130b935dd2f9f71313f9a59bb8cbe9ffbd9689ef8d"
score = 40
@@ -224494,8 +224877,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_AD23 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L692-L712"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L692-L712"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b"
logic_hash = "da8f618d905af35d6a046b13aaf9f6280323649fed8e01bb274984277d8f8b94"
score = 40
@@ -224524,8 +224907,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_F4EE : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L714-L734"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L714-L734"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f4ee803eefdb4eaeedb3024c3516f1f9a202c77f4870d6b74356bbde32b3b560"
logic_hash = "41dd8ca1479faaae34d58868522163ea3c833f9e5fa7a2092d81c668ccb47517"
score = 40
@@ -224554,8 +224937,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Anticheatexpertcom_Acebase_Anticheatexpert_7326
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L736-L755"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L736-L755"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7326aefff9ea3a32286b423a62baebe33b73251348666c1ee569afe62dd60e11"
logic_hash = "e2d5c28a46b8f605cfd40366330c4a6144688f5bc9f1b436d7dc770a2f699199"
score = 40
@@ -224583,8 +224966,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Argotronicegbr_Argusmonitorsys_Argusmonitordrive
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L757-L776"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L757-L776"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "df9b2892498c68805fdc0fabb369f8bcf011e784898cb32fdc5d85f6123f1126"
logic_hash = "0cdbe7352a8bff280d9cd7b84fc8a63836493b1904841594cbc6a88368dcc8d7"
score = 40
@@ -224613,8 +224996,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_119C : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L778-L798"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L778-L798"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280"
logic_hash = "50dec374d5afdc5d973a03182d23dda0422eac69c63c55029c1ccac8372a0c55"
score = 40
@@ -224643,8 +225026,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7196 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L800-L820"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L800-L820"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d"
logic_hash = "d6195db196ce54cb2b049786bad135ea8bc247e018c79e29a2bdd0f321c3bf9f"
score = 40
@@ -224673,8 +225056,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7A20 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L822-L842"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L822-L842"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7a20ca8f9361eb892257b3693095ffeee61457dc4e22d9b119e3a9f3a1507069"
logic_hash = "5cf18de406e0ee7eab0a970f571301ae5fce394e5b6c4ac5feb1bd5b40420353"
score = 40
@@ -224703,8 +225086,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7F37 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L844-L864"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L844-L864"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa"
logic_hash = "11d4ea031412722a44416030630264e3a3ecaa89b2c904a26735526123a70187"
score = 40
@@ -224733,8 +225116,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asmediatechnologyinc_Asmiosys_Asmediapcidriver_E
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L866-L886"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L866-L886"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e4658d93544f69f5cb9aa6d9fec420fecc8750cb57e1e9798da38c139d44f2eb"
logic_hash = "f250309f77bee435a92edf42d0e8fc6de57bdccf8b1976f49c9683f0ba8b705c"
score = 40
@@ -224763,8 +225146,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asmmapsys_42BA : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L888-L905"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L888-L905"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "42baccea0fceb60b79f78098163147a8dd1ded24cb2f0dbb93edc07dab66135c"
hash = "5f76c140118b181427969237e364fd70b14fa36533061fd4d8eb2f4751706739"
logic_hash = "8ad8b64ac8c524d0048d28087f6088721eced82065a7fce4dbd6e8edbb60d48c"
@@ -224791,8 +225174,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Appshopdrvsys_Appshopdrvdriv
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L907-L926"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L907-L926"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cea231333781085538127bdcfbf49ef1d7500c057295fba061e962376e8219e6"
logic_hash = "292ee8cba0a4f51631a0dc819a3e28d0c74e40cb6b3bf12af5ec48b3151adae4"
score = 40
@@ -224821,8 +225204,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrautochkupddrvsys_Asrautoc
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L928-L948"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L928-L948"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4"
logic_hash = "25ead888db22b8d427c707a8046cbcb560e48c3e997854863c0a5d15b7e2ffc9"
score = 40
@@ -224851,8 +225234,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrautochkupddrvsys_Asrautoc
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L950-L970"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L950-L970"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4ae42c1f11a98dee07a0d7199f611699511f1fb95120fabc4c3c349c485467fe"
logic_hash = "0f300716040a3a07dc6d0edf288c6a0efeb6c6e092f70fcf59765710725b8310"
score = 40
@@ -224881,8 +225264,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrcddrvsys_Asrocksetuputili
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L972-L991"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L972-L991"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "04cc7df4077e36199b04afa39204c8f568f7f66f045e73010fb9b7685324442f"
logic_hash = "1b1e7759386701fdeaff1111d0ef2b7ade17f1925f96d80710371fb89a4ad98c"
score = 40
@@ -224911,8 +225294,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrdrvsys_Asrockiodriver_200
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L993-L1022"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L993-L1022"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d"
hash = "3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838"
hash = "4bf974f5d3489638a48ee508b4a8cfa0f0262909778ccdd2e871172b71654d89"
@@ -224951,8 +225334,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrdrvsys_Asrockiodriver_4D0
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1024-L1053"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1024-L1053"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4d03a01257e156a3a018230059052791c3cde556e5cec7a4dd2f55f65c06e146"
hash = "3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838"
hash = "950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9"
@@ -224991,8 +225374,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asus_Asmmapsys_Atkgenericfunctionservice_025E :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1055-L1075"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1055-L1075"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4"
logic_hash = "4947714493d25896e4abfe86a13a664bc175aa7b88c9007bee9c25b4d21e1c4e"
score = 40
@@ -225021,8 +225404,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustek_Driversys_Ectool_1BEB : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1077-L1099"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1077-L1099"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb"
hash = "42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0"
hash = "771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd"
@@ -225054,8 +225437,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustek_Driversys_Ectool_927C : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1101-L1123"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1101-L1123"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a"
hash = "42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0"
hash = "1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb"
@@ -225087,8 +225470,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_01E0 :
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1125-L1148"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1125-L1148"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece"
hash = "0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c"
hash = "1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5"
@@ -225121,8 +225504,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_1A4F :
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1150-L1173"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1150-L1173"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5"
hash = "0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c"
hash = "e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f"
@@ -225155,8 +225538,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_55A1 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1175-L1196"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1175-L1196"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9"
hash = "c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc"
logic_hash = "4990ab0e9d79b13f5e925cf3bc1c02d22faea4c1ea664bcbd83c902d3e3c25e9"
@@ -225186,8 +225569,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_FB6B :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1198-L1218"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1198-L1218"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22"
logic_hash = "5e129269f08463ea032cc66caf72d97e9316f8d02501134b340e7a85b0664fc2"
score = 40
@@ -225216,8 +225599,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Bsdefsys_Supportsstsfssteeatf
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1220-L1242"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1220-L1242"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3"
hash = "3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5"
hash = "36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb"
@@ -225249,8 +225632,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Bsdefsys_Supportsstsfssteeatf
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1244-L1266"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1244-L1266"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be"
hash = "3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5"
hash = "0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3"
@@ -225282,8 +225665,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Bsitfsys_Asusbiosflashdriver_
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1268-L1287"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1268-L1287"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "41f604cfc56b101cafba8d12ee7f30409457deb13684091262571f1a6c1ddd07"
logic_hash = "8b2af78f8c4d819b449d700f16b3a44dc8c6ff0650c8abc6a26ff4a7d12cc7a4"
score = 40
@@ -225312,8 +225695,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Bsitfsys_Asusbiosflashdriver_
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1289-L1308"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1289-L1308"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "602bef923ddbf2ea7967cedf56866b9db10fb43f0e90a9681cd021f1cddc05c9"
logic_hash = "c4ccb87bb1420e3c984325075ebe9aac948fbd57589d2bafab15b0c1db69ba23"
score = 40
@@ -225342,8 +225725,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedrive
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1310-L1331"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1310-L1331"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1fac3fab8ea2137a7e81a26de121187bf72e7d16ffa3e9aec3886e2376d3c718"
hash = "cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb"
hash = "f4c7e94a7c2e49b130671b573a9e4ff4527a777978f371c659c3f97c14d126de"
@@ -225374,8 +225757,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedrive
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1333-L1353"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1333-L1353"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0"
logic_hash = "1fadeeb18ef7e63288614eea5067b404f013e1f22f95543d6e68bf9d505d0969"
score = 40
@@ -225404,8 +225787,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedrive
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1355-L1376"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1355-L1376"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f4c7e94a7c2e49b130671b573a9e4ff4527a777978f371c659c3f97c14d126de"
hash = "cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb"
hash = "1fac3fab8ea2137a7e81a26de121187bf72e7d16ffa3e9aec3886e2376d3c718"
@@ -225436,8 +225819,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Iomapsys_Asuskernelmodedriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1378-L1398"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1378-L1398"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41"
logic_hash = "789278cba8807e23356f454abbc269708095e75d42d1775cd5ee9f8d485edaa2"
score = 40
@@ -225466,8 +225849,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Iomapsys_Asuskernelmodedriver
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1400-L1419"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1400-L1419"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e62d0c1353a3d913497e6016d0f48d7cf9ef99e4026b94ccd873d6c7a9a54565"
logic_hash = "8c26a07825c6841d438204994311253fa63909670dc21273559fdc6927bfacf5"
score = 40
@@ -225496,8 +225879,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Atitechnologiesinc_Atillksys_Atidiagnostics_38BB
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1421-L1445"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1421-L1445"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7"
hash = "5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a"
hash = "6c6c5e35accc37c928d721c800476ccf4c4b5b06a1b0906dc5ff4df71ff50943"
@@ -225531,8 +225914,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Atitechnologiesinc_Atillksys_Atidiagnostics_AD40
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1447-L1471"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1447-L1471"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173"
hash = "6c6c5e35accc37c928d721c800476ccf4c4b5b06a1b0906dc5ff4df71ff50943"
hash = "38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7"
@@ -225566,8 +225949,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Atszio_Atsziodriver_31D8 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1473-L1492"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1473-L1492"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a"
hash = "673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b"
logic_hash = "07b0ebf36031db9e02d22d21e0c96791464d6274ad06f0233f6e0eaa1dd5a23e"
@@ -225596,8 +225979,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Atszio_Atsziodriver_673B : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1494-L1513"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1494-L1513"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b"
hash = "31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a"
logic_hash = "d3f753b1bd9dc99cece28a3da9a87e9d211207204f05f573f01391f2c1a08f07"
@@ -225626,8 +226009,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avaluetechnologyinc_Avalueio_Avalueio_A5A4 : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1515-L1536"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1515-L1536"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a5a4a3c3d3d5a79f3ed703fc56d45011c21f9913001fcbcc43a3f7572cff44ec"
hash = "defde359045213ae6ae278e2a92c5b4a46a74119902364c7957a38138e9c9bbd"
logic_hash = "078bb0fd40d0005f00b51db3c8ca0c7aeb146b0c6cc91c354dbca7947ca0cca6"
@@ -225657,8 +226040,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_1768 : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1538-L1558"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1538-L1558"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca"
logic_hash = "8cf5a881578379893866f7b839e8297d6df69fa9179ba1dcd4ebbfe84ad3480a"
score = 40
@@ -225687,8 +226070,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_36E3 : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1560-L1580"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1560-L1580"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289"
logic_hash = "1b9709397f3c91bea738d5896c05d258f8027c8c6377c7ef46d9743814b4ff08"
score = 40
@@ -225717,8 +226100,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_3B6E : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1582-L1602"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1582-L1602"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b"
logic_hash = "b9c0ca0d7c6ed0f1c22614a691d7431d6e2d50fc6e056fea084a2b4b35f89bda"
score = 40
@@ -225747,8 +226130,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_4B52 : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1604-L1624"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1604-L1624"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1"
logic_hash = "36285d44bc0a205847f221268e2f2e653cc9d72586cf9fa29bff9169b1255a11"
score = 40
@@ -225777,8 +226160,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_7AD0 : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1626-L1646"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1626-L1646"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed"
logic_hash = "ff50464341011b8fd064737e82a1cbf13cd423ee7d66e6e2a9956a5e45eb7487"
score = 40
@@ -225807,8 +226190,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_AD8F : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1648-L1668"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1648-L1668"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833"
logic_hash = "261034b8434f15f33c4ade4233bcac29721a2396f31b343187b8a079860dbc6b"
score = 40
@@ -225837,8 +226220,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_0F17 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1670-L1690"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1670-L1690"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf"
logic_hash = "0fb3821df0c55202f073943fe9db69f66696a8b468cdf9e212f3c5687443a516"
score = 40
@@ -225867,8 +226250,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1273 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1692-L1712"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1692-L1712"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1"
logic_hash = "c3474167be5ccd6bb12715ec98736ab19704e7e23c99dfb43316fe6a67bded4c"
score = 40
@@ -225897,8 +226280,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_14AD :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1714-L1734"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1714-L1734"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8"
logic_hash = "ccd640ccc5fbf8b38bc77c2ecf9c4d03e0e89fa0df94b8670bf372cb023b68a0"
score = 40
@@ -225927,8 +226310,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1A42 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1736-L1756"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1736-L1756"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0"
logic_hash = "6091cf5d691ea3dda126330a3f728d09b93b2ea9d194921b6c8a3b22f509c1c2"
score = 40
@@ -225957,8 +226340,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_2732 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1758-L1778"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1758-L1778"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c"
logic_hash = "1be5c3cc3146991ddb5233b793c94e27fa625ee0ccd07d70c7fc1df94dd188fe"
score = 40
@@ -225987,8 +226370,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_4DA0 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1780-L1800"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1780-L1800"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba"
logic_hash = "47066658b84f59e70d45ca1e24a5c0c1d603777811095743ebe52be2470839cf"
score = 40
@@ -226017,8 +226400,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_6500 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1802-L1822"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1802-L1822"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3"
logic_hash = "de69889de3b86f3f6cf8b49f61b72011550930c535967aae8d7e36ce3bf457b0"
score = 40
@@ -226047,8 +226430,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_86A1 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1824-L1844"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1824-L1844"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882"
logic_hash = "ed339c46892ee8dc825c11ae498a1688a898bfdbea19573554b0401c05dc80ae"
score = 40
@@ -226077,8 +226460,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_A5A5 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1846-L1866"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1846-L1866"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad"
logic_hash = "03be829ccd2afbb997021e1c529fe05816b023463a721832e1025889869dd64a"
score = 40
@@ -226107,8 +226490,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_AAA3 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1868-L1888"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1868-L1888"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c"
logic_hash = "e9884e3ed7c77742f10bb5729197cebf5d908dd676f092825f063bf026f145f8"
score = 40
@@ -226137,8 +226520,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_BE8D :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1890-L1910"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1890-L1910"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2"
logic_hash = "379b92f4a5717cea8d17f6e7e76051d9a64bc60a87c3c8c3df743bc5e93fe435"
score = 40
@@ -226167,8 +226550,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_D5C4 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1912-L1932"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1912-L1932"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9"
logic_hash = "68fc887c49109d876275e4d2b4f95d7e038d3d9bf933b2f69b9601c651a5006e"
score = 40
@@ -226197,8 +226580,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_DCB8 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1934-L1954"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1934-L1954"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258"
logic_hash = "960c58bb3b9a55e65d1fa35c5d96f1dda4d6077577d2de965d4d1be75185f753"
score = 40
@@ -226227,8 +226610,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_EBE2 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1956-L1976"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1956-L1976"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3"
logic_hash = "3d67156c099e55df1e74cd3fb0b8824f0cc135c18787ac215a67ebe92dafbb56"
score = 40
@@ -226257,8 +226640,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswvmmsys_Avastantivirus_3650 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L1978-L1998"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L1978-L1998"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10"
logic_hash = "58000206a2580d29011f6cef0f9857d18feba15f84aaaf0a9cc5fe1aa9995b22"
score = 40
@@ -226287,8 +226670,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_1072 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2000-L2021"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2000-L2021"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1072beb3ff6b191b3df1a339e3a8c87a8dc5eae727f2b993ea51b448e837636a"
hash = "e8eb1c821dbf56bde05c0c49f6d560021628df89c29192058ce68907e7048994"
logic_hash = "c0c2dc1debc9b9958c7f50af78d97c6f0355881545dd92acd6ac73a81a0d8432"
@@ -226318,8 +226701,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_1A45 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2023-L2043"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2023-L2043"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1a450ae0c9258ab0ae64f126f876b5feed63498db729ec61d06ed280e6c46f67"
logic_hash = "467abf76659e1ec218f30eb0030fbac28d1b9f607107887685722d0d7c6716f3"
score = 40
@@ -226348,8 +226731,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_2AD8 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2045-L2065"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2045-L2065"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2ad8c38f6e0ca6c93abe3228c8a5d4299430ce0a2eeb80c914326c75ba8a33f9"
hash = "d0e4d3e1f5d5942aaf2c72631e9490eecc4d295ee78c323d8fe05092e5b788eb"
logic_hash = "d92afd560455481d41bfae408bf4b89d2658113fb5d352c91f260000c37de1b4"
@@ -226379,8 +226762,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_42B3 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2067-L2088"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2067-L2088"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "42b31b850894bf917372ff50fbe1aff3990331e8bd03840d75e29dcc1026c180"
hash = "c0c52425dd90f36d110952c665e5b644bb1092f952942c07bb4da998c9ce6e5b"
logic_hash = "793729361c66b2bbdf656f7cc903d47ef7bfc5dc86aa938397ce6add0d62d9e2"
@@ -226410,8 +226793,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_5E3B : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2090-L2110"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2090-L2110"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5e3bc2d7bc56971457d642458563435c7e5c9c3c7c079ef5abeb6a61fb4d52ea"
logic_hash = "c9f231b060722dc288750fa66cb8ceccba2a72bce1cd2ab757b671a44cc5e992"
score = 40
@@ -226440,8 +226823,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_5FAE : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2112-L2132"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2112-L2132"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5fae7e491b0d919f0b551e15e0942ac7772f2889722684aea32cff369e975879"
logic_hash = "a959ff560745ca0ec24749f963ec3232a8ce98e7dd75a7541d8708ed92a7a47f"
score = 40
@@ -226470,8 +226853,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_7337 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2134-L2155"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2134-L2155"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "733789d0a253e8d80cc3240e365b8d4274e510e36007f6e4b5fd13b07b084c3e"
hash = "d1463b7fec911c10a8c96d84eb7c0f9e95fa488d826647a591a38c0593f812a4"
logic_hash = "86e8e2891e9ddeecb13cdaceae58d4603a61aea6e5097128766c1be7423a39d4"
@@ -226501,8 +226884,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_85FD : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2157-L2177"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2157-L2177"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "85fdd255c5d7add25fd7cd502221387a5e11f02144753890218dd31a8333a1a3"
logic_hash = "d5cf9b6134e94222081bf09f6237265d899d5a21f5699a09f7bd6677782861d0"
score = 40
@@ -226531,8 +226914,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_D0E4 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2179-L2199"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2179-L2199"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d0e4d3e1f5d5942aaf2c72631e9490eecc4d295ee78c323d8fe05092e5b788eb"
hash = "2ad8c38f6e0ca6c93abe3228c8a5d4299430ce0a2eeb80c914326c75ba8a33f9"
logic_hash = "6a29c44686032d2367b1b4b9ef342239b9490e48ba1cc5f862b66f3de6a3f4b2"
@@ -226562,8 +226945,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2201-L2221"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2201-L2221"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917"
logic_hash = "bb2bd5ef41b08d7d19a072a6ecad03072120b142e3d216058ed8d1c9e993fdb3"
score = 40
@@ -226592,8 +226975,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2223-L2243"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2223-L2243"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c"
logic_hash = "00ae3ba530009124430fc9afa4460c73e89025c115b688f7aac7499fe4d729ed"
score = 40
@@ -226622,8 +227005,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2245-L2265"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2245-L2265"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0"
logic_hash = "e058f104fb0d99d2fe54f538a943329afd9aceb7e01c33717d9ee632ac92a9d2"
score = 40
@@ -226652,8 +227035,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2267-L2287"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2267-L2287"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1"
logic_hash = "c551ec6a179146ccabbcdf918d6588dc7dd21eb49d0d2c49b8e459f3c8f6f42d"
score = 40
@@ -226682,8 +227065,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2289-L2309"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2289-L2309"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf"
logic_hash = "292504c513a0de570ffec755db6654438cb9a0de872ade6ee11977902573f7c2"
score = 40
@@ -226712,8 +227095,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2311-L2331"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2311-L2331"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c"
logic_hash = "56961261c72a628270617b62d76b5d9a333016afa79dec029c1d004be3bc8433"
score = 40
@@ -226742,8 +227125,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecurit
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2333-L2353"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2333-L2353"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5"
logic_hash = "dcbfb24a89e227671b9b70b53ca52218cd60aa07f03a4f9ad1ee857193eb6538"
score = 40
@@ -226772,8 +227155,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2355-L2375"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2355-L2375"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d"
logic_hash = "e3fa01688be214b700205f585e050de51f5d3375ad5a6d8eb17fb25c78cd19f2"
score = 40
@@ -226802,8 +227185,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2377-L2397"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2377-L2397"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8"
logic_hash = "e7932b3344c9663fdeb151718589bee6237a43da9eb25c9ae075c340bc0c1fd6"
score = 40
@@ -226832,8 +227215,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2399-L2419"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2399-L2419"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4"
logic_hash = "a6a3a4c7ac5aac568376b9e981b77d826ffa307396e862903854412d216349d8"
score = 40
@@ -226862,8 +227245,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2421-L2441"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2421-L2441"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c"
logic_hash = "f6073d8320242f1360ba4b8393dcb23ca0d9e64e6be971b1f425dbc6faf590db"
score = 40
@@ -226892,8 +227275,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2443-L2463"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2443-L2463"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2"
logic_hash = "972f7a0afcca5223fea2636af46fd4883e95dd5dfd72bd43b3c943ca05ec993e"
score = 40
@@ -226922,8 +227305,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2465-L2485"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2465-L2485"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf"
logic_hash = "7ac9aabdbfabfe6de6a8cf0f4ad236f4b71716d97f9fd9125574d1a0c1a6a37e"
score = 40
@@ -226952,8 +227335,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2487-L2507"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2487-L2507"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d"
logic_hash = "71200a8f692636ac77480772b9a41777f00a5b83fe8660044e91ecf4f256755e"
score = 40
@@ -226982,8 +227365,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2509-L2529"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2509-L2529"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea"
logic_hash = "9a3cfcb5eee3c4f7e3a6993f8caf806929d48ec08938b5ff06bf7d712765c162"
score = 40
@@ -227012,8 +227395,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2531-L2551"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2531-L2551"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9"
logic_hash = "0a3c5dd6cefadf057700d5da227fca3a5daebf02173423a6d5a658d010de1535"
score = 40
@@ -227042,8 +227425,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2553-L2573"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2553-L2573"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7"
logic_hash = "360312878bc0baf4d8768fe82542bca197a0f0cf93e3a301848bd60c48273ed2"
score = 40
@@ -227072,8 +227455,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2575-L2595"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2575-L2595"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1"
logic_hash = "498a22eed622b4a0975dd89c84084015b5687bb05e14558873629c36b37a209f"
score = 40
@@ -227102,8 +227485,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2597-L2617"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2597-L2617"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6"
logic_hash = "1a795af53445110b32e3341579d26cdbda4daf4687e6115d84004bd52c13fbaa"
score = 40
@@ -227132,8 +227515,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecu
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2619-L2639"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2619-L2639"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9"
logic_hash = "37506c489d8a365e329d64831383b7b53480f9c8e1dfc936c52a37a70d79b2b1"
score = 40
@@ -227162,8 +227545,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Baiduinc_Baiduantivirus_Baiduantivirus_3219 : FI
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2641-L2659"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2641-L2659"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "32198295d2a2700b9895fff999c2b233f9befb0bc175815ec4b71ee926b6edfc"
logic_hash = "db98e053fdb253ac04c3ed5657546d5ea2b5413ec257241f959d92abe79d3849"
score = 40
@@ -227191,8 +227574,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Baiduinc_Baiduantivirus_Baiduantivirus_47EC : FI
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2661-L2679"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2661-L2679"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "47ec51b5f0ede1e70bd66f3f0152f9eb536d534565dbb7fcc3a05f542dbe4428"
logic_hash = "5bae2bb7ecb50971facf2ef5269a02762afc4d07f120179deb1e0b0628684a89"
score = 40
@@ -227220,8 +227603,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Baiduinc_Baiduantivirus_Baiduantivirus_D8CE : FI
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2681-L2699"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2681-L2699"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d8ce0a5866178495a66d23c9587822164966111fcd34764011e907951c599711"
logic_hash = "4f561bf97af87ecb8e27275746fdbfacbb6ed5c5a5ffdda922f29251e5fe6bba"
score = 40
@@ -227249,8 +227632,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Baiduinc_Baiduantivirus_Baiduantivirus_F6EE : FI
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2701-L2719"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2701-L2719"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3"
logic_hash = "36e69d00197ad9bc1c8140a26d5a68528458c87110ebfc2cdf60e53b68d640c7"
score = 40
@@ -227278,8 +227661,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Beckhoffautomationgmbh_Tcio_Beckhofftwincat_E0C5
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2721-L2739"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2721-L2739"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e0c58531501d6176ed0f632addca977616b0dab460f32f0a5909d21f828fc63b"
logic_hash = "ab99089a5a55c53e9615fd0e793e6355abff3135e1681f5b19c1cfc71ab0b779"
score = 40
@@ -227307,8 +227690,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Beckhoffautomationgmbhcokg_Tcrouter_Beckhofftwin
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2741-L2759"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2741-L2759"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d89938a469e8e4b429507522b5a52cb6f87c50f559f22f3042921631b768e59a"
logic_hash = "271d41bd2a0b813e622710c60c18af4eebec97ca1f2b8d0facc9c4eaf026f31e"
score = 40
@@ -227336,8 +227719,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Beijinghuorongnetworktechnologycoltd_Nxeng_Huoro
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2761-L2780"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2761-L2780"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "68d698a978b8ea3bf467bdea2d75ef3099826c3a0d4a1ddb95b078f48f0ae7a1"
logic_hash = "09ccd1b798858eddcf13b23456bb0f6f299263b158fda9a5b1cf9be8e13c9f88"
score = 40
@@ -227366,8 +227749,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Beijingrisingnetworksecuritytechnologycoltd_Beij
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2782-L2801"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2782-L2801"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ea8c8f834523886b07d87e85e24f124391d69a738814a0f7c31132b6b712ed65"
logic_hash = "9dcb9a8abd254f2dbb2be2af7d8b268179edaaf536d78a2ca6a0cbea1d7b9744"
score = 40
@@ -227396,8 +227779,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_1D03 : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2803-L2823"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2803-L2823"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8"
logic_hash = "8892078379e3e9c71b10151a40e2b288e1428b7b26d0be6e11c6605934846f72"
score = 40
@@ -227426,8 +227809,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_A8AA : FIL
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2825-L2844"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2825-L2844"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a8aae612727320db096b337a45bf3cd31b5f9702ef6c4747dd2aaa74ff6badb7"
logic_hash = "e8adced017949ddd40fa0bdf891ecb79f126cb4cd38a0de90064d2e06d002581"
score = 40
@@ -227456,8 +227839,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_D205 : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2846-L2866"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2846-L2866"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e"
logic_hash = "4bbdf8a95e68b3c3e43e1b8f116d3e867657f790caa3d225be3f26b035784498"
score = 40
@@ -227486,8 +227869,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriverfle_42E1 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2868-L2890"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2868-L2890"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb"
hash = "55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a"
hash = "f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65"
@@ -227518,8 +227901,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Bsmisys_552F : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2892-L2910"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2892-L2910"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9"
hash = "59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347"
logic_hash = "c9c26b7bbd61f21379faaf595544e804e4125b28a52be1313297694f6f109d9a"
@@ -227547,8 +227930,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Bsmisys_5962 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2912-L2930"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2912-L2930"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347"
hash = "552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9"
logic_hash = "2ddfc5fea50425403654a8c60b372e2416cb0e0424ab26a8812e0b1fb35d399d"
@@ -227576,8 +227959,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Catalystenterprisesinc_Pmadsys_Physicalmemoryacc
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2932-L2951"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2932-L2951"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "37784d01f84aa4d60c8738f7a75dac1bf712941fc08ed9f32f3e89d044d9c71f"
logic_hash = "f55a73e0229e1b233d56e8a072bee8dc2f10a1c5422dccadfa0b1b26a65e9a19"
score = 40
@@ -227606,8 +227989,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Checkpointsoftwaretechnologiesltd_Vsdatantsys_Zo
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2953-L2972"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2953-L2972"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1c43f33573a0815c5edc5e18ba1038afdd11f55a7cd8b08ba59b8f7357117e4c"
logic_hash = "09e7164296a2a9d251fd5e7557c1d3b94593fa3c52fd8c4dfa7cd41e1929580c"
score = 40
@@ -227636,8 +228019,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Chengduwesthouseinteractiveentertainmentltd_Seas
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2974-L2994"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2974-L2994"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "507b07b0dc0e638b65b4a4d11a462b35439c746d42337b9888927bf994176102"
logic_hash = "f152610fe358abfff80203048ddc18d4fe8714acf7bf64395b04c9bf7c738e7e"
score = 40
@@ -227666,8 +228049,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ciscosystemsinc_Immunetutildriversys_Ciscosecure
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L2996-L3015"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L2996-L3015"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2e270063af92a4f37d3f828dbb444c9a6277ea0d15a5b808e66e3b66ca5f5a58"
logic_hash = "7e5995652e43e02d1c8441204cd450a25315d5951dce7b52262e8450c08b2cd6"
score = 40
@@ -227696,8 +228079,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_00D9 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3017-L3037"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3017-L3037"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "00d9781d0823ab49505ef9c877aa6fa674e19ecc8b02c39ee2728f298bc92b03"
logic_hash = "0fa8efee0ac703d2f8144da40d3eab46dac9214089e4fdd72f5136300df9a684"
score = 40
@@ -227726,8 +228109,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_0FC3 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3039-L3060"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3039-L3060"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0fc3bc6e81b04dcaa349f59f04d6c85c55a2fea5db8fa0ba53d3096a040ce5a7"
hash = "40eef1f52c7b81750cee2b74b5d2f4155d4e58bdde5e18ea612ab09ed0864554"
logic_hash = "ff61c321db63717ffcd55cc939e6f0cb36e213babd6fb5dd974823059d5a9e77"
@@ -227757,8 +228140,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_182B : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3062-L3082"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3062-L3082"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "182bbdb9ecd3932e0f0c986b779c2b2b3997a7ca9375caa2ec59b4b08f4e9714"
hash = "bc453d428fc224960fa8cbbaf90c86ce9b4c8c30916ad56e525ab19b6516424e"
logic_hash = "d395aa617d5156787188b85c8852c5c7152ddcf23328653102f3369364e44fc1"
@@ -227788,8 +228171,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_26EC : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3084-L3104"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3084-L3104"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "26ecd3cea139218120a9f168c8c0c3b856e0dd8fb2205c2a4bcb398f5f35d8dd"
hash = "dee384604d2d0018473941acbefe553711ded7344a4932daeffb876fe2fa0233"
logic_hash = "a5d460d17bfe79f9aa7a895e79b91fdf1000289f1e6e9ebe6b6ca5c87d281f29"
@@ -227819,8 +228202,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_31FF : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3106-L3126"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3106-L3126"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "31ffc8218a52c3276bece1e5bac7fcb638dca0bc95c2d385511958abdbe4e4a5"
hash = "8d3347c93dff62eecdde22ccc6ba3ce8c0446874738488527ea76d0645341409"
logic_hash = "8810ab407111f26ad2488a9720a248a065eaac3e1d11ee81a9df2475d2cf9d78"
@@ -227850,8 +228233,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_348D : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3128-L3149"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3128-L3149"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "348dc502ac57d7362c7f222e656c52e630c90bef92217a3bd20e49193b5a69f1"
hash = "c186967cc4f2a0cb853c9796d3ea416d233e48e735f02b1bb013967964e89778"
logic_hash = "ace379168446f7893e44e28ec4a37c1b7badf6c180584ce4ecdfaa0938ec008b"
@@ -227881,8 +228264,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_3913 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3151-L3173"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3151-L3173"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "39134750f909987f6ebb46cf37519bb80707be0ca2017f3735018bac795a3f8d"
hash = "3e758221506628b116e88c14e71be99940894663013df3cf1a9e0b6fb18852b9"
hash = "a34e45e5bbec861e937aefb3cbb7c8818f72df2082029e43264c2b361424cbb1"
@@ -227913,8 +228296,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_47C4 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3175-L3195"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3175-L3195"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "47c490cc83a17ff36a1a92e08d63e76edffba49c9577865315a6c9be6ba80a7d"
hash = "a97b404aae301048e0600693457c3320d33f395e9312938831bc5a0e808f2e67"
logic_hash = "db8f69e6a16e6c9f078ac66c97129a947a24b12414311977a61aee32b8f586de"
@@ -227944,8 +228327,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_6D2C : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3197-L3218"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3197-L3218"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6d2cc7e1d95bb752d79613d0ea287ea48a63fb643dcb88c12b516055da56a11d"
hash = "8047859a7a886bcf4e666494bd03a6be9ce18e20dc72df0e5b418d180efef250"
logic_hash = "7f94cdf155fdd4ae8ab1318519639289fd4acc2574ff6ad2c5ff7422f5120861"
@@ -227975,8 +228358,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_767E : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3220-L3241"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3220-L3241"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "767ef5c831f92d92f2bfc3e6ea7fd76d11999eeea24cb464fd62e73132ed564b"
hash = "d9a73df5ac5c68ef5b37a67e5e649332da0f649c3bb6828f70b65c0a2e7d3a23"
logic_hash = "9914142d26522c557861450a6879a0e0b1414ffc7e474db0391dc125ba9f8c8f"
@@ -228006,8 +228389,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_8D33 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3243-L3263"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3243-L3263"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8d3347c93dff62eecdde22ccc6ba3ce8c0446874738488527ea76d0645341409"
hash = "31ffc8218a52c3276bece1e5bac7fcb638dca0bc95c2d385511958abdbe4e4a5"
logic_hash = "9868c2b401562623484d7bc00700332a754380b25b05cb95f38a8b242e7f59fa"
@@ -228037,8 +228420,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_A97B : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3265-L3285"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3265-L3285"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a97b404aae301048e0600693457c3320d33f395e9312938831bc5a0e808f2e67"
hash = "47c490cc83a17ff36a1a92e08d63e76edffba49c9577865315a6c9be6ba80a7d"
logic_hash = "1b7961c9c0e0812fa68f330f45ba1834a246f3571e9086280b03c155865746e9"
@@ -228068,8 +228451,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_BC45 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3287-L3307"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3287-L3307"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "bc453d428fc224960fa8cbbaf90c86ce9b4c8c30916ad56e525ab19b6516424e"
hash = "182bbdb9ecd3932e0f0c986b779c2b2b3997a7ca9375caa2ec59b4b08f4e9714"
logic_hash = "283d6d71ba7ace25c248949d232d2ce0c86fa87115304b8d6c07e7564e6757a3"
@@ -228099,8 +228482,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_DEE3 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3309-L3329"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3309-L3329"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "dee384604d2d0018473941acbefe553711ded7344a4932daeffb876fe2fa0233"
hash = "26ecd3cea139218120a9f168c8c0c3b856e0dd8fb2205c2a4bcb398f5f35d8dd"
logic_hash = "106ecc5e36dbf66a7660d00bfcce40934528899d60bd2bb7711c56f515119fcc"
@@ -228130,8 +228513,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Dsark_Qihookernelmodedriver_3503 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3331-L3350"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3331-L3350"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "35035495a36f8537e2a5f56031277cd884de557257b40b92bd39454877a264fb"
logic_hash = "1051b638b9f6ed6899dfd6dbc64bee65497a2029e6ee4464b5b21034f4cdbf2b"
score = 40
@@ -228160,8 +228543,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Dsark_Qihookernelmodedriver_8612 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3352-L3371"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3352-L3371"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "86127dbc92e2896319d1c9117b85e6db01ff001f3a85614d5ef9088d181b044a"
logic_hash = "fe26c1d7f4fd8434ca615ec4fb8e8d53e30354dbaf8cf973991f50af54bfca36"
score = 40
@@ -228190,8 +228573,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Dsark_Qihookernelmodedriver_A223 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3373-L3392"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3373-L3392"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a22358cb2fb1aa334272deaa24e2280425f9661862b46331cbdc786138ede8be"
logic_hash = "d52e907804905c378a9461aa5f14778c06d0ef2deee6b438082a6aeee9821eed"
score = 40
@@ -228220,8 +228603,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Dsark_Qihookernelmodedriver_CD3D : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3394-L3413"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3394-L3413"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cd3d1a2e119cbbb41ec0e7d7fb17bac106735d62b33ed3cde10087af1da89403"
logic_hash = "d83e154b6c3a4dffed2b1413c13db55db40d888514ebe152c61657615bf4421c"
score = 40
@@ -228250,8 +228633,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cn_Netmonsys_Netmon_3D76 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3415-L3434"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3415-L3434"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3d769a5f1ad0d32fb4e06478d35401d9788bad1a477b813adbdf4fd93b2c2694"
logic_hash = "e988de59f76eb89f52fa8706816ca03c49a00cadbbfc3cd2a073e8f1345491a8"
score = 40
@@ -228280,8 +228663,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cncryptfoundation_Cncrypt_5F0C : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3436-L3453"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3436-L3453"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5f0cfe8357bb52b45068ddbac053e32bc38e6cb5e086746f5402657b0a5cfb1c"
logic_hash = "be6921e81c1a9112177c75d01ac112b0d2aa53bb01e11b4e695ed945c92fbcc7"
score = 40
@@ -228308,8 +228691,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Compalelectronicinc_011D : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3455-L3471"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3455-L3471"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "011df46e94218cbb2f0b8da13ab3cec397246fdc63436e58b1bf597550a647f6"
logic_hash = "20966fa6956fc0bbda5ecb361913556d64965c330c6c8d944c623fe40ffd8072"
score = 40
@@ -228334,8 +228717,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Compalelectronicinc_Iomanager_Compaliomanagerapp
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3473-L3492"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3473-L3492"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d7833a5d77ab264572458a51226000190857f1b5807c556e23e18c39bb950ca6"
logic_hash = "2d187f293e5c0a210f3c8c25c0ab3a53f4e2591d6e82a43d1edbce6726d84299"
score = 40
@@ -228364,8 +228747,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerz_Computerzsys_Computerzsystemdriver_61F
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3494-L3514"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3494-L3514"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "61f3b1c026d203ce94fab514e3d15090222c0eedc2a768cc2d073ec658671874"
logic_hash = "aa7bdef0ae84d9fe51ce2e93dde2eac3c7f77e6c4dc54ab70d2226627eaa600f"
score = 40
@@ -228394,8 +228777,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_07D0 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3516-L3536"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3516-L3536"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "07d0090c76155318e78a676e2f8af1500c20aaa1e84f047c674d5f990f5a09c8"
hash = "898e07cf276ec2090b3e7ca7c192cc0fa10d6f13d989ef1cb5826ca9ce25b289"
logic_hash = "d0ee229c01a95c9a78770538bf00d28296598a851e09642fd02a9b1cda5a4d47"
@@ -228425,8 +228808,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_3867 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3538-L3559"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3538-L3559"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "386745d23a841e1c768b5bdf052e0c79bb47245f9713ee64e2a63f330697f0c8"
hash = "5aee1bae73d056960b3a2d2e24ea07c44358dc7bc3f8ac58cc015cccc8f8d89c"
logic_hash = "c393b9605a0527d42e87ddce3db14310d6365913625da956a3a4b48341a2f189"
@@ -228456,8 +228839,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_5C80 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3561-L3583"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3561-L3583"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5c80dc051c4b0c62b9284211f71e5567c0c0187e466591eacb93e7dc10e4b9ab"
hash = "d474ea066d416ded9ed8501c285ca6b1c26a1d1c813c8f6bd5523eeb66c5d01e"
hash = "d6801e845d380c809d0da8c7a5d3cd2faa382875ae72f5f7af667a34df25fbf7"
@@ -228489,8 +228872,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_898E : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3585-L3605"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3585-L3605"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "898e07cf276ec2090b3e7ca7c192cc0fa10d6f13d989ef1cb5826ca9ce25b289"
hash = "07d0090c76155318e78a676e2f8af1500c20aaa1e84f047c674d5f990f5a09c8"
logic_hash = "8895375f8ce3efa2fec38f6b42d4401b64d5dbde4c1bd9eead31ecb442f72588"
@@ -228520,8 +228903,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_C586 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3607-L3628"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3607-L3628"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c586befc3fd561fcbf1cf706214ae2adaa43ce9ba760efd548d581f60deafc65"
hash = "dda2a604bb94a274e23f0005f0aa330d45ca1ea25111746fb46fa5ef6d155b1d"
logic_hash = "388207b1e6c161d593b9cc98c1bb226b2cd659f6b67c04f587a676e8831040d2"
@@ -228551,8 +228934,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_E502 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3630-L3652"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3630-L3652"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e502c2736825ea0380dd42effaa48105a201d4146e79de00713b8d3aaa98cd65"
hash = "5c80dc051c4b0c62b9284211f71e5567c0c0187e466591eacb93e7dc10e4b9ab"
hash = "d6801e845d380c809d0da8c7a5d3cd2faa382875ae72f5f7af667a34df25fbf7"
@@ -228584,8 +228967,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Copyright_Advancedmalwareprotection_6F55 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3654-L3673"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3654-L3673"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c"
logic_hash = "bc145972169694e3d9d1fdc15207c2e8585c28a46db67f00fe5e40b5c4f69d2b"
score = 40
@@ -228613,8 +228996,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3675-L3695"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3675-L3695"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b"
hash = "a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d"
logic_hash = "ce2fdb038e7c7fccf85346a8e28927ad6dddfab3817d7577981b7737e4b5e2f5"
@@ -228644,8 +229027,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3697-L3716"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3697-L3716"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "01e024d3c76fb1b71851ab7761afbee23159d6e8cbf7f5f1d5052efca2f7756d"
logic_hash = "5a7b14d8060f2ceb498f8fd9cbd4c7b0210127f77bf643eb7d3dc51db8314b6d"
score = 40
@@ -228674,8 +229057,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3718-L3738"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3718-L3738"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6"
hash = "5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36"
logic_hash = "509a27365deba035228e94cdddd33422bb445b673dc1dc5ef91eeed291215cd4"
@@ -228705,8 +229088,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3740-L3760"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3740-L3760"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36"
hash = "29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6"
logic_hash = "5dc9ec007f318b16034b43248be9807c024780aa58eb714982130656e7f2b6a6"
@@ -228736,8 +229119,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3762-L3782"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3762-L3782"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d"
hash = "000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b"
logic_hash = "881222a52349787251b723640a42b468e4d3f8ee614329de61d7816b00beb9ff"
@@ -228767,8 +229150,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3784-L3804"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3784-L3804"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1"
logic_hash = "f8f88a29890c05676879f4fd677a5b048c3a4a4ab339d6563dbbaad8c27357c5"
score = 40
@@ -228797,8 +229180,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Countertack_Fastdump_Fastdump_9CB9 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3806-L3825"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3806-L3825"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9cb90643674a941bca2ff0823618e4790a737b9bdcfe882b3af6926591b84d80"
logic_hash = "d7911711b2716658ca3ba383080be69f1e6a5b2925f90128ee99e4433a781f9d"
score = 40
@@ -228827,8 +229210,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_019C : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3827-L3860"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3827-L3860"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "019c2955e380dd5867c4b82361a8d8de62346ef91140c95cb311b84448c0fa4f"
hash = "2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22"
hash = "3301b49b813427fa37a719988fe6446c6f4468dfe15aa246bec8d397f62f6486"
@@ -228871,8 +229254,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0484 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3862-L3891"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3862-L3891"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0484defcf1b5afbe573472753dc2395e528608b688e5c7d1d178164e48e7bed7"
hash = "26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43"
hash = "3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf"
@@ -228911,8 +229294,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0D37 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3893-L3931"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3893-L3931"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f"
hash = "11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b"
hash = "19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758"
@@ -228959,8 +229342,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0E85 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3933-L3962"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3933-L3962"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0e8595217f4457757bed0e3cdea25ea70429732b173bba999f02dc85c7e06d02"
hash = "405a99028c99f36ab0f84a1fd810a167b8f0597725e37513d7430617106501f1"
hash = "40da0adf588cbb2841a657239d92f24b111d62b173204b8102dd0e014932fe59"
@@ -228998,8 +229381,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_11A4 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3964-L3991"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3964-L3991"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "11a4b08e70ebc25a1d4c35ed0f8ef576c1424c52b580115b26149bd224ffc768"
hash = "34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3"
hash = "368a9c2b6f12adbe2ba65181fb96f8b0d2241e4eae9f3ce3e20e50c3a3cc9aa1"
@@ -229036,8 +229419,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_1E16 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L3993-L4018"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L3993-L4018"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961"
hash = "2298e838e3c015aedfb83ab18194a2503fe5764a862c294c8b39c550aab2f08e"
hash = "2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486"
@@ -229072,8 +229455,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_2298 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4020-L4045"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4020-L4045"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2298e838e3c015aedfb83ab18194a2503fe5764a862c294c8b39c550aab2f08e"
hash = "2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486"
hash = "69640e9209f8e2ac25416bd3119b5308894b6ce22b5c80cb5d5f98f2f85d42ce"
@@ -229108,8 +229491,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_34BE : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4047-L4074"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4047-L4074"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3"
hash = "5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02"
hash = "368a9c2b6f12adbe2ba65181fb96f8b0d2241e4eae9f3ce3e20e50c3a3cc9aa1"
@@ -229146,8 +229529,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_58CB : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4076-L4096"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4076-L4096"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "58cb5439e34be4ede6d93c463cb0433c99a100a1c06fca777eda751fd72c07bf"
logic_hash = "1371a21f5aedb6de43bf33484a7c0c28e373efbcf5f35130794dfb6f7d9539e4"
score = 40
@@ -229176,8 +229559,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_6C5C : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4098-L4122"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4098-L4122"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6c5c6c350c8dd4ca90a8cca0ed1eeca185ebc67b1100935c8f03eb3032aca388"
hash = "771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c"
hash = "8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2"
@@ -229211,8 +229594,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_7710 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4124-L4148"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4124-L4148"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c"
hash = "8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2"
hash = "6c5c6c350c8dd4ca90a8cca0ed1eeca185ebc67b1100935c8f03eb3032aca388"
@@ -229246,8 +229629,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_8A07 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4150-L4179"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4150-L4179"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8a0702681bc51419fbd336817787a966c7f92cabe09f8e959251069578dfa881"
hash = "26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43"
hash = "65e3548bc09dffd550e79501e3fe0fee268f895908e2bba1aa5620eb9bdac52d"
@@ -229286,8 +229669,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_A397 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4181-L4214"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4181-L4214"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a3975db1127c331ba541fffff0c607a15c45b47aa078e756b402422ef7e81c2c"
hash = "6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63"
hash = "f7e0cca8ad9ea1e34fa1a5e0533a746b2fa0988ba56b01542bc43841e463b686"
@@ -229330,8 +229713,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Creativetechnologyinnovationcoltd_Ctiiosys_Ctiio
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4216-L4236"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4216-L4236"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109"
logic_hash = "af44f6a1b57804f308beafc0c8645fac10c75de1ee29f0ec7e8010286a9bb71b"
score = 40
@@ -229360,8 +229743,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cybelsoft_Driverscloudamdsys_Driverscloudcom_2BC
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4238-L4257"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4238-L4257"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2bc72d11fa0beda25dc1dbc372967db49bd3c3a3903913f0877bff6792724dfe"
logic_hash = "6ac2bb6a476264c3fb3c1fde6eb8c937c14df0b9738288ed5c6293c5b4a564e7"
score = 40
@@ -229390,8 +229773,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Cyreninc_Amp_Cyrenamp_CBB8 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4259-L4279"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4259-L4279"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6"
logic_hash = "8b0b51158f964a0e83b20efc90265f9b0a13d01980f53050b552072a8205884e"
score = 40
@@ -229420,8 +229803,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Databaseharborsoftware_Sysinfodetectorxsys_Sysin
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4281-L4301"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4281-L4301"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "45e5977b8d5baec776eb2e62a84981a8e46f6ce17947c9a76fa1f955dc547271"
logic_hash = "c92e9bfc248716c4734d6fb9b725091152accae71f37165e986973b2ee88d3f2"
score = 40
@@ -229450,8 +229833,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Dell_Dbutil_71FE : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4303-L4320"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4303-L4320"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009"
logic_hash = "61e5a76b8c1dbe8dc194a370a0ee953042c8067cab530fd025aca4014c766e49"
score = 40
@@ -229477,8 +229860,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Dell_Dellinstrumentation_BC26 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4322-L4339"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4322-L4339"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "bc2606740e4648c3732541db929f2e02ea8567520d35de57c671e93c71e632f3"
logic_hash = "1d8ebbbc42bf54c65b313ee26e3157b70a91af34d9b6522ee9b0b1cc64e82efc"
score = 40
@@ -229504,8 +229887,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Dellcomputercorporation_Dddriver_Delldiagsdevice
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4341-L4360"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4341-L4360"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "51562209e16a1c0247d73d7bfc8827ae4a2e57af11350379a8fba1ec44e56e54"
logic_hash = "6defa0914bca8dea7a8672d94dea2f12e3efe2f7c0fc589111f224b61c4763da"
score = 40
@@ -229534,8 +229917,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Dellinc_Dddriveru_Delldiagsuniversaldevicedriver
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4362-L4381"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4362-L4381"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1f46f7a8f414bb1ac9f875799efa4b5f62bd18806c64b17d961007755accb5ab"
logic_hash = "b96ff9f46a8c7a5492744c248a2be45dda0d189f514891c4f467d682171c9cde"
score = 40
@@ -229564,8 +229947,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Dellinc_Wdtkernelsys_Wdtkernelsys_0E27 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4383-L4401"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4383-L4401"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0e27bec347ca0050c455467bd8d774175c503b8aa1af3411e94966f7dc6b28b7"
logic_hash = "f2991d73b9e0d4a7884e401a34eab316ec3d3bfafb86ba28c9fdf30712a32bfc"
score = 40
@@ -229593,8 +229976,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Dellinc_Wdtkernelsys_Wdtkernelsys_8B69 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4403-L4421"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4403-L4421"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8b695b1a430336f49335162d8ca4137c2424640e27ee29511472fea4451462fe"
logic_hash = "ba730cb432113a6f304f63cb74060455f76efab02a613bf4eade59589d5a3713"
score = 40
@@ -229622,8 +230005,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Dfi_Memctl_Memoryaccessdriver_FE93 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4423-L4442"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4423-L4442"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "fe9323ede771de8ff389ba161ad8696cd6cd788dbf7dd382b6b79011544eed73"
logic_hash = "0d12e670bdd57539b2e640aa11aed959013419d553267c3cae1b79a275224941"
score = 40
@@ -229652,8 +230035,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Digitalelectronicscorporation_Ipctypesys_Ipctype
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4444-L4463"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4444-L4463"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8e2acce10d704c8b511c8b6211a2be5d8e4ade91ebcbda2ac10018e4c0ae99fb"
logic_hash = "d941d5d8c7980edb1aeb391c12a88ad495ae2ee02e931715cd17dd14430aab96"
score = 40
@@ -229682,8 +230065,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Dpmemiosys_Directphysicalmemoryandportaccessdriv
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4465-L4483"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4465-L4483"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7cf6881e43337c288b1883fafb234146a450ff94388aee395e05e36202c5afbb"
logic_hash = "ae0d133bf5dc5261bc6726ca183b970cc6d2e0cf05bb333f0119b9e517d25f54"
score = 40
@@ -229711,8 +230094,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_3D23 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4485-L4505"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4485-L4505"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4"
logic_hash = "8b4a0893d06698a517967938a4050f5bea6d99c391b695a5833a0d63c7284f49"
score = 40
@@ -229741,8 +230124,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_DD4A : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4507-L4527"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4507-L4527"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097"
logic_hash = "b492e69eba14a756a03c379d74e5cbd56c8752da805ad1d6a4d2ea1cfa87e4b0"
score = 40
@@ -229771,8 +230154,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytes_Elbycdio_Cdrtools_07AF : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4529-L4549"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4529-L4549"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "07af8c5659ad293214364789df270c0e6d03d90f4f4495da76abc2d534c64d88"
logic_hash = "04708df9052bd0e7aee3765566b3b34409b544a2e3ddf6dfca7c152fe794e7d7"
score = 40
@@ -229801,8 +230184,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytes_Elbycdio_Cdrtools_98EC : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4551-L4571"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4551-L4571"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "98ec7cc994d26699f5d26103a0aeb361128cff3c2c4d624fc99126540e23e97e"
logic_hash = "12548cc8284f54b0b4b1c4a272318e7997d2b3de5ed29bb42075ddfeab2d11a0"
score = 40
@@ -229831,8 +230214,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_033C : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4573-L4593"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4573-L4593"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "033c4634ab1a43bc3247384864f3380401d3b4006a383312193799dded0de4c7"
logic_hash = "bc7f354fc4e93589c9b5ae04c7d3eccd5d15da38ce62540a3fac2ad589c31d79"
score = 40
@@ -229861,8 +230244,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_0DC4 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4595-L4615"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4595-L4615"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0dc4ff96d7e7db696e0391c5a1dda92a0b0aedbf1b0535bf5d62ebeec5b2311c"
logic_hash = "546bdc96a009ec35c4fcace50b9ffdec4c0fccd27dc5a71c9282be2e2a1266b0"
score = 40
@@ -229891,8 +230274,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_1228 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4617-L4637"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4617-L4637"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1228d0b6b4f907384346f64e918cc28021fe1cd7d4e39687bca34a708998261a"
logic_hash = "5b8815e90c7f00702409ccb5a82d543fbd76d288d2cdf2a7cb925a2c70dd011c"
score = 40
@@ -229921,8 +230304,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_16B5 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4639-L4659"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4639-L4659"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "16b591cf5dc1e7282fdb25e45497fe3efc8095cbe31c05f6d97c5221a9a547e1"
logic_hash = "401e59d88bbc83924963767650703e274f62879e8e5ab934cd4d669f7d463137"
score = 40
@@ -229951,8 +230334,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_1F15 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4661-L4681"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4661-L4681"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1f15fd9b81092a98fabcc4ac95e45cec2d9ff3874d2e3faac482f3e86edad441"
logic_hash = "51708206ba92aa25ea5cdb6b0a75f533627037ac6670dfa7fcec17a860ab7477"
score = 40
@@ -229981,8 +230364,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2380 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4683-L4703"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4683-L4703"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4"
logic_hash = "e1ddea956565b20d686acc2ba3aca679d394f175c52b61210f1c58d9508acd66"
score = 40
@@ -230011,8 +230394,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2FBB : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4705-L4725"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4705-L4725"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445"
logic_hash = "92b4c7fef2ea09934a57c005a6b976d8aeee104ae6259cbf8ee3092b4c28dcec"
score = 40
@@ -230041,8 +230424,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_3E85 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4727-L4747"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4727-L4747"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3e85cf32562a47d51827b21ab1e7f8c26c0dbd1cd86272f3cc64caae61a7e5fb"
logic_hash = "95ab728f4be09a8021420c88e0c0e8ab753d9f4d6bb26fa4f8a3bf4b77b1ed96"
score = 40
@@ -230071,8 +230454,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5148 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4749-L4769"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4749-L4769"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "51480eebbbfb684149842c3e19a8ffbd3f71183c017e0c4bc6cf06aacf9c0292"
logic_hash = "0a378ee1e77566bf1996d656c8c9a86c0cae549b396bde00444181ef2f9864cd"
score = 40
@@ -230101,8 +230484,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5CFA : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4771-L4791"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4771-L4791"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185"
logic_hash = "b5ef275a401c0d961c70745d8ff4be421f5d1e9b935547ae1b543fd71306f5c6"
score = 40
@@ -230131,8 +230514,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_7048 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4793-L4815"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4793-L4815"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7048d90ed4c83ad52eb9c677f615627b32815066e34230c3b407ebb01279bae6"
hash = "d80714d87529bb0bc7abcc12d768c43a697fbca59741c38fa0b46900da4db30e"
hash = "fed0fe2489ae807913be33827b3b11359652a127e33b64464cc570c05abd0d17"
@@ -230163,8 +230546,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_7227 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4817-L4839"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4817-L4839"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7227377a47204f8e2ff167eee54b4b3545c0a19e3727f0ec59974e1a904f4a96"
hash = "8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00"
hash = "b11e109f6b3dbc8aa82cd7da0b7ba93d07d9809ee2a4b21ec014f6a676a53027"
@@ -230196,8 +230579,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_7CF7 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4841-L4861"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4841-L4861"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7cf756afcaf2ce4f8fb479fdede152a17eabf4c5c7c329699dab026a4c1d4fd0"
logic_hash = "4a863cb3401e6aaec05ff8fe3ec963856f5090ce69af44f2e6a74a9e1aba6de5"
score = 40
@@ -230226,8 +230609,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8137 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4863-L4883"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4863-L4883"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60"
logic_hash = "4e12ed3c52bfe4ae4798a3b3dc659038594c07403af04b564a6246016fae4ebe"
score = 40
@@ -230256,8 +230639,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_828A : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4885-L4905"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4885-L4905"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "828a18b16418c021b6c4aa8c6d54cef4e815efca0d48b9ff14822f9ccb69dff2"
logic_hash = "cad39fc4ee7a142d1f7ca00018ccdbcd456c29548c2fa86f141348cbf5557b7d"
score = 40
@@ -230286,8 +230669,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_82FB : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4907-L4927"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4907-L4927"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989"
logic_hash = "893969337a657c55323063297b5fb6fdcc153c4964b5cbb5672b8d9ce49cdb9e"
score = 40
@@ -230316,8 +230699,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_83A1 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4929-L4949"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4929-L4949"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "83a1fabf782d5f041132d7c7281525f6610207b38f33ff3c5e44eb9444dd0cbc"
logic_hash = "66c80efc4c2960081a799ba75efd3c8dffa059afd5acb5cbb4a010307a87ecf9"
score = 40
@@ -230346,8 +230729,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8F68 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4951-L4973"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4951-L4973"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00"
hash = "7227377a47204f8e2ff167eee54b4b3545c0a19e3727f0ec59974e1a904f4a96"
hash = "c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9"
@@ -230379,8 +230762,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9679 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4975-L4995"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4975-L4995"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d"
logic_hash = "96d4a2e8d8760e09004f0cd154d98b4043ef26b9599536e6f27e9feac749f6fb"
score = 40
@@ -230409,8 +230792,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9CA5 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L4997-L5017"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L4997-L5017"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9ca586b49135166eea00c6f83329a2d134152e0e9423822a51c13394265b6340"
logic_hash = "dae9463569a741cd99df4ed6a1f839cf619ade6984e6b7822fa020e152cf2409"
score = 40
@@ -230439,8 +230822,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_ADA4 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5019-L5039"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5019-L5039"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47"
logic_hash = "af139f7eb2e58cead2474426c12ce890376892f66489a8aef81f75cf0cc67082"
score = 40
@@ -230469,8 +230852,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_AF16 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5041-L5061"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5041-L5061"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "af16c36480d806adca881e4073dcd41acb20c35ed0b1a8f9bd4331de655036e1"
logic_hash = "50c73a16e5579b478dbd0a30d2ebd250e782387744572a7d761a80077458888d"
score = 40
@@ -230499,8 +230882,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_B9AD : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5063-L5083"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5063-L5083"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b9ad7199c00d477ebbc15f2dcf78a6ba60c2670dad0ef0994cebccb19111f890"
logic_hash = "f919acec0c79b775e47e5fe5387ecce0e7c427731db17b9dde086cba815b351b"
score = 40
@@ -230529,8 +230912,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_EEA5 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5085-L5105"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5085-L5105"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b"
logic_hash = "0cfeb502af0895346ad708806232fa39ba44e92a6811c3dfa9a54a1cd54fbaf9"
score = 40
@@ -230559,8 +230942,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F42E : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5107-L5127"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5107-L5127"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f42eb29f5b2bcb2a70d796fd71fd1b259d5380b216ee672cf46dcdd4604b87ad"
logic_hash = "4f910705e7236bbaf932aa3da08d1d25bdafadabe230fb2770f3054485c6b48e"
score = 40
@@ -230589,8 +230972,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F85E : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5129-L5149"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5129-L5149"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439"
logic_hash = "e17cd05cf53848b60e338d2e0c72a721dcc54b1c17eebf1bf00504793b533ffd"
score = 40
@@ -230619,8 +231002,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Eldoscorporation_Elrawdsksys_Rawdisk_4744 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5151-L5172"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5151-L5172"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6"
hash = "5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a"
logic_hash = "304accbcc70109f94bf8c6b91dc3340a36cab59a3e18fdd6ab95187d7811e8c7"
@@ -230650,8 +231033,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Elitegroupcomputersystems_Ecsiodriversys_Ecsiodr
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5174-L5194"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5174-L5194"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "270547552060c6f4f5b2ebd57a636d5e71d5f8a9d4305c2b0fe5db0aa2f389cc"
logic_hash = "57f44a10f2ca386eae0c9b78683b50e77cd47eb417a57148fdb3cd68b028ebda"
score = 40
@@ -230680,8 +231063,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Entechtaiwan_Pstripsys_Powerstrip_AB01 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5196-L5215"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5196-L5215"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ab01485bb7c8bc1a9c86096eeea6d31d8fad557bf4d44072b46373d2203faa6e"
logic_hash = "f85b336b2df7eb00b22790c64daf3018771eb860997f16811df4570790894c97"
score = 40
@@ -230710,8 +231093,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Entechtaiwan_Seasys_Softenginex_6CB5 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5217-L5237"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5217-L5237"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc"
logic_hash = "f54087e55509ac7293c31760ea869b2ee9cf066c06dd9e018ea371046a517a6b"
score = 40
@@ -230740,8 +231123,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Esafenet_Esafenetprocessctrl_Processctrl_D64E :
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5239-L5258"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5239-L5258"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d64eeb940daffdc8327fb18b160c20e539088cf8407813655f59efa9fdf0022e"
logic_hash = "6268cc0eb5e9e818335c197a28a302a34984f72d2bdd2b4196d844227896d4fe"
score = 40
@@ -230770,8 +231153,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Evgalowleveldriver_33DA : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5260-L5276"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5260-L5276"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "33da2ce240b4559cc6e847d56c5fbeaa3d644ec160841920ea0a098dcee28d0e"
logic_hash = "972a2999ef02e03872fa5dad6d63681d3c1d5096bddc203f5ba7f99d72bb9c2c"
score = 40
@@ -230797,8 +231180,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Evgatechnologyinc_Windowsvistasmartiodevice_Wind
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5278-L5298"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5278-L5298"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3c95ebf3f1a87f67d2861dbd1c85dc26c118610af0c9fbf4180428e653ac3e50"
logic_hash = "69e9f8e0c6e48306d321873c085c8dc42e25cc6151103df0996eb33a83449d37"
score = 40
@@ -230827,8 +231210,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Featureintegrationtechnologyinc_Fintekpciecom_81
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5300-L5320"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5300-L5320"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "81fbc9d02ef9e05602ea9c0804d423043d0ea5a06393c7ece3be03459f76a41d"
hash = "ebf0e56a1941e3a6583aab4a735f1b04d4750228c18666925945ed9d7c9007e1"
logic_hash = "7a2d8fd45c32f40e739e5719f14ce4c7912fc1c1b3f7ab6d645d852b689b4ca7"
@@ -230857,8 +231240,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Filseclabcorporation_Fildds_Filseclabdynamicdefe
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5322-L5342"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5322-L5342"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f8c07b6e2066a5a22a92d9f521ecdeb8c68698c400e4b83e0501b9f340957c22"
logic_hash = "37308672821ab7f9167e1febc06e31993891cc4f0ddf32edae8e874d2ef42f3d"
score = 40
@@ -230887,8 +231270,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Filseclabcorporation_Filnk_Filseclabdynamicdefen
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5344-L5364"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5344-L5364"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ae55a0e93e5ef3948adecf20fa55b0f555dcf40589917a5bfbaa732075f0cc12"
logic_hash = "74a151972597809f4aa1e1df651b595da55f4d31b8c83360dc4ef5693ecede7b"
score = 40
@@ -230917,8 +231300,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Filseclabcorporation_Filwfp_Filseclabfirewall_49
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5366-L5386"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5366-L5386"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "490cfbb540dcd70b7bff4fdd62e7ed7400bbfebaf5083523d49f7184670f7b9a"
logic_hash = "3c919a1aef8822d4dea4cc0b4e9af219ec43be237a9d64076b10dbf3dfd06e0b"
score = 40
@@ -230947,8 +231330,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Fintekcorp_Fintekcorpfintekpcieuart_1794 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5388-L5408"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5388-L5408"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "17942865680bd3d6e6633c90cc4bd692ae0951a8589dbe103c1e293b3067344d"
hash = "32bd0edb9daa60175b1dc054f30e28e8dbfa293a32e6c86bfd06bc046eaa2f9e"
hash = "b1920889466cd5054e3ab6433a618e76c6671c3e806af8b3084c77c0e7648cbe"
@@ -230978,8 +231361,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Fintekcorp_Fintekcorpfintekpcieuart_32BD : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5410-L5430"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5410-L5430"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "32bd0edb9daa60175b1dc054f30e28e8dbfa293a32e6c86bfd06bc046eaa2f9e"
hash = "17942865680bd3d6e6633c90cc4bd692ae0951a8589dbe103c1e293b3067344d"
hash = "b1920889466cd5054e3ab6433a618e76c6671c3e806af8b3084c77c0e7648cbe"
@@ -231009,8 +231392,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Foxconnrcorporation_Foxkedriversys_Foxconnrkerne
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5432-L5451"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5432-L5451"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "eb81e127e7a46c80acdf8a3fc24a350381f24acb06f0fdf9fdcd34ce9b08d084"
logic_hash = "1c24424bc96e775532f74950f9066da9523d4d07214d064d9c1c1327f3dbe012"
score = 40
@@ -231039,8 +231422,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Fujitsulimited_Advdrvsys_Microsoftrwindowsropera
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5453-L5472"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5453-L5472"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162"
logic_hash = "864cb66cec7702eeb0a979e59215e7dafbeb42625d5c6cb3f4956bb2501a4c1a"
score = 40
@@ -231068,8 +231451,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Fujitsulimited_Fjfwupgdsys_Fujitsufirmwareupdate
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5474-L5493"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5474-L5493"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "30ee861d6d34db31ed57273fe1b3e08c30260c46fbca2cc00725d08ffd1013f6"
logic_hash = "db6eedf3cd0d357bb166fd0caf61b0e26db266ec41847d0c078d554a221427f0"
score = 40
@@ -231098,8 +231481,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gamedriver_Gamedriverx_9DDA : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5495-L5513"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5495-L5513"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9ddae47ff968343a8c32a5344060257fdc08e2a7bdb9a227c8b3a584ee3c9f1e"
hash = "b6628d201c2a68d2a3de2a87de7a5acfe21b101a97928e1c8d5c82102d967383"
logic_hash = "c0f0bccc5bf92ca048a7c8d6af3bf1a65e111c732dc4b98254c03e567c4dbfba"
@@ -231127,8 +231510,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Geintelligentplatformsinc_Gedevicedriver_Proficy
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5515-L5535"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5515-L5535"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "51145a3fa8258aac106f65f34159d23c54b48b6d54ec0421748b3939ab6778eb"
hash = "cac5dc7c3da69b682097144f12a816530091d4708ca432a7ce39f6abe6616461"
logic_hash = "11aed679484a29c0cf55d26fc8595e62cf60e48c96ec524dd4be438a975180e2"
@@ -231158,8 +231541,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Geintelligentplatformsinc_Gedevicedriver_Proficy
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5537-L5557"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5537-L5557"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cac5dc7c3da69b682097144f12a816530091d4708ca432a7ce39f6abe6616461"
hash = "51145a3fa8258aac106f65f34159d23c54b48b6d54ec0421748b3939ab6778eb"
logic_hash = "f3c26142b2f18490c79ea7a658397b9c029286a3040bf2159e3fcc76c4bbd788"
@@ -231189,8 +231572,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Generalelectriccompany_Gedevicedriver_Proficymac
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5559-L5580"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5559-L5580"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a369942ce8d4b70ebf664981e12c736ec980dbe5a74585dd826553c4723b1bce"
hash = "ae73dd357e5950face9c956570088f334d18464cd49f00c56420e3d6ff47e8dc"
logic_hash = "423309de0c0cf44bc8b75fb878f0917032dd6fb50ce5632e026fcec9d218b684"
@@ -231220,8 +231603,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Genitlkiwibenjaminxxxxx_Titidrv_Titidrvtiticatz_
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5582-L5602"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5582-L5602"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "208ea38734979aa2c86332eba1ea5269999227077ff110ac0a0d411073165f85"
logic_hash = "3910ef41622c5e11e8b19a5d74d92f468cf84ccca033eb7835503f2b5f25634b"
score = 40
@@ -231250,8 +231633,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystem
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5604-L5624"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5604-L5624"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0abca92512fc98fe6c2e7d0a33935686fc3acbd0a4c68b51f4a70ece828c0664"
logic_hash = "56733e8e47de11c1195e45e0cd996a14418ae166d493520c9acd8637bb2f6ec7"
score = 40
@@ -231280,8 +231663,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystem
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5626-L5646"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5626-L5646"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4b465faf013929edf2f605c8cd1ac7a278ddc9a536c4c34096965e6852cbfb51"
hash = "edbb23e74562e98b849e5d0eefde3af056ec6e272802a04b61bebd12395754e5"
logic_hash = "c0e9444808782f9c1eb7a3d07ffd64411ec1f903ef1e70273e6a9dd4f3e27270"
@@ -231311,8 +231694,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystem
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5648-L5668"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5648-L5668"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e6023b8fd2ce4ad2f3005a53aa160772e43fe58da8e467bd05ab71f3335fb822"
logic_hash = "f9555b5224f37591a1265567a1373b9ac37182347fc0f13bfec3311de4c6dc20"
score = 40
@@ -231341,8 +231724,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystem
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5670-L5690"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5670-L5690"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e6d1ee0455068b74cf537388c874acb335382876aa9d74586efb05d6cc362ae5"
logic_hash = "c536b676ccb2d79d3bcd4f2848c081f440c256800adaa897cfc5a816a93fe80b"
score = 40
@@ -231371,8 +231754,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystem
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5692-L5712"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5692-L5712"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "edbb23e74562e98b849e5d0eefde3af056ec6e272802a04b61bebd12395754e5"
hash = "4b465faf013929edf2f605c8cd1ac7a278ddc9a536c4c34096965e6852cbfb51"
logic_hash = "0a729463c077e67113c7aeb1347b6ff2374fa8e4e5524b05c0a5ed2194b605b6"
@@ -231402,8 +231785,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ggprotectsys_Gg_0AA6 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5714-L5733"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5714-L5733"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0aa69aee93c6be9bc82680a7df99c114591038ae02e6666fc6e42acb09643111"
logic_hash = "aebcb32913609a218f0c87a911ddb663e58591e52edc77ad8a1bdede613042c4"
score = 40
@@ -231432,8 +231815,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gdrv_FF67 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5735-L5755"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5735-L5755"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339"
logic_hash = "cb1dd11bac0aae34063a4ec1999342ee0cabb9ff48864f54ce507c5dbfe79d68"
score = 40
@@ -231462,8 +231845,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftware
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5757-L5778"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5757-L5778"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0"
hash = "0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c"
logic_hash = "8ac0e55293e0c384706a6734f3a62e86ff01c4582c9960e530a8d23e263758ae"
@@ -231493,8 +231876,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftware
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5780-L5800"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5780-L5800"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743"
logic_hash = "149ea9a9a6e8051b741e932b36918d8b04f112d23095dd7e13c15a6ff58a0434"
score = 40
@@ -231523,8 +231906,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftware
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5802-L5822"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5802-L5822"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097"
logic_hash = "a59b95c6b920206465730fbf320e96c243a19ce4b54ab7bffc48dbcb3a1f2698"
score = 40
@@ -231553,8 +231936,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftware
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5824-L5844"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5824-L5844"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0"
logic_hash = "dbb746c7656581ccc84c8981027f134809a3b201a4fbc47e397002a52e1ca327"
score = 40
@@ -231583,8 +231966,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftware
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5846-L5866"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5846-L5866"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2"
logic_hash = "089299c9a212f85af4ef3713d50db83eafe5fd6ba67b31f7ea827a288e8d27fa"
score = 40
@@ -231613,8 +231996,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Groupibltd_Gibepextsys_Groupibthfhuntpoint_912E
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5868-L5887"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5868-L5887"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "912ee11b2ea9d30519f56735e8a4720101bcacd077c6634cf32eb228b2d96e13"
logic_hash = "7270a05b316504342c699fe91f94f79cd4dfa0c5c4dccc4653a31d9b7335edb8"
score = 40
@@ -231643,8 +232026,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Guangzhoushiruielectronics_Windowscputemperature
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5889-L5907"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5889-L5907"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4cea52c32579869d0209f18ced0b9cc9ad8f86cac29e0fb63b3d60eb64801bda"
logic_hash = "ee5ffc7af2b21f986a3ab1eb2e4583611b0721afab087b93ce494c23a6dcad4d"
score = 40
@@ -231672,8 +232055,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Guidancesoftwareinc_Enportvsys_Encasedriver_D42F
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5909-L5928"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5909-L5928"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d42f1b420747b82533e33107c710c45c29ff20aa5da3d1c8498b7bed7f9ebc81"
logic_hash = "3bef3eaabb1d49a3718f323eb02de2c78b3e1cac62f4efc9f01e24ef74c14cb5"
score = 40
@@ -231702,8 +232085,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Hewlettpackard_Cpqsysio_Physicalmemorydriver_402
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5930-L5949"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5930-L5949"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4024b090cebcabaab884c84ec80ffb15622d12632f236383a9b0a470bff9fe33"
logic_hash = "ddea7eaf1e00c52f9b953421dc9e19c4698c3600d89ab1144e868ab07f5f5872"
score = 40
@@ -231732,8 +232115,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutsy
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5951-L5974"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5951-L5974"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "16360ead229b13deb47bc2bef40f282474c9f18c213c636cdfb8cc2495168251"
hash = "7db320e49139f636c8b6d12b6c78b666a62599e9d59587ba87c6b89b0a34b18d"
hash = "945ee05244316ff2f877718cf0625d4eb34e6ec472f403f958f2a700f9092507"
@@ -231766,8 +232149,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutsy
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L5976-L5999"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L5976-L5999"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cfab93885e5129a86d13fd380d010cc8c204429973b776ab1b472d84a767930f"
hash = "945ee05244316ff2f877718cf0625d4eb34e6ec472f403f958f2a700f9092507"
hash = "7db320e49139f636c8b6d12b6c78b666a62599e9d59587ba87c6b89b0a34b18d"
@@ -231800,8 +232183,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutxs
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6001-L6022"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6001-L6022"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d"
hash = "f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af"
hash = "f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b"
@@ -231832,8 +232215,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutxs
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6024-L6045"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6024-L6045"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af"
hash = "f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b"
hash = "2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d"
@@ -231864,8 +232247,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Hilschergesellschaftfrsystemaoutomationmbh_Physm
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6047-L6067"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6047-L6067"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d"
logic_hash = "e824742681257cdad52e30c81f59b9b34a30d2234ef7a6476ae633a1d98f0179"
score = 40
@@ -231894,8 +232277,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Honordevicecoltd_Monprocess_Honor_72D0 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6069-L6088"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6069-L6088"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "72d0b5615b996cbb01b1ca139e627079094f734da48a0435ffd8480a25d0a258"
logic_hash = "fa3ed0df4faa8e3280ab2f286c1df0780450250159e077ebec8d24aafca37358"
score = 40
@@ -231924,8 +232307,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Horizondatasysinc_Shield_Rebootrestorestandard_V
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6090-L6110"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6090-L6110"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b11db76aeab05f29e8f5d51cdfe70898a46fbd50a1245ca1aed39de10aafd401"
hash = "b1547490f3040b1e3668ee195adbf2d312024809915d01a71ed75fae72971a9d"
logic_hash = "c3ef6454e707a11cf8a085584a79961028099e118a8096e96428183460080710"
@@ -231955,8 +232338,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Horizondatasysinc_Shieldasync_Rebootrestorestand
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6112-L6131"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6112-L6131"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "da3315363989b564a1b8b690bddfeb3bd81c1690a3da5813ca0c46a715fe94b0"
logic_hash = "da831236b0007a176d1f47dca991c9d7b4651e51c5969cbe7605898c53c6562d"
score = 40
@@ -231985,8 +232368,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Hpdevelopmentcompany_Etdsuppsys_Hpetdidriverdll_
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6133-L6153"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6133-L6153"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
logic_hash = "5819bedb4148ea9271ea996cc5576cfda95c5a535686cc9a7299badc00b93792"
score = 40
@@ -232015,8 +232398,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_A468 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6155-L6174"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6155-L6174"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9"
logic_hash = "43c6ad1d36a8d43c7c3667e65e4f7ac314b3af19e1c525f3630599115870321a"
score = 40
@@ -232044,8 +232427,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_C505 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6176-L6196"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6176-L6196"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5"
logic_hash = "4a04d312f69c013836e5aefaba7b2ce6865c82a654818554b64fe4a76f40d5bc"
score = 40
@@ -232074,8 +232457,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Htcvive_Viverraudiosys_Vivevirtualaudiodriver_9D
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6198-L6218"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6198-L6218"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9d5e8700a434838eb63a0573178b4291f07a9d96dabfb4ead40253a3cd9edefd"
logic_hash = "be9768457ae79c5b47e157f1895bf2e847caef20acccab0430af7c015335c686"
score = 40
@@ -232104,8 +232487,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Huawei_Hwosec_Huaweimatebook_B179 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6220-L6241"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6220-L6241"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de"
hash = "bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc"
logic_hash = "6f2e03de03bfde59cf60d2e905becd6a516310a603cd280843d1b236f0b793b1"
@@ -232135,8 +232518,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Huaweidevicecoltd_Hwauidoosec_Huaweiaudiodriver_
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6243-L6263"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6243-L6263"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5abe477517f51d81061d2e69a9adebdcda80d36667d0afabe103fda4802d33db"
hash = "90d2e9e994ed8e964845a26dce741ad43b29ff54cf5faa67271d62d4e24acbc8"
logic_hash = "ab4052e8cebd50659b78582ff60ebfe3188095ced073bb6bae6d9ded0f01df5d"
@@ -232166,8 +232549,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Hubeicenturynetworktechnologycoltd_Hardwaremonsy
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6265-L6284"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6265-L6284"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "14807ce592bf8f12da8a338d7ef575ae60c2d513c5c7ecf1f276aef3b2aa627c"
logic_hash = "f5b41be97794dc61b239da0f4095bf178897adee53eb4872c1ff7f1ea61b2a1b"
score = 40
@@ -232196,8 +232579,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Hvmsys_F89D : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6286-L6304"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6286-L6304"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f89d5d95b8a59e6d5e50a49217f83d080e4eaf4bb77b80d8f38cd915640ba124"
logic_hash = "c354bc4979734b885e2036e0840fff7b24bcb8d7f6b3c4a7a75c44b2196e1e36"
score = 40
@@ -232225,8 +232608,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Inferre_Hwdetectngsys_Hwdetectngsys_2F8B : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6306-L6327"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6306-L6327"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2f8b68de1e541093f2d4525a0d02f36d361cd69ee8b1db18e6dd064af3856f4f"
hash = "43136de6b77ef85bc661d401723f38624e93c4408d758bc9f27987f2b4511fee"
hash = "d45600f3015a54fa2c9baa7897edbd821aeea2532e6aadb8065415ed0a23d0c2"
@@ -232257,8 +232640,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Inferre_Hwdetectngsys_Hwdetectngsys_D456 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6329-L6350"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6329-L6350"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d45600f3015a54fa2c9baa7897edbd821aeea2532e6aadb8065415ed0a23d0c2"
hash = "43136de6b77ef85bc661d401723f38624e93c4408d758bc9f27987f2b4511fee"
hash = "2f8b68de1e541093f2d4525a0d02f36d361cd69ee8b1db18e6dd064af3856f4f"
@@ -232289,8 +232672,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Iprt_Virtualboxguestadditions_BBF5 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6352-L6372"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6352-L6372"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "bbf564a02784d53b8006333406807c3539ee4a594585b1f3713325904cb730ec"
logic_hash = "8295b733b8921700ea89e315a0f50c8cc99f943bd834067f2471f7dae0ff7b38"
score = 40
@@ -232319,8 +232702,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxguest_Virtualboxguestadditions_9
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6374-L6394"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6374-L6394"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "983310cdce8397c016bfcfcc9c3a8abbb5c928b235bc3c3ae3a3cc10ef24dfbd"
logic_hash = "ba8bd8869ee909dc0d0ff921a9a39b8faf69399e048037a794e0b492838558d7"
score = 40
@@ -232349,8 +232732,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxguest_Virtualboxguestadditions_D
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6396-L6416"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6396-L6416"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d53f9111a5e6c94b37e3f39c5860897405cb250dd11aa91c3814a98b1759c055"
logic_hash = "099029ecde71d36567073682bdbc0bd4fe74b8a58889f914bec00d00a344d89c"
score = 40
@@ -232379,8 +232762,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxtapsys_Virtualboxhostinterfacene
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6418-L6438"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6418-L6438"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "994f322def98c99aec7ea0036ef5f4b802120458782ae3867d116d55215c56e4"
logic_hash = "d5b6f5e9b2d53c2ac9d3d97e1f697467bc6f7090831214ea5bccadb584d9671a"
score = 40
@@ -232409,8 +232792,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxusbmonsys_Virtualboxusbmonitordr
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6440-L6460"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6440-L6460"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3d055be2671e136c937f361cef905e295ddb6983526341f1d5f80a16b7655b40"
logic_hash = "2b96c9a685caa6207f42f593621fc242aeea3a8aababcea76929818aff9d81b1"
score = 40
@@ -232439,8 +232822,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxusbsys_Virtualboxusbdriver_C509
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6462-L6482"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6462-L6482"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c509935f3812ad9b363754216561e0a529fc2d5b8e86bfa7302b8d149b7d04aa"
logic_hash = "0e9bb1e598adb2d3653d7f2dbf99ecba9e6bfafdf7929cc3187210c28d7f70e6"
score = 40
@@ -232469,8 +232852,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftware_Insydeflash_Insydeflashutilitybit
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6484-L6504"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6484-L6504"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ce0a4430d090ba2f1b46abeaae0cb5fd176ac39a236888fa363bf6f9fd6036d9"
logic_hash = "664d8070c4627d551169d4b29f2cb9b74556699b93937f77c4a5d6b0c2124211"
score = 40
@@ -232499,8 +232882,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftware_Oatool_Oatoolxdriver_E8D2 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6506-L6525"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6506-L6525"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e8d2424037f63aa395085c546aeac0cd7a09567a4e304c509e087d1b3ce199da"
logic_hash = "f7b77766e47f0d56daa9c18e8fa5808ecf1a8d06cc58314052a0ef749347f14a"
score = 40
@@ -232529,8 +232912,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdrive
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6527-L6547"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6527-L6547"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0452a6e8f00bae0b79335c1799a26b2b77d603451f2e6cc3b137ad91996d4dec"
logic_hash = "0546773268013dd780c7147a0432202955f75960e57af6885e6b56db3c0e598a"
score = 40
@@ -232559,8 +232942,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdrive
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6549-L6570"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6549-L6570"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0d30c6c4fa0216d0637b4049142bc275814fd674859373bd4af520ce173a1c75"
hash = "7164aaff86b3b7c588fc7ae7839cc09c5c8c6ae29d1aff5325adaf5bedd7c9f5"
hash = "c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2"
@@ -232591,8 +232974,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdrive
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6572-L6592"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6572-L6592"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "38d6d90d543bf6037023c1b1b14212b4fa07731cbbb44bdb17e8faffc12b22e8"
logic_hash = "32e19be262d687a23d57e99d68f2f8feff545fe868bf58264efc8c2125fd89ce"
score = 40
@@ -232621,8 +233004,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdrive
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6594-L6614"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6594-L6614"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd"
logic_hash = "3a1b9483968a5fc7475554cbe3263d9e00b787d39212f1e23d15f8eea28d14bc"
score = 40
@@ -232651,8 +233034,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdrive
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6616-L6636"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6616-L6636"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b9ae1d53a464bc9bb86782ab6c55e2da8804c80a361139a82a6c8eef30fddd7c"
logic_hash = "14b300ccc9395c718df686020de4b8888bc20c62ffe8b4ef47407a0b23862047"
score = 40
@@ -232681,8 +233064,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdrive
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6638-L6659"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6638-L6659"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2"
hash = "7164aaff86b3b7c588fc7ae7839cc09c5c8c6ae29d1aff5325adaf5bedd7c9f5"
hash = "0d30c6c4fa0216d0637b4049142bc275814fd674859373bd4af520ce173a1c75"
@@ -232713,8 +233096,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorp_Stdcdrvwssys_Selftestdatacollectordriv
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6661-L6681"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6661-L6681"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "70afdc0e11db840d5367afe53c35d9642c1cf616c7832ab283781d085988e505"
logic_hash = "6c4448dc4f9ad54c560787eef5e5847e8d5a4ec230d380e864d4b8d91e4f0440"
score = 40
@@ -232743,8 +233126,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iocdrvsys_Intelrextremetuningut
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6683-L6702"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6683-L6702"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b936c4ba80ccee3b0b3b67fc88c8caa103fcfc47888e976f6d5b6f113d22f41f"
logic_hash = "b06014a7cd9d00d1544c0343eaff0395fa251b8ab4d46a6581cdae5914293c2d"
score = 40
@@ -232773,8 +233156,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_19BF : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6704-L6724"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6704-L6724"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775"
logic_hash = "0a4320ec1af463606714366803e1ba2a064f6a1ec8e3b021fab872224461e544"
score = 40
@@ -232803,8 +233186,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_1F81 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6726-L6746"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6726-L6746"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501"
logic_hash = "c0162698fd83ada7bdc195e8d68065ef452bff0dcec2770e426bd9f7dc050c03"
score = 40
@@ -232833,8 +233216,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_2D2C : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6748-L6768"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6748-L6768"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b"
logic_hash = "7076e9f16219ab3085444056492c883fa4d3cc05a2478f93ea48c66652f66720"
score = 40
@@ -232863,8 +233246,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_37C6 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6770-L6790"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6770-L6790"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9"
logic_hash = "4ccef1c62cb7279958fb09137d8958bd8b9196d309ac329087de4bf98efaeb91"
score = 40
@@ -232893,8 +233276,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4429 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6792-L6813"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6792-L6813"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b"
hash = "a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df"
logic_hash = "8293000c1805cbec9ced43222d2d29891aaca833f87e5cd42717f40b79c7ed39"
@@ -232924,8 +233307,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4D05 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6815-L6842"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6815-L6842"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee"
hash = "57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572"
hash = "77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9"
@@ -232961,8 +233344,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F65 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6844-L6864"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6844-L6864"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0"
logic_hash = "cd8ffe43c865b02feb1f4b2c672f85385fcbed1e22958e6817126ac2e116f0c8"
score = 40
@@ -232991,8 +233374,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F69 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6866-L6886"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6866-L6886"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683"
logic_hash = "cae4c5d337fec7aa21e200a58c4e88b7b6f9d4e32834165d63e01e414d0b29db"
score = 40
@@ -233021,8 +233404,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_7CB4 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6888-L6908"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6888-L6908"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7"
logic_hash = "f5b8fe2cc0780b807f2710473f1d9fddfa0f945beabc2b37bd3a103c87437631"
score = 40
@@ -233051,8 +233434,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_D1F4 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6910-L6930"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6910-L6930"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f"
logic_hash = "ced7ad8821da2f10b42f02a9af03848a0ffb302df83d28e51620f27d37fb4c50"
score = 40
@@ -233081,8 +233464,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_DE35 : FI
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6932-L6952"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6932-L6952"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5"
hash = "f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54"
logic_hash = "1f09e919b9949feb759430dc1ecdd52b545ddf0bf18ed419ecd7e042355be8d6"
@@ -233112,8 +233495,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_F877 : FI
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6954-L6974"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6954-L6974"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54"
hash = "de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5"
logic_hash = "65966a05952fcf57b8d722154fe6dcafba49fffa0494086e1ff2bf76229d0c78"
@@ -233143,8 +233526,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Pmxdrvsys_Intelrmanagementengin
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6976-L6995"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6976-L6995"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b1a8ee1222eea5f199028d90b9b77c2acf46d6d84a9e125403b2888c6f681c72"
logic_hash = "dc689d29adbd6e18da2ceef4bdd475136c875faf280746684d85f374a08a764a"
score = 40
@@ -233173,8 +233556,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Stdcdrvsys_Selftestdatacollecto
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L6997-L7017"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L6997-L7017"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "37022838c4327e2a5805e8479330d8ff6f8cd3495079905e867811906c98ea20"
logic_hash = "b54c393802c9ef9632f0e88a3f10f30cf6c723b1b56d389bbcfa9e17b1d4b87c"
score = 40
@@ -233203,8 +233586,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxc_1183 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7019-L7039"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7019-L7039"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "11832c345e9898c4f74d3bf8f126cf84b4b1a66ad36135e15d103dbf2ac17359"
logic_hash = "a50f3cf5e4d2cb62480ff5bf801ed0fcd8eb85498015fbb2b59c35d1fe1c7704"
score = 40
@@ -233233,8 +233616,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxcdiobmpcicpci_0
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7041-L7062"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7041-L7062"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "05c15a75d183301382a082f6d76bf3ab4c520bf158abca4433d9881134461686"
hash = "4b4ea21da21a1167c00b903c05a4e3af6c514ea3dfe0b5f371f6a06305e1d27f"
logic_hash = "6e59547655fd81806b7407b7afbef8e6f018ec29bf6f0204863148f8a5c27e69"
@@ -233264,8 +233647,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxcdiobmpcicpci_6
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7064-L7085"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7064-L7085"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "63865f04c1150655817ed4c9f56ad9f637d41ebd2965b6127fc7c02757a7800e"
hash = "9c8ed1506b3e35f5eea6ac539e286d46ef76ddbfdfc5406390fd2157c762ce91"
logic_hash = "9dec3f6167777a807a5d311e2aaa90eb021f43b6b49c09980df26e04a629845f"
@@ -233295,8 +233678,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Intigua_Intigua_E9A1 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7087-L7104"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7087-L7104"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e9a1c39600193c7fd546733284a575b2d5192e2fd3ff64ca1a33b00739f8d429"
logic_hash = "f02221ace9f9c3dd5fa5e8d8a3d093fe4e18e1a44cd08ab229a60a3f98d28abd"
score = 40
@@ -233323,8 +233706,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Forcedeletesys_Iobitmalwarefighter_EF4E :
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7106-L7125"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7106-L7125"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ef4e4b88df24825dbf4e7131e71a41002715d38b7a8c0c432aa936c854152ef3"
logic_hash = "d1f17e295cce99da65388956f51d7138d9e08c319589adcfb5ff8443addd32e4"
score = 40
@@ -233353,8 +233736,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Iobitunlockersys_Iobitunlocker_0209 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7127-L7158"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7127-L7158"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0209934453e9ce60b1a5e4b85412e6faf29127987505bfb1185fc9296c578b09"
hash = "2b33df9aff7cb99a782b252e8eb65ca49874a112986a1c49cd9971210597a8ae"
hash = "507724d96a54f3e45c16a065bf38ae82a9b80d07096a461068a701cae0c1cf29"
@@ -233395,8 +233778,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Iobitunlockersys_Iobitunlocker_2B33 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7160-L7191"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7160-L7191"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2b33df9aff7cb99a782b252e8eb65ca49874a112986a1c49cd9971210597a8ae"
hash = "faa9aa7118ecf9bb6594281f6b582f1ced0cc62d5db09a2fbf9b7ce70c532285"
hash = "507724d96a54f3e45c16a065bf38ae82a9b80d07096a461068a701cae0c1cf29"
@@ -233437,8 +233820,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Iobitunlockersys_Iobitunlocker_C79A : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7193-L7213"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7193-L7213"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c79a2bb050af6436b10b58ef04dbc7082df1513cec5934432004eb56fba05e66"
logic_hash = "f9a7916948e21c42591501fc3670dfc299d6a4631d58398735d07c90d9fd29d4"
score = 40
@@ -233467,8 +233850,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Iuforcedeletesys_Uninstaller_30F5 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7215-L7234"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7215-L7234"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "30f5d03e37d22c7dece8bb8240edc8566f2be7fe76d3c7f97eeceb60d889ee06"
logic_hash = "fd56a0df378c4f02cc72928b0ff47081e23cd57e1be55317e8fd5ebd0dab7d9c"
score = 40
@@ -233497,8 +233880,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Monitorsys_Advancedsystemcare_E4A7 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7236-L7256"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7236-L7256"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb"
logic_hash = "e48ae7519ed462ee24c24dfbd21697808c4e9fe5708703a4116aa16243b4fe4b"
score = 40
@@ -233527,8 +233910,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Iobitinformationtechnology_Iobitunlockersys_Unlo
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7258-L7277"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7258-L7277"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2ba404c50684d59b701959a1732617dec6a6a25c8005294c0d2b3822b38479a4"
logic_hash = "871b99e7713ff5e6aa70d3e5e15c8d808939c4be7ac8c3c144d1085f8a43661f"
score = 40
@@ -233557,8 +233940,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Iobitinformationtechnology_Iobitunlockersys_Unlo
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7279-L7299"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7279-L7299"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004"
logic_hash = "f9a912a602b78f20f4af5ec89dd3e9863d3f04b23ccb6242b005a7c5017d1761"
score = 40
@@ -233587,8 +233970,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Isinc_Avenger_Stopzilla_6BC0 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7301-L7321"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7301-L7321"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6bc0e1c104fac4a8caa4237c7ae181ca11a043a3ee26426aeb7a90dc40281fad"
logic_hash = "a055b7b41066370cfeb8c5c1de02fcc7100c07d7afedd92e71ced4df38ff0229"
score = 40
@@ -233617,8 +234000,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Itmsystem_023D : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7323-L7341"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7323-L7341"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "023d722cbbdd04e3db77de7e6e3cfeabcef21ba5b2f04c3f3a33691801dd45eb"
logic_hash = "829de362e783c8ca924e16707676188bde9889887b1590a16e28d46bfab216b4"
score = 40
@@ -233645,8 +234028,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Jiransoftcoltd_Xkpsmsys_Xkeeper_28C5 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7343-L7362"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7343-L7362"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "28c5bb735f9fc38e0ebd366978898f0cfcd455e4ff8bf1a321768b09e01ee84d"
logic_hash = "6e3af37771c5323da49b419af6372f63557eebcd4a79d24288e080ef237537a7"
score = 40
@@ -233675,8 +234058,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Kcomputingpvtltd_Krkscansys_Krkscan_5C6C : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7364-L7383"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7364-L7383"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5c6ce55a85f5d4640bd1485a72d0812bc4f5188ee966c5fe334248a7175d9040"
logic_hash = "0bf8e3a3661aee6d71c36cd36444efbd9890490f9a6d04f2d7bbeb3db4d682e4"
score = 40
@@ -233705,8 +234088,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Kcomputingpvtltd_Krkscansys_Krkscan_B16E : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7385-L7404"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7385-L7404"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b16e217cdca19e00c1b68bdfb28ead53b20adeabd6edcd91542f9fbf48942877"
logic_hash = "114ee3a706bd066eccad2684ea1e914e92b73522f3a55b99071713facdcdd4d5"
score = 40
@@ -233735,8 +234118,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Khwmonsys_Khwmon_103C : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7406-L7422"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7406-L7422"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "103ce48e8491684f383d9851e4710cbb5c739b5c7f332f2d11b88babc2c217b5"
logic_hash = "ab9009d36572f6e82c4c55217d879292b860569a0f509867cd81f6ecb0b2072c"
score = 40
@@ -233762,8 +234145,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Kingsoftcorporation_Ksapisys_Kingsoftantivirusse
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7424-L7443"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7424-L7443"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1cd219f58b249a2e4f86553bdd649c73785093e22c87170798dae90f193240af"
logic_hash = "7e449a1f622f6580fdc973ac34194e3826280a944fb28ace015106af35b57889"
score = 40
@@ -233792,8 +234175,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Kingsoftcorporation_Ksapisys_Kingsoftantivirusse
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7445-L7464"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7445-L7464"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "26ed45461e62d733f33671bfd0724399d866ee7606f3f112c90896ce8355392e"
logic_hash = "6058db1080aa41ca5ab07275cf490716552dc7a7871ff08b34d81a75df79d933"
score = 40
@@ -233822,8 +234205,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Kingsoftcorporation_Ktdifilt_Kingsoftinternetsec
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7466-L7485"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7466-L7485"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "597eff2718073b11da3d4bcade9a03fb4684f9be57d184fce65ac70a2ef07246"
logic_hash = "1acd283636d655de4c0797255108abc509d1ef2853cd1c43ed6a44151d281ebe"
score = 40
@@ -233852,8 +234235,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Kontrontechnologyas_Ktapisys_Ktapisystemdriver_7
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7487-L7506"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7487-L7506"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7ee17efef04bb7c9de90d5210263ed6993f867e5a11f86e65e3bb1362c7de237"
logic_hash = "6d62228422d31c60f73692409122e6feeeef2fe2c84c14876c5f4005b1f01167"
score = 40
@@ -233882,8 +234265,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Kontrontechnologyas_Ktapisys_Ktapisystemdriver_8
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7508-L7528"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7508-L7528"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "89ba754861e11d9db4440b2b5db61fd5bee16752e4623c4271b8fdd0a666c677"
hash = "9ca9432b0d29204cb5420a1a6b01533d4552130c2a8a5ecd7837efadefb4a046"
logic_hash = "b9e208e184937c8d266662ccff04af6626a6b18733efd037d61eba45cb5f6740"
@@ -233913,8 +234296,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lallasoft_Alallsoftwrittendriver_Lallamondriver_
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7530-L7549"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7530-L7549"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d9dc2860ab791755a535786dcc559db186ba19ba99ea75266844f249a1e138a0"
logic_hash = "ce8223b8053e1755316c2e37513fa96b234ee2991fbfe167add7716e820e1d8c"
score = 40
@@ -233943,8 +234326,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lecocorporation_Lecomaxsys_0F2D : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7551-L7569"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7551-L7569"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0f2dff4116a84241d8cafe534b63454fb4ea26272da8977be03670701ec6631c"
logic_hash = "bf1481b40afe6797d1f3b7920d1f8407447e42abd1841707f63b1d1e09a908ab"
score = 40
@@ -233972,8 +234355,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lenovo_Bootrepairsys_Bootrepair_5AB3 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7571-L7590"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7571-L7590"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946"
logic_hash = "691ff53d939f72eb1b21233108ffb2ce27b0c9f5cd10e77d9810fa49f6a4750f"
score = 40
@@ -234002,8 +234385,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lenovo_Lnvmsriosys_Lenovofilterdriver_245B : FIL
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7592-L7611"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7592-L7611"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "245b6ab442a7d53dc30ece28e1c6de727c019669385877cbe929b81aa1a2ad2f"
logic_hash = "e22ec9bd7b670a6280676c58dcf962632cd7f13f90018d6b48e604c56fe168c2"
score = 40
@@ -234032,8 +234415,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lenovo_Lnvmsriosys_Lenovofilterdriver_7023 : FIL
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7613-L7632"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7613-L7632"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7023f08c9f99076a5fb82a0f661847e2951800f095fca1793a0e6bd9c949b478"
logic_hash = "a801b8ab5d83d88666faae17a46d6767a47e673a011f9c6c610a3abd2783da7e"
score = 40
@@ -234062,8 +234445,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lenovo_Srswdrvsys_Srsetupwin_5741 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7634-L7653"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7634-L7653"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "57414e532a7a10ae7af7fa6294d1d95ad4d9d506882258c5e59d53b4e4f2c91a"
logic_hash = "f37094a0d985e950dafa7632aea764c1498f65f85ac985b3a68cd7f7d865ddd9"
score = 40
@@ -234092,8 +234475,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lenovogrouplimitedr_Lenovodiagnosticsdriversys_L
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7655-L7675"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7655-L7675"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe"
logic_hash = "16a4925c80367389324e91cc1b17803b9fd44c041ff0b8bb0f956dc07e1b2702"
score = 40
@@ -234122,8 +234505,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lgelectronicsinc_Lhasys_Microsoftwindowsoperatin
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7677-L7698"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7677-L7698"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade"
hash = "e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf"
logic_hash = "e834087d8dd9dfa7f0245e7e976f6bac39cc29dcba11bbb71937399707e4bacb"
@@ -234153,8 +234536,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lgelectronicsinc_Xlhasys_Microsoftwindowsoperati
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7700-L7719"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7700-L7719"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "11c9cbc39b6e028f2e8f9e7f83b47ae83ca73961ecfebb2f7213f9478f5446d5"
logic_hash = "e3efb2df118e06f8d2d129342418024c543bd03bf289f7784c06a4dff00e8c1e"
score = 40
@@ -234183,8 +234566,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Licensedforsysinfolab_Astrasys_Astragenericdevic
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7721-L7740"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7721-L7740"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4a8b6b462c4271af4a32cf8705fa64913bfcdaefb6cf02d1e722c611d428cb16"
logic_hash = "b2ec13deca87b585b8a41ae2e68a08b28bd01868290b86c8efb4856b4154efc4"
score = 40
@@ -234213,8 +234596,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Logitech_Lgcoretempsys_Lgcoretemp_E0CB : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7742-L7762"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7742-L7762"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e0cb07a0624ddfacaa882af49e3783ae02c9fbd0ab232541a05a95b4a8abd8ef"
logic_hash = "40ddc7fb9211417bef5e84b6e9a85eec94af147326bfedf525b1436646260584"
score = 40
@@ -234243,8 +234626,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Logitechinc_Lvavsys_Logitechwebcamsoftware_E86C
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7764-L7784"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7764-L7784"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4"
logic_hash = "82cf7219c4be395f7a72fb7f41eaefe8d68c874e8caf8f4827bf7825f2414ab7"
score = 40
@@ -234273,8 +234656,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Logmeininc_Lmiinfosys_Logmein_453B : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7786-L7806"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7786-L7806"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233"
logic_hash = "2072faed236cf96e54e3775b698aecce7b517c41e28755ddf4394da286712e51"
score = 40
@@ -234303,8 +234686,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lowleveldriver_16F8 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7808-L7825"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7808-L7825"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0"
logic_hash = "fd98c9ddc239c7905f28e480fc12226b636611192d831e83730bce990047e537"
score = 40
@@ -234330,8 +234713,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lowleveldriver_69FB : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7827-L7843"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7827-L7843"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "69fb21e4c8dbfcab838d53d98ec7357d35e30cbbe5fde9e26457d79242ddd78e"
logic_hash = "e937b19f38eb98b3c05d9662f224fc620c151b2f49dd35b37a13e1cdb22b3ed3"
score = 40
@@ -234357,8 +234740,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lowleveldriver_9AF0 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7845-L7861"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7845-L7861"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9af0b89c5c54eb66e5a660b61aee7c1a25b1c92e20a310d8b16552abcf90c0b5"
logic_hash = "dd760de32a7a553d06f6f6fee609f71f795e6f830c7b0740a3202b5370d79155"
score = 40
@@ -234384,8 +234767,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Lowleveldriver_F941 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7863-L7880"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7863-L7880"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f9418b5e90a235339a4a1a889490faca39cd117a51ba4446daa1011da06c7ecd"
logic_hash = "76808eb07b0752cf46590bbb34eb39fee6dcd55f94dd98c584a56d772a864177"
score = 40
@@ -234411,8 +234794,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_0368 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7882-L7903"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7882-L7903"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "03680068ec41bbe725e1ed2042b63b82391f792e8e21e45dc114618641611d5d"
hash = "66f851b309bada6d3e4b211baa23b534165b29ba16b5cbf5e8f44eaeb3ca86ea"
logic_hash = "4644651cdbf868102094744dbcf8c4bc0fa5b35f2ca10cbe30a9aa8d58de0d6f"
@@ -234442,8 +234825,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_13AE : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7905-L7929"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7905-L7929"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "13ae3081393f8100cc491ebb88ba58f0491b3550787cf3fd25a73aa7ca0290d9"
hash = "5c9e257c9740561b5744812e1343815e7972c362c8993d972b96a56e18c712f3"
hash = "71c0ce3d33352ba6a0fb26e274d0fa87dc756d2473e104e0f5a7d57fab8a5713"
@@ -234477,8 +234860,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_37D9 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7931-L7951"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7931-L7951"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "37d999df20c1a0b8ffaef9484c213a97b9987ed308b4ba07316a6013fbd31c60"
hash = "3f3684a37b2645fa6827943d9812ffc2d83e89e962935b29874bec7c3714a06f"
logic_hash = "313f90a40048751479493767e9a44f161a3ccf4a652a09a9ad3ec926fcb5e734"
@@ -234508,8 +234891,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_3F36 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7953-L7973"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7953-L7973"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3f3684a37b2645fa6827943d9812ffc2d83e89e962935b29874bec7c3714a06f"
hash = "37d999df20c1a0b8ffaef9484c213a97b9987ed308b4ba07316a6013fbd31c60"
logic_hash = "c82730df0e7b53c67478f3fa01728841eb3794354c3233b87fe342e652fadb2e"
@@ -234539,8 +234922,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_423F : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7975-L7995"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7975-L7995"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "423f052690b6b523502931151dfcc63530e3bd9d79680f9b5ac033b23b5c6f18"
hash = "fa77a472e95c4d0a2271e5d7253a85af25c07719df26941b39082cfc0733071a"
logic_hash = "d11277a7079e113356cb6879b83bb2cb68aeb3cfe259017299737b7bf4b402d7"
@@ -234570,8 +234953,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_468B : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L7997-L8018"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L7997-L8018"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "468b087a0901d7bd971ab564b03ded48c508840b1f9e5d233a7916d1da6d9bd5"
hash = "f93e0d776481c4ded177d5e4aebb27f30f0d47dcb4a1448aee8b66099ac686e1"
logic_hash = "26386f30192448f1eb3e7ca04b972a1c84ac46cd6613cfd2eeaeee2967bc480e"
@@ -234601,8 +234984,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_64DD : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8020-L8040"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8020-L8040"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "64dddd5ac53fe2c9de2b317c09034d1bccaf21d6c03ccfde3518e5aa3623dd66"
hash = "7553c76b006bd2c75af4e4ee00a02279d3f1f5d691e7dbdc955eac46fd3614c3"
logic_hash = "f2e892fffc6494420282a4b197f5bf07a6cd069c11c795e662dc7e78613a1e3e"
@@ -234632,8 +235015,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_71C0 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8042-L8066"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8042-L8066"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "71c0ce3d33352ba6a0fb26e274d0fa87dc756d2473e104e0f5a7d57fab8a5713"
hash = "13ae3081393f8100cc491ebb88ba58f0491b3550787cf3fd25a73aa7ca0290d9"
hash = "8781589c77df2330a0085866a455d3ef64e4771eb574a211849784fdfa765040"
@@ -234667,8 +235050,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_7553 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8068-L8088"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8068-L8088"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7553c76b006bd2c75af4e4ee00a02279d3f1f5d691e7dbdc955eac46fd3614c3"
hash = "64dddd5ac53fe2c9de2b317c09034d1bccaf21d6c03ccfde3518e5aa3623dd66"
logic_hash = "e60b387fe83bffdd1411f3b8fb491f0b60ff0de3eac87c9c5ee8c55ca6c48afc"
@@ -234698,8 +235081,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_C6A5 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8090-L8110"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8090-L8110"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c6a5663f20e5cee2c92dee43a0f2868fb0af299f842410f4473dcde7abcb6413"
hash = "f14da8aa5c8eea8df63cf935481d673fdf3847f5701c310abf4023f9d80ad57d"
logic_hash = "a032c34700838e62dd9f07e5ef970a77899e27a9f6ceddefe82cb5ea5b93cbed"
@@ -234729,8 +235112,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_F14D : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8112-L8132"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8112-L8132"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f14da8aa5c8eea8df63cf935481d673fdf3847f5701c310abf4023f9d80ad57d"
hash = "c6a5663f20e5cee2c92dee43a0f2868fb0af299f842410f4473dcde7abcb6413"
logic_hash = "6d1a98e8b5ab416446cf15cf15a2bad93dfbe9b984b40f5fae523e17e6eb5caa"
@@ -234760,8 +235143,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_FA77 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8134-L8154"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8134-L8154"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "fa77a472e95c4d0a2271e5d7253a85af25c07719df26941b39082cfc0733071a"
hash = "423f052690b6b523502931151dfcc63530e3bd9d79680f9b5ac033b23b5c6f18"
logic_hash = "e59a975ce22fb83623ae84000e07bcc0f2060b7e16cfc3e2b538138246ef296a"
@@ -234791,8 +235174,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Mandiant_Realtimedriver_Realtimedriver_1E87 : FI
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8156-L8175"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8156-L8175"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1e87c118482101a9acb0952f4545dad155956dd397858b5d2748c63f0d836704"
logic_hash = "fefb4d17e45520cf907d178ce8dfba4d9b0e58c2365cf651fb0d8ba7ec9252fd"
score = 40
@@ -234821,8 +235204,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_0483 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8177-L8197"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8177-L8197"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0483b32f9544e9c3cc3f206e7bc983ea83f5a9ca44864f2af9b8fc10ff45949f"
logic_hash = "f8695a92b2baaaa0f3107e7ab458a1ff46f333e0d06834f9d9ee532bca26be59"
score = 40
@@ -234851,8 +235234,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_4880 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8199-L8219"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8199-L8219"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8"
hash = "55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa"
logic_hash = "497d5bb4a789cfe90fbe15da2b8492de0ba29081fdfbff54816e025e4dff2fcd"
@@ -234882,8 +235265,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_5596 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8221-L8241"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8221-L8241"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa"
hash = "4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8"
logic_hash = "fcfc255a20b512b38057022c05a694e757b08950d6d35b3c361b0559da51a689"
@@ -234913,8 +235296,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_6A48 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8243-L8263"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8243-L8263"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5"
hash = "fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c"
logic_hash = "d67bc654f7a410cbcb7e0b5c67eafeea6b11b28fe8651f5e71525b41925c115d"
@@ -234944,8 +235327,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_FD38 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8265-L8285"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8265-L8285"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c"
hash = "6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5"
logic_hash = "9307a3f6003f6b88d4384aad37803597d7444bcfae806a9f3d59c9a1e59d56e5"
@@ -234975,8 +235358,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Matroxelectronicsystemsltd_Mtxmemmanager_Matroxi
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8287-L8306"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8287-L8306"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "bd434c90eba514f5448978edb8b9fcd424f2e5cf3c0df9040efe5c25ec692dbc"
logic_hash = "78c89c6439b304267a79173791dc476190d0d009f1e1ab8e35dad715e1da87d0"
score = 40
@@ -235005,8 +235388,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Mellanoxtechnologiesltd_Mstsys_Mstmellanoxsuppor
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8308-L8327"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8308-L8327"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "bf8d3377fc0834828afcc94165172333b2e1b58fb37d45be91a07d8d2e54d431"
logic_hash = "248ca85a90bbcf7e2ecaece85b4fbd97cf242cf2e605c815c57130352f4208db"
score = 40
@@ -235035,8 +235418,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Microfocus_Microfocusxtier_5351 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8329-L8348"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8329-L8348"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c"
logic_hash = "869dda4be585813720487aff05ec28f7a7d5a158e4105bf89cfa3ee86468bcd0"
score = 40
@@ -235064,8 +235447,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Microfocus_Microfocusxtier_95D5 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8350-L8369"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8350-L8369"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3"
logic_hash = "eafe92d82ecbaf786512adf55e5603f6c8f3164198c1486f37a1ef5d622f4f16"
score = 40
@@ -235093,8 +235476,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Microsoftcorporation_Afdsys_Microsoftwindowsoper
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8371-L8391"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8371-L8391"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "95fd266cc454177901cb58f4d30417c4a7caf29be62bb8649e5b8fca58823600"
logic_hash = "452aa30445c6f5ad7be9b8d6ce0575680f81c2a729ca9b9e141a42789443c31e"
score = 40
@@ -235123,8 +235506,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Microsoftcorporation_Afdsys_Microsoftwindowsoper
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8393-L8413"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8393-L8413"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ebf6be42d39fd5d9361afa43479f883ff8eba97d72f313ece289f78cb51c22f2"
logic_hash = "d2ba0ccdc16727d58f32fe980b63955eaaae75878280ad21cfd50e4c2341dd62"
score = 40
@@ -235153,8 +235536,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Microsoftcorporation_Cscsys_Microsoftwindowsoper
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8415-L8435"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8415-L8435"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "828c54cfecb2a08863319544ac716aee3898dfe78a87d7757a0e92f1b1f1daf1"
logic_hash = "612296c65cd8f88034d04f50792934d3a3eaddef9d515490cb27cb4880d6e5b3"
score = 40
@@ -235183,8 +235566,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Microsoftcorporation_Ksld_Microsoftmalwareprotec
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8437-L8456"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8437-L8456"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2b3195346d9b62b08bb61bb61f0da20b2abb0c726186c09a2e4fa926baacbfc5"
logic_hash = "ab49b2479deb14f91f202c641ffdd567923de6dbe832f316e31cc18a220072ee"
score = 40
@@ -235213,8 +235596,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Microworldtechnologiesinc_Procobsrvesx_Escanecon
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8458-L8478"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8458-L8478"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "37206b758eac2c7775ef881c1dc9a96129a517069bdf47049afc3b29e328408e"
logic_hash = "09f50c54e031c89713dfd6410f18fe9dc221c5c485a785700a94eacfff1b9235"
score = 40
@@ -235243,8 +235626,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8480-L8501"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8480-L8501"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff"
hash = "ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471"
hash = "d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2"
@@ -235275,8 +235658,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8503-L8523"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8503-L8523"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89"
logic_hash = "e0200be2b1f874be9c35f3106b14ffdc9da89be220a3cdf7a50e2beb8550c403"
score = 40
@@ -235305,8 +235688,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8525-L8546"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8525-L8546"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471"
hash = "d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2"
hash = "0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff"
@@ -235337,8 +235720,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8548-L8568"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8548-L8568"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab"
logic_hash = "fd10cce7fd48320e9c759ca3a355e303ca48033775c439abaf00350152ea649c"
score = 40
@@ -235367,8 +235750,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Mitactechnologycorporation_Mtcbsvsys_Mitacsystem
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8570-L8590"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8570-L8590"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8"
logic_hash = "7b7839ec4e13e224b06df775db27a07f9a41c070192b2106440dc8b12fa3abee"
score = 40
@@ -235397,8 +235780,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Mitactechnologycorporation_Vdbsvsys_Mitacsystems
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8592-L8612"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8592-L8612"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "91afa3de4b70ee26a4be68587d58b154c7b32b50b504ff0dc0babc4eb56578f4"
logic_hash = "c65bf966d24a5a109c5e0379ee6c18c3d00a8763eba2d8482b05806ef226a6a7"
score = 40
@@ -235427,8 +235810,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Motorolainc_Smserlsys_Motorolasmmodem_Smrel_E599
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8614-L8633"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8614-L8633"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e599200c44eca5eb06475f90f67a58723b30c3c2887bd12ed7c31ff1042382ea"
logic_hash = "3682762c4bb9ab44028ea9f2f712a5990896bf2575282945fee0f31bbca67e74"
score = 40
@@ -235457,8 +235840,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_1014 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8635-L8684"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8635-L8684"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558"
hash = "131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6"
hash = "18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805"
@@ -235517,8 +235900,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_1DDF : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8686-L8706"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8686-L8706"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219"
logic_hash = "d708517c883098651d04e0c1db0fc4945dce400f5f8e141c9f121d0df397616c"
score = 40
@@ -235547,8 +235930,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_2BBE : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8708-L8729"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8708-L8729"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250"
hash = "e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a"
logic_hash = "ecf4a23530496241f443baa368abf3a389c037903cd081924342843d216cc946"
@@ -235578,8 +235961,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3070 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8731-L8751"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8731-L8751"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab"
logic_hash = "0f41bbef2800288be6a34cb7a6a06f0831b85f26108d2aa7f88452d223646a02"
score = 40
@@ -235608,8 +235991,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3124 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8753-L8773"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8753-L8773"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5"
logic_hash = "7b5809a8b0473dd287590653cd24f36bd0891a34c2a299937510dbfc559af421"
score = 40
@@ -235638,8 +236021,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3D9E : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8775-L8795"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8775-L8795"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3"
logic_hash = "751988bbc07681ff94f481e4ffa72efcc91b58dc78e1ff808797fc4d8762aa71"
score = 40
@@ -235668,8 +236051,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_591B : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8797-L8817"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8797-L8817"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52"
logic_hash = "3d7db1df982c7e16c402e1383bc3d92675ab53dea942d0dea6603853a88a7cf2"
score = 40
@@ -235698,8 +236081,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_9254 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8819-L8839"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8819-L8839"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b"
logic_hash = "831ac4b85f8d4eba9908a471abce7edb7adde7c3fda9cc57190624db5da4de52"
score = 40
@@ -235728,8 +236111,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_98B7 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8841-L8861"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8841-L8861"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8"
logic_hash = "5f92ad64336127815a83fa7f27165f1cc42300475128efcae40aabcb3cde7c75"
score = 40
@@ -235758,8 +236141,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_99F4 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8863-L8912"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8863-L8912"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1"
hash = "56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7"
hash = "c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8"
@@ -235818,8 +236201,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CC58 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8914-L8934"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8914-L8934"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b"
logic_hash = "bf1f0853e2110e23468922f32215687c9524c7f1a3191e6aedc600fe132dd05d"
score = 40
@@ -235848,8 +236231,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CF4B : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8936-L8956"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8936-L8956"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b"
logic_hash = "d966feaa162fdccb3f8f2751f06391091a5c19d30192c5dde9cc3a7e675ba249"
score = 40
@@ -235878,8 +236261,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_D0BD : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8958-L8978"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8958-L8978"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889"
logic_hash = "c37fe257f820c3bdf25634483303786579401ed96bb93c06d89f6be5f88ade69"
score = 40
@@ -235908,8 +236291,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_E839 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L8980-L9000"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L8980-L9000"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa"
logic_hash = "2b17f112f1c846d14cd396ea6a9fc1259a2c9a50dd4776a88a593d6fce09a216"
score = 40
@@ -235938,8 +236321,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolib_09BE : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9002-L9022"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9002-L9022"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1"
logic_hash = "ded9b80e96a51f68a92aabf62621c59657e1d39fc2093e1079b367a010f1a0cc"
score = 40
@@ -235968,8 +236351,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolibx_1E8B : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9024-L9045"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9024-L9045"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee"
hash = "5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3"
logic_hash = "bdef31e4b170eb803ca3508f179ebd82396e9fbe822b0c1a852c0f2841e34b22"
@@ -235999,8 +236382,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Multitheftauto_Mtasanandreas_9F4C : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9047-L9065"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9047-L9065"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5"
logic_hash = "08149cbb2228f0077690ada631de42cb2064cd43d4d46b0de37b853118778dbe"
score = 40
@@ -236027,8 +236410,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Mydriverscom_Hwm_Drivergenius_08EB : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9067-L9087"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9067-L9087"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6"
logic_hash = "c1dbd3f34c699beab7d4be72e52f7ed52d7e45a03a9306cb57ccd0fab1b1b0dc"
score = 40
@@ -236057,8 +236440,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nationalinstrumentscorporation_Nipalf_Nipal_F_1A
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9089-L9108"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9089-L9108"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1a6b4d5ad40c9ddf2599f6a44e94a1336aa3d28bf6a220b775f5c3305faecb2d"
logic_hash = "b137122d88a94a27ae9c9b0ee1d3c68ca37b8e6ff8308480a35cf057fc2634ab"
score = 40
@@ -236087,8 +236470,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ncomputingcoltd_Kmwpsmssys_Vspace_B045 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9110-L9129"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9110-L9129"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b045c00f3b921da2e9a5c7977e51c8beceff4a89ec9c4e365f3e4d41f8129e98"
logic_hash = "79fe5c857d732278b609422eb99613f5ddd33f9692c90e09bcd4388d88e32c30"
score = 40
@@ -236117,8 +236500,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ncrcorporation_Radhwmgrsys_Ncrcorporationhardwar
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9131-L9151"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9131-L9151"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7c8ad57b3a224fdc2aac9dd2d7c3624f1fcd3542d4db804de25a90155657e2cc"
logic_hash = "32120b6afe02561689d77a26b58aa6a89e314864412f255941824484416c3cdc"
score = 40
@@ -236147,8 +236530,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ncrcorporation_Radhwmgrsys_Ncrcorporationhardwar
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9153-L9173"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9153-L9173"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "df96d844b967d404e58a12fc57487abc24cd3bd1f8417acfe1ce1ee4a0b0b858"
logic_hash = "c4fc06a19769f2236d54ad399a53c0a3dba73cc660a633331306e4f9a058bb0e"
score = 40
@@ -236177,8 +236560,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Neacsafe_6544 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9175-L9191"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9175-L9191"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "65447f727801e8be8a51aaaafc07618c8196553e683affb0721da441e2430bad"
logic_hash = "221438e2d4d6d69652e3f3645224b074f99973d5db077f901981ab3b7dffb2f3"
score = 40
@@ -236204,8 +236587,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersdkcom_Lgdcatchersys_Netfiltersdk_0C42
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9193-L9213"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9193-L9213"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0c42fe45ffa9a9c36c87a7f01510a077da6340ffd86bf8509f02c6939da133c5"
logic_hash = "b478fd6bcd2b37bf5963428f05aa51bf5345719eedbf9021656663be426fbd22"
score = 40
@@ -236234,8 +236617,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_1265 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9215-L9237"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9215-L9237"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "12656fc113b178fa3e6bfffc6473897766c44120082483eb8059ebff29b5d2df"
hash = "1cd75de5f54b799b60789696587b56a4a793cf60775b81f236f0e65189d863af"
hash = "7ff8fe4c220cf6416984b70a7e272006a018e5662da3cedc2a88efeb6411b4a4"
@@ -236266,8 +236649,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_18B9 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9239-L9260"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9239-L9260"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "18b923b169b2c3c7db5cbfda0db0999f04adb2cf6c917e5b1fb2ff04714ecac1"
hash = "79e7165e626c7bde546cd1bea4b9ec206de8bed7821479856bdb0a2adc3e3617"
hash = "edc6e32e3545f859e5b49ece1cabd13623122c1f03a2f7454a61034b3ff577ed"
@@ -236298,8 +236681,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_26D6 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9262-L9284"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9262-L9284"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "26d67d479dafe6b33c980bd1eed0b6d749f43d05d001c5dcaaf5fcddb9b899fe"
hash = "2fa78c2988f9580b0c18822b117d065fb419f9c476f4cfa43925ba6cd2dffac3"
hash = "6a234a2b8eb3844f7b5831ee048f88e8a76e9d38e753cc82f61b234c79fe1660"
@@ -236330,8 +236713,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_EDC6 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9286-L9307"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9286-L9307"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "edc6e32e3545f859e5b49ece1cabd13623122c1f03a2f7454a61034b3ff577ed"
hash = "79e7165e626c7bde546cd1bea4b9ec206de8bed7821479856bdb0a2adc3e3617"
hash = "18b923b169b2c3c7db5cbfda0db0999f04adb2cf6c917e5b1fb2ff04714ecac1"
@@ -236362,8 +236745,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_F171 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9309-L9329"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9309-L9329"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f1718a005232d1261894b798a60c73d971416359b70d0e545d7e7a40ed742b71"
logic_hash = "d524aded77ea124c066f22e050822da91c1b45cadf20a5dda07d8f5332e2ea28"
score = 40
@@ -236392,8 +236775,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nitgencompanycoltd_Ngstar_Ngstarsys_4542 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9331-L9350"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9331-L9350"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4542b20be7adceb61fa5f538fed8c395951e775dbd7c4a2f7c6aee477c4d924e"
logic_hash = "493a6b39ecbb3a93ba247cb45d1c0af84093433dbe73dc8ab097ac65cfe3c9dc"
score = 40
@@ -236422,8 +236805,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nmscommunications_Cgkwinksys_Ctaccess_223F : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9352-L9372"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9352-L9372"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "223f61c3f443c5047d1aeb905b0551005a426f084b7a50384905e7e4ecb761a1"
logic_hash = "971e6b13911ad77bf9d4d2c984710473b955205339f99353ddd0f39e6fa05d84"
score = 40
@@ -236452,8 +236835,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nopingcom_Nprsys_Nprsys_3E73 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9374-L9393"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9374-L9393"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3e73d22b534a4c5996121750e3fc0f6913d5ad4c6dbc630b590647201656d714"
logic_hash = "f3d099bd04df90354bfc0d8232ede03f040860c1d3e0b281118a9d8d730bfaae"
score = 40
@@ -236482,8 +236865,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_003E : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9395-L9415"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9395-L9415"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "003e61358878c7e49e18420ee0b4a37b51880be40929a76e529c7b3fb18e81b4"
hash = "53810ca98e07a567bb082628d95d796f14c218762cbbaa79704740284dccda4b"
hash = "8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c"
@@ -236513,8 +236896,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_00B3 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9417-L9440"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9417-L9440"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "00b3ff11585c2527b9e1c140fd57cb70b18fd0b775ec87e9646603056622a1fd"
hash = "18f306b6edcfacd33b7b244eaecdd0986ef342f0d381158844d1f0ee1ac5c8d7"
hash = "3140005ce5cac03985f71c29732859c88017df9d41c3761aa7c57bbcb7ad2928"
@@ -236546,8 +236929,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_00C0 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9442-L9462"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9442-L9462"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "00c02901472d74e8276743c847b8148be3799b0e3037c1dfdca21fa81ad4b922"
hash = "4cd80f4e33b713570f6a16b9f77679efa45a466737e41db45b41924e7d7caef4"
hash = "66a20fc2658c70facd420f5437a73fa07a5175998e569255cfb16c2f14c5e796"
@@ -236577,8 +236960,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_0CF9 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9464-L9483"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9464-L9483"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0cf91e8f64a7c98dbeab21597bd76723aee892ed8fa4ee44b09f9e75089308e2"
hash = "f62911334068c9edd44b9c3e8dee8155a0097aa331dd4566a61afa3549f35f65"
logic_hash = "a308cb1c7b183a945287de6cb2f8338936b62c4d4063d17cbd74d46ed10a1606"
@@ -236607,8 +236990,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_0CFB : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9485-L9507"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9485-L9507"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0cfb7ea2cc515a7fe913ab3619cbfcf1ca96d8cf72dc350905634a5782907a49"
hash = "b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b"
hash = "b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e"
@@ -236640,8 +237023,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_1493 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9509-L9533"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9509-L9533"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "14938f68957ede6e2b742a550042119a8fbc9f14427fb89fa53fff12d243561c"
hash = "28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7"
hash = "41eeeb0472c7e9c3a7146a2133341cd74dd3f8b5064c9dee2c70e5daa060954f"
@@ -236674,8 +237057,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_1675 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9535-L9556"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9535-L9556"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1675eedd4c7f2ec47002d623bb4ec689ca9683020e0fdb0729a9047c8fb953dd"
hash = "c6feb3f4932387df7598e29d4f5bdacec0b9ce98db3f51d96fc4ffdcc6eb10e1"
hash = "e7b79fe1377b3da749590c080d4d96e59e622b1013b2183b98c81baa8bf2fffe"
@@ -236706,8 +237089,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_1C2F : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9558-L9580"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9558-L9580"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1c2f1e2b0cc4da128feb73a6b9dd040df8495fefe861d69c9f44778c6ddb9b9b"
hash = "6b71b7f86e41540a82d7750a698e0386b74f52962b879cbb46f17935183cd2c7"
hash = "904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a"
@@ -236739,8 +237122,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_1E9C : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9582-L9601"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9582-L9601"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1e9c236ed39507661ec32731033c4a9b9c97a6221def69200e03685c08e0bfa7"
hash = "76276c87617b836dd6f31b73d2bb0e756d4b3d133bddfe169cb4225124ca6bfb"
logic_hash = "67025981d732568b93e2e826e8268ffc252fa26c109d95816e55df14a6036610"
@@ -236769,8 +237152,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_202D : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9603-L9626"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9603-L9626"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "202d9703a5b8d06c5f92d2c5218a93431aa55af389007826a9bfaaf900812213"
hash = "2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0"
hash = "5a661e26cfe5d8dedf8c9644129039cfa40aebb448895187b96a8b7441d52aaa"
@@ -236803,8 +237186,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_3A65 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9628-L9650"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9628-L9650"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0"
hash = "6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44"
hash = "84739539aa6a9c9cb3c48c53f9399742883f17f24e081ebfa7bfaaf59f3ed451"
@@ -236836,8 +237219,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_3B71 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9652-L9674"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9652-L9674"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3b7177e9a10c1392633c5f605600bb23c8629379f7f42957972374a05d4dc458"
hash = "72b67b6b38f5e5447880447a55fead7f1de51ca37ae4a0c2b2f23a4cb7455f35"
hash = "87e094214feb56a482cd8ae7ee7c7882b5a8dccce7947fdaa04a660fa19f41e5"
@@ -236868,8 +237251,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_49EF : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9676-L9696"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9676-L9696"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "49ef680510e3dac6979a20629d10f06822c78f45b9a62ec209b71827a526be94"
hash = "653f6a65e0e608cae217bea2f90f05d8125cf23f83ba01a60de0f5659cfa5d4d"
hash = "a855b6ec385b3369c547a3c54e88a013dd028865aba0f3f08be84cdcbaa9a0f6"
@@ -236899,8 +237282,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_4C85 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9698-L9718"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9698-L9718"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4c859b3d11d2ff0049b644a19f3a316a8ca1a4995aa9c39991a7bde8d4f426a4"
hash = "a15325e9e6b8e4192291deb56c20c558dde3f96eb682c6e90952844edb984a00"
hash = "e728b259113d772b4e96466ab8fe18980f37c36f187b286361c852bd88101717"
@@ -236930,8 +237313,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_4CD8 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9720-L9740"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9720-L9740"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4cd80f4e33b713570f6a16b9f77679efa45a466737e41db45b41924e7d7caef4"
hash = "00c02901472d74e8276743c847b8148be3799b0e3037c1dfdca21fa81ad4b922"
hash = "66a20fc2658c70facd420f5437a73fa07a5175998e569255cfb16c2f14c5e796"
@@ -236961,8 +237344,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_5381 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9742-L9762"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9742-L9762"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "53810ca98e07a567bb082628d95d796f14c218762cbbaa79704740284dccda4b"
hash = "8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c"
hash = "003e61358878c7e49e18420ee0b4a37b51880be40929a76e529c7b3fb18e81b4"
@@ -236992,8 +237375,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_5A66 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9764-L9787"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9764-L9787"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5a661e26cfe5d8dedf8c9644129039cfa40aebb448895187b96a8b7441d52aaa"
hash = "fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f"
hash = "202d9703a5b8d06c5f92d2c5218a93431aa55af389007826a9bfaaf900812213"
@@ -237026,8 +237409,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_66F8 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9789-L9809"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9789-L9809"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "66f8bd2b29763acfbb7423f4c3c9c3af9f3ca4113bd580ab32f6e3ee4a4fc64e"
hash = "7f84f009704bc36f0e97c7be3de90648a5e7c21b4f870e4f210514d4418079a0"
logic_hash = "b429e17d68f791c1508870714bb43b7bb22eb18b420d5aac997240e20d30b0e9"
@@ -237056,8 +237439,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_6C5A : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9811-L9831"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9811-L9831"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6c5aef14613b8471f5f4fdeb9f25b5907c2335a4bc18b3c2266fb1ffd8f1741d"
hash = "ec1307356828426d60eab78ffb5fc48a06a389dea6e7cc13621f1fa82858a613"
logic_hash = "2da2655738e05e1b9a6b62bfdf9cab79adad8556a782448a498f8813be2d6819"
@@ -237086,8 +237469,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_6CF1 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9833-L9852"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9833-L9852"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6cf1cac0e97d30bb445b710fd8513879678a8b07be95d309cbf29e9b328ff259"
logic_hash = "d93c983760cb41842c2eb23ff5225a616887772cf5bc445120b68908a05ed32f"
score = 40
@@ -237115,8 +237498,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_7627 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9854-L9873"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9854-L9873"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "76276c87617b836dd6f31b73d2bb0e756d4b3d133bddfe169cb4225124ca6bfb"
hash = "1e9c236ed39507661ec32731033c4a9b9c97a6221def69200e03685c08e0bfa7"
logic_hash = "eba1a04dc1de06122a8bad80399c4233b9c3101f4fcbc805ec7615010da76833"
@@ -237145,8 +237528,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_8138 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9875-L9898"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9875-L9898"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8138b219a2b1be2b0be61e5338be470c18ad6975f11119aee3a771d4584ed750"
hash = "ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a"
hash = "da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d"
@@ -237179,8 +237562,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_834A : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9900-L9920"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9900-L9920"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "834a3d755b5ae798561f8e5fbb18cf28dfcae7a111dc6a03967888e9d10f6d78"
hash = "e89cb7217ec1568b43ad9ca35bf059b17c3e26f093e373ab6ebdeee24272db21"
logic_hash = "faa0d8aa85cef1e0fbbc4c301e2ab585d128199ee0773650780d36fa9b4d3e60"
@@ -237209,8 +237592,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_8473 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9922-L9944"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9922-L9944"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "84739539aa6a9c9cb3c48c53f9399742883f17f24e081ebfa7bfaaf59f3ed451"
hash = "6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44"
hash = "e279e425d906ba77784fb5b2738913f5065a567d03abe4fd5571695d418c1c0f"
@@ -237242,8 +237625,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_A153 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9946-L9966"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9946-L9966"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a15325e9e6b8e4192291deb56c20c558dde3f96eb682c6e90952844edb984a00"
hash = "e728b259113d772b4e96466ab8fe18980f37c36f187b286361c852bd88101717"
hash = "4c859b3d11d2ff0049b644a19f3a316a8ca1a4995aa9c39991a7bde8d4f426a4"
@@ -237273,8 +237656,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_A855 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9968-L9988"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9968-L9988"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a855b6ec385b3369c547a3c54e88a013dd028865aba0f3f08be84cdcbaa9a0f6"
hash = "49ef680510e3dac6979a20629d10f06822c78f45b9a62ec209b71827a526be94"
hash = "653f6a65e0e608cae217bea2f90f05d8125cf23f83ba01a60de0f5659cfa5d4d"
@@ -237304,8 +237687,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_B50F : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L9990-L10012"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L9990-L10012"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e"
hash = "dd2f1f7012fb1f4b2fb49be57af515cb462aa9c438e5756285d914d65da3745b"
hash = "b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b"
@@ -237337,8 +237720,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_C6FE : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10014-L10035"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10014-L10035"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c6feb3f4932387df7598e29d4f5bdacec0b9ce98db3f51d96fc4ffdcc6eb10e1"
hash = "e7b79fe1377b3da749590c080d4d96e59e622b1013b2183b98c81baa8bf2fffe"
hash = "f77fe6b1e0e913ac109335a8fa2ac4961d35cbbd50729936059aba8700690a9e"
@@ -237369,8 +237752,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_DD4F : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10037-L10059"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10037-L10059"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "dd4fedd5662122cbfe046a12e2137294ef1cb7822238d9e24eacc78f22f8e93d"
hash = "904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a"
hash = "1c2f1e2b0cc4da128feb73a6b9dd040df8495fefe861d69c9f44778c6ddb9b9b"
@@ -237402,8 +237785,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_F27F : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10061-L10084"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10061-L10084"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f27febff1be9e89e48a9128e2121c7754d15f8a5b2e88c50102cecee5fe60229"
hash = "8138b219a2b1be2b0be61e5338be470c18ad6975f11119aee3a771d4584ed750"
hash = "e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48"
@@ -237436,8 +237819,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_F629 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10086-L10105"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10086-L10105"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f62911334068c9edd44b9c3e8dee8155a0097aa331dd4566a61afa3549f35f65"
hash = "0cf91e8f64a7c98dbeab21597bd76723aee892ed8fa4ee44b09f9e75089308e2"
logic_hash = "b4ad3eedff5e41aa07d42c46dd5ef97ef281c049ed676e6b93474f21e20da428"
@@ -237466,8 +237849,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_7A2C : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10107-L10126"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10107-L10126"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7a2cd1dc110d014165c001ce65578da0c0c8d7d41cc1fa44f974e8a82296fc25"
logic_hash = "8aff5079dccdfadabb2af5fb1409da365384c53d50e3e1f361a2f39502f2a51d"
score = 40
@@ -237495,8 +237878,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_C190 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10128-L10147"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10128-L10147"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c190e4a7f1781ec9fa8c17506b4745a1369dcdf174ce07f85de1a66cf4b5ed8a"
logic_hash = "eb9fd65aa2ddb98f509bb632b4dd3e856c77f39454cff1f0ce71b732553b6d93"
score = 40
@@ -237524,8 +237907,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_CA34 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10149-L10168"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10149-L10168"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ca34f945117ec853a713183fa4e8cf85ea0c2c49ca26e73d869fee021f7b491d"
logic_hash = "8000539cc5deba15c567e4ce883edef35f0af15c4cf29d4b7921b76ccc1c3285"
score = 40
@@ -237553,8 +237936,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nseccoltd_Nseckrnl_Nsec_206F : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10170-L10190"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10170-L10190"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "206f27ae820783b7755bca89f83a0fe096dbb510018dd65b63fc80bd20c03261"
logic_hash = "b8ac1111909cc1f6099638a8745479d7f1005f55d3df67332ec8e700783e0d1c"
score = 40
@@ -237583,8 +237966,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nuvotontechnologycorp_Myportiosys_Nuvotonportiod
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10192-L10212"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10192-L10212"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "18bf6cf0224a41058ba3944ff0df9e12fa256c7c353d6fa6132a464cd5db5709"
hash = "30d5e07d9e88722a5e0eec17d0437b859f782d1c15fc80b5381f3e3eb4221bc7"
logic_hash = "28fefe4b7b6a892118017d7d7a75b423f5bff415ebe735ed45bd72f06c7d3446"
@@ -237614,8 +237997,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10214-L10235"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10214-L10235"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "060d25126e45309414b380ee29f900840b689eae4217a8e621563f130c1d457f"
hash = "b8321471be85dc8a67ac18a2460cab50e7c41cb47252f9a7278b1e69d6970f25"
logic_hash = "cc41a2f162e088fa16e65d996a8e81ac4c3bd0fe8180edd4e4a3056cfce2e800"
@@ -237645,8 +238028,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10237-L10257"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10237-L10257"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0fc0644085f956706ea892563309ba72f0986b7a3d4aa9ae81c1fa1c35e3e2d3"
logic_hash = "3dafb30a2e005ed048601d982ff82d47292c47eb8183b405cbae7b12e8b7bb1e"
score = 40
@@ -237675,8 +238058,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10259-L10280"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10259-L10280"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "16ae28284c09839900b99c0bdf6ce4ffcd7fe666cfd5cfb0d54a3ad9bea9aa9c"
hash = "d54ac69c438ba77cde88c6efd6a423491996d4e8a235666644b1db954eb1da9c"
logic_hash = "b5cc701a13a1a7f5cf8820c4715e787c31dc081aed7d2d25877135b91456ca91"
@@ -237706,8 +238089,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10282-L10302"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10282-L10302"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2203bd4731a8fdc2a1c60e975fd79fd5985369e98a117df7ee43c528d3c85958"
logic_hash = "c7063f4e76718049db4b4e5954d9faa10a8e0df66c51a4a45931b9c5fafab2a2"
score = 40
@@ -237736,8 +238119,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10304-L10324"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10304-L10324"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "29f449fca0a41deccef5b0dccd22af18259222f69ed6389beafe8d5168c59e36"
hash = "d633055c7eda26dacfc30109eb790625519fc7b0a3a601ceed9e21918aad8a1b"
logic_hash = "ed32a4d594c586e3b2e30b5aee004075c78b30378fe9f49d376aa3a760a5021c"
@@ -237767,8 +238150,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10326-L10347"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10326-L10347"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3cb111fdedc32f2f253aacde4372b710035c8652eb3586553652477a521c9284"
hash = "9bfd24947052bfe9f2979113a7941e40bd7e3a82eaa081a32ad4064159f07c91"
logic_hash = "294bfc9e9c5d7e2562b9f34c1990dedf5899b8ec129cde4bece4bd7c56ff2ba0"
@@ -237798,8 +238181,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10349-L10369"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10349-L10369"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3d008e636e74c846fe7c00f90089ff725561cb3d49ce3253f2bbfbc939bbfcb2"
logic_hash = "52d80a5749161ad2eef5deaf9b9478789df05692a500dfe16cc13638b5a5e985"
score = 40
@@ -237828,8 +238211,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10371-L10391"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10371-L10391"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4d777a9e2c61e8b55b3c34c5265b301454bb080abe7ffb373e7800bd6a498f8d"
logic_hash = "d0f69a7ef40f16d166c8885d7f9392ff6e2ed941fa1a8856e0d1f765657bc591"
score = 40
@@ -237858,8 +238241,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10393-L10413"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10393-L10413"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "642857fc8d737e92db8771e46e8638a37d9743928c959ed056c15427c6197a54"
hash = "f4e500a9ac5991da5bf114fa80e66456a2cde3458a3d41c14e127ac09240c114"
logic_hash = "0b05809eff6c3edf9eddc18d63c6524121300828be7a773d4d6b56fefe24f6fe"
@@ -237889,8 +238272,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10415-L10435"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10415-L10435"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "64a8e00570c68574b091ebdd5734b87f544fa59b75a4377966c661d0475d69a5"
hash = "d7c90cf3fdbbd2f40fe6a39ad0bb2a9a97a0416354ea84db3aeff6d925d14df8"
logic_hash = "2c0eafcf0666a6330cf38c72a1cb592385f39b895b9e314389d4d6887c9cbfd3"
@@ -237920,8 +238303,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10437-L10458"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10437-L10458"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "77da3e8c5d70978b287d433ae1e1236c895b530a8e1475a9a190cdcc06711d2f"
hash = "837d3b67d3e66ef1674c9f1a47046e1617ed13f73ee08441d95a6de3d73ee9f2"
logic_hash = "058e6f661a2483abd4686f0956c8d10beebf3cb0ccee41b06fd91af28cb692e7"
@@ -237951,8 +238334,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10460-L10480"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10460-L10480"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "848b150ffcf1301b26634a41f28deacb5ccdd3117d79b590d515ed49849b8891"
logic_hash = "0e01fba0938d7b900a003ccccd36c83073afe4f96f3be083bf87f4f2e4a71f0a"
score = 40
@@ -237981,8 +238364,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10482-L10502"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10482-L10502"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "87b4c5b7f653b47c9c3bed833f4d65648db22481e9fc54aa4a8c6549fa31712b"
logic_hash = "cf1dc51bf920f1dfbd8da1266218e39f207c86a838f7a3b9f5123b21612ab41d"
score = 40
@@ -238011,8 +238394,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10504-L10524"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10504-L10524"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "909f6c4b8f779df01ef91e549679aa4600223ac75bc7f3a3a79a37cee2326e77"
logic_hash = "800cfa026bf5e17dc413d955f35f6490bcec32f05b032de1613a69c9ab07fa84"
score = 40
@@ -238041,8 +238424,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10526-L10546"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10526-L10546"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a47555d04b375f844073fdcc71e5ccaa1bbb201e24dcdebe2399e055e15c849f"
logic_hash = "88eab74c8ed6aa75a7bec57762e0b721a4a1e8a3750bc9ba2390936ce93c33a1"
score = 40
@@ -238071,8 +238454,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10548-L10568"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10548-L10568"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ae3a6a0726f667658fc3e3180980609dcb31bdbf833d7cb76ba5d405058d5156"
logic_hash = "bacbb8b1f506d6383ae007cee786e9dcfe939e6e10531e5fff78d839ccabbd09"
score = 40
@@ -238101,8 +238484,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10570-L10591"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10570-L10591"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "afda5af5f210336061bff0fab0ed93ee495312bed639ec5db56fbac0ea8247d3"
hash = "b2364c3cf230648dad30952701aef90acfc9891541c7e154e30c9750da213ed1"
logic_hash = "111d2a62db85f8ec58db7f8d645e3c538a8cbbb98d187e8aaadb10ee5622f142"
@@ -238132,8 +238515,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10593-L10613"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10593-L10613"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b0dcdbdc62949c981c4fc04ccea64be008676d23506fc05637d9686151a4b77f"
logic_hash = "33d965641fe61ee056b8475e892281070eb5ea3e8cc34ed7f751edb56d8091da"
score = 40
@@ -238162,8 +238545,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10615-L10635"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10615-L10635"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d633055c7eda26dacfc30109eb790625519fc7b0a3a601ceed9e21918aad8a1b"
hash = "29f449fca0a41deccef5b0dccd22af18259222f69ed6389beafe8d5168c59e36"
logic_hash = "40d935ad81305da16adadabbbb18376bb0af64df5ce164625ec1e223ee01ceba"
@@ -238193,8 +238576,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10637-L10657"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10637-L10657"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d7c90cf3fdbbd2f40fe6a39ad0bb2a9a97a0416354ea84db3aeff6d925d14df8"
hash = "64a8e00570c68574b091ebdd5734b87f544fa59b75a4377966c661d0475d69a5"
logic_hash = "1e5669c7c79c027bdef5dbd135b35ea4e9af8c164b6b8f027490e2fa49ebf904"
@@ -238224,8 +238607,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10659-L10679"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10659-L10679"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f4e500a9ac5991da5bf114fa80e66456a2cde3458a3d41c14e127ac09240c114"
hash = "642857fc8d737e92db8771e46e8638a37d9743928c959ed056c15427c6197a54"
logic_hash = "a787fd5e5b62f39a19222a8167382966dd707e2aba99f4c08ad839b221a17e75"
@@ -238255,8 +238638,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorporation_Nvflash_Nvidiaflashdriver_AFDD
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10681-L10701"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10681-L10701"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508"
logic_hash = "d4b2cb535b3b4326ae004b890e8251b91eda5fd5a0a6a5484cb71bbd5a833b54"
score = 40
@@ -238285,8 +238668,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_9131 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10703-L10723"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10703-L10723"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c"
logic_hash = "dd697cda77791c5000be66f20a4f9dc845b549873978f2ba1fd005ce5c7d55f4"
score = 40
@@ -238315,8 +238698,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_F060 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10725-L10745"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10725-L10745"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008"
logic_hash = "33bf7995d658db32c332d503970bdd00ac22eaf94f7895fc4034e6acb79718b3"
score = 40
@@ -238345,8 +238728,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10747-L10768"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10747-L10768"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5"
hash = "a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062"
logic_hash = "85f7b31efbcde8bb59ddb234473ea01b356f32d3c249904cea6eea8fbdc17de6"
@@ -238376,8 +238759,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_3EC5 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10770-L10790"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10770-L10790"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8"
hash = "47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84"
logic_hash = "58e043d8b08722bfce456eab9a4ed7e6d10f757dac9ec621c57ad165048c48f3"
@@ -238407,8 +238790,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_47EA : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10792-L10812"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10792-L10812"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84"
hash = "3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8"
logic_hash = "e6bea09a04b7f043d9a8cef4c8dc3e2f087fdf1a981f6d23dee728ea6d15d792"
@@ -238438,8 +238821,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Opswatinc_Ardrvsys_Appremoverdriver_07C5 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10814-L10833"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10814-L10833"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "07c5209bf83065fe760f4fee4ed2308b0c523671f68ca73a3854c2c8c28c0541"
logic_hash = "c298d946d04a578bf7953f320385c31f553e06e7421a0c49b96c2e431211fbf1"
score = 40
@@ -238468,8 +238851,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Oraclecorporation_Dndrvsys_Oraclevmvirtualbox_R_
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10835-L10854"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10835-L10854"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e786f64dab69f2ae1e399044f59dc4b8efc7c291f77ca7f5df4394fe00edf62b"
logic_hash = "5a71b8f3123548a1ba6003f478312192dff037febe865fe41a6713ff5e0c4e1e"
score = 40
@@ -238498,8 +238881,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Oti_Otipcibussys_Kernelmodedrivertoaccessphysica
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10856-L10875"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10856-L10875"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80"
logic_hash = "70c0716f7b40a1e723f1fd7e9465bca11601c75a07f8832bd27a47bba2bee1a1"
score = 40
@@ -238527,8 +238910,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Overclockingtool_Atillksys_Overclockingtool_11A9
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10877-L10898"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10877-L10898"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "11a9787831ac4f0657aeb5e7019c23acc39d8833faf28f85bd10d7590ea4cc5f"
hash = "d2182b6ef3255c7c1a69223cd3c2d68eb8ba3112ce433cd49cd803dc76412d4b"
logic_hash = "8160ebf6b95f99d3ee6975e0e3d22353fc01f818eb6581ca07d44d82e3fbf515"
@@ -238558,8 +238941,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Paloaltonetworksinc_Cyvrlpcsys_Cortexxdradvanced
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10900-L10921"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10900-L10921"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "05f8f514d1367aca856564af5443a75f47d22a30ce63f0b024a41e6b9553a527"
hash = "2cd7a0c4e8d24404c92e4ed8539b2136028a8ca663f3432e417b00665493e13f"
logic_hash = "4acc8c5764698d2efc72c12726ed64032dd3150c32689366e4fa351d2b43a01f"
@@ -238589,8 +238972,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Paniosys
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10923-L10943"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10923-L10943"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960"
logic_hash = "e50320ae6e9cd2fbecd8c8b5f14ef1a5ff3ca28638caf179050b563add7856fa"
score = 40
@@ -238619,8 +239002,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panioxsy
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10945-L10965"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10945-L10965"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74"
logic_hash = "1a024ad87f1887f9a1774efb55afe28de36a2acc49432321c2fd407f40771be4"
score = 40
@@ -238649,8 +239032,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfl
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10967-L10987"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10967-L10987"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7"
logic_hash = "cdbcf6a1631960174ef24b3137dd0ff258cbb0d0cc7a0e117e552be4e2cc5513"
score = 40
@@ -238679,8 +239062,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfl
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L10989-L11009"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L10989-L11009"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf"
logic_hash = "0212b97232781983270c0dd6abbfb571d60fa88bc5409e9bc8aab9f24b3fa62c"
score = 40
@@ -238709,8 +239092,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Paragonsoftwaregmbh_Biontdrv_Paragonsystemutilit
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11011-L11030"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11011-L11030"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "174c8d771d31d70fc95448e961a395f5ceb7658f0cc381a718fb3b854cde4efe"
logic_hash = "ab1c36d1c4eb6b8aa25b07e254cdf9e4bb6fd919bae6676f6b2a9119ee5560a8"
score = 40
@@ -238738,8 +239121,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Paragonsoftwaregmbh_Biontdrv_Paragonsystemutilit
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11032-L11051"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11032-L11051"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "fb0dbc3b9c897b7571b94fb2203ffb1ac0facfe366b2cb1f91904ea5335018f0"
logic_hash = "518a0b724d87ad4d9ea4e9dc75303ba07da06cca22a64d5204084acc0ab2d5d5"
score = 40
@@ -238767,8 +239150,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Pcdoctorinc_Pcdsrvc_1D05 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11053-L11071"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11053-L11071"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1d053020079124ac526d84affb17bf4a1563ecd872c83b4b6299c9aa6a732557"
logic_hash = "b373d7afe0b7a04ddcfa5479f31d426f0f05693c60ae156c3a9d936f4db8d099"
score = 40
@@ -238796,8 +239179,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Pchuntersys_Pchunter_1B7F : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11073-L11093"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11073-L11093"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa"
logic_hash = "c13175174ef3cb8a8a1b93a406c0a8e4a667ab261471fde7b974f2cf568b7fed"
score = 40
@@ -238826,8 +239209,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Pctools_Pctcoresys_Kerneldriversuite_C76D : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11095-L11114"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11095-L11114"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c76dd87891e3e30db2aed057e7b04c19ca264f434c21f68a7a2d9b17a97aff39"
logic_hash = "1c0844b75ceff670205246bf60ab94570e5f953c832b0544471829bdf9ba6040"
score = 40
@@ -238856,8 +239239,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Pctools_Tfsysmon_Threatfire_1C1A : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11116-L11136"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11116-L11136"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1c1a4ca2cbac9fe5954763a20aeb82da9b10d028824f42fff071503dcbe15856"
logic_hash = "5b1a35666c37d9c0ed217f282bf3a331da8631534e7fa2502e9c5ce0552bae49"
score = 40
@@ -238886,8 +239269,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Phoenixtechnologies_Agentsys_Driveragent_05F0 :
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11138-L11162"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11138-L11162"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748"
hash = "4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca"
hash = "4db1e0fdc9e6cefeb1d588668ea6161a977c372d841e7b87098cf90aa679abfb"
@@ -238921,8 +239304,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Phoenixtechnologies_Agentsys_Driveragent_4045 :
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11164-L11188"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11164-L11188"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca"
hash = "8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f"
hash = "6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa"
@@ -238956,8 +239339,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Phoenixtechnologiesltd_Phlashnt_Winphlash_65DB :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11190-L11210"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11190-L11210"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890"
logic_hash = "05f3225297bdd961ab444f307bedccca5fe32cdd286d676cd20e7667bc5d84b9"
score = 40
@@ -238986,8 +239369,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Pinduoduoltdcorp_Vboxdrv_Pinduoduosecurevdi_9DAB
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11212-L11232"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11212-L11232"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4"
logic_hash = "3434275f26d0da9a354cd409a9bc49aaba8990e84fd6ba70dc83a517970920b3"
score = 40
@@ -239016,8 +239399,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Pointgreyresearch_Pgrhostcontrolsys_Pgrhostcontr
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11234-L11253"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11234-L11253"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4b0e9834dd672e4ce81464d8887c71f9a0942140557cd0ad321da9a1aa849959"
logic_hash = "441b6a56e35dc8074b84a71a9206ec2fa6c56b7df23f8a7a269e257876f8bff2"
score = 40
@@ -239046,8 +239429,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Portwellinc_Portwellsys_Portwelldriver_2F0B : FI
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11255-L11274"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11255-L11274"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2f0b16ed90b8c15bf52a7c32699dbe0dbcd38fc02ed2ddb4e1ba35487177b6c5"
logic_hash = "a4cb5a49fa3f953eec2422166abc52889796b654c214ffa4f95e7b58081823b4"
score = 40
@@ -239076,8 +239459,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Powertool_Kevpsys_Powertool_09B0 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11276-L11303"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11276-L11303"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184"
hash = "1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c"
hash = "2a4f4400402cdc475d39389645ca825bb0e775c3ecb7c527e30c5be44e24af7d"
@@ -239114,8 +239497,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Powertool_Kevpsys_Powertool_7C0F : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11305-L11332"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11305-L11332"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7c0f77d103015fc29379ba75d133dc3450d557b0ba1f7495c6b43447abdae230"
hash = "d9500af86bf129d06b47bcfbc4b23fcc724cfbd2af58b03cdb13b26f8f50d65e"
hash = "2a4f4400402cdc475d39389645ca825bb0e775c3ecb7c527e30c5be44e24af7d"
@@ -239152,8 +239535,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Proxydrvsys_Nn_0B20 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11334-L11354"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11334-L11354"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0b205838a8271daea89656b1ec7c5bb7244c42a8b8000d7697e92095da6b9b94"
logic_hash = "985464b739a7d6375bd6a8a23f3d850b497a9344f4674672b84bb2b7c5e854ea"
score = 40
@@ -239182,8 +239565,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Proxydrvsys_Nn_C0E7 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11356-L11376"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11356-L11376"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c0e74f565237c32989cb81234f4b5ad85f9dd731c112847c0a143d771021cb99"
logic_hash = "f92d7cf5e21523330ecd60d046724ef32804362ef01c1213bc870b5a2d11d872"
score = 40
@@ -239212,8 +239595,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Pulsesecurellc_Neofltr_Secureapplicationmanager_
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11378-L11398"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11378-L11398"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8dbc28fefb8cf9377be55a7c6062988df5a24f0ff475f6dd65cf07fe5173f51d"
logic_hash = "43d10fb1bdfa2c15f53b81d18502211a633a4a8ec7bb9f29591c53b86cf9d4d5"
score = 40
@@ -239242,8 +239625,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Quanta_Controlcentersys_Controlcenterdriver_0B12
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11400-L11419"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11400-L11419"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0b12eb25db68d8714ba52583597ed20e5fab2f6e82dcd0bcb23161acb4a9a126"
logic_hash = "6591903f61031ff19498e388848b17b6492c6b03ce323d66b3e516864247fff3"
score = 40
@@ -239272,8 +239655,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystemsinch
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11421-L11441"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11421-L11441"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "00c3e86952eebb113d91d118629077b3370ebc41eeacb419762d2de30a43c09c"
logic_hash = "37a8f91acdfd22aeb2be6ebe9514ebabb6daed856df2d502890c02008eceeaa7"
score = 40
@@ -239302,8 +239685,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystemsinch
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11443-L11464"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11443-L11464"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0f30ecd4faec147a2335a4fc031c8a1ac9310c35339ebeb651eb1429421951a0"
hash = "903d6d71da64566b1d9c32d4fb1a1491e9f91006ad2281bb91d4f1ee9567ef7b"
logic_hash = "495b5cfc0024a5441981658777b68717dd97c61def3ef9ec32c6c6c4e4ac7f08"
@@ -239333,8 +239716,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystemsinch
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11466-L11486"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11466-L11486"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7c79e5196c2f51d2ab16e40b9d5725a8bf6ae0aaa70b02377aedc0f4e93ca37f"
logic_hash = "803078481b82716cf123afc43c74fa53047b8e45a07024de0eac7cc4a5512fd7"
score = 40
@@ -239363,8 +239746,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rayhinchliffe_Sivxsys_Sivdriver_V_3390 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11488-L11507"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11488-L11507"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "33903e8fa9f0a2acaa4784d645e309b0bd780693824b6c2c5fef257238c77478"
logic_hash = "f7569edb5f84596659c3786b4ce1a4851c744b855ee97ce0ed83027e76130240"
score = 40
@@ -239393,8 +239776,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_0507 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11509-L11529"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11509-L11529"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0507d893e3fd2917c81c1dc13ccb22ae5402ab6ca9fb8d89485010838050d08d"
hash = "ad8fd8300ed375e22463cea8767f68857d9a3b0ff8585fbeb60acef89bf4a7d7"
logic_hash = "7a8a55ddb64b719986487d670b3523419674135ca9eb485a2b6ca63cd46dd18f"
@@ -239424,8 +239807,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_0B54 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11531-L11553"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11531-L11553"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0b547368c03e0a584ae3c5e62af3728426c68b316a15f3290316844d193ad182"
hash = "9eba5d1545fdbf37cf053ac3f3ba45bcb651b8abb7805cbfdfb5f91ea294fb95"
hash = "9fa120bda98633e30480d8475c9ac6637470c4ca7c63763560bf869138091b01"
@@ -239457,8 +239840,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_0C92 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11555-L11575"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11555-L11575"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0c925468c3376458d0e1ec65e097bd1a81a03901035c0195e8f6ef904ef3f901"
hash = "16e2b071991b470a76dff4b6312d3c7e2133ad9ac4b6a62dda4e32281952fb23"
logic_hash = "14a925738900ed1f8fde98341841e9c237b2ccf6ca5e21e2c931ff08d2245b64"
@@ -239488,8 +239871,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_16E2 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11577-L11597"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11577-L11597"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "16e2b071991b470a76dff4b6312d3c7e2133ad9ac4b6a62dda4e32281952fb23"
hash = "0c925468c3376458d0e1ec65e097bd1a81a03901035c0195e8f6ef904ef3f901"
logic_hash = "162cf712c505520635388ec61c69165a2fff8704c7edef58c63cc8cbcc624e0d"
@@ -239519,8 +239902,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_2665 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11599-L11621"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11599-L11621"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2665d3127ddd9411af38a255787a4e2483d720aa021be8d6418e071da52ed266"
hash = "567809308cfb72d59b89364a6475f34a912d03889aa50866803ac3d0bf2c3270"
hash = "93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63"
@@ -239552,8 +239935,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_46D1 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11623-L11646"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11623-L11646"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "46d1dc89cc5fa327e7adf3e3d6d498657240772b85548c17d2e356aac193dd28"
hash = "4c2d2122ef7a100e1651f2ec50528c0d1a2b8a71c075461f0dc58a1aca36bc61"
hash = "d59cc3765a2a9fa510273dded5a9f9ac5190f1edf24a00ffd6a1bbd1cb34c757"
@@ -239585,8 +239968,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_8ED0 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11648-L11670"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11648-L11670"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8ed0c00920ce76e832701d45117ed00b12e20588cb6fe8039fbccdfef9841047"
hash = "9724488ca2ba4c787640c49131f4d1daae5bd47d6b2e7e5f9e8918b1d6f655be"
hash = "a66d2fb7ef7350ea74d4290c57fb62bc59c6ea93f759d4ca93c3febca7aeb512"
@@ -239618,8 +240001,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_9724 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11672-L11694"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11672-L11694"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9724488ca2ba4c787640c49131f4d1daae5bd47d6b2e7e5f9e8918b1d6f655be"
hash = "a66d2fb7ef7350ea74d4290c57fb62bc59c6ea93f759d4ca93c3febca7aeb512"
hash = "e77786b21dbe73e9619ac9aac5e7e92989333d559aa22b4b65c97f0a42ff2e21"
@@ -239651,8 +240034,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_9E34 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11696-L11716"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11696-L11716"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9e3430d5e0e93bc4a5dccc985053912065e65722bfc2eaf431bc1da91410434c"
logic_hash = "ad4f1f2d690ba7186459d29163528fbee862a9f19b1106a4de12e483ca106e61"
score = 40
@@ -239681,8 +240064,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_AD8F : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11718-L11738"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11718-L11738"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ad8fd8300ed375e22463cea8767f68857d9a3b0ff8585fbeb60acef89bf4a7d7"
hash = "0507d893e3fd2917c81c1dc13ccb22ae5402ab6ca9fb8d89485010838050d08d"
logic_hash = "2cbeb5784c1f074b8d76d8f884e7529b8c137ff6b9df0320db677927766fcc70"
@@ -239712,8 +240095,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_D7B7 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11740-L11762"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11740-L11762"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d7b743c3f98662c955c616e0d1bb0800c9602e5b6f2385336a72623037bfd6dd"
hash = "567809308cfb72d59b89364a6475f34a912d03889aa50866803ac3d0bf2c3270"
hash = "93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63"
@@ -239745,8 +240128,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_F159 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11764-L11786"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11764-L11786"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f15962354d37089884abba417f58e9dbd521569b4f69037a24a37cfc2a490672"
hash = "9fa120bda98633e30480d8475c9ac6637470c4ca7c63763560bf869138091b01"
hash = "0b547368c03e0a584ae3c5e62af3728426c68b316a15f3290316844d193ad182"
@@ -239778,8 +240161,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfoisys_Hwinfoiakerneldriver_33C6 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11788-L11808"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11788-L11808"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "33c6c622464f80a8d8017a03ff3aa196840da8bb03bfb5212b51612b5cf953dc"
logic_hash = "f575dc35dbb6761ea1e884f83f5c2a4b96f9b0add964fc8bb8eb777bd2a4d4fe"
score = 40
@@ -239808,8 +240191,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_1B17 : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11810-L11830"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11810-L11830"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1b17d12076d047e74d15e6e51e10497ad49419bec7fbe93386c57d3efbaadc0b"
logic_hash = "ec59b785ccb662aa6bb7817d98628e71a29a1e373fb00cd43b5d836d1d5f7b3f"
score = 40
@@ -239838,8 +240221,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_4AC0 : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11832-L11852"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11832-L11852"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4ac08a6035cfcafdac712d7c3cf2eef6e10258f14cee6e80e1ef2f71f5045173"
logic_hash = "bac2fcf05490ae3c528886264cb021832a1063236f1f8c41b1423b473a67fa2f"
score = 40
@@ -239868,8 +240251,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_4E54 : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11854-L11874"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11854-L11874"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4e54e98df13110aac41f3207e400cce2a00df29ce18c32186e536c1de25a75ce"
logic_hash = "518c4f04fad904231c7fcf39c9438535d27dac4583bfabce40aba5f6fa764118"
score = 40
@@ -239898,8 +240281,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_6701 : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11876-L11896"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11876-L11896"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6701433861742c08eb50f1e785962378143ad5b6c374ac29118168599f8a0f1c"
logic_hash = "4c648b588a933666d3d1b4409715d48e6439de62fb5423779c926b3ae6c01f65"
score = 40
@@ -239928,8 +240311,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_6E9E : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11898-L11918"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11898-L11918"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6e9e9e0b9a23deec5f28dc45f0bbe7423565f037f74be2957e82e5f72c886094"
logic_hash = "3f1c9d8418b6e9b963f2aff3835a8c94516a45e7e478d8926f2145c98094a584"
score = 40
@@ -239958,8 +240341,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_7125 : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11920-L11940"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11920-L11940"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7125c9831a52d89d3d59fb28043b67fbe0068d69732da006fabb95550d1fa730"
logic_hash = "b159153548df6bc249d2ca19017b3c65f53603016732732f7a36a16114bcc423"
score = 40
@@ -239988,8 +240371,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_76AF : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11942-L11962"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11942-L11962"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "76af3f9fa111d694e37058606f2636430bdd378c85b94f426fbfcd6666ebe6cc"
logic_hash = "748825e6fa0cf18711e177514b2c16cacd5ecf77f48e2a20a1d3afdff2842c5e"
score = 40
@@ -240018,8 +240401,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_7702 : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11964-L11984"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11964-L11984"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7702f240800528d8186e3e6a26e2680486fed65a6fb5a2a000ad12c1fb61a398"
logic_hash = "9d40a6c2025afbbc04369c8c39108bdc1b8eaf1c76d2e642f865ac8ecfc68c40"
score = 40
@@ -240048,8 +240431,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_8DCE : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L11986-L12006"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L11986-L12006"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8dcec67a1f4903981c3e0ab938784c2f241e041e26748e1c22059e0e507cfb37"
logic_hash = "dd9795cb1a52104c75c1a71cb34e7abbe6f595bd808c5aa8daf12ef6650ff8a8"
score = 40
@@ -240078,8 +240461,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_EC9B : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12008-L12028"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12008-L12028"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ec9bd7fb90c3a2aa4605bd73fe1f74399e2cda75fd4c5fff84660ad4f797c4fe"
logic_hash = "95b11d3ffbc1307c7caf8e4381ccb2387a9eeacdc966f1768c62fe0ca441e158"
score = 40
@@ -240108,8 +240491,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_FF1C : FIL
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12030-L12050"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12030-L12050"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ff1ccef7374a1a5054a6f4437e3e0504b14ed76e17090cc6b1a4ec0e2da427a5"
logic_hash = "22568727876a6cad37efab49c618c9a680d0082f0121f2b61f72bfb6ce9b307d"
score = 40
@@ -240138,8 +240521,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realsilsemiconductorcorporation_Rtsusbwindowsx_W
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12052-L12072"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12052-L12072"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "39171fcaff172d6b38762acef3d3352f9a375e3db7e54a7b51261a53b3c94266"
logic_hash = "1e3b8f65cc006f02f68b7326b2f96669a888ad55da945ee0407ba880bb270f5e"
score = 40
@@ -240168,8 +240551,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_074A : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12074-L12094"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12074-L12094"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761"
logic_hash = "02d968f73ddaf21808522a4c41abe0a691028b1f758a4ebe59ab308704bfcd94"
score = 40
@@ -240198,8 +240581,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_3E1F : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12096-L12116"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12096-L12116"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3e1f592533625bf794e0184485a4407782018718ae797103f9e968ff6f0973a1"
hash = "442c18aeb09556bb779b21185c4f7e152b892410429c123c86fc209a802bff3c"
logic_hash = "cf15efa69f8b7f5e3f052883e300e7822a975e95f1c50055089881c1479266a6"
@@ -240229,8 +240612,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_442C : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12118-L12138"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12118-L12138"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "442c18aeb09556bb779b21185c4f7e152b892410429c123c86fc209a802bff3c"
hash = "3e1f592533625bf794e0184485a4407782018718ae797103f9e968ff6f0973a1"
logic_hash = "b44ece633deccb00cea884422a24053616bf92a71a7f0a0264102d548ce02bb7"
@@ -240260,8 +240643,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_4ED2 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12140-L12160"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12140-L12160"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7"
logic_hash = "f972b648ed6c4945535c17116fd57bb0babc8ad195042e72e7c26c06a154dc96"
score = 40
@@ -240290,8 +240673,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_7133 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12162-L12182"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12162-L12182"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129"
logic_hash = "b02ec8e171f5b3ee6aaa6854e2af0793e3d09393ee7a27ea254dfd97d387ae51"
score = 40
@@ -240320,8 +240703,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_8EF5 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12184-L12204"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12184-L12204"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8ef59605ebb2cb259f19aba1a8c122629c224c58e603f270eaa72f516277620c"
logic_hash = "1744987eb5dcf8d622dbac9094b3c8edaf2f39c339130763443fd22ab6f0bd48"
score = 40
@@ -240350,8 +240733,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_A6F7 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12206-L12226"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12206-L12226"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a6f7897cd08fe9de5e902bb204ff87215584a008f458357d019a50d6139ca4af"
logic_hash = "1985cfc11492f44a487fdb4720c2bc8eaaa9bf64d6ebadb7cb528e6679d8bfa1"
score = 40
@@ -240380,8 +240763,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_DB71 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12228-L12248"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12228-L12248"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "db711ec3f4c96b60e4ed674d60c20ff7212d80e34b7aa171ad626eaa8399e8c7"
logic_hash = "ec209c1505fc42a2c966511688e982a10d32455ae1af1c2d96d8585127c4039f"
score = 40
@@ -240410,8 +240793,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_082C : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12250-L12270"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12250-L12270"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d"
logic_hash = "c944f6e59dee6e04023f076647aa0ccd93d886ad7174b84c05dd551a93560d0e"
score = 40
@@ -240440,8 +240823,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_32E1 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12272-L12292"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12272-L12292"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993"
logic_hash = "fa7948fd783658616b4f730f93e7889edfab8be745b1b069166f33fe9aa70f1f"
score = 40
@@ -240470,8 +240853,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_AB8F : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12294-L12314"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12294-L12314"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89"
logic_hash = "e802b5961434785965dfb3c6a36beacdc9b01adc3edab9cde68f91e056ba1ad7"
score = 40
@@ -240500,8 +240883,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_B205 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12316-L12336"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12316-L12336"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b205835b818d8a50903cf76936fcf8160060762725bd74a523320cfbd091c038"
logic_hash = "4bf874e0f0520238abc366f227a85c2110dbc7ee28cb1147b626456804752b86"
score = 40
@@ -240530,8 +240913,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realteksemiconductorcorp_Cmupx_Cmupxdriverforrea
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12338-L12357"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12338-L12357"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cdf38928a13dfe0e6de054f0229945b9f7db9f88eb7269ecefdceb4b5fab4bfa"
logic_hash = "f801055fef73a0ac11490b5f7503c4f3314018a130564081c038a82d2c28e0ee"
score = 40
@@ -240560,8 +240943,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realteksemiconductorcorp_Rtportsys_Realtekportio
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12359-L12379"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12359-L12379"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ff322cd0cc30976f9dbdb7a3681529aeab0de7b7f5c5763362b02c15da9657a1"
logic_hash = "c7e7b5dfa51e1b7e682beafa0fab85ff57a224ba9b7dc62c2871fdb6497c53c6"
score = 40
@@ -240590,8 +240973,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realteksemiconductorcorp_Rtstpx_Rtstpxdriverforr
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12381-L12400"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12381-L12400"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b19ec8330b026100f705c05b793030ca109e15cbec4ada13b452acf259cc29d5"
logic_hash = "2c27a371c2866f1b075c04a1296b79596c334da1c7aa93045c1bd9d481a9feb2"
score = 40
@@ -240620,8 +241003,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Realteksemiconductorcorporation_Rtspciewindowsx_
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12402-L12422"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12402-L12422"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a1fa7d8275ccd14a6adc438ef4b950e7de4ed26fcbe4b3e184243663b03c83d6"
logic_hash = "859ffd2f82968978f593ee682af5a18c0d29753579e40da2549896f6ce1c75c7"
score = 40
@@ -240650,8 +241033,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontro
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12424-L12444"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12424-L12444"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba"
logic_hash = "2501a008cfec68bf84f57b079c9fd376eddbe2386cb49244a5927fdc642023ba"
score = 40
@@ -240680,8 +241063,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontro
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12446-L12466"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12446-L12466"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704"
logic_hash = "baaf5f73a2e73d3921fa6fb45db2330a6a4ab258b33f0f06898e9f55e6a2dcbe"
score = 40
@@ -240710,8 +241093,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Asrsetupdrvsys_Asrsetupdrvdriver_9D
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12468-L12489"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12468-L12489"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9d9346e6f46f831e263385a9bd32428e01919cca26a035bbb8e9cb00bf410bc3"
hash = "a0728184caead84f2e88777d833765f2d8af6a20aad77b426e07e76ef91f5c3f"
logic_hash = "dcff6bc179805e15997f51afbfcb2ce88c6d928d955a42b6bde5f30866628866"
@@ -240741,8 +241124,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rwdrvdriver_1E0E : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12491-L12517"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12491-L12517"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe"
hash = "3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf"
hash = "45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a"
@@ -240778,8 +241161,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rwdrvdriver_45BA : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12519-L12545"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12519-L12545"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a"
hash = "bdcacb9f373b017d0905845292bca2089feb0900ce80e78df1bcaae8328ce042"
hash = "3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf"
@@ -240815,8 +241198,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rweverythingreadwritedrive
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12547-L12571"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12547-L12571"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb"
hash = "2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f"
hash = "2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a"
@@ -240850,8 +241233,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rweverythingreadwritedrive
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12573-L12597"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12573-L12597"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a"
hash = "3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de"
hash = "2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f"
@@ -240885,8 +241268,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Safenetinc_Hostnt_Hostnt_07B6 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12599-L12619"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12599-L12619"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357"
logic_hash = "236d6c65059404bcb1077e3feee71f72321bcc215ae297d29bd91de673e8f9e5"
score = 40
@@ -240915,8 +241298,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Safeticatechnologies_Stprocessmonitor_Safetica_5
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12621-L12640"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12621-L12640"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df"
logic_hash = "15cb5aab862c0fa651596f8ef47cd5c7d4c49fe4c1c15d12f1be316dcb70259a"
score = 40
@@ -240945,8 +241328,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Safeticatechnologies_Stprocessmonitor_Safetica_7
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12642-L12661"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12642-L12661"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b"
logic_hash = "b52657a760a3b09a88211cace4f38131ddc44cd6b59967428bb9b3193eb89b5f"
score = 40
@@ -240975,8 +241358,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_0EAB : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12663-L12683"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12663-L12683"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0eab16c7f54b61620277977f8c332737081a46bc6bbde50742b6904bdd54f502"
logic_hash = "59e9ef41d0edeb10c7ac2151b856506d5873241ce821760ffb3b89fc769cf1c6"
score = 40
@@ -241005,8 +241388,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_1284 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12685-L12705"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12685-L12705"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1284a1462a5270833ec7719f768cdb381e7d0a9c475041f9f3c74fa8eea83590"
logic_hash = "df7535f4ad2496fa6ca1a0956ecbbb9693c3f2fbf453d147952bc11fccf8fd01"
score = 40
@@ -241035,8 +241418,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_1AAF : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12707-L12727"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12707-L12727"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b"
logic_hash = "ddfd28245855d5f688b08db25724f11e1e8f4517ae0be97817ac268ee5dcafe6"
score = 40
@@ -241065,8 +241448,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_3E27 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12729-L12749"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12729-L12749"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75"
logic_hash = "67fd8bc6bc1fc8195c00a4e2e01adfa369cd6f05bd0264fa0907e644eebd25b9"
score = 40
@@ -241095,8 +241478,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_496F : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12751-L12771"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12751-L12771"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b"
logic_hash = "babd48f9b0387cef031bcca43ebb80430aa3b214d1fdf02d2fa12513d326fe76"
score = 40
@@ -241125,8 +241508,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_881B : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12773-L12793"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12773-L12793"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461"
logic_hash = "a1c3bcab1b640b9bf98730b7fba960647c7365270fb18ffb74d4ab38ca52d978"
score = 40
@@ -241155,8 +241538,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_B019 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12795-L12815"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12795-L12815"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a"
logic_hash = "30468a1f693b0819abb15a094a11510a3b0936872e9e7d1272a31588be832f8e"
score = 40
@@ -241185,8 +241568,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_CBF7 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12817-L12837"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12817-L12837"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cbf74bed1a4d3d5819b7c50e9d91e5760db1562d8032122edac6f0970f427183"
logic_hash = "5634577b6a43552453e5ad52ca74a073ff2966d751a83a2b76a758f6334dcd33"
score = 40
@@ -241215,8 +241598,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_D7C7 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12839-L12859"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12839-L12859"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d7c79238f862b471740aff4cc3982658d1339795e9ec884a8921efe2e547d7c3"
logic_hash = "2bbe62c2314cd6a3959ac8b6dbbf724d8ffa6c1e9e325d94bd25fa7b7925bfb6"
score = 40
@@ -241245,8 +241628,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Ssmartsoftwaresolutionsgmbh_Sysdrvs_Sysdrvs_0E53
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12861-L12881"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12861-L12881"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b"
logic_hash = "11cef10e7cf3411f640a4804c31f355c22ca1bb36b9faeaf217be11131cf067f"
score = 40
@@ -241275,8 +241658,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_75
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12883-L12903"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12883-L12903"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c"
logic_hash = "03a663a0131980e79d980ad497af168fce977470b026fe27620c37fdbc53de0f"
score = 40
@@ -241305,8 +241688,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_78
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12905-L12926"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12905-L12926"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f"
hash = "c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924"
logic_hash = "0bc04482f3d0e77264454fb1c90baef8fc2d30083e391d3285a2a18549739083"
@@ -241336,8 +241719,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_C8
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12928-L12948"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12928-L12948"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada"
logic_hash = "4712ce6514f156ca82308badde22f0c191fd5f10e17ff261be33a215ba6db486"
score = 40
@@ -241366,8 +241749,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxtapsys_Virtualboxhostinte
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12950-L12970"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12950-L12970"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cfa28e2f624f927d4cbd2952306570d86901d2f24e3d07cc6277e98289d09783"
logic_hash = "bafd99cc8f0ef74e34c5ea6fe85e1a6bcd8fb9f6ff69fc1b53c37371a1a8002c"
score = 40
@@ -241396,8 +241779,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxusbmonsys_Virtualboxusbmo
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12972-L12992"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12972-L12992"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8a2482e19040d591c7cec5dfc35865596ce0154350b5c4e1c9eecc86e7752145"
logic_hash = "d5a9285edc6a30b5af06dd219a40bc31a539b2ea3d0d52ea3dc40c6b1c094f2f"
score = 40
@@ -241426,8 +241809,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxusbsys_Virtualboxusbdrive
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L12994-L13014"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L12994-L13014"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5b26c4678ecd37d1829513f41ff9e9df9ef1d1d6fea9e3d477353c90cc915291"
logic_hash = "85c1425ea8e940cb16790361ed88e0581d24492bae3e3980a31ece2aa805fe67"
score = 40
@@ -241456,8 +241839,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Supermicrocomputerinc_Phymem_Phymem_1963 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13016-L13036"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13016-L13036"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52"
logic_hash = "c129bd1b4580bb3a8241890e6993ab9ba9f68cae21264a2ef67e38fa89b0e54c"
score = 40
@@ -241486,8 +241869,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Supermicrocomputerinc_Superbmc_Superbmc_F843 : F
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13038-L13058"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13038-L13058"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35"
logic_hash = "89974654ba0fbf21981c310fca6857de51c2d203a1baf36151ebd2975bfa5082"
score = 40
@@ -241516,8 +241899,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Symanteccorporation_Vproeventmonitorsys_Symantec
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13060-L13080"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13060-L13080"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca"
logic_hash = "2e57b449ea12a900207558cc1440cf4ffba3bf7ab4fff202730b139a4a8574a5"
score = 40
@@ -241546,8 +241929,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_7795 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13082-L13102"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13082-L13102"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c"
logic_hash = "59bccf3bd5979066891d0735a5e0db83373b53470df81f404a524021a8bfc9d1"
score = 40
@@ -241576,8 +241959,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13104-L13125"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13104-L13125"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85"
hash = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
logic_hash = "8e6904e7597b16478aabe54dd098880d2fb8e1c087743cce9c7d561c5185cb72"
@@ -241607,8 +241990,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13127-L13148"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13127-L13148"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1"
hash = "98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb"
logic_hash = "22a6fddd146f52872a19f32dcc068566396052db0e88cef4588c84dc7f0e83a3"
@@ -241638,8 +242021,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13150-L13171"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13150-L13171"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e"
hash = "51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5"
logic_hash = "88463f655ed9c5d5406583a653d6cd2d8a528b69d23281791793485e8b32e657"
@@ -241669,8 +242052,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13173-L13193"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13173-L13193"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb"
logic_hash = "56661a23463e2abdaabbea5546a5ad32f95b2e33357582bfc9602b424b3fa992"
score = 40
@@ -241699,8 +242082,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13195-L13224"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13195-L13224"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a"
hash = "59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879"
hash = "6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7"
@@ -241739,8 +242122,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13226-L13247"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13226-L13247"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc"
hash = "46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7"
hash = "6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e"
@@ -241771,8 +242154,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13249-L13270"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13249-L13270"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa"
hash = "86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675"
logic_hash = "9a40e042d317e64baf22ac711fc8fc5f14d640bd8cbf98a66a774e36781342a2"
@@ -241802,8 +242185,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13272-L13292"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13272-L13292"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c"
logic_hash = "e59b706adea504f3ffd1f6129eb4c578c5060f72581bb4b026aad9f51a7ee9a9"
score = 40
@@ -241832,8 +242215,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13294-L13315"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13294-L13315"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e"
hash = "3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc"
hash = "46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7"
@@ -241864,8 +242247,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13317-L13337"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13317-L13337"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf"
logic_hash = "c20b1652d378331baa2fdfcf11a8e89d34580e6d971b2a894242005c5cba5132"
score = 40
@@ -241894,8 +242277,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13339-L13368"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13339-L13368"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc"
hash = "f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478"
hash = "89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7"
@@ -241934,8 +242317,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13370-L13390"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13370-L13390"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4"
logic_hash = "48dec7429b15651515925452523ef2f422cfce6300be2de859dd14eec2be2ce7"
score = 40
@@ -241964,8 +242347,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13392-L13412"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13392-L13412"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f"
logic_hash = "17eaf4df3f16cd7f5fb0085502844d1398b801b875f0daf0273f396fa5ceeef1"
score = 40
@@ -241994,8 +242377,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Proces
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13414-L13434"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13414-L13434"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c"
logic_hash = "6dd24d00b0b1c5912182d3540d5c5c8bf92dc128d61e3474c02b6c296e543ce5"
score = 40
@@ -242024,8 +242407,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tecsolutionslimited_Thelpersys_Ocularthelper_7E7
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13436-L13455"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13436-L13455"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7e783b0a0ff4710306bb3bca29296cf962ae77abc81245a99f12a9039158226f"
logic_hash = "fd568668873b8565e7a4cfa8850a9bf0610f97e92a4bd94a9e2ea272dde15551"
score = 40
@@ -242054,8 +242437,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Teledynedigitalimaginginc_Cormemsys_Saperalt_40C
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13457-L13476"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13457-L13476"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "40c855d20d497823716a08a443dc85846233226985ee653770bc3b245cf2ed0f"
logic_hash = "997b51c9c485742d608ed6aa4fce3c88a0fef71040f4ebba406239cf2b9ba9ac"
score = 40
@@ -242084,8 +242467,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_0D13 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13478-L13498"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13478-L13498"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0d133ced666c798ea63b6d8026ec507d429e834daa7c74e4e091e462e5815180"
hash = "3670ccd9515d529bb31751fcd613066348057741adeaf0bffd1b9a54eb8baa76"
logic_hash = "da4ee685552b5b46db8f55bdc3d8d9a805dfecd956abb7ec9c964e2d37e1ec15"
@@ -242115,8 +242498,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_3670 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13500-L13520"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13500-L13520"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3670ccd9515d529bb31751fcd613066348057741adeaf0bffd1b9a54eb8baa76"
hash = "0d133ced666c798ea63b6d8026ec507d429e834daa7c74e4e091e462e5815180"
logic_hash = "3ca3c8fe11a696ad5eaf4b806c277a903a665b3c16a5c8a86dbf8468a71ad9ee"
@@ -242146,8 +242529,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_4CE8 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13522-L13542"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13522-L13542"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4ce8583768720be90fae66eed3b6b4a8c7c64e033be53d4cd98246d6e06086d0"
logic_hash = "56c47482120b34385d05b75f4acfb97274917b9f09a0cc3ed3de325f85359867"
score = 40
@@ -242176,8 +242559,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_9399 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13544-L13565"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13544-L13565"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9399f35b90f09b41f9eeda55c8e37f6d1cb22de6e224e54567d1f0865a718727"
hash = "a66b4420fa1df81a517e2bbea1a414b57721c67a4aa1df1967894f77e81d036e"
logic_hash = "941086f0c049e2440e0b61a386e88629d8b963e25b2eb510f430e2089da4b1b1"
@@ -242207,8 +242590,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_BA40 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13567-L13587"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13567-L13587"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ba40b1fc798c2f78165e78997b4baf3d99858ee39a372ca6fbc303057793e50d"
logic_hash = "283e6e4db73123319185021fd07b51a5934ca93f8d655ec140a4bb337c7e8ede"
score = 40
@@ -242237,8 +242620,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_EAE5 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13589-L13609"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13589-L13609"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "eae5c993b250dcc5fee01deeb30045b0e5ee7cf9306ef6edd8c58e4dc743a8ed"
logic_hash = "94448e39f7891b7f638b264c10b7b404a7e627482b2bb0ee2bbe1050408542e3"
score = 40
@@ -242267,8 +242650,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Terabyteinc_Tboflhelper_AA20 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13611-L13629"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13611-L13629"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "aa20aa2316cd6d203146bd2bc5b7466ba7b83a8500654a688172bcafa82ab168"
logic_hash = "5518934d99da2105c1537b6c3799f6a6d37423d19091fcf6484c57b0e7eeaef2"
score = 40
@@ -242295,8 +242678,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_18DE : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13631-L13651"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13631-L13651"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506"
logic_hash = "e9fd590b52a60ce8460346464a70bf12768b0429b789351c0df5898ede50f923"
score = 40
@@ -242325,8 +242708,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_263E : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13653-L13673"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13653-L13673"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24"
logic_hash = "d8549205ba22f91eff72477504adba4bd66a6680cbb0ccfb9b9a1fd55c4c9309"
score = 40
@@ -242355,8 +242738,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2A62 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13675-L13695"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13675-L13695"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8"
logic_hash = "45b3f2b32c4d8c9d6602c3537a6e089e6f8cbd2ccf90ab547891433147231b5f"
score = 40
@@ -242385,8 +242768,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2B4C : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13697-L13717"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13697-L13717"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a"
logic_hash = "d5445038bf7413b033e6accacda01e506ec41b593e42dc5d99d323c7c5954540"
score = 40
@@ -242415,8 +242798,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_58A7 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13719-L13739"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13719-L13739"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495"
logic_hash = "681d64368491f4dc8ac04f162882d01de0df1d6007723a552459ce7a464749c6"
score = 40
@@ -242445,8 +242828,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_9B2F : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13741-L13761"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13741-L13761"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285"
logic_hash = "f4a6e14ca745e7c89efeabbfeed9618f8394aeedb6122a2f299a72a6ac12d55d"
score = 40
@@ -242475,8 +242858,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_A209 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13763-L13783"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13763-L13783"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a2096b460e31451659b0dde752264c362f47254c8191930bc921ff16a4311641"
logic_hash = "d9a4616bf96e10157d796fb9459de13e0e5019be78c761b1d1b1de53a5cef1e1"
score = 40
@@ -242505,8 +242888,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_D0E2 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13785-L13805"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13785-L13805"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605"
logic_hash = "8ad4dd74b5ebbf427f741ed3926064dd1f1b4ad22e7116c3a42347639abd2db9"
score = 40
@@ -242535,8 +242918,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E05E : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13807-L13827"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13807-L13827"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53"
logic_hash = "efed6fd980ede4770f1e8348c2e86a168dd460da1edc9891a9d6d0ef95fddb95"
score = 40
@@ -242565,8 +242948,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E4EC : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13829-L13849"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13829-L13849"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148"
logic_hash = "9ffa4e1f6f0d4bf7e036ef708b8b7389ae024ae19fd71dc9f90197a3950d7760"
score = 40
@@ -242595,8 +242978,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_EF6D : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13851-L13871"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13851-L13871"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850"
logic_hash = "6edf72e73f44e20472ead187fc56525e226c537442a153b252f19c0d9822abba"
score = 40
@@ -242625,8 +243008,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Toolhouseentwicklungskg_Tsdrvxsys_Toolstardriver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13873-L13893"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13873-L13893"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9bf84b41789b3d5d5622732b5c4f5630da189ede2098b0ce166fcae331178377"
logic_hash = "3b960b1676dd426251045c5a4e3a3b42c04839e48a3df49fa67a8cbc6a8282ea"
score = 40
@@ -242655,8 +243038,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Topazofd_Wsddprmsys_Wsddprm_FF5D : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13895-L13915"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13895-L13915"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8"
logic_hash = "2c83624e1c74f53a23cb4c6ba719567a50e037fa1287e18dbb2855608ac61388"
score = 40
@@ -242685,8 +243068,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiospacka
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13917-L13937"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13917-L13937"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073"
logic_hash = "fe9cdeceb618e257b6bb93f36a04fc4f4a43b9929908a01b26a2c95492302fc8"
score = 40
@@ -242715,8 +243098,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiospacka
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13939-L13959"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13939-L13959"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7d4ca5760b6ad2e4152080e115f040f9d42608d2c7d7f074a579f911d06c8cf8"
logic_hash = "bf5da1c310b513f74eb7a37dc8265d60044119287ee0c68afc02459bd5b1e737"
score = 40
@@ -242745,8 +243128,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Activeclean_A903 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13961-L13981"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13961-L13981"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e"
logic_hash = "50ed2770d46ef30268514a1f587138f54838d9a06691a89d4d6191c49f24cee5"
score = 40
@@ -242775,8 +243158,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_61BE : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L13983-L14003"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L13983-L14003"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf"
logic_hash = "d08ab779dc23d1f7b14f9f5304b388a4eb3688347f6d4bb447944032dad96565"
score = 40
@@ -242805,8 +243188,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_A802 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14005-L14025"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14005-L14025"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e"
logic_hash = "092c64b2d07e5eb30e78eab90b3f4fddd5498b6b2e9e0b4f46eb163005e913e5"
score = 40
@@ -242835,8 +243218,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_ADC1 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14027-L14047"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14027-L14047"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee"
logic_hash = "e0ab9b0d06188714c89dd95eb27a85bd38c3616ff5879726163ede986e4407ae"
score = 40
@@ -242865,8 +243248,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_C901 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14049-L14069"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14049-L14069"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c"
logic_hash = "a05e2007e3d56a6f89eb5ae0c53879dd20412af5d70f8d8b54841dc3264be611"
score = 40
@@ -242895,8 +243278,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_3FA6 : F
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14071-L14091"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14071-L14091"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e"
logic_hash = "9a1bdc5ebbb3584f51d9beaa4f288300b53cf04ce64182a68c23b6dc93fd2456"
score = 40
@@ -242925,8 +243308,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_4BC0 : F
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14093-L14113"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14093-L14113"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4"
logic_hash = "2ef481e984a8c4be74bbffa73351655d64a69921b01c38b58fefee3bdeb5283b"
score = 40
@@ -242955,8 +243338,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_ED2F : F
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14115-L14135"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14115-L14135"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39"
logic_hash = "8183384a48b4f9659f1bfd5c8e0fa0971fb33de009d80e4f3a1c75fcfcc8dd35"
score = 40
@@ -242985,8 +243368,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_0909 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14137-L14157"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14137-L14157"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06"
logic_hash = "ace08e2618ae297354c10e4d9b773a760f3d93813657b7d6e4af651b41bf5081"
score = 40
@@ -243015,8 +243398,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_12ED : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14159-L14179"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14159-L14179"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56"
logic_hash = "6726cd70601cadd1f6e25e4ec40102d1e0a67720a40c9adfa990a6593469de2c"
score = 40
@@ -243045,8 +243428,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_1C12 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14181-L14201"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14181-L14201"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687"
logic_hash = "c9122409b64e9a166e0b9fcedfa2f6caeba21517616c68bf0ac06d10e8b3bda3"
score = 40
@@ -243075,8 +243458,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_2AFD : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14203-L14223"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14203-L14223"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30"
logic_hash = "001f70bccf1e8781fffd1598cbdc6bca0dc4d7822d3a97fa99a2b5a7798a35a3"
score = 40
@@ -243105,8 +243488,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3854 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14225-L14246"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14225-L14246"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039"
hash = "b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3"
logic_hash = "a439965b1208a4f886a7c0a8441b13d0ca987b04f05bfae1a544b264780dfb9e"
@@ -243136,8 +243519,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3C42 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14248-L14268"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14248-L14268"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f"
logic_hash = "d193fe0cc13ecc5fd62f12c6e7b39dfe893309988b0ad75086dee5ba342bba7a"
score = 40
@@ -243166,8 +243549,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3E1D : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14270-L14290"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14270-L14290"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272"
logic_hash = "d02a7b3da1314e5db11591febae9768b0dd24122db9510137b498c28d2cf610d"
score = 40
@@ -243196,8 +243579,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_478D : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14292-L14312"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14292-L14312"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0"
logic_hash = "a87cc6c2c1462f6a2dfe70bd5a2b20e52b6afd289bf0b51d2266ba5e5db945d5"
score = 40
@@ -243226,8 +243609,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_4E37 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14314-L14334"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14314-L14334"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69"
logic_hash = "ab62b1353810200de7d901b60f336f0f8acdf31f4ac4111d69f523cf9ddbaec2"
score = 40
@@ -243256,8 +243639,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5027 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14336-L14356"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14336-L14356"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48"
logic_hash = "b32d5fd7cb330cc256b59309904dd0f2e2b22a04579a16fba410f02b7a56b93c"
score = 40
@@ -243286,8 +243669,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5192 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14358-L14378"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14358-L14378"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b"
logic_hash = "68fc6ef964827f1270386eaa57cfc296b9cb41580ec966b5712926c48eb72c7a"
score = 40
@@ -243316,8 +243699,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_62F5 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14380-L14401"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14380-L14401"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0"
hash = "ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7"
logic_hash = "02c131839a9b859780644616181e038a25616c23eaa64a4a0877789905d19b90"
@@ -243347,8 +243730,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_654C : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14403-L14423"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14403-L14423"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad"
logic_hash = "a3a1184bc9be7316835ea820a5ecf5c7d8b2e9e6538464613a60e27b4ff4538d"
score = 40
@@ -243377,8 +243760,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_6FFD : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14425-L14445"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14425-L14445"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc"
logic_hash = "9fb3fb79e6310bdc57f5881afc7f78bd1fbae91085b2f53022728fba6dcdd1ca"
score = 40
@@ -243407,8 +243790,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_76E8 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14447-L14467"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14447-L14467"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524"
logic_hash = "6b72dded569f6fa06deed149094c0a600df998e312bbac2e590bab35233ee927"
score = 40
@@ -243437,8 +243820,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7837 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14469-L14489"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14469-L14489"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408"
logic_hash = "d3d7a26c985fb5d69413576bb84bd96fd403443d9a609796a0fb91ad757e4fb1"
score = 40
@@ -243467,8 +243850,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7C73 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14491-L14512"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14491-L14512"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b"
hash = "fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c"
logic_hash = "e82956b11550d0fbc562c8b91c2f45c295c09a08b413f1cbaac34114ddec7146"
@@ -243498,8 +243881,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_80A5 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14514-L14534"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14514-L14534"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085"
logic_hash = "6616976b6bbe4a32dc528683175ed06d4d95649506a3a6be8fbb449d54df2073"
score = 40
@@ -243528,8 +243911,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_818E : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14536-L14556"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14536-L14556"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01"
logic_hash = "4423eff62247142f110a2a154c6d1aa45243ab1dd2ca6de3c4b5dfc2b2dd9250"
score = 40
@@ -243558,8 +243941,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_8910 : FI
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14558-L14578"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14558-L14578"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10"
hash = "97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd"
logic_hash = "c79577c232b6cfc215d549005c418c4f7ce4fe452f28bc7a3beed62b87292439"
@@ -243589,8 +243972,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_97B3 : FI
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14580-L14600"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14580-L14600"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd"
hash = "89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10"
logic_hash = "800b43309abd2921378c28cace1ccfb2f7d3420c0f7059c9cbd7422095cbba43"
@@ -243620,8 +244003,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_BCFC : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14602-L14622"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14602-L14622"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f"
logic_hash = "3e30691b086de658d82e026659d56c84eaba4eda9800aaab38b16491906ae62d"
score = 40
@@ -243650,8 +244033,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_C082 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14624-L14644"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14624-L14644"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd"
logic_hash = "707ecf255229eba2b17f24ad6c2b0448248d83a96002cf97ece4f16599d5e35b"
score = 40
@@ -243680,8 +244063,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_CC68 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14646-L14666"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14646-L14666"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64"
logic_hash = "0141a02f82f336312b7c68762194be186782d1026b2546498d5ee77eb2759e97"
score = 40
@@ -243710,8 +244093,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_D783 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14668-L14688"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14668-L14688"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f"
logic_hash = "c2a801b7c8b4ec3034e1e6ca8e329b3f52caf8d12dc5753d6443f80b1abd2026"
score = 40
@@ -243740,8 +244123,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_DBC6 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14690-L14710"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14690-L14710"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed"
logic_hash = "2827c335dc164e365e7b70d1d46091a770e01905c7ecd29e011ffe9a7f65395b"
score = 40
@@ -243770,8 +244153,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E3EF : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14712-L14732"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14712-L14732"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918"
logic_hash = "415d9696d5c6425800927cb294aa7b8c434eaa09ff1874d3a2435e3b2fef2ebc"
score = 40
@@ -243800,8 +244183,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E4D9 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14734-L14754"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14734-L14754"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036"
logic_hash = "8c60c83b3eb6bb8175c685b26ac61228d72d5c90272422f5d8c42d634595d843"
score = 40
@@ -243830,8 +244213,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_EC5F : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14756-L14776"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14756-L14776"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5"
logic_hash = "34f57ea4f81c799fbd6d4e05d2971bdd88167efd6d8374211fdb0bc67f234c39"
score = 40
@@ -243860,8 +244243,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_ECD0 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14778-L14798"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14778-L14798"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566"
logic_hash = "013a455b25c88f8ec7f4e7e3d2788ce2007c13fd1edfb0707ac725942797d0ba"
score = 40
@@ -243890,8 +244273,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_FDA9 : FI
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14800-L14820"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14800-L14820"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280"
logic_hash = "f1b90d1d7223562e08fd24e8ae56c060b4551fd7afdfc63dcd515c01c30228a8"
score = 40
@@ -243920,8 +244303,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylaunchantim
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14822-L14842"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14822-L14842"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d0eb3ba0aff471d19260192784bf9f056d669b779b6eaff84e732b7124ce1d11"
logic_hash = "7e27fa1f77897e6bb87da8efa6b496512e129ac87d952f9dfd21acd6d3fdb4d7"
score = 40
@@ -243950,8 +244333,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylaunchantim
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14844-L14864"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14844-L14864"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "dd628061d6e53f3f0b44f409ad914b3494c5d7b5ff6ff0e8fc3161aacec93e96"
logic_hash = "68ff28475ad91569afab83c91f8de2f4a2b8e847d60faaff16c54d6abbdd1bde"
score = 40
@@ -243980,8 +244363,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylaunchantim
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14866-L14886"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14866-L14886"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e505569892551b2ba79d8792badff0a41faea033e8d8f85c3afea33463c70bd9"
logic_hash = "3d6d268326e59b54c6ac69287f4bed50762011e79c4c62539cff81fdf325aede"
score = 40
@@ -244010,8 +244393,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14888-L14908"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14888-L14908"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b"
logic_hash = "48f8d8eca813398d21e3fdb16a4362e31d9e2a89203c9d6c55d28dc93c9cc37a"
score = 40
@@ -244040,8 +244423,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14910-L14930"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14910-L14930"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40"
logic_hash = "a830db3cc3e4b8581d6779bb948cc8c226b43b515de233adc4fd565af852f178"
score = 40
@@ -244070,8 +244453,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublicb
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14932-L14952"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14932-L14952"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712"
logic_hash = "807407933d2bfc92ef6adb04b08da2f665d7647338634420c2c959ff011cef19"
score = 40
@@ -244100,8 +244483,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Watchdogdevelopmentcomllc_Amsdksys_Amsdk_12B3 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14954-L14974"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14954-L14974"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "12b3d8bc5cc1ea6e2acd741d8a80f56cf2a0a7ebfa0998e3f0743fcf83fabb9e"
logic_hash = "fabfc8e94106dd5f845a8fb3b10ac0559257071008addb6a5a036424fa97ff22"
score = 40
@@ -244130,8 +244513,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Watchdogdevelopmentcomllc_Wamsdksys_Wamsdk_0BE8
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14976-L14997"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14976-L14997"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0be8483c2ea42f1ce4c90e84ac474a4e7017bc6d682e06f96dc1e31922a07b10"
hash = "5af1dae21425dda8311a2044209c308525135e1733eeff5dd20649946c6e054c"
logic_hash = "5d3517403b7c79befed4cf4c3d021a75e987e229520b29e7866a5d1b4a80cff1"
@@ -244161,8 +244544,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Watchdogdevelopmentcomllc_Wsdkdsys_Wsdkd_6278 :
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L14999-L15019"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L14999-L15019"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6278bc785113831b2ec3368e2c9c9e89e8aca49085a59d8d38dac651471d6440"
logic_hash = "50b9442a06004fb155ffa070562457631a77aedf9dd4a5355f0517c40d93f0ed"
score = 40
@@ -244191,8 +244574,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wellbiacomcoltd_Xhuntersys_Xigncode_E727 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15021-L15040"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15021-L15040"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e727d0753d2cd0b2f6eeba4cea53aa10b3ff3ed2afeb78f545fcf6d840f85c3e"
logic_hash = "9ed1baa9406fc4421e19f500b25358fc250e1efb1887a8a518fad08ccb485735"
score = 40
@@ -244221,8 +244604,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpudriver_Wi
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15042-L15062"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15042-L15062"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980"
logic_hash = "984a63ed37b45e4fb0508ada56d9c5425d3b4682e5421ca8d34e3a11622c0c79"
score = 40
@@ -244251,8 +244634,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Wind
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15064-L15091"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15064-L15091"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e"
hash = "49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668"
hash = "6001c6acae09d2a91f8773bbdfd52654c99bc672a9756dc4cb53dc2e3efeb097"
@@ -244289,8 +244672,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Wind
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15093-L15120"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15093-L15120"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668"
hash = "84c5f6ddd9c90de873236205b59921caabb57ac6f7a506abbe2ce188833bbe51"
hash = "8e92aacd60fca1f09b7257e62caf0692794f5d741c5d1eec89d841e87f2c359c"
@@ -244327,8 +244710,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Wind
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15122-L15142"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15122-L15142"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "eaa5dae373553024d7294105e4e07d996f3a8bd47c770cdf8df79bf57619a8cd"
logic_hash = "2c4497e7cc7c8a225fbdf34b28bda929f4b3f81e8b5ed4ed441ae21910224e1a"
score = 40
@@ -244357,8 +244740,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Dpmemiosys_W
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15144-L15163"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15144-L15163"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cd631c54fe1375e4bdd2f63b58bd106066eeee267fc77b3161ceb023ab5fddda"
logic_hash = "a5996340f3c398267c1fbd2792c260411267dbc370a0ab38a2babe428279271d"
score = 40
@@ -244387,8 +244770,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Hpvisionsys_
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15165-L15184"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15165-L15184"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c1e11e2012216b54b2aad1be37b469d328f39b09352c66e8c74e6032ec858b96"
logic_hash = "c05e0348b0d4d088462a95a06d48c0914ba80195ab6f6f020fabd1fe4abd2cdc"
score = 40
@@ -244417,8 +244800,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Rtkiosys_Win
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15186-L15207"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15186-L15207"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82"
hash = "916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677"
hash = "caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab"
@@ -244449,8 +244832,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Rtkiosys_Win
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15209-L15230"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15209-L15230"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677"
hash = "caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab"
hash = "478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82"
@@ -244481,8 +244864,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Gdrvsys_Windowsrddkdriver_CF
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15232-L15252"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15232-L15252"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b"
hash = "f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b"
logic_hash = "552218650acd9d7addf9c35cae5f3ff2fc9610421a55db1d94018e6286365669"
@@ -244512,8 +244895,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Gdrvsys_Windowsrddkdriver_F4
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15254-L15274"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15254-L15274"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b"
hash = "cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b"
logic_hash = "e7ca103b49c11733154f9f4bf164be90f25d3534ea103312047d7f1a9c240131"
@@ -244543,8 +244926,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkdriver_
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15276-L15296"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15276-L15296"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "6f806a9de79ac2886613c20758546f7e9597db5a20744f7dd82d310b7d6457d0"
logic_hash = "f5788ab0cbc9e3c8db15a3219d3170760501cf5f024160d14329e388f8bb7ad3"
score = 40
@@ -244573,8 +244956,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkdriver_
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15298-L15319"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15298-L15319"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "a29093d4d708185ba8be35709113fb42e402bbfbf2960d3e00fd7c759ef0b94e"
hash = "c490d6c0844f59fdb4aa850a06e283fbf5e5b6ac20ff42ead03d549d8ae1c01b"
hash = "e3dbafce5ad2bf17446d0f853aeedf58cc25aa1080ab97e22375a1022d6acb16"
@@ -244605,8 +244988,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkdriver_
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15321-L15342"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15321-L15342"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c490d6c0844f59fdb4aa850a06e283fbf5e5b6ac20ff42ead03d549d8ae1c01b"
hash = "a29093d4d708185ba8be35709113fb42e402bbfbf2960d3e00fd7c759ef0b94e"
hash = "e3dbafce5ad2bf17446d0f853aeedf58cc25aa1080ab97e22375a1022d6acb16"
@@ -244637,8 +245020,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkprovide
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15344-L15364"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15344-L15364"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3c0a36990f7eef89b2d5f454b6452b6df1304609903f31f475502e4050241dd8"
logic_hash = "da65187b5025386d93deb27a678bfa2829c2001da996c0928aafc1e428a46273"
score = 40
@@ -244667,8 +245050,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkprovide
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15366-L15386"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15366-L15386"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "71423a66165782efb4db7be6ce48ddb463d9f65fd0f266d333a6558791d158e5"
hash = "8fe429c46fedbab8f06e5396056adabbb84a31efef7f9523eb745fc60144db65"
logic_hash = "e835a0e43380bb3453deb31ea3b971df6f64a8ba608852cc016faf588cb0fc42"
@@ -244698,8 +245081,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkprovide
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15388-L15408"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15388-L15408"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8fe429c46fedbab8f06e5396056adabbb84a31efef7f9523eb745fc60144db65"
hash = "71423a66165782efb4db7be6ce48ddb463d9f65fd0f266d333a6558791d158e5"
logic_hash = "c768c1592586c6a053f69d8f64c66ba213dc054113d98f3144610fdb5978a0f1"
@@ -244729,8 +245112,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrserver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15410-L15430"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15410-L15430"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3"
logic_hash = "bf66fbf3e0cf00fca119fda3400d832b971d0ba956c5ddb482db7297606ebccf"
score = 40
@@ -244759,8 +245142,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrserver
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15432-L15452"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15432-L15452"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "be683cd38e64280567c59f7dc0a45570abcb8a75f1d894853bbbd25675b4adf7"
logic_hash = "b9fc30a913201cecc216bfb985b78d748206c01b8ab878e1197da2af088d30e3"
score = 40
@@ -244789,8 +245172,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserver
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15454-L15476"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15454-L15476"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229"
hash = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
hash = "6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38"
@@ -244822,8 +245205,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserver
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15478-L15500"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15478-L15500"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "88992ddcb9aaedb8bfcc9b4354138d1f7b0d7dddb9e7fcc28590f27824bee5c3"
hash = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
hash = "6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38"
@@ -244855,8 +245238,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Speedfansys_Windowsrse
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15502-L15522"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15502-L15522"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c"
logic_hash = "b85463f570aa4f3d6dc333ab4e73c8e4a873fb42cda602055f76bf8736161923"
score = 40
@@ -244885,8 +245268,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Amifldrvsys_Windowsrwindd
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15524-L15545"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15524-L15545"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20"
hash = "ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f"
logic_hash = "8447cb05f7756af39ff41b5c062a628de82ae8b5f73af617def79ebd148867e3"
@@ -244916,8 +245299,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Atlaccesssys_Windowsrwind
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15547-L15567"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15547-L15567"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0b57569aaa0f4789d9642dd2189b0a82466b80ad32ff35f88127210ed105fe57"
logic_hash = "a28fedf44804f4b3100c2a112fddaccf1dacbadebd3f1feda4ef4903ffc52aac"
score = 40
@@ -244946,8 +245329,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Cpuzsys_Windowsrwinddkdri
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15569-L15600"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15569-L15600"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c"
hash = "2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e"
hash = "4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036"
@@ -244987,8 +245370,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Cupfixerxsys_Windowsrwind
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15602-L15622"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15602-L15622"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9"
logic_hash = "e0e0515264bd09621d3eac6c7b004ac2282c2438d24ead002fe1e9a1be919a72"
score = 40
@@ -245017,8 +245400,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15624-L15644"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15624-L15644"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1698ba7eeee6ff9272cc25b242af89190ff23fd9530f21aa8f0f3792412594f3"
logic_hash = "29ecb986257d9e64b5d418b76193e00746a7e15ccc98f2d5f2ad1171b871303d"
score = 40
@@ -245047,8 +245430,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15646-L15666"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15646-L15666"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3af9c376d43321e813057ecd0403e71cafc3302139e2409ab41e254386c33ecb"
logic_hash = "fa8542efaba7f50f495b5db2323f1434e5903138840343eeeb514834aa8ebf8e"
score = 40
@@ -245077,8 +245460,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15668-L15688"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15668-L15688"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "55b5bcbf8fb4e1ce99d201d3903d785888c928aa26e947ce2cdb99eefd0dae03"
logic_hash = "228b45c3623aea82b18f46155dfc360e7abbb38090aaf03beeb5d4359343384c"
score = 40
@@ -245107,8 +245490,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15690-L15710"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15690-L15710"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9dee9c925f7ea84f56d4a2ad4cf9a88c4dac27380887bf9ac73e7c8108066504"
logic_hash = "b5455e69670f8d00cf0842f3ea86f9b194054462a6f1b6c2640c23ce69130be9"
score = 40
@@ -245137,8 +245520,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15712-L15732"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15712-L15732"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b2247e68386c1bdfd48687105c3728ebbad672daffa91b57845b4e49693ffd71"
logic_hash = "a1bb78ce379ed7b3b9695624f63ceebcca832ecebacbb13fe7832890bc5e9356"
score = 40
@@ -245167,8 +245550,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15734-L15754"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15734-L15754"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c35cab244bd88bf0b1e7fc89c587d82763f66cf1108084713f867f72cc6f3633"
logic_hash = "24944c0b7f30c6bda8560cc7ab0019509e83e5e1489b37a673c34e94325a9038"
score = 40
@@ -245197,8 +245580,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15756-L15776"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15756-L15776"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "f8d45fa03f56e2ea14920b902856666b8d44f1f1b16644baf8c1ae9a61851fb6"
logic_hash = "7a99a9e6d87b31cb0c08b406f362fefad0b49c4040ab5023b3b12471c5182168"
score = 40
@@ -245227,8 +245610,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwi
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15778-L15798"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15778-L15798"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "ff55c1f308a5694eb66a3e9ba326266c826c5341c44958831a7a59a23ed5ecc8"
logic_hash = "c7260c135504dd8d6657d9a65c77c2356e45bf94f0d1e30cabf986bf215fa27b"
score = 40
@@ -245257,8 +245640,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Lgdatacatchersys_Gameacc_
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15800-L15822"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15800-L15822"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "07fb2bb6c852f6a6fe982b2232f047e167be39738bac26806ffe0927ba873756"
hash = "45b07a2f387e047a6bb0e59b7f22fb56182d57b50e84e386a38c2dbb7e773837"
hash = "516159871730b18c2bddedb1a9da110577112d4835606ee79bb80e7a58784a13"
@@ -245289,8 +245672,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwind
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15824-L15850"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15824-L15850"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0eace788e09c8d3f793a1fad94d35bcfd233f0777873412cd0c8172865562eec"
hash = "47e35f474f259314c588af35e88561a015801b52db523eb75fc7eccff8b3be4d"
hash = "5c54a5cd3386ac14725a07962562e9fdcefbb7be0d19803f9d71de24573de1e3"
@@ -245326,8 +245709,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwind
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15852-L15877"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15852-L15877"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "0f3e7bf7b103613844a38afb574817ddaecd00e4d206d891660dbb0e5dfee04e"
hash = "1a0f57a4d7c8137baf24c65d542729547b876979273df7a245aaeea87280c090"
hash = "62b14bb308c99132d90646e85bc7d6eb593f38e225c8232f69f24b74a019c176"
@@ -245362,8 +245745,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwind
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15879-L15904"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15879-L15904"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9dbc2a37f53507296cc912e7d354dab4e55541ba821561aa84f74d1bd8346be2"
hash = "65a3e69854c729659281d2c5f8a4c8274ad3606befdcd9e1b79d3262f260bfa1"
hash = "71701c5c569ef67391c995a12b21ca06935b7799ed211d978f7877115c58dce0"
@@ -245398,8 +245781,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwind
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15906-L15932"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15906-L15932"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "db1dbb09d437d3e8bed08c88ca43769b4fe8728f68b78ff6f9c8d2557e28d2b1"
hash = "5c54a5cd3386ac14725a07962562e9fdcefbb7be0d19803f9d71de24573de1e3"
hash = "6703400b490b35bcde6e41ce1640920251855e6d94171170ae7ea22cdd0938c0"
@@ -245435,8 +245818,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Psmounterexsys_Psmountere
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15934-L15954"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15934-L15954"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "4e99d454a56845bb0e622cfd68b895b7868ef7e8a43424e5b7b803f5a2d25eca"
logic_hash = "f5d678f4df74da6944e08596024d4d74b39faa44bbee69a81ece66d2cfda3705"
score = 40
@@ -245465,8 +245848,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Sbiosiosys_Samsungrbiosio
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15956-L15977"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15956-L15977"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "1e24c45ce2672ee403db34077c88e8b7d7797d113c6fd161906dce3784da627d"
hash = "39336e2ce105901ab65021d6fdc3932d3d6aab665fe4bd55aa1aa66eb0de32f0"
logic_hash = "88fe87f9b21325471263b8dddb2787b36b44b5ce04f82b948bc466e5a6a0187c"
@@ -245496,8 +245879,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Sbiosiosys_Samsungrbiosio
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L15979-L15999"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L15979-L15999"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "442d506c1ac1f48f6224f0cdd64590779aee9c88bdda2f2cc3169b862cba1243"
hash = "b3d1bdd4ad819b99870b6e2ed3527dfc0e3ce27b929ad64382b9c3d4e332315c"
logic_hash = "21c4f027e3067272f96fbab6a6c151c952e8491919bfd54f56a170319a128420"
@@ -245527,8 +245910,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Sbiosiosys_Samsungrbiosio
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16001-L16021"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16001-L16021"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "b3d1bdd4ad819b99870b6e2ed3527dfc0e3ce27b929ad64382b9c3d4e332315c"
hash = "442d506c1ac1f48f6224f0cdd64590779aee9c88bdda2f2cc3169b862cba1243"
logic_hash = "5bcc568a4f4edc03e51801c4b256b34ed7f7ae08b7e00ca3f4bd7559502e3c76"
@@ -245558,8 +245941,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Sioctlsys_Windowsrwinddkd
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16023-L16042"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16023-L16042"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3a24b63cce5a4b7bd6188940af75b05a414b283c3c8eb528b5ba607ef720fc93"
logic_hash = "8b3fcd30476513fc5a6d54a7abc2ef09448d21fd3d233558d864876c0104d81e"
score = 40
@@ -245588,8 +245971,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Vmdrvsys_Windowsrwinddkdr
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16044-L16065"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16044-L16065"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351"
hash = "5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921"
hash = "d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3"
@@ -245620,8 +246003,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Vmdrvsys_Windowsrwinddkdr
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16067-L16088"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16067-L16088"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921"
hash = "32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351"
hash = "d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3"
@@ -245652,8 +246035,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Wnbiossys_Windowsrwinddkd
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16090-L16110"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16090-L16110"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "530d9223ec7e4123532a403abef96dfd1af5291eb49497392ff5d14d18fccfbb"
logic_hash = "872b7d9fe3d091494edd51bee2949fb66b3bfdf1c6dd37f69d786135bd28f4b0"
score = 40
@@ -245682,8 +246065,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowswinowsdriverkitsprovider_Hwrwdrvsys_Hardw
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16112-L16131"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16112-L16131"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "017933be6023795e944a2a373e74e2cc6885b5c9bc1554c437036250c20c3a7d"
logic_hash = "209103a9a5a00924d70ea6465465108829d63a82f0cc974bb22bb1862ddb69c4"
score = 40
@@ -245712,8 +246095,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Windowswinowsdriverkitsprovider_Hwrwdrvsys_Hardw
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16133-L16153"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16133-L16153"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21"
logic_hash = "c944a18684124e98a0303af65effe0d0430ffbffc1706703de85c396f95fe2db"
score = 40
@@ -245742,8 +246125,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_358A : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16155-L16178"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16155-L16178"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69"
hash = "48b1344e45e4de4dfb74ef918af5e0e403001c9061018e703261bbd72dc30548"
hash = "786f0ba14567a7e19192645ad4e40bee6df259abf2fbdfda35b6a38f8493d6cc"
@@ -245776,8 +246159,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_5E27 : FILE
date = "2026-04-28"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16180-L16200"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16180-L16200"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "5e27fe26110d2b9f6c2bad407d3d0611356576b531564f75ff96f9f72d5fcae4"
hash = "9d530642aeb6524691d06b9e02a84e3487c9cdd86c264b105035d925c984823a"
logic_hash = "79d95f03a2fb173ec0bdb47b2ac08b239add99b480af7ef8d89e864f210646d1"
@@ -245807,8 +246190,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_786F : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16202-L16225"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16202-L16225"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "786f0ba14567a7e19192645ad4e40bee6df259abf2fbdfda35b6a38f8493d6cc"
hash = "87aae726bf7104aac8c8f566ea98f2b51a2bfb6097b6fc8aa1f70adeb4681e1b"
hash = "daf549a7080d384ba99d1b5bd2383dbb1aa640f7ea3a216df1f08981508155f5"
@@ -245841,8 +246224,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_9D53 : FILE
date = "2025-09-18"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16227-L16247"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16227-L16247"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9d530642aeb6524691d06b9e02a84e3487c9cdd86c264b105035d925c984823a"
hash = "5e27fe26110d2b9f6c2bad407d3d0611356576b531564f75ff96f9f72d5fcae4"
logic_hash = "bdf3933b96f571ca3f07d9c3775847d5053f3f147b75068e7dad4a152480935e"
@@ -245872,8 +246255,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wistroncorporation_Wirwadrvsys_Wistronrwadriver_
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16249-L16269"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16249-L16269"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d8fc8e3a1348393c5d7c3a84bcbae383d85a4721a751ad7afac5428e5e579b4e"
logic_hash = "4270da4954e5e18e0af84d2e25b81d2ffc3ebbb88b56df82c007e845321e73d1"
score = 40
@@ -245902,8 +246285,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wj_Kprocesshacker_7021 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16271-L16290"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16271-L16290"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4"
logic_hash = "bc96fa80c146ac50a0fbe911d156319a8a0e294274555470a4e54bcbeb4b0382"
score = 40
@@ -245931,8 +246314,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wj_Kprocesshacker_C725 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16292-L16311"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16292-L16311"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c"
logic_hash = "ddad54eb78252b66738762ec084b5c6217d1fbe43fbf63478907c14a283ecd45"
score = 40
@@ -245960,8 +246343,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Wwwseavocom_Wwwseavocom_Seavoapidriver_9ADE : FI
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16313-L16332"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16313-L16332"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9ade632e54c3f5e8c75eaf636f2910bad3a8a07d6f078e48c9641d3af1fe811c"
logic_hash = "0ad273ea8a7cc0eac364e89c8c8e631e1f5c5087acc261981464a6d37b413c7e"
score = 40
@@ -245990,8 +246373,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Yyinc_Dianhu_80CB : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16334-L16353"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16334-L16353"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3"
hash = "bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955"
logic_hash = "51f777627c894168be2a39b29c43605c056f315455a891f0c96af22cde6479a5"
@@ -246019,8 +246402,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Z_Computerzsys_Zwuqisystemdriver_61E7 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16355-L16375"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16355-L16375"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "61e7f9a91ef25529d85b22c39e830078b96f40b94d00756595dded9d1a8f6629"
logic_hash = "132de64c1bd400ff81be20bcfa3abf1740cad35980a0e995c15a7f0e962d04ba"
score = 40
@@ -246049,8 +246432,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_2BBC : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16377-L16394"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16377-L16394"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1"
logic_hash = "ba1505a26c24cfba8c70003ece48df45ab0df32fc3c4bcd5760584adc95c2207"
score = 40
@@ -246076,8 +246459,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_3C18 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16396-L16413"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16396-L16413"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b"
logic_hash = "299fe3e9d60a3210ca49f9f528775ad4007fb126387193373306e790a40e7578"
score = 40
@@ -246103,8 +246486,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_45F4 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16415-L16432"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16415-L16432"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef"
logic_hash = "703a9473a0b0e6b5d1b46383d5753b1d001f8c00255f60fcb75ae19136d187f8"
score = 40
@@ -246130,8 +246513,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_5439 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16434-L16452"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16434-L16452"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91"
hash = "ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd"
logic_hash = "8ab59a57c8a0ecb78639fc51c7c6879c1e4ee5a8bc89c983174b86c78c939fd3"
@@ -246158,8 +246541,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_7661 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16454-L16471"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16454-L16471"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a"
logic_hash = "78b00b4f59a463a571eadedc898a5b8a4cbe26d6d24fd73c519a83593220a540"
score = 40
@@ -246185,8 +246568,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_7CB5 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16473-L16491"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16473-L16491"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21"
logic_hash = "79e32d2f75689c60ac3961cc83ea9789af1c2b56a1dbfa1a1b24cde36b81bbb9"
score = 40
@@ -246213,8 +246596,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_8FE9 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16493-L16510"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16493-L16510"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a"
logic_hash = "df8222658326582813aaa02cecc07288305aedc239e94d17400da97cee6a3f53"
score = 40
@@ -246240,8 +246623,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_9A95 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16512-L16529"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16512-L16529"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c"
logic_hash = "539419b2187dbbddbb48cd6938f9744999c87649c5d809ef211acf720de9bfd2"
score = 40
@@ -246267,8 +246650,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_D7E0 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16531-L16549"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16531-L16549"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0"
logic_hash = "4d20a02f6fdf66a0d87d0deee345d5e6da7597b22430f3a5a613b4d0481f60b3"
score = 40
@@ -246295,8 +246678,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_DE8F : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16551-L16568"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16551-L16568"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c"
logic_hash = "5eb6aa6b325bc423a6da4014edf8a1d40c5afc51456b2ed590187c0c2924e270"
score = 40
@@ -246322,8 +246705,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_E428 : FILE
date = "2025-09-18"
modified = "2026-04-28"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16570-L16587"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16570-L16587"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f"
logic_hash = "1aed371a8e52d3033aae6f0897b706058c21ca29c553788dc780611bab9761fe"
score = 40
@@ -246349,8 +246732,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zmanaltd_Zam_078E : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16589-L16605"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16589-L16605"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "078e7fb479ad6f0734682d41a17d41518de35bf4f6c5c212643b7d37e641041e"
logic_hash = "b40e58a457a5e62604f3f9d83a58cd3831983ea029c6a5470bdb8f70abedf2b8"
score = 40
@@ -246376,8 +246759,8 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zyarkit_4688 : FILE
date = "2026-07-10"
modified = "2026-07-10"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/detections/yara/yara-rules_vuln_drivers_strict.yar#L16607-L16626"
- license_url = "https://github.com/magicsword-io/LOLDrivers//blob/2ad986b10a5f0b859b22d52b1ad4afe4c4551532/LICENSE"
+ source_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/detections/yara/yara-rules_vuln_drivers_strict.yar#L16607-L16626"
+ license_url = "https://github.com/magicsword-io/LOLDrivers//blob/1c60ea1c8909396fe294c76aaafae4923b6dbea1/LICENSE"
hash = "46883bc25c77678f60c1b836f4c438d87158c9af6b229f533522f635a0d5276e"
logic_hash = "b2a3d7a2a4f60fa838bbba213048ea4ef1ac3ec3c63a884433d6bcac599da715"
score = 40
@@ -246401,7 +246784,7 @@ rule LOLDRIVERS_PUA_VULN_Driver_Zyarkit_4688 : FILE
* YARA Rule Set
* Repository Name: SEKOIA
* Repository: https://github.com/SEKOIA-IO/Community
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: fa3a9630ef9ce484fb1b945480a43f989e6865d4
* Number of Rules: 746
* Skipped: 0 (age), 3 (quality), 0 (score), 0 (importance)
@@ -253352,7 +253735,7 @@ rule SEKOIA_Emmenhtal_Strings_Hta_Exe : FILE
hash = "e86a22f1c73b85678e64341427c7193ba65903f3c0f29af2e65d7c56d833d912"
logic_hash = "93f85a4ccb58c6aeb664c4c843ff80a4ab7b4308a944537f7ebe087515a61659"
score = 75
- quality = 55
+ quality = 80
tags = "FILE"
version = "1.0"
classification = "TLP:CLEAR"
@@ -253956,7 +254339,7 @@ rule SEKOIA_Technique_Csv_Dde_Exec_Regex : FILE
license_url = "https://github.com/SEKOIA-IO/Community/blob/fa3a9630ef9ce484fb1b945480a43f989e6865d4/LICENSE.md"
logic_hash = "fd4c64ad094b8ed543cc6990f2e4f341bb38ba0b4d335347e5676475da94dc06"
score = 75
- quality = 28
+ quality = 53
tags = "FILE"
version = "1.0"
classification = "TLP:CLEAR"
@@ -261492,7 +261875,7 @@ rule SEKOIA_Implant_Win_Flagpro : FILE
license_url = "https://github.com/SEKOIA-IO/Community/blob/fa3a9630ef9ce484fb1b945480a43f989e6865d4/LICENSE.md"
logic_hash = "eb1aba9924af474d6d890572a9bf72e0d1aa5dc31dd4cc34648195b0207ab4d6"
score = 75
- quality = 55
+ quality = 80
tags = "FILE"
version = "1.0"
classification = "TLP:CLEAR"
@@ -262193,7 +262576,7 @@ rule SEKOIA_Infostealer_Win_Solarmarker_Powershell : FILE
license_url = "https://github.com/SEKOIA-IO/Community/blob/fa3a9630ef9ce484fb1b945480a43f989e6865d4/LICENSE.md"
logic_hash = "32267cf7e03ed65da969aeeff5ef5d7291e47446ea11a4b391f085967e8aa67d"
score = 75
- quality = 55
+ quality = 80
tags = "FILE"
version = "1.0"
classification = "TLP:CLEAR"
@@ -263936,7 +264319,7 @@ rule SEKOIA_Loader_Win_Batloader_Scripts : FILE
license_url = "https://github.com/SEKOIA-IO/Community/blob/fa3a9630ef9ce484fb1b945480a43f989e6865d4/LICENSE.md"
logic_hash = "aab6c7780bbc7bed8994b4e70129107bb7b719642fae92b1d3f9146eb11efabc"
score = 75
- quality = 55
+ quality = 80
tags = "FILE"
version = "1.0"
classification = "TLP:CLEAR"
@@ -268415,7 +268798,7 @@ rule SEKOIA_Loader_Win_Purecrypter : FILE
license_url = "https://github.com/SEKOIA-IO/Community/blob/fa3a9630ef9ce484fb1b945480a43f989e6865d4/LICENSE.md"
logic_hash = "5d0d733a4f8447d2d51656a20640fc9482581e19ba1d53fed7d98e85bb748763"
score = 75
- quality = 55
+ quality = 80
tags = "FILE"
version = "1.0"
classification = "TLP:CLEAR"
@@ -269409,7 +269792,7 @@ rule SEKOIA_Generic_Sharpshooter_Payload_1 : FILE
* YARA Rule Set
* Repository Name: Synacktiv
* Repository: https://github.com/synacktiv/synacktiv-rules
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: d234cc4da0783db7dca56ae8dd5252afdc248df8
* Number of Rules: 8
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -269766,7 +270149,7 @@ rule SYNACKTIV_MAL_Linkpro_Arpdiag_ELF_KO_Oct25 : FILE
* YARA Rule Set
* Repository Name: ArtifactDrop
* Repository: https://github.com/matthieugras/artifact-drop/
- * Retrieval Date: 2026-09-06
+ * Retrieval Date: 2026-09-13
* Git Commit: d2bcbe820bc134a4ed672ef6013498f856561af4
* Number of Rules: 1
* Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
@@ -269825,10 +270208,10 @@ rule ARTIFACTDROP_Go_Reflectiveloader_Decryption_Loop : FILE
* YARA Rule Set
* Repository Name: Signature Base
* Repository: https://github.com/Neo23x0/signature-base
- * Retrieval Date: 2026-09-06
- * Git Commit: 278165d7845decece517f756cf92ff4a41938d1e
- * Number of Rules: 4872
- * Skipped: 0 (age), 9 (quality), 4 (score), 0 (importance)
+ * Retrieval Date: 2026-09-13
+ * Git Commit: 94a1c48d7ab499879287ff611dfe7f9c56376030
+ * Number of Rules: 4873
+ * Skipped: 0 (age), 7 (quality), 4 (score), 0 (importance)
*
*
* LICENSE
@@ -269882,8 +270265,8 @@ private rule SIGNATURE_BASE_Hatman_Mftmsr_PRIVATE : HATMAN
date = "2017-12-19"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hatman.yar#L77-L87"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hatman.yar#L77-L87"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a03a3f5c583843acb216a8edefceaa1e89248fe72db49bcd906d2183998b1674"
score = 75
quality = 85
@@ -269907,8 +270290,8 @@ private rule SIGNATURE_BASE_Hatman_Origcode_PRIVATE : HATMAN
date = "2017-12-19"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hatman.yar#L68-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hatman.yar#L68-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f6286e084bdbf3e2730a1aa3b7e302c1611c987447e083780e2d03000d1d226e"
score = 75
quality = 85
@@ -269930,8 +270313,8 @@ private rule SIGNATURE_BASE_Hatman_Loadoff_PRIVATE : HATMAN
date = "2017-12-19"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hatman.yar#L88-L98"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hatman.yar#L88-L98"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "70d33c40b919d1852eded8c4afa96978c8b4503f95fb4a48e1d8b89864b77d38"
score = 75
quality = 85
@@ -269955,8 +270338,8 @@ private rule SIGNATURE_BASE_Hatman_Origaddr_PRIVATE : HATMAN
date = "2017-12-19"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hatman.yar#L59-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hatman.yar#L59-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e9f775326dc0496662fbec98438e0273c51a88a434542dfcabd6e8b11131ab3e"
score = 75
quality = 85
@@ -269978,8 +270361,8 @@ private rule SIGNATURE_BASE_Hatman_Memcpy_PRIVATE : HATMAN
date = "2017-12-19"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hatman.yar#L31-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hatman.yar#L31-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1e1566cc09e1ddd70cdb3b199f6972931f84a29ae2ef4815a5ecf1fe42afe42b"
score = 75
quality = 85
@@ -270003,8 +270386,8 @@ private rule SIGNATURE_BASE_Hatman_Nullsub_PRIVATE : HATMAN
date = "2017-12-19"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hatman.yar#L51-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hatman.yar#L51-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7e7a7494e68450a03aeddfaa1fd0a3fb3cff06684d5bb0c4615571e698293fe3"
score = 75
quality = 85
@@ -270025,8 +270408,8 @@ private rule SIGNATURE_BASE_Hatman_Dividers_PRIVATE : HATMAN
date = "2017-12-19"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hatman.yar#L42-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hatman.yar#L42-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "92ec47ea81b78ec9b05f5c17164daaef7112c8590b4443f70cf3bf2efd108e1f"
score = 75
quality = 85
@@ -270048,8 +270431,8 @@ private rule SIGNATURE_BASE_Hatman_Setstatus_PRIVATE : HATMAN
date = "2017-12-19"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hatman.yar#L21-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hatman.yar#L21-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "264292bbc479413bf70f05b96bcea3c856906eb8c711720831bea9b887a7ffb0"
score = 75
quality = 85
@@ -270072,8 +270455,8 @@ rule SIGNATURE_BASE_SUSP_WER_Critical_Heapcorruption : FILE
date = "2019-10-18"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1185459425710092288"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_wer_files.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_wer_files.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "efa84e375f31ca37b9dd9c7a74251929ac957b9bd530e92f74b8836f56048fea"
score = 45
quality = 85
@@ -270096,11 +270479,11 @@ rule SIGNATURE_BASE_SUSP_WER_Suspicious_Crash_Directory : FILE
date = "2019-10-18"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1185585050059976705"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_wer_files.yar#L20-L54"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_wer_files.yar#L20-L54"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a197feeafca38ffe33428fa807e2b80e3071ab8960926fc2f328748bda299910"
score = 45
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -270127,8 +270510,8 @@ rule SIGNATURE_BASE_Malware_Floxif_Mpsvc_Dll : HIGHVOL FILE
date = "2017-04-07"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_floxif.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_floxif.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1e654ee1c4736f4ccb8b5b7aa604782cfb584068df4d9e006de8009e60ab5a14"
logic_hash = "e51258558dfd9a2c65589100a224492f4582067484c99d405b2d432a48cc6ed8"
score = 75
@@ -270153,8 +270536,8 @@ rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Eraser_1 : FILE
date = "2020-05-16"
modified = "2023-12-05"
reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_academic_data_centers_camp_may20.yar#L1-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_academic_data_centers_camp_may20.yar#L1-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "552245645cc49087dfbc827d069fa678626b946f4b71cb35fa4a49becd971363"
logic_hash = "9a0410e86fa8fb8b599e5b8a6508d6889eb6e26600f0ecf222561ac4a169676d"
score = 75
@@ -270179,8 +270562,8 @@ rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Loader_1 : FILE
date = "2020-05-16"
modified = "2023-12-05"
reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_academic_data_centers_camp_may20.yar#L20-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_academic_data_centers_camp_may20.yar#L20-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0efdd382872f0ff0866e5f68f0c66c01fcf4f9836a78ddaa5bbb349f20353897"
logic_hash = "a73883f9fdf3d53694d9f9efec5f8f15994c5fd80c5f2a87b1741db6b954a023"
score = 75
@@ -270204,8 +270587,8 @@ rule SIGNATURE_BASE_Sphinx_Moth_Cudacrt : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "www.kudelskisecurity.com"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sphinx_moth.yar#L9-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sphinx_moth.yar#L9-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ae7ff3d5ffd29de80ce5dcccde9af04d2537a279fe35f6e94257d59a462ba6a0"
score = 75
quality = 85
@@ -270231,8 +270614,8 @@ rule SIGNATURE_BASE_Sphinx_Moth_H2T : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "www.kudelskisecurity.com"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sphinx_moth.yar#L28-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sphinx_moth.yar#L28-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7aca260d415de84cf432b18385db6a9768a036e3bd0a9aa8ded4a1bfcad26d0c"
score = 75
quality = 85
@@ -270258,8 +270641,8 @@ rule SIGNATURE_BASE_Sphinx_Moth_Iastor32 : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "www.kudelskisecurity.com"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sphinx_moth.yar#L47-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sphinx_moth.yar#L47-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "056949677654a88fb430c988939006dacfefdabbe12824936a01e5aabbb73441"
score = 75
quality = 85
@@ -270281,8 +270664,8 @@ rule SIGNATURE_BASE_Sphinx_Moth_Kerberos32 : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "www.kudelskisecurity.com"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sphinx_moth.yar#L61-L85"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sphinx_moth.yar#L61-L85"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5b672c9b9b0ffffd8f243832ea217bfc10b08026c71d297ee1047ca999fb829c"
score = 75
quality = 85
@@ -270315,8 +270698,8 @@ rule SIGNATURE_BASE_Sphinx_Moth_Kerberos64 : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "www.kudelskisecurity.com"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sphinx_moth.yar#L87-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sphinx_moth.yar#L87-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "13aeb72fcd0f5fd6e73464a90787c756c50569f9eae48945e4ff90d8f9073585"
score = 75
quality = 85
@@ -270343,8 +270726,8 @@ rule SIGNATURE_BASE_Sphinx_Moth_Nvcplex : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "www.kudelskisecurity.com"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sphinx_moth.yar#L106-L120"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sphinx_moth.yar#L106-L120"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2f851c0ab8c4a426b00addfbe0da7ceebb08e93014efcb11d64247d14fec909b"
score = 75
quality = 85
@@ -270368,8 +270751,8 @@ rule SIGNATURE_BASE_MAL_Backdoor_Naikon_APT_Sample1 : FILE
date = "2015-05-14"
modified = "2023-01-06"
reference = "https://goo.gl/7vHyvh"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_naikon.yar#L2-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_naikon.yar#L2-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d5716c80cba8554eb79eecfb4aa3d99faf0435a1833ec5ef51f528146c758eba"
hash = "f5ab8e49c0778fa208baad660fe4fa40fc8a114f5f71614afbd6dcc09625cb96"
logic_hash = "e582fc3518dab2392a79909b5369c48656b6f280b915fad4befb0839ec7ce1bd"
@@ -270408,8 +270791,8 @@ rule SIGNATURE_BASE_APT_Malware_Commentcrew_Miniasp : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_miniasp.yar#L2-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_miniasp.yar#L2-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0af4360a5ae54d789a8814bf7791d5c77136d625"
hash = "777bf8def279942a25750feffc11d8a36cc0acf9"
hash = "173f20b126cb57fc8ab04d01ae223071e2345f97"
@@ -270450,8 +270833,8 @@ rule SIGNATURE_BASE_Apt_Hellsing_Implantstrings : FILE
date = "2015-04-07"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hellsing_kaspersky.yar#L2-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hellsing_kaspersky.yar#L2-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d62dc766a40d1dc7044cc5c9f07a78d36e231b771fafb52442b26514f4c603db"
score = 75
quality = 85
@@ -270488,8 +270871,8 @@ rule SIGNATURE_BASE_Apt_Hellsing_Installer : FILE
date = "2015-04-07"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hellsing_kaspersky.yar#L31-L54"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hellsing_kaspersky.yar#L31-L54"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "556898e9507835d93e2cf7e21e997b6e64dc154ac675b429f5f8226bf929309c"
score = 75
quality = 85
@@ -270523,8 +270906,8 @@ rule SIGNATURE_BASE_Apt_Hellsing_Proxytool : FILE
date = "2015-04-07"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hellsing_kaspersky.yar#L56-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hellsing_kaspersky.yar#L56-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8f2656e7b4e6fb5336fb4e39bcec3e99531db532f757b65e3aa12cd2a4334840"
score = 50
quality = 85
@@ -270552,8 +270935,8 @@ rule SIGNATURE_BASE_Apt_Hellsing_Xkat : FILE
date = "2015-04-07"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hellsing_kaspersky.yar#L76-L97"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hellsing_kaspersky.yar#L76-L97"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ba74ca11c96e59a04f1cb57b4866df7a581ad94ca81230f2ca5068c8808297aa"
score = 75
quality = 85
@@ -270587,8 +270970,8 @@ rule SIGNATURE_BASE_Apt_Hellsing_Msgertype2 : FILE
date = "2015-04-07"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hellsing_kaspersky.yar#L99-L117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hellsing_kaspersky.yar#L99-L117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "232e4dfd8d236da223240d9a4ec3f8bfa635d51d7376ff19dfa5579af31fc47f"
score = 75
quality = 85
@@ -270616,8 +270999,8 @@ rule SIGNATURE_BASE_Apt_Hellsing_Irene : FILE
date = "2015-04-07"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hellsing_kaspersky.yar#L119-L137"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hellsing_kaspersky.yar#L119-L137"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e7da04083468dba7045b55181642d7cd57d543fbeda24685ba2ac63799740798"
score = 75
quality = 85
@@ -270645,8 +271028,8 @@ rule SIGNATURE_BASE_HKTL_NET_Edge_Saved_Passwords_Dumper_May26
date = "2026-05-05"
modified = "2026-05-15"
reference = "https://github.com/L1v1ng0ffTh3L4N/Proof-of-Concepts/tree/main/EdgeSavedPasswordsDumper"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/hktl_edge_pwd_dumper_may25.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_edge_pwd_dumper_may25.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b0bfcb6fd5968ed8b7b025dc6fb0e2874eb49e00ffc4827e3cd334a8c48d2f12"
score = 80
quality = 85
@@ -270670,8 +271053,8 @@ rule SIGNATURE_BASE_SUSP_Email_Redirection_Spoofing_Feb25
date = "2025-02-20"
modified = "2025-03-20"
reference = "https://any.run/cybersecurity-blog/cyber-attacks-january-2025/#fake-youtube-links-redirect-users-to-phishing-pages-11298"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_email_redirection_spoofing.yar#L1-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_email_redirection_spoofing.yar#L1-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b196220b369c199a7e4d57cb5db18b32eb2565a6f9190929c5c01ac4fa04ac8"
hash = "c4eb35c1a1c10226bff9bb0c88ca516441208d193b4994eeb292a66e53a2cc04"
hash = "e3b8ea03a472348814c6ac81088234836e627a1878ec36e46ce62526e1390935"
@@ -270698,8 +271081,8 @@ rule SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_1 : FILE
date = "2021-07-02"
modified = "2023-12-05"
reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_revil_general.yar#L3-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_revil_general.yar#L3-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e"
hash = "aae6e388e774180bc3eb96dad5d5bfefd63d0eb7124d68b6991701936801f1c7"
hash = "dc6b0e8c1e9c113f0364e1c8370060dee3fcbe25b667ddeca7623a95cd21411f"
@@ -270730,8 +271113,8 @@ rule SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_2 : FILE
date = "2021-07-02"
modified = "2023-12-05"
reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_revil_general.yar#L32-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_revil_general.yar#L32-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402"
hash = "8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd"
hash = "cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6"
@@ -270764,8 +271147,8 @@ rule SIGNATURE_BASE_Kriskynote_Mar17_1 : FILE
date = "2017-03-03"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_kriskynote.yar#L11-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_kriskynote.yar#L11-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a19c4b615aa54207604b181873e614d84126b639fee2cce3ca9d5bd863f6f577"
hash = "62b41db0bf63fa45a2c2b0f5df8c2209a5d96bf2bddf82749595c66d30b7ec61"
logic_hash = "cc4861f3a612cbaba6abf8ded76972941c879f04b59c29756bf0ba8083bf93ab"
@@ -270792,8 +271175,8 @@ rule SIGNATURE_BASE_Kriskynote_Mar17_2 : FILE
date = "2017-03-03"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_kriskynote.yar#L32-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_kriskynote.yar#L32-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cb9a2f77868b28d98e4f9c1b27b7242fec2f2abbc91bfc21fe0573e472c5dfcb"
logic_hash = "4a1a7c1c75cc64df32d2f055538c5ad15418802733046471520c372a616f1e11"
score = 75
@@ -270817,8 +271200,8 @@ rule SIGNATURE_BASE_Kriskynote_Mar17_3 : FILE
date = "2017-03-03"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_kriskynote.yar#L48-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_kriskynote.yar#L48-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fc838e07834994f25b3b271611e1014b3593278f0703a4a985fb4234936df492"
logic_hash = "fda8a7944cdd12cadb1c902664909a8164835f660e6fa56209bc51164a90e77c"
score = 75
@@ -270844,8 +271227,8 @@ rule SIGNATURE_BASE_Custom_Ssh_Backdoor_Server
date = "2015-05-14"
modified = "2022-08-18"
reference = "https://goo.gl/S46L3o"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_backdoor_ssh_python.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_backdoor_ssh_python.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0953b6c2181249b94282ca5736471f85d80d41c9"
logic_hash = "7bb142b69a75003e8f26d462c0895a3d807d5c326684e83d756178a3b91669dc"
score = 75
@@ -270869,8 +271252,8 @@ rule SIGNATURE_BASE_APT_NK_Methodology_Artificial_Useragent_IE_Win7 : FILE
date = "2019-04-06"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt37.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt37.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e63efbf8624a531bb435b7446dbbfc25"
logic_hash = "43119b83a7eaf3dade9477d342b5656970940e9b4f41b3ba5f720d7fbe927762"
score = 45
@@ -270896,8 +271279,8 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Lsls : FILE
date = "2018-02-08"
modified = "2023-12-05"
reference = "https://twitter.com/cyberintproject/status/961714165550342146"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cn_campaign_njrat.yar#L13-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cn_campaign_njrat.yar#L13-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "94c6a92984df9ed255f4c644261b01c4e255acbe32ddfd0debe38b558f29a6c9"
logic_hash = "c6542391e8d1a4fe4d26fd8b2dfb1fcab7b39c67dcc6495f2e5f95c4d6f8d61c"
score = 75
@@ -270920,8 +271303,8 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_C : FILE
date = "2018-02-08"
modified = "2023-12-05"
reference = "https://twitter.com/cyberintproject/status/961714165550342146"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cn_campaign_njrat.yar#L28-L55"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cn_campaign_njrat.yar#L28-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7"
logic_hash = "cfdc7ce8b89a16d2ae604268a030bd41259fed87a7f37b0dca8f7c467703c7f2"
score = 75
@@ -270954,8 +271337,8 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_System3 : FILE
date = "2018-02-08"
modified = "2023-12-05"
reference = "https://twitter.com/cyberintproject/status/961714165550342146"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cn_campaign_njrat.yar#L57-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cn_campaign_njrat.yar#L57-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "73fa84cff51d384c2d22d9e53fc5d42cb642172447b07e796c81dd403fb010c2"
logic_hash = "8292ae1de39c57bc5ed6fa078570e92dbcd22cd13d5b5f22d158986708139fbe"
score = 75
@@ -270982,8 +271365,8 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal1 : FILE
date = "2018-02-08"
modified = "2023-12-05"
reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cn_campaign_njrat.yar#L77-L103"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cn_campaign_njrat.yar#L77-L103"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "173d69164a6df5bced94ab7016435c128ccf7156145f5d26ca59652ef5dcd24e"
logic_hash = "cf532761d07ee3e84028a9071409f081a7a85728d55c215c912f0b70902f101f"
score = 75
@@ -271014,8 +271397,8 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Keylogger_1 : FILE
date = "2018-02-08"
modified = "2023-12-05"
reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cn_campaign_njrat.yar#L105-L122"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cn_campaign_njrat.yar#L105-L122"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf"
logic_hash = "efba7004614c690e469082255cf7b5cb62cac5da2bfcc26e036e2eafcb5728f9"
score = 75
@@ -271043,8 +271426,8 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal4 : FILE
date = "2018-02-08"
modified = "2023-12-05"
reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cn_campaign_njrat.yar#L124-L138"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cn_campaign_njrat.yar#L124-L138"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f7549c74f09be7e4dbfb64006e535b9f6d17352e236edc2cdb102ec3035cf66e"
logic_hash = "044901271adb06036e7d5aa8f2b6f893be10445bee95453c293d0025994e8d21"
score = 75
@@ -271068,8 +271451,8 @@ rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal5 : FILE
date = "2018-02-08"
modified = "2023-12-05"
reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cn_campaign_njrat.yar#L140-L160"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cn_campaign_njrat.yar#L140-L160"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "24c05cd8a1175fbd9aca315ec67fb621448d96bd186e8d5e98cb4f3a19482af4"
hash = "05696db46144dab3355dcefe0408f906a6d43fced04cb68334df31c6dfd12720"
logic_hash = "971276d5033477a08a1ec037cff9735667c2b4f7d9d4a7bcd88f2b1d8c348d4f"
@@ -271099,8 +271482,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_1 : FILE
date = "2023-02-13"
modified = "2023-12-05"
reference = "https://twitter.com/idonaor1/status/1624703255770005506?s=12&t=mxHaauzwR6YOj5Px8cIeIw"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ransom_darkbit_feb23.yar#L2-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ransom_darkbit_feb23.yar#L2-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ba1baea7cb7362160c4b00b0355000a789b238c1ec82b840479c04028e6ca3ab"
score = 75
quality = 85
@@ -271125,8 +271508,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_2 : FILE
date = "2023-02-13"
modified = "2023-12-05"
reference = "https://www.hybrid-analysis.com/sample/9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff?environmentId=160"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ransom_darkbit_feb23.yar#L25-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ransom_darkbit_feb23.yar#L25-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff"
logic_hash = "577435536300902811612a3415e82420574c98345b91b21fb2bfd2bfde396bec"
score = 75
@@ -271153,8 +271536,8 @@ rule SIGNATURE_BASE_MAL_Coralwave_Lenovospkvol_Remcosmicdrop : FILE
date = "2026-01-01"
modified = "2026-05-15"
reference = "https://bazaar.abuse.ch/sample/050edadedd7947bc6418f7856a29df5b7b5550bf5eec7f5f37e9a7e1713036f6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_coralwave_remcos_dropper.yar#L1-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_coralwave_remcos_dropper.yar#L1-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "65302b435a5bc30e8f0215455679635ec50b5b1caba9e55f9258d17c7238be54"
logic_hash = "ec6303584d65cf2138ca44a1cf5e958586d9eee2e9e17a90d0942b1ebee3d01f"
score = 85
@@ -271184,8 +271567,8 @@ rule SIGNATURE_BASE_SUSP_RAR_Ntdsdit : FILE
date = "2019-12-16"
modified = "2022-11-15"
reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rar_exfil.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rar_exfil.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "12e527b040e02f573f2a6e0fac4ff99ec441bf189c9bb7e1f763619c079a5bfa"
score = 70
quality = 85
@@ -271208,8 +271591,8 @@ rule SIGNATURE_BASE_Typical_Malware_String_Transforms : FILE
date = "2016-07-31"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_transformed_strings.yar#L10-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_transformed_strings.yar#L10-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1d3813e0d20b82ceda56d03589bb944f747dfe931396ed514fb6b36f72f98c26"
score = 60
quality = 83
@@ -271253,8 +271636,8 @@ rule SIGNATURE_BASE_Kraken_Bot_Sample : FILE
date = "2015-05-07"
modified = "2023-12-05"
reference = "https://blog.gdatasoftware.com/blog/article/dissecting-the-kraken.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_kraken_bot1.yar#L8-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_kraken_bot1.yar#L8-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "798e9f43fc199269a3ec68980eb4d91eb195436d"
logic_hash = "2e0f0a981ce3483aad8e48f6a259f9875ea4f8449feb24bafbae07243dd82a16"
score = 90
@@ -271281,8 +271664,8 @@ rule SIGNATURE_BASE_SUSP_PS1_Msdt_Execution_May22 : CVE_2022_30190 FILE
date = "2022-05-31"
modified = "2025-03-21"
reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_doc_follina.yar#L2-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_doc_follina.yar#L2-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9b8a061de4210d23e58b5190a300ee331273fc98f357156a0bb1d79f9f2b49b1"
score = 65
quality = 85
@@ -271316,8 +271699,8 @@ rule SIGNATURE_BASE_SUSP_Doc_Wordxmlrels_May22 : CVE_2022_30190 FILE
date = "2022-05-30"
modified = "2022-06-20"
reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_doc_follina.yar#L39-L61"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_doc_follina.yar#L39-L61"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0"
logic_hash = "c9846f8c2c1724792de14ab4de0064f951a8faaf01cc27d873e600f29d59c842"
score = 70
@@ -271344,8 +271727,8 @@ rule SIGNATURE_BASE_SUSP_Doc_RTF_Externalresource_May22 : CVE_2022_30190 FILE
date = "2022-05-30"
modified = "2022-05-31"
reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_doc_follina.yar#L63-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_doc_follina.yar#L63-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c841e0c1ff78bf8dade5f573a7452b16a7f447cfc19417704b727684a8f3d3ff"
score = 70
quality = 85
@@ -271367,13 +271750,13 @@ rule SIGNATURE_BASE_EXPL_Follina_CVE_2022_30190_Msdt_Msprotocoluri_May22 : CVE_2
date = "2022-05-30"
modified = "2022-07-18"
reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_doc_follina.yar#L81-L99"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_doc_follina.yar#L81-L99"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784"
hash = "778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07"
logic_hash = "d56820737951f97606749c74025589e6a8ecbe70cfff069492368b2ba8528a7d"
score = 80
- quality = 60
+ quality = 85
tags = "CVE-2022-30190, FILE"
strings:
@@ -271392,8 +271775,8 @@ rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_Jun22 : FILE
date = "2022-06-01"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_doc_follina.yar#L101-L132"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_doc_follina.yar#L101-L132"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
logic_hash = "36cb711399197c694ac4fa4fd49cd5d587a830e152a138c81851b8e16301803d"
score = 75
@@ -271425,8 +271808,8 @@ rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_EMAIL_Jun22 : FILE
date = "2022-06-01"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_doc_follina.yar#L134-L193"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_doc_follina.yar#L134-L193"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
logic_hash = "fcbb3e32762f8c67b5b226e8095b767d630f8c118521a82fc22f9a3cc272b794"
score = 75
@@ -271480,8 +271863,8 @@ rule SIGNATURE_BASE_SUSP_DOC_RTF_Externalresource_EMAIL_Jun22 : CVE_2022_30190 F
date = "2022-06-01"
modified = "2026-05-15"
reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_doc_follina.yar#L195-L221"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_doc_follina.yar#L195-L221"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "73e76bd80f77640c0d8d47ebb7903eb9cc23336fbe653e7d008cae6a0de7c45b"
score = 70
quality = 85
@@ -271510,8 +271893,8 @@ rule SIGNATURE_BASE_SUSP_Msdt_Artefact_Jun22_2 : CVE_2022_30190 FILE
date = "2022-06-01"
modified = "2022-07-29"
reference = "https://twitter.com/nas_bench/status/1531718490494844928"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_doc_follina.yar#L223-L242"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_doc_follina.yar#L223-L242"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e18f6405f0411128335336e65dda4ed2b6be6e9ad47b94646ececf0479fbe967"
score = 75
quality = 85
@@ -271535,8 +271918,8 @@ rule SIGNATURE_BASE_SUSP_LNK_Follina_Jun22 : CVE_2022_30190 FILE
date = "2022-06-02"
modified = "2026-05-15"
reference = "https://twitter.com/gossithedog/status/1531650897905950727"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_doc_follina.yar#L244-L262"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_doc_follina.yar#L244-L262"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0b63bb266b968987b2b5a83c9429e96acbd57e12178e4f5fd5894b23d1aaa237"
score = 75
quality = 85
@@ -271560,8 +271943,8 @@ rule SIGNATURE_BASE_MAL_EXPL_Perfctl_Oct24 : FILE
date = "2024-10-09"
modified = "2024-12-12"
reference = "https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_perfctl_oct24.yar#L2-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_perfctl_oct24.yar#L2-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "22e4a57ac560ebe1eff8957906589f4dd5934ee555ebcc0f7ba613b07fad2c13"
logic_hash = "44d4683efc66b3c6c2d32be6b83a2bbc1db39c9a020365dddd27c20667bc6a66"
score = 80
@@ -271586,8 +271969,8 @@ rule SIGNATURE_BASE_MAL_LNX_Perfctl_Oct24 : FILE
date = "2024-10-09"
modified = "2024-12-12"
reference = "https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_perfctl_oct24.yar#L23-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_perfctl_oct24.yar#L23-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a6d3c6b6359ae660d855f978057aab1115b418ed277bb9047cd488f9c7850747"
hash = "ca3f246d635bfa560f6c839111be554a14735513e90b3e6784bedfe1930bdfd6"
logic_hash = "d47df34240f59124542acc41484e8935327490c04c4e15a558b2ffc6f9c52ea8"
@@ -271613,8 +271996,8 @@ rule SIGNATURE_BASE_WEBSHELL_JAVA_Versamem_JAR_Aug24_1 : FILE
date = "2024-08-27"
modified = "2024-08-29"
reference = "https://x.com/ryanaraine/status/1828440883315999117"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_volttyphoon_versamem.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_volttyphoon_versamem.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d21558eb6c8e700b8a4cb86fdaa5487179828152af68828e878397859d6d3952"
score = 75
quality = 85
@@ -271643,8 +272026,8 @@ rule SIGNATURE_BASE_WEBSHELL_JAVA_Versamem_JAR_Aug24_2 : FILE
date = "2024-08-29"
modified = "2024-12-12"
reference = "https://x.com/craiu/status/1828687700884336990"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_volttyphoon_versamem.yar#L27-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_volttyphoon_versamem.yar#L27-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4bcedac20a75e8f8833f4725adfc87577c32990c3783bf6c743f14599a176c37"
logic_hash = "0bdf3bf5130c51c1355f179704933ca473a702595c580642035c8d3b9aad5725"
score = 75
@@ -271667,8 +272050,8 @@ rule SIGNATURE_BASE_Quarkspwdump_Gen
date = "2015-09-29"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_quarkspwdump.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_quarkspwdump.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b86e6aea37c324ce686bd2b49cf5b871d90f51cec24476daa01dd69543b54fa"
hash = "87e4c76cd194568e65287f894b4afcef26d498386de181f568879dde124ff48f"
hash = "a59be92bf4cce04335bd1a1fcf08c1a94d5820b80c068b3efe13e2ca83d857c9"
@@ -271700,8 +272083,8 @@ rule SIGNATURE_BASE_EXPL_Shitrix_Exploit_Code_Jan20_1 : FILE CVE_2019_19781
date = "2020-01-13"
modified = "2023-12-05"
reference = "https://isc.sans.edu/forums/diary/Citrix+ADC+Exploits+Overview+of+Observed+Payloads/25704/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_shitrix.yar#L2-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_shitrix.yar#L2-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "00687b30235be5ef3c00432b5b96bbc325dee553e7c0cb565d6f389b1bce12de"
score = 70
quality = 85
@@ -271736,8 +272119,8 @@ rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_1 : FILE
date = "2016-02-29"
modified = "2023-05-04"
reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turbo_campaign.yar#L1-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turbo_campaign.yar#L1-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "61ef65a1500d3def3376a82bc376db451d202d18b03855ee279b6c01757deb2a"
score = 75
quality = 83
@@ -271794,8 +272177,8 @@ rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Kernelmodule_1 : FILE
date = "2016-02-29"
modified = "2023-05-04"
reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turbo_campaign.yar#L51-L83"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turbo_campaign.yar#L51-L83"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fab37e2dbe05c694da6e428aa922747b276c2827cbbd2b6c8002f0cc30c2870c"
score = 75
quality = 85
@@ -271835,8 +272218,8 @@ rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Linux_Sharedmemcreation_1 : FILE
date = "2016-02-29"
modified = "2023-12-05"
reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turbo_campaign.yar#L85-L96"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turbo_campaign.yar#L85-L96"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "adbdccea9ea7aefcca18d659c027a49e7e2e053873b77ddaf369203b3e301033"
score = 75
quality = 85
@@ -271857,8 +272240,8 @@ rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Linux_Strings_1 : FILE
date = "2016-02-29"
modified = "2023-12-05"
reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turbo_campaign.yar#L98-L128"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turbo_campaign.yar#L98-L128"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b54b406a562247d4c3d4a9c4d1b7584bdcecfe5b6c76867c04770e016eeb8c9a"
score = 75
quality = 83
@@ -271892,8 +272275,8 @@ rule SIGNATURE_BASE_Apt_Win_Exe_Trojan_Derusbi_1 : FILE
date = "2016-02-29"
modified = "2023-12-05"
reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turbo_campaign.yar#L130-L189"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turbo_campaign.yar#L130-L189"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "02fb4da724b257aef0ec0fecfe5b7a25a23fe4dd5baae0ddd2d21350b9af34e9"
score = 75
quality = 83
@@ -271943,8 +272326,8 @@ rule SIGNATURE_BASE_Upatre_Hazgurut : FILE
date = "2015-10-13"
modified = "2023-12-05"
reference = "https://weankor.vxstream-sandbox.com/sample/6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3?environmentId=7"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_upatre_oct15.yar#L8-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_upatre_oct15.yar#L8-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7ee0d20b15e24b7fe72154d9521e1959752b4e9c20d2992500df9ac096450a50"
hash = "79ffc620ddb143525fa32bc6a83c636168501a4a589a38cdb0a74afac1ee8b92"
hash = "62d8a6880c594fe9529158b94a9336179fa7a3d3bf1aa9d0baaf07d03b281bd3"
@@ -271987,8 +272370,8 @@ rule SIGNATURE_BASE_APT_Fnv1A_Plus_Extra_XOR_In_MSIL_Experimental : FILE
date = "2020-12-22"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_backdoor_sunburst_fnv1a_experimental.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_backdoor_sunburst_fnv1a_experimental.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77"
hash = "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6"
hash = "019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134"
@@ -272014,8 +272397,8 @@ rule SIGNATURE_BASE_VULN_Dell_BIOS_Update_Driver_Dbutil_May21 : CVE_2021_21551 F
date = "2021-05-05"
modified = "2023-12-05"
reference = "https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vul_dell_bios_upd_driver.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vul_dell_bios_upd_driver.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5"
hash = "ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1"
logic_hash = "9cefb9fe28e818a3b0bc1c9ac570ddf2fac7ebf23408963656b7ec86d5bf3224"
@@ -272040,8 +272423,8 @@ rule SIGNATURE_BASE_No_Powershell : FILE
date = "2016-05-21"
modified = "2023-12-05"
reference = "https://github.com/Ben0xA/nps"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_nopowershell.yar#L8-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_nopowershell.yar#L8-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "64f811b99eb4ae038c88c67ee0dc9b150445e68a2eb35ff1a0296533ae2edd71"
logic_hash = "9fba467cfbf8cad0c8e6cf1e1c7eacd8b0be869ebe6c5180f50f5cdefa8b5bb5"
score = 80
@@ -272065,8 +272448,8 @@ rule SIGNATURE_BASE_APT_Cobaltstrike_Beacon_Indicator : FILE
date = "2018-11-09"
modified = "2026-05-26"
reference = "https://github.com/JPCERTCC/aa-tools/blob/master/cobaltstrikescan.py"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cobaltstrike.yar#L40-L52"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cobaltstrike.yar#L40-L52"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0f429a7a8c8bbea22eba3bbf81e391dab8e957583283a995d1d60d42f17c20e7"
score = 75
quality = 83
@@ -272088,8 +272471,8 @@ rule SIGNATURE_BASE_HKTL_Cobaltstrike_Beacon_Strings
date = "2021-03-16"
modified = "2026-05-26"
reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cobaltstrike.yar#L54-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cobaltstrike.yar#L54-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4349a7ad94df2269217b55c2aef9628c4eef078566c276936accdd4f996ba2cf"
score = 75
quality = 85
@@ -272112,8 +272495,8 @@ rule SIGNATURE_BASE_HKTL_Cobaltstrike_Beacon_XOR_Strings
date = "2021-03-16"
modified = "2026-05-26"
reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cobaltstrike.yar#L69-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cobaltstrike.yar#L69-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "214f0400863783ab4294d8acc820cf00ab9941d193b2b843f877207b9912d799"
score = 75
quality = 85
@@ -272141,8 +272524,8 @@ rule SIGNATURE_BASE_HKTL_Cobaltstrike_Beacon_4_2_Decrypt
date = "2021-03-16"
modified = "2026-05-26"
reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cobaltstrike.yar#L92-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cobaltstrike.yar#L92-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8685b1626c8d263f49ccf129dcd4fe1b42482fcdb37c2e109cedcecaed8c2407"
score = 75
quality = 85
@@ -272164,8 +272547,8 @@ rule SIGNATURE_BASE_HKTL_Win_Cobaltstrike : COMMODITY
date = "2021-05-25"
modified = "2026-05-26"
reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cobaltstrike.yar#L106-L124"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cobaltstrike.yar#L106-L124"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c"
logic_hash = "1e8a68050ff25f77e903af2e0a85579be1af77c64684e42e8f357eee4ae59377"
score = 75
@@ -272193,8 +272576,8 @@ rule SIGNATURE_BASE_Beacon_K5Om : FILE
date = "2017-06-07"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt19.yar#L10-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt19.yar#L10-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9"
logic_hash = "4b1ec0fc6c0ad4e76c526f7568153bca62f9bffdd38a3b1eaa51a37a1dcab226"
score = 75
@@ -272223,8 +272606,8 @@ rule SIGNATURE_BASE_FE_LEGALSTRIKE_MACRO
date = "2017-06-02"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt19.yar#L34-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt19.yar#L34-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b38edeedcc02168d3ba7e82c3f5c6963ffc8ce1688eeb424ce686484f3687512"
score = 75
quality = 85
@@ -272249,8 +272632,8 @@ rule SIGNATURE_BASE_FE_LEGALSTRIKE_RTF : FILE
date = "2017-06-02"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt19.yar#L52-L69"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt19.yar#L52-L69"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "af811694076f7d53ee76713538839c4ec82c591518d59d5988dcb893bfd32ffe"
score = 75
quality = 85
@@ -272278,8 +272661,8 @@ rule SIGNATURE_BASE_Dubnium_Sample_1 : FILE
date = "2016-06-10"
modified = "2023-12-05"
reference = "https://goo.gl/AW9Cuu"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dubnium.yar#L10-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dubnium.yar#L10-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
logic_hash = "94763f42dacbeede9a72c3ecc222164a5808bd74c5d2d783c76831221a9c30c8"
score = 75
@@ -272303,8 +272686,8 @@ rule SIGNATURE_BASE_Dubnium_Sample_2 : FILE
date = "2016-06-10"
modified = "2023-12-05"
reference = "https://goo.gl/AW9Cuu"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dubnium.yar#L26-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dubnium.yar#L26-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
logic_hash = "5b633a7e002609fa78b0de8fb818af1b47fbe77497d161b6b41602fb34780ca8"
score = 75
@@ -272328,8 +272711,8 @@ rule SIGNATURE_BASE_Dubnium_Sample_3 : FILE
date = "2016-06-10"
modified = "2023-12-05"
reference = "https://goo.gl/AW9Cuu"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dubnium.yar#L42-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dubnium.yar#L42-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "caefcdf2b4e5a928cdf9360b70960337f751ec4a5ab8c0b75851fc9a1ab507a8"
hash = "e0362d319a8d0e13eda782a0d8da960dd96043e6cc3500faeae521d1747576e5"
hash = "a77d1c452291a6f2f6ed89a4bac88dd03d38acde709b0061efd9f50e6d9f3827"
@@ -272359,8 +272742,8 @@ rule SIGNATURE_BASE_Dubnium_Sample_5 : FILE
date = "2016-06-10"
modified = "2023-12-05"
reference = "https://goo.gl/AW9Cuu"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dubnium.yar#L64-L87"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dubnium.yar#L64-L87"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
hash = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
hash = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
@@ -272393,8 +272776,8 @@ rule SIGNATURE_BASE_Dubnium_Sample_6 : FILE
date = "2016-06-10"
modified = "2023-12-05"
reference = "https://goo.gl/AW9Cuu"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dubnium.yar#L89-L107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dubnium.yar#L89-L107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
hash = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
hash = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
@@ -272422,8 +272805,8 @@ rule SIGNATURE_BASE_Dubnium_Sample_7 : FILE
date = "2016-06-10"
modified = "2023-12-05"
reference = "https://goo.gl/AW9Cuu"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dubnium.yar#L109-L131"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dubnium.yar#L109-L131"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
hash = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
hash = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
@@ -272455,8 +272838,8 @@ rule SIGNATURE_BASE_Dubnium_Sample_Sshopenssl : FILE
date = "2016-06-10"
modified = "2023-12-05"
reference = "https://goo.gl/AW9Cuu"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dubnium.yar#L133-L152"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dubnium.yar#L133-L152"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
hash = "feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
hash = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
@@ -272483,10 +272866,10 @@ rule SIGNATURE_BASE_Windowscredentialeditor
author = "Florian Roth"
id = "1542c6e4-36b2-5272-85d0-43226869b43e"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L20-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L20-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "531a0bdc893d89b1c14deee11df95b430051cef07744a15b5d606e1c5378db97"
score = 90
quality = 85
@@ -272509,8 +272892,8 @@ rule SIGNATURE_BASE_HKTL_Amplia_Security_Tool : FILE
date = "2013-01-01"
modified = "2023-02-14"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L33-L53"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L33-L53"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7ca32d8df0011f23922c6566b28aa55b0756d5b67bf3db8908b206b1038bb1f2"
score = 60
quality = 85
@@ -272534,10 +272917,10 @@ rule SIGNATURE_BASE_Pwdump
author = "Marc Stroebel"
id = "e557e548-53e8-5098-93d4-8e899384e67c"
date = "2014-04-24"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L56-L69"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L56-L69"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a998d16f84e8689f182f6665ad165c6ff19e25d3e52acc10ca4cc6fe54ba354f"
score = 70
quality = 85
@@ -272558,10 +272941,10 @@ rule SIGNATURE_BASE_Pscan_Portscan_1
author = "F. Roth"
id = "54997776-644b-5a72-b08c-7174b7dc7f66"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L71-L83"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L71-L83"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c624fcdf28506b551bf7b36883d95b279a7c56322337a0acafd91205659c92cc"
score = 50
quality = 85
@@ -272582,10 +272965,10 @@ rule SIGNATURE_BASE_Hacktool_Samples
author = "Florian Roth"
id = "ecacf84a-f66c-5c21-ae4b-fd9bfb5be384"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L85-L119"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L85-L119"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0064950d88eccbe670cd1dc70861d093c7f49f8f10e984aef4cfb4bcc94e4645"
score = 50
quality = 83
@@ -272629,10 +273012,10 @@ rule SIGNATURE_BASE_Fierce2
author = "Florian Roth (Nextron Systems)"
id = "08a72151-48c2-513b-995f-be0d5acba7dd"
date = "2014-01-07"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L123-L135"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L123-L135"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "05502827dd5d1903507fd1e176d518516a5c1965fb4e51ea26b1a05eb0dce3d2"
score = 60
quality = 85
@@ -272652,10 +273035,10 @@ rule SIGNATURE_BASE_Ncrack
author = "Florian Roth (Nextron Systems)"
id = "c1c56ee9-7f76-5440-b0e0-86e372c53340"
date = "2014-01-07"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L137-L149"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L137-L149"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a42bfaefb873a10821bcc06db109d8ab20daa8c8ac0b6cfb245d2ee339f318bb"
score = 60
quality = 85
@@ -272675,10 +273058,10 @@ rule SIGNATURE_BASE_Sqlmap
author = "Florian Roth (Nextron Systems)"
id = "55a72fe6-f82d-5d55-842f-5d7e1cfcc9fa"
date = "2014-01-07"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L151-L163"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L151-L163"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9c248c856c3d91a282012489b53dc9e15569e1bb1a5c9f5e3c7938f7ce0c3157"
score = 60
quality = 85
@@ -272698,11 +273081,11 @@ rule SIGNATURE_BASE_HKTL_Portscanner_Simple_Jan14
author = "yarGen Yara Rule Generator by Florian Roth"
id = "3e8960ce-0428-51e1-b992-4fa09fee8520"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
old_rule_name = "PortScanner"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L165-L177"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L165-L177"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b381b9212282c0c650cb4b0323436c63"
logic_hash = "c69269b227d46b5b970cfc094b3154b0a533b439b8ed492a2059025bc96d17a0"
score = 75
@@ -272723,10 +273106,10 @@ rule SIGNATURE_BASE_Domainscanv1_0
author = "yarGen Yara Rule Generator by Florian Roth"
id = "94ead827-8b29-5cb5-82b6-a7ca5087bf7e"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L179-L196"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L179-L196"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aefcd73b802e1c2bdc9b2ef206a4f24e"
logic_hash = "b06d902528fee5d1718d0a2984af3314e92e1ec7033c7596f9fb0e51a20eb848"
score = 75
@@ -272753,10 +273136,10 @@ rule SIGNATURE_BASE_HKTL_Moorer_Port_Scanner
author = "yarGen Yara Rule Generator by Florian Roth"
id = "5d8fb83f-bed3-53d2-bd33-2158911dc7c8"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L198-L211"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L198-L211"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "376304acdd0b0251c8b19fea20bb6f5b"
logic_hash = "248f437964fc6f7836f6b4c87e1f35bb1bac25a1a484cdf1a4065e7efb823b51"
score = 75
@@ -272779,10 +273162,10 @@ rule SIGNATURE_BASE_Netbios_Name_Scanner
author = "yarGen Yara Rule Generator by Florian Roth"
id = "03716e00-a969-5ab5-9be7-e8fc4272e40f"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L213-L225"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L213-L225"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "888ba1d391e14c0a9c829f5a1964ca2c"
logic_hash = "19b40a283b74317fece2f5be0ee3e38227d9631eebbc7efb0ea19056b52630f1"
score = 75
@@ -272804,10 +273187,10 @@ rule SIGNATURE_BASE_Felikspack3___Scanners_Ipscan
author = "yarGen Yara Rule Generator by Florian Roth"
id = "8360b268-3434-5142-9248-40b7a1589be9"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L227-L239"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L227-L239"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6c1bcf0b1297689c8c4c12cc70996a75"
logic_hash = "8da10a4536ecea889f29bb3f098518580629bf48eda88db7adfc5f61738ede25"
score = 75
@@ -272829,10 +273212,10 @@ rule SIGNATURE_BASE_Cgisscan_Cgiscan
author = "yarGen Yara Rule Generator by Florian Roth"
id = "60bd5038-a308-55fd-85bb-2c4183f1c951"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L241-L253"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L241-L253"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "338820e4e8e7c943074d5a5bc832458a"
logic_hash = "5bd856a77c53616cf78d093462f8b7ca5a5fb0924406a02941d86bdb015a1fbc"
score = 75
@@ -272854,10 +273237,10 @@ rule SIGNATURE_BASE_IP_Stealing_Utilities
author = "yarGen Yara Rule Generator by Florian Roth"
id = "3a947e9c-d707-5819-88f2-059585750048"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L255-L266"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L255-L266"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "65646e10fb15a2940a37c5ab9f59c7fc"
logic_hash = "38958edeee6e140e11267cdd7899ad517799dbce33ac267d51dea0f8aecfa1ee"
score = 75
@@ -272878,10 +273261,10 @@ rule SIGNATURE_BASE_Superscan4
author = "yarGen Yara Rule Generator by Florian Roth"
id = "bd353382-ffa2-56c5-b842-1ffc94d6849e"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L268-L281"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L268-L281"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "78f76428ede30e555044b83c47bc86f0"
logic_hash = "7f76c59e85efac5c150f783606e2a9bdc8724c6afd9f9c6405d63f7467c72752"
score = 75
@@ -272903,10 +273286,10 @@ rule SIGNATURE_BASE_Portracer
author = "yarGen Yara Rule Generator by Florian Roth"
id = "54717938-2f4c-5442-b0ad-40b9acd1101a"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L283-L295"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L283-L295"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2834a872a0a8da5b1be5db65dfdef388"
logic_hash = "f6ad85a8970b10e25becca76e17bff30cbc787ed45f331af4ecf9563ff11b65d"
score = 75
@@ -272928,10 +273311,10 @@ rule SIGNATURE_BASE_Scanarator
author = "yarGen Yara Rule Generator by Florian Roth"
id = "dfc3ff29-03b4-58ca-bfe0-c6888fddab67"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L297-L307"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L297-L307"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "848bd5a518e0b6c05bd29aceb8536c46"
logic_hash = "9400435470c26245cd814e1e39f275eb22566d66d1a72d4f3e618a6ad11bc8d9"
score = 75
@@ -272951,10 +273334,10 @@ rule SIGNATURE_BASE_Aolipsniffer
author = "yarGen Yara Rule Generator by Florian Roth"
id = "f7cc0f31-6ba4-504b-82de-0334257b8a95"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L309-L327"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L309-L327"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "51565754ea43d2d57b712d9f0a3e62b8"
logic_hash = "e627b8ea85e4325714c98e93ad6147adfa600af548a80dce8548b7f5743733b5"
score = 75
@@ -272982,10 +273365,10 @@ rule SIGNATURE_BASE__Bitchin_Threads_
author = "yarGen Yara Rule Generator by Florian Roth"
id = "3a51e76c-b360-5f10-961c-ecc3ea3fa3c9"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L329-L340"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L329-L340"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7491b138c1ee5a0d9d141fbfd1f0071b"
logic_hash = "f43fec37d9dc668b562838465e5696e502c638b207e7af6a77fac5a8b00e92a8"
score = 75
@@ -273006,10 +273389,10 @@ rule SIGNATURE_BASE_Cgis4_Cgis4
author = "yarGen Yara Rule Generator by Florian Roth"
id = "98fbf445-b7a5-58fa-8f06-34be7321e2eb"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L342-L357"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L342-L357"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d658dad1cd759d7f7d67da010e47ca23"
logic_hash = "2cf3fc6447323cbefe5f5ad02271eeb4c271bb9784d2c29030858542a43fbb04"
score = 75
@@ -273034,10 +273417,10 @@ rule SIGNATURE_BASE_Portscan
author = "yarGen Yara Rule Generator by Florian Roth"
id = "967d6e3b-ae0d-5f93-a20d-742fc010608d"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L359-L370"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L359-L370"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a8bfdb2a925e89a281956b1e3bb32348"
logic_hash = "d93b54ffc7416b5354304daf156908f11d7e320a91bd936e397a15ede63caae3"
score = 75
@@ -273058,10 +273441,10 @@ rule SIGNATURE_BASE_Proport_Zip_Folder_Proport
author = "yarGen Yara Rule Generator by Florian Roth"
id = "cd611f6c-42ed-5cd3-a6ab-7e0970925e61"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L372-L389"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L372-L389"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c1937a86939d4d12d10fc44b7ab9ab27"
logic_hash = "0ee2ffc5ed243d170b8013b3a164a3719f43bd473f4af7e1a2697d88a298fe9f"
score = 75
@@ -273088,10 +273471,10 @@ rule SIGNATURE_BASE_Stealthwasp_S_Basic_Portscanner_V1_2
author = "yarGen Yara Rule Generator by Florian Roth"
id = "7f706186-f2e2-5d4d-951a-2ec8fc757cec"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L391-L402"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L391-L402"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7c0f2cab134534cd35964fe4c6a1ff00"
logic_hash = "b01c165b5e5be3ba6905e8bc44a14c3d7195effd058e4c0c31678777d19db8b5"
score = 75
@@ -273112,10 +273495,10 @@ rule SIGNATURE_BASE_Bluesportscan
author = "yarGen Yara Rule Generator by Florian Roth"
id = "4bcb8b7c-5e22-5496-9a29-66e85e3c3395"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L404-L415"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L404-L415"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6292f5fc737511f91af5e35643fc9eef"
logic_hash = "5cb4e4b87eaf166c85d23114f5abc10ef83b4a29968bf6fef4b3fce7ff2787fd"
score = 75
@@ -273136,10 +273519,10 @@ rule SIGNATURE_BASE_Scanarator_Iis
author = "yarGen Yara Rule Generator by Florian Roth"
id = "a467147b-53c8-53db-aa33-5f0e4e066988"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L417-L428"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L417-L428"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3a8fc02c62c8dd65e038cc03e5451b6e"
logic_hash = "092cb902e10624b207b7932e6b3c1fe2277ed1d183e5de9ee4d07d8548e90ab6"
score = 75
@@ -273160,10 +273543,10 @@ rule SIGNATURE_BASE_Stealth_Stealth
author = "yarGen Yara Rule Generator by Florian Roth"
id = "5f45882e-3e27-596d-8725-fad380e1c297"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L430-L441"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L430-L441"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ce3a386ce0eae10fc2ce0177bbc8ffa"
logic_hash = "e210b1a553549c22f66511dfc9d0d3f5b17f02981b9e9915827bc909f34b3262"
score = 75
@@ -273184,10 +273567,10 @@ rule SIGNATURE_BASE_Angry_IP_Scanner_V2_08_Ipscan
author = "yarGen Yara Rule Generator by Florian Roth"
id = "5fbcbb95-6cd4-5587-bf44-5b5ed133ce5e"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L443-L455"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L443-L455"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70cf2c09776a29c3e837cb79d291514a"
logic_hash = "1b50856ad35c146a684298a86f1629c45996ab08ffae8486a388805262ec2367"
score = 75
@@ -273209,10 +273592,10 @@ rule SIGNATURE_BASE_Crack_Loader
author = "yarGen Yara Rule Generator by Florian Roth"
id = "0c4c7b69-7739-5c1b-8c7c-4aaa724e4455"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L457-L468"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L457-L468"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f4f79358a6c600c1f0ba1f7e4879a16d"
logic_hash = "3380ace7c34c15dfd9a9625c8c4a1ed7e35c1cf3c2eca9b1e00dd0092d256150"
score = 75
@@ -273233,10 +273616,10 @@ rule SIGNATURE_BASE_CN_GUI_Scanner
author = "Florian Roth (Nextron Systems)"
id = "ca88d4d3-5d18-5856-874f-e50deceef54f"
date = "2014-04-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L470-L487"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L470-L487"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3c67bbb1911cdaef5e675c56145e1112"
logic_hash = "f9281277ad7058527699d1f5037bb78be1363c90f38e2e399592c58f0b313bd7"
score = 65
@@ -273261,10 +273644,10 @@ rule SIGNATURE_BASE_CN_Packed_Scanner : FILE
author = "Florian Roth (Nextron Systems)"
id = "a11c4ee6-7244-5601-af26-a45f9fdc8e1b"
date = "2014-06-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L489-L505"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L489-L505"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6323b51c116a77e3fba98f7bb7ff4ac6"
logic_hash = "0d9178ec65029e4ce8d4c3cc28ebd041c612f3a48f095b60c7a4515de03cccf4"
score = 40
@@ -273288,10 +273671,10 @@ rule SIGNATURE_BASE_Tiny_Network_Tool_Generic : FILE
author = "Florian Roth (Nextron Systems)"
id = "04b1c2c6-605c-52d5-aa07-f3b77a6c4593"
date = "2014-08-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L507-L539"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L507-L539"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9e1ab25a937f39ed8b031cd8cfbc4c07"
hash = "cafc31d39c1e4721af3ba519759884b9"
hash = "8e635b9a1e5aa5ef84bfa619bd2a1f92"
@@ -273328,10 +273711,10 @@ rule SIGNATURE_BASE_Beastdoor_Backdoor
author = "Florian Roth (Nextron Systems)"
id = "64f67233-6677-53c8-b212-f1a425f78803"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L541-L561"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L541-L561"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5ab10dda548cb821d7c15ebcd0a9f1ec6ef1a14abcc8ad4056944d060c49535a"
logic_hash = "35aa5d66c0fd4bf1995fc23a68283e8a28f31b5a1e1f3b742dd0ab89c48bf403"
score = 55
@@ -273360,10 +273743,10 @@ rule SIGNATURE_BASE_Powershell_Netcat
author = "Florian Roth (Nextron Systems)"
id = "e4b018c0-3214-5102-93b1-6a048324f9dd"
date = "2014-10-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L563-L577"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L563-L577"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ff9d7c3e83fd27620559306c07556ce7afd1ba7a5db5f5c21ad0841d58b85014"
score = 60
quality = 85
@@ -273385,10 +273768,10 @@ rule SIGNATURE_BASE_Chinese_Hacktool_1014
author = "Florian Roth (Nextron Systems)"
id = "e5db5f58-a1fd-51e0-9037-337fcca71f11"
date = "2014-10-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L579-L596"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L579-L596"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "98c07a62f7f0842bcdbf941170f34990"
logic_hash = "ffb1f653fd536a46dae4bf2c91c3c0582b703b8f0d33838b9736083e307a8e79"
score = 60
@@ -273413,10 +273796,10 @@ rule SIGNATURE_BASE_CN_Hacktool_BAT_Portsopen
author = "Florian Roth (Nextron Systems)"
id = "55c3f678-ba70-5a4a-b288-9d0953eff968"
date = "2014-12-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L598-L612"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L598-L612"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e5bc7b3264d7fc63fcc6c3d7e45859eb83b8ce60bd9a918f5eff887f626d09a3"
score = 60
quality = 85
@@ -273438,10 +273821,10 @@ rule SIGNATURE_BASE_CN_Hacktool_Ssport_Portscanner
author = "Florian Roth (Nextron Systems)"
id = "38cc8830-efd3-51b7-8ac6-c9bf468212cb"
date = "2014-12-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L614-L628"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L614-L628"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "30c380b6c683cbcbef7072e793d94e1782206b844fa23d334b737818f0a32f9f"
score = 70
quality = 85
@@ -273463,10 +273846,10 @@ rule SIGNATURE_BASE_CN_Hacktool_Scanport_Portscanner
author = "Florian Roth (Nextron Systems)"
id = "a708283e-339c-599f-9321-3b063d0076a9"
date = "2014-12-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L630-L644"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L630-L644"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fa2dce57cc3e9baecb80b0165dfeb1af1ba4c4b30098e3b1252eb98b4fc30f7f"
score = 70
quality = 60
@@ -273488,10 +273871,10 @@ rule SIGNATURE_BASE_CN_Hacktool_S_EXE_Portscanner
author = "Florian Roth (Nextron Systems)"
id = "d6b35d4f-7e25-50dd-bef2-08f7033312e8"
date = "2014-12-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L646-L660"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L646-L660"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "658ae90f3af3c7abec6e692b6be350939ba7b654a9972d1a1016ff33e815a1de"
score = 70
quality = 85
@@ -273513,10 +273896,10 @@ rule SIGNATURE_BASE_CN_Hacktool_Milkt_BAT
author = "Florian Roth (Nextron Systems)"
id = "d680a5f1-6182-5bc8-99de-c3cba1a61903"
date = "2014-12-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L662-L675"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L662-L675"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ad74c45db0ef52223eb4dd162a21c57074a4ecb869a841d836d14afc997a7478"
score = 70
quality = 85
@@ -273537,10 +273920,10 @@ rule SIGNATURE_BASE_CN_Hacktool_Milkt_Scanner
author = "Florian Roth (Nextron Systems)"
id = "aa83c983-25c2-5051-88a1-fbc70d947d6e"
date = "2014-12-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L677-L695"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L677-L695"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "707cbd625b5694b710d01622a053e60828da7f70b38e43012d04364137583fe9"
score = 60
quality = 85
@@ -273566,10 +273949,10 @@ rule SIGNATURE_BASE_CN_Hacktool_1433_Scanner : FILE
author = "Florian Roth (Nextron Systems)"
id = "77712d29-1a32-59e7-999a-a2ef02212886"
date = "2014-12-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L697-L714"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L697-L714"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3e51e3596fc90bcea46236728da5437a9b6f56a42d64a651940321f575b32129"
score = 40
quality = 85
@@ -273594,10 +273977,10 @@ rule SIGNATURE_BASE_CN_Hacktool_1433_Scanner_Comp2 : FILE
author = "Florian Roth (Nextron Systems)"
id = "7d707be5-dad0-5d91-965b-908a8603b6c0"
date = "2014-12-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L716-L730"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L716-L730"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7c84d59a821531d9e741a05a23a911bb1caa825a18bb6532381e5ff38193c260"
score = 40
quality = 85
@@ -273619,10 +274002,10 @@ rule SIGNATURE_BASE_WCE_Modified_1_1014
author = "Florian Roth (Nextron Systems)"
id = "536d1a7f-bda1-5c22-bf72-a177468e7c42"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L732-L746"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L732-L746"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "09a412ac3c85cedce2642a19e99d8f903a2e0354"
logic_hash = "f094d635aabea9b9101fad3d0d23ad37692317ae5b4f636296ee612752c4421f"
score = 70
@@ -273645,10 +274028,10 @@ rule SIGNATURE_BASE_Ikat_Wmi_Rundll : FILE
author = "Florian Roth (Nextron Systems)"
id = "e3d80c95-d333-53cf-8165-b3a1e66ed00d"
date = "2014-05-11"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L767-L788"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L767-L788"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "97c4d4e6a644eed5aa12437805e39213e494d120"
logic_hash = "b857e17c790a97468ae69c8cbec6474ee38bea25bb04520516a2603996d4bd41"
score = 65
@@ -273676,10 +274059,10 @@ rule SIGNATURE_BASE_Ikat_Revelations
author = "Florian Roth (Nextron Systems)"
id = "c5ef2c2a-c9c0-5c3a-bbcc-0b0949527850"
date = "2014-05-11"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L790-L807"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L790-L807"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c4e217a8f2a2433297961561c5926cbd522f7996"
logic_hash = "0f3aa9e784beb7de8b560ecde8cc06d49e07f5e4ea4acb233ec9ac007179d7a3"
score = 75
@@ -273703,10 +274086,10 @@ rule SIGNATURE_BASE_Ikat_Priv_Esc_Tasksch
author = "Florian Roth (Nextron Systems)"
id = "0786b313-3154-536b-b7eb-c4d8444a309f"
date = "2014-05-11"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L809-L835"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L809-L835"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "84ab94bff7abf10ffe4446ff280f071f9702cf8b"
logic_hash = "6d0f755a758aaac4328f5f4343b424c03c2751ddad6a1dbe7c0332171c027945"
score = 75
@@ -273739,10 +274122,10 @@ rule SIGNATURE_BASE_Ikat_Command_Lines_Agent
author = "Florian Roth (Nextron Systems)"
id = "35068d59-272d-55a6-b211-2c138276914c"
date = "2014-05-11"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L837-L858"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L837-L858"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c802ee1e49c0eae2a3fc22d2e82589d857f96d94"
logic_hash = "a39f8e388aa11c732156753f4a19aa9cc3ccd0437de30cdcc608926320a089b0"
score = 75
@@ -273770,10 +274153,10 @@ rule SIGNATURE_BASE_Ikat_Cmd_As_Dll
author = "Florian Roth (Nextron Systems)"
id = "8d15b4b6-25f3-556c-bfa8-eba503c9c649"
date = "2014-05-11"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L860-L878"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L860-L878"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b5d0ba941efbc3b5c97fe70f70c14b2050b8336a"
logic_hash = "3f8390fb6eb16749e63379222a5899b811e7ccd6b3b219b60d7a621fd4595e7b"
score = 65
@@ -273797,10 +274180,10 @@ rule SIGNATURE_BASE_Ikat_Tools_Nmap
author = "Florian Roth (Nextron Systems)"
id = "be4858e6-a8f3-55eb-9c04-f4def838dde1"
date = "2014-05-11"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L880-L897"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L880-L897"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d0543f365df61e6ebb5e345943577cc40fca8682"
logic_hash = "f538d807ed4904a2c321385a095a97bc0d718349f7eb31a367e521228412cef2"
score = 50
@@ -273824,10 +274207,10 @@ rule SIGNATURE_BASE_Ikat_Startbar
author = "Florian Roth (Nextron Systems)"
id = "f29f15e9-aa29-519a-b4ad-c018aac68fd6"
date = "2014-05-11"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L899-L919"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L899-L919"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0cac59b80b5427a8780168e1b85c540efffaf74f"
logic_hash = "adb29d4903a771b0dab9dee8313878757ff12fc014da86291e32eb3ec60bf551"
score = 50
@@ -273854,10 +274237,10 @@ rule SIGNATURE_BASE_Ikat_Tool_Generic
author = "Florian Roth (Nextron Systems)"
id = "a8064a26-09c0-59f1-bdf9-628a445014ff"
date = "2014-05-11"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L921-L947"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L921-L947"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "814c126f21bc5e993499f0c4e15b280bf7c1c77f"
hash = "75f5aed1e719443a710b70f2004f34b2fe30f2a9"
hash = "b65a460d015fd94830d55e8eeaf6222321e12349"
@@ -273890,10 +274273,10 @@ rule SIGNATURE_BASE_Bypassuac2
author = "yarGen Yara Rule Generator"
id = "8b7e49de-9b0a-5dc4-86af-1a854dc649cc"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L949-L961"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L949-L961"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ef3e7dd2d1384ecec1a37254303959a43695df61"
logic_hash = "398783fa0453a60fd1c6aa64eacfbfa7c5385e81c79d1b6a8a8386dae9b825cc"
score = 75
@@ -273915,10 +274298,10 @@ rule SIGNATURE_BASE_Bypassuac_3
author = "yarGen Yara Rule Generator"
id = "407a8e12-1160-584d-94c8-7aa78e29c754"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L963-L976"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L963-L976"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1974aacd0ed987119999735cad8413031115ce35"
logic_hash = "cf3183ff4562f2962f87bc594c1710c73c113fa1d49fa56f7a3ff391ba4b9003"
score = 75
@@ -273941,10 +274324,10 @@ rule SIGNATURE_BASE_Bypassuacdll_6
author = "yarGen Yara Rule Generator"
id = "5be27053-446f-5ea3-a242-2661aeffa3df"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L994-L1005"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L994-L1005"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
logic_hash = "3cb89875ddf79a3709aeb58149e228e03b9fb43fa1565aab5ece743857b4cc71"
score = 75
@@ -273965,10 +274348,10 @@ rule SIGNATURE_BASE_Bypassuac_EXE
author = "yarGen Yara Rule Generator"
id = "b88aded5-7dfb-5cdf-bb42-cd8b069259e0"
date = "2016-02-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1007-L1021"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1007-L1021"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
logic_hash = "0283efd6866ed9417f2d255715f04c0ed6d7a89befce6a3a52c22ac06593c0bd"
score = 75
@@ -273992,10 +274375,10 @@ rule SIGNATURE_BASE_APT_Proxy_Malware_Packed_Dev
author = "FRoth"
id = "0b81b6c9-86fa-59c1-b58c-80310f6c0680"
date = "2014-11-10"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1023-L1037"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1023-L1037"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6b6a86ceeab64a6cb273debfa82aec58"
logic_hash = "64b15aaf93b40744b887c75fa26f4996d72045a55ac82ab4de89a0d9a3714684"
score = 50
@@ -274017,10 +274400,10 @@ rule SIGNATURE_BASE_Tzddos_Ddos_Tool_CN
author = "Florian Roth (Nextron Systems)"
id = "bf2bfc7b-4db8-5d35-a312-2530a42985d5"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1039-L1058"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1039-L1058"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d4c517eda5458247edae59309453e0ae7d812f8e"
logic_hash = "fed09a8586f9b573e46871efa71082f4573d2bd069fde9cc2928b267d0025bab"
score = 60
@@ -274047,10 +274430,10 @@ rule SIGNATURE_BASE_Ncat_Hacktools_CN
author = "Florian Roth (Nextron Systems)"
id = "bdbfaf75-f8c0-508e-b6b1-9ddea179a325"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1060-L1078"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1060-L1078"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "001c0c01c96fa56216159f83f6f298755366e528"
logic_hash = "0e059e90447747ed5259da4a870036d37d181c1cfea734ab25e760e81612f0f3"
score = 60
@@ -274076,10 +274459,10 @@ rule SIGNATURE_BASE_MS08_067_Exploit_Hacktools_CN
author = "Florian Roth (Nextron Systems)"
id = "c15836c7-e739-5cc0-9d41-d651ea3e4738"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1080-L1099"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1080-L1099"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a3e9e0655447494253a1a60dbc763d9661181322"
logic_hash = "e5756250de401324d0c86f855bc088c8364e4a632cece25e553939fa621b73d8"
score = 60
@@ -274106,10 +274489,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Sql
author = "Florian Roth (Nextron Systems)"
id = "77ea95fc-7a6a-522b-8a72-1832598c4d2d"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1101-L1122"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1101-L1122"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d5139b865e99b7a276af7ae11b14096adb928245"
logic_hash = "139f7308055351d9dc8a704c055360ac9408dcefc9eee4b9f222886fb5249b8c"
score = 60
@@ -274138,10 +274521,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_445TOOL
author = "Florian Roth (Nextron Systems)"
id = "02075631-49cc-5b97-ad8e-92d734a26d34"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1124-L1140"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1124-L1140"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "92050ba43029f914696289598cf3b18e34457a11"
logic_hash = "69a17bf7735eea946a5326d9535e68b8f010f2a0229875970b1bb15029c6dc4e"
score = 60
@@ -274165,10 +274548,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_445
author = "Florian Roth (Nextron Systems)"
id = "02075631-49cc-5b97-ad8e-92d734a26d34"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1142-L1162"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1142-L1162"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a61316578bcbde66f39d88e7fc113c134b5b966b"
logic_hash = "d3f5b2c601dfa1702bbd1f8bdc1f847dd34ba84a6c527a3e02cdb76075e4ad2c"
score = 60
@@ -274196,10 +274579,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Wineggdrop
author = "Florian Roth (Nextron Systems)"
id = "9b6244ee-5ace-5caa-bfa2-732bcfcfc998"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1164-L1187"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1164-L1187"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7665011742ce01f57e8dc0a85d35ec556035145d"
logic_hash = "6123a07038e30e11e37a70b912a1c854c13341e67eaf4ed14ca9954288a42d62"
score = 60
@@ -274230,10 +274613,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Scan_BAT
author = "Florian Roth (Nextron Systems)"
id = "836e0618-93c7-5519-bbc4-705ff5c2e127"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1189-L1207"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1189-L1207"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6517d7c245f1300e42f7354b0fe5d9666e5ce52a"
logic_hash = "eed941d2ad5d33d7224504b08d2104d4043fab7a2ff027fc54cd1afd42e32549"
score = 60
@@ -274259,10 +274642,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_Burst
author = "Florian Roth (Nextron Systems)"
id = "e07c66d1-958e-5ad2-9d5b-380d48af8360"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1209-L1222"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1209-L1222"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ce8e3d95f89fb887d284015ff2953dbdb1f16776"
logic_hash = "c334019cab377f4d96f5daee6a2f1fa7e24ecc43b3aee1eb76537640fdfd8a97"
score = 60
@@ -274283,10 +274666,10 @@ rule SIGNATURE_BASE_Hacktools_CN_445_Cmd : FILE
author = "Florian Roth (Nextron Systems)"
id = "b9693f51-26ac-5bf1-8c4d-ca852a154636"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1224-L1239"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1224-L1239"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "69b105a3aec3234819868c1a913772c40c6b727a"
logic_hash = "e0ab572fe9009ddc39f34302d8a16531c23f51ce4ea373d57a039f22ccc934c7"
score = 60
@@ -274309,10 +274692,10 @@ rule SIGNATURE_BASE_Hacktools_CN_GOGOGO_Bat
author = "Florian Roth (Nextron Systems)"
id = "b52cc150-81d4-5895-8f83-ee2006f75617"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1241-L1266"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1241-L1266"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4bd4f5b070acf7fe70460d7eefb3623366074bbd"
logic_hash = "0209ffba87ff07379c768c1c00496a37f0f9bc6b786a31afdafe55d65a9f39ab"
score = 60
@@ -274345,10 +274728,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Pass
author = "Florian Roth (Nextron Systems)"
id = "d8f6784f-80c8-51e2-9d86-40022cd8705d"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1268-L1291"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1268-L1291"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "55a05cf93dbd274355d798534be471dff26803f9"
logic_hash = "3a30cc602a66bd87304756311d56e7c698c1edb0b4b209198c589c4792776992"
score = 60
@@ -274379,10 +274762,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Johor_Posts_Killer
author = "Florian Roth (Nextron Systems)"
id = "68bba78e-f3a0-5eaa-9c63-e5f23a76b328"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1293-L1314"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1293-L1314"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d157f9a76f9d72dba020887d7b861a05f2e56b6a"
logic_hash = "2fc63cd42619a2b92ab8670b14ab4c01eb3b194cd337d329ba224b7088d26318"
score = 60
@@ -274411,10 +274794,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_Tesksd
author = "Florian Roth (Nextron Systems)"
id = "399ff307-c2e8-57bb-b792-a2c599e8686e"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1316-L1331"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1316-L1331"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "922147b3e1e6cf1f5dd5f64a4e34d28bdc9128cb"
logic_hash = "dc81acef0ad3e6307f68ee755e5b27f2dcf1e2822e560a72dc5ae572703f4459"
score = 60
@@ -274437,10 +274820,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Http : FILE
author = "Florian Roth (Nextron Systems)"
id = "bbff6ff6-8cef-5a83-afd3-34f306e8e715"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1333-L1349"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1333-L1349"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "788bf0fdb2f15e0c628da7056b4e7b1a66340338"
logic_hash = "690b41bdf856e0d4d90b4a42524134302e9649018fdd495c359582aa6121a017"
score = 60
@@ -274466,8 +274849,8 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Start
date = "2014-11-17"
modified = "2023-01-27"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1351-L1373"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1351-L1373"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "75d194d53ccc37a68286d246f2a84af6b070e30c"
logic_hash = "b435957150da7b790809d2cf90a01c967127c183ddcbf333beda1a7c599b69a5"
score = 60
@@ -274496,10 +274879,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Panda_Tasksvr
author = "Florian Roth (Nextron Systems)"
id = "5c85b382-551a-5e9e-9af8-d106cbe26f74"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1375-L1390"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1375-L1390"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a73fc74086c8bb583b1e3dcfd326e7a383007dc0"
logic_hash = "183708e525ec6676662b59a2a3c79f5113a80f2d5b3bd4713c74a536fe303b2d"
score = 60
@@ -274522,10 +274905,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Clear
author = "Florian Roth (Nextron Systems)"
id = "21f33a36-779e-5eac-819c-ef79f291b43c"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1392-L1413"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1392-L1413"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "148c574a4e6e661aeadaf3a4c9eafa92a00b68e4"
logic_hash = "d10ed2c6ea3f1a8b289529cc90f50f84288003576aced903f48db3c2abc4722d"
score = 60
@@ -274554,10 +274937,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Thecard
author = "Florian Roth (Nextron Systems)"
id = "a9946aeb-2042-522f-8d91-f8b96341bb64"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1415-L1432"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1415-L1432"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "50b01ea0bfa5ded855b19b024d39a3d632bacb4c"
logic_hash = "29e1fb2e0bfa60e5406f9fd1c0ec99f0fc1b416ffc4d59846627e40959a32c63"
score = 60
@@ -274582,10 +274965,10 @@ rule SIGNATURE_BASE_Hacktools_CN_Burst_Blast
author = "Florian Roth (Nextron Systems)"
id = "9ac723c4-e88d-5fb3-b18f-c8b764c8acf3"
date = "2014-11-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1434-L1448"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1434-L1448"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b07702a381fa2eaee40b96ae2443918209674051"
logic_hash = "77902c7b23bab80d035f1dbe074554f16f99b2c9e31c80171296a1d33f705dac"
score = 60
@@ -274607,10 +274990,10 @@ rule SIGNATURE_BASE_Vubrute_Vubrute
author = "Florian Roth (Nextron Systems)"
id = "7ac74c85-465c-5eb5-8e91-004f28cabb75"
date = "2014-11-22"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1450-L1466"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1450-L1466"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "166fa8c5a0ebb216c832ab61bf8872da556576a7"
logic_hash = "9dab03b70b249c0c481e3bc98c3196e83da93ea2723674d38baf32469392d52a"
score = 70
@@ -274634,10 +275017,10 @@ rule SIGNATURE_BASE_DK_Brute
author = "Florian Roth (Nextron Systems)"
id = "c9ea0dcf-10f3-5161-aebc-2db04c24b0a5"
date = "2014-11-22"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://goo.gl/xiIphp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1468-L1485"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1468-L1485"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "93b7c3a01c41baecfbe42461cb455265f33fbc3d"
logic_hash = "a48ba3513c9c99066e9dda02859089e9e1db15e7bd52443795771609f011c94a"
score = 70
@@ -274661,10 +275044,10 @@ rule SIGNATURE_BASE_Vubrute_Config
author = "Florian Roth (Nextron Systems)"
id = "25cad108-b2d6-5886-bb2f-e614e05649fa"
date = "2014-11-22"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://goo.gl/xiIphp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1487-L1507"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1487-L1507"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b9f66b9265d2370dab887604921167c11f7d93e9"
logic_hash = "b4c54d5ecb269c7310b5bd2a9e8fe5d6c75503f8cb1f25679399e25185d9cb51"
score = 70
@@ -274691,10 +275074,10 @@ rule SIGNATURE_BASE_Sig_238_Hunt
author = "Florian Roth (Nextron Systems)"
id = "5d9d1f99-2f12-51e9-a554-b349e19d00fb"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1509-L1528"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1509-L1528"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f9f059380d95c7f8d26152b1cb361d93492077ca"
logic_hash = "66d22c4dc2864d61bd485d6840887905f020fce8e19bb976ec09acaa6ed0387c"
score = 60
@@ -274721,10 +275104,10 @@ rule SIGNATURE_BASE_Sig_238_Listip
author = "Florian Roth (Nextron Systems)"
id = "417faf20-ee07-5c3e-bfcf-89599e38e62e"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1530-L1548"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1530-L1548"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f32a0c5bf787c10eb494eb3b83d0c7a035e7172b"
logic_hash = "db5cc21e8c76fdd10953ba0f06c4a1ad319ee522d9def7777dad66612b51edfc"
score = 60
@@ -274750,10 +275133,10 @@ rule SIGNATURE_BASE_Arttrayhookdll
author = "Florian Roth (Nextron Systems)"
id = "324561fc-024c-5583-aa25-6b13e9616898"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1550-L1564"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1550-L1564"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4867214a3d96095d14aa8575f0adbb81a9381e6c"
logic_hash = "e43cefdb11df870f4732e74782ecefb94c0a4850c4aa994e4fbc940f523d2434"
score = 60
@@ -274775,10 +275158,10 @@ rule SIGNATURE_BASE_Sig_238_Eee
author = "Florian Roth (Nextron Systems)"
id = "9d3ad3a9-0498-5ca3-ac19-f250cb10c4d3"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1566-L1585"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1566-L1585"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "236916ce2980c359ff1d5001af6dacb99227d9cb"
logic_hash = "b12c11f46125a33a2d7d9d02f25762c07b9d5088f70887c000b29e82a7921399"
score = 60
@@ -274805,10 +275188,10 @@ rule SIGNATURE_BASE_Aspbackdoor_Asp4
author = "Florian Roth (Nextron Systems)"
id = "7718aa71-fc0f-505c-a035-b78ae0438653"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1587-L1607"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1587-L1607"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "faf991664fd82a8755feb65334e5130f791baa8c"
logic_hash = "dab19a2b92bbfe17cb860981d7bd5c3f3dd1a9e7c2ac5093fc4117f9205c1c27"
score = 60
@@ -274836,10 +275219,10 @@ rule SIGNATURE_BASE_Aspfile1
author = "Florian Roth (Nextron Systems)"
id = "1b66dec0-22c8-5937-a0b2-22cbc68241ef"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1609-L1627"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1609-L1627"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "77b1e3a6e8f67bd6d16b7ace73dca383725ac0af"
logic_hash = "4968e44f807f8ffface65e21fd8684ccfaee281b4da10f5110482c3f26ccac26"
score = 60
@@ -274865,10 +275248,10 @@ rule SIGNATURE_BASE_Editserver
author = "Florian Roth (Nextron Systems)"
id = "de6bf995-1c7c-561f-98df-e8748d5fb157"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1629-L1651"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1629-L1651"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "87b29c9121cac6ae780237f7e04ee3bc1a9777d3"
logic_hash = "6a8f6fcf8f4a0ea5ac114150d7becbd716be0bb40cd45fd5c76a4a8a328e5e40"
score = 60
@@ -274897,10 +275280,10 @@ rule SIGNATURE_BASE_Sig_238_Letmein
author = "Florian Roth (Nextron Systems)"
id = "5dba055f-1928-534a-8d0e-11dda56d93b7"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1653-L1669"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1653-L1669"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "74d223a56f97b223a640e4139bb9b94d8faa895d"
logic_hash = "6cf454d11bc806b3a30c52b730994adb8d92613c92849162717f415e5681e417"
score = 60
@@ -274924,10 +275307,10 @@ rule SIGNATURE_BASE_Sig_238_Token
author = "Florian Roth (Nextron Systems)"
id = "9d0ac24b-2078-5455-8d9e-a642c71f7b2d"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1671-L1688"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1671-L1688"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c52bc6543d4281aa75a3e6e2da33cfb4b7c34b14"
logic_hash = "88d7086a48c6a2e3801db75565184b087e663e80e2364765072fc37a5549b8b5"
score = 60
@@ -274952,10 +275335,10 @@ rule SIGNATURE_BASE_Sig_238_TELNET
author = "Florian Roth (Nextron Systems)"
id = "fae22e0f-2f69-5dc6-984c-2c07530ad11a"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1690-L1706"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1690-L1706"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "50d02d77dc6cc4dc2674f90762a2622e861d79b1"
logic_hash = "4e90d95b7c94933ed5c50f060840291540fc99de0173298b97d2c6ccbf75d26a"
score = 60
@@ -274979,10 +275362,10 @@ rule SIGNATURE_BASE_Snifferport
author = "Florian Roth (Nextron Systems)"
id = "5b903344-18d2-5d3d-be66-7260a5f3ea4b"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1708-L1725"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1708-L1725"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d14133b5eaced9b7039048d0767c544419473144"
logic_hash = "361f1a55ed4bd5a7a5d01d346c4efd1b83e701363484282235b5aab18d3abe1a"
score = 60
@@ -275007,10 +275390,10 @@ rule SIGNATURE_BASE_Sig_238_Webget
author = "Florian Roth (Nextron Systems)"
id = "b03a2463-94fe-5050-8e3d-269101a03cda"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1727-L1743"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1727-L1743"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "36b5a5dee093aa846f906bbecf872a4e66989e42"
logic_hash = "958c465caddf6436b29042f1f1772e039d011d23ff13d91818a9d7ad21a2c750"
score = 60
@@ -275034,10 +275417,10 @@ rule SIGNATURE_BASE_Xyzcmd_Zip_Folder_Xyzcmd
author = "Florian Roth (Nextron Systems)"
id = "c3d70b93-1d53-5403-bd22-d1e4bad5042b"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1745-L1761"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1745-L1761"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bbea5a94950b0e8aab4a12ad80e09b630dd98115"
logic_hash = "ad0e8f964c7be376236b50ea370de3e433fa9e7b043663d8f32fad06997056ea"
score = 60
@@ -275061,10 +275444,10 @@ rule SIGNATURE_BASE_Aspack_Chinese
author = "Florian Roth (Nextron Systems)"
id = "ac821117-7534-5dec-9477-25be87361900"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1763-L1780"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1763-L1780"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "02a9394bc2ec385876c4b4f61d72471ac8251a8e"
logic_hash = "98b3af76986cd41190612a2fdfbd9ba48f102456897f4acaedd89a40ab5a582a"
score = 60
@@ -275089,10 +275472,10 @@ rule SIGNATURE_BASE_Aspbackdoor_EDIR
author = "Florian Roth (Nextron Systems)"
id = "0895091a-b620-5746-8245-d44716ec2bbe"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1782-L1799"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1782-L1799"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "03367ad891b1580cfc864e8a03850368cbf3e0bb"
logic_hash = "be7d956333107a57a0fd86c69fc9eabcd3d9daf3f66385c44ba246fc2000dc4d"
score = 60
@@ -275117,10 +275500,10 @@ rule SIGNATURE_BASE_Bypassfirewall_Zip_Folder_Ie
author = "Florian Roth (Nextron Systems)"
id = "7bd10fa1-be2d-5882-b4c7-b696612343e5"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1801-L1817"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1801-L1817"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d1b9058f16399e182c9b78314ad18b975d882131"
logic_hash = "844e260870f075b0afae0667691e61ab8f138a29871f9a18d1f2b623f9bb9e2a"
score = 60
@@ -275144,10 +275527,10 @@ rule SIGNATURE_BASE_Editkeylogreadme
author = "Florian Roth (Nextron Systems)"
id = "db083c04-9e5c-5cfd-b4d4-eecf28191b6b"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1819-L1837"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1819-L1837"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dfa90540b0e58346f4b6ea12e30c1404e15fbe5a"
logic_hash = "a58a2336e7d714a2e7f60eec8dacbee9a7190552dd791d8b6eba084ffaf0904a"
score = 60
@@ -275173,10 +275556,10 @@ rule SIGNATURE_BASE_Passsniffer_Zip_Folder_Readme
author = "Florian Roth (Nextron Systems)"
id = "f5965aa8-0f78-56fd-8e3e-6dc013942cb3"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1839-L1854"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1839-L1854"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a52545ae62ddb0ea52905cbb61d895a51bfe9bcd"
logic_hash = "d9e6cd2ba7e98481664b0560184a07349bb471dd370c4b73ef5f5f05a8e89946"
score = 60
@@ -275199,10 +275582,10 @@ rule SIGNATURE_BASE_Sig_238_Gina
author = "Florian Roth (Nextron Systems)"
id = "85c19493-e6d4-55e8-8526-6817243e90cf"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1856-L1871"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1856-L1871"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "324acc52566baf4afdb0f3e4aaf76e42899e0cf6"
logic_hash = "f0ece7406a31f5a4212da5c4144233c5c45b8120d09267fdf7e291d6c9827384"
score = 60
@@ -275225,10 +275608,10 @@ rule SIGNATURE_BASE_Splitjoin
author = "Florian Roth (Nextron Systems)"
id = "2f1a69cd-34b3-5af0-a054-fe19d9becb25"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1873-L1889"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1873-L1889"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e4a9ef5d417038c4c76b72b5a636769a98bd2f8c"
logic_hash = "dede4518ed9be28e89bc67dab4e68503383c16746f088f37a4c8069e256183ca"
score = 60
@@ -275252,10 +275635,10 @@ rule SIGNATURE_BASE_Editkeylog
author = "Florian Roth (Nextron Systems)"
id = "db083c04-9e5c-5cfd-b4d4-eecf28191b6b"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1891-L1907"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1891-L1907"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a450c31f13c23426b24624f53873e4fc3777dc6b"
logic_hash = "0efb173598117857c5bf7894f017d655653e843dd0a44439d1b10b7e5c59b248"
score = 60
@@ -275279,10 +275662,10 @@ rule SIGNATURE_BASE_Passsniffer
author = "Florian Roth (Nextron Systems)"
id = "f5965aa8-0f78-56fd-8e3e-6dc013942cb3"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1909-L1927"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1909-L1927"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dcce4c577728e8edf7ed38ac6ef6a1e68afb2c9f"
logic_hash = "771b45473c48618c43c6be84dd37b2ccb23643f1674d437763cb78ce560067c0"
score = 60
@@ -275308,10 +275691,10 @@ rule SIGNATURE_BASE_Aspfile2
author = "Florian Roth (Nextron Systems)"
id = "42bbcc16-a6d7-53d7-8651-1a28c6b26ee8"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1929-L1945"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1929-L1945"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "14efbc6cb01b809ad75a535d32b9da4df517ff29"
logic_hash = "0fd52e646751b14840f30100382c5171fd001c05110dccb4ac87be9b2c4b6131"
score = 60
@@ -275335,10 +275718,10 @@ rule SIGNATURE_BASE_Unpack_Rar_Folder_Injectt
author = "Florian Roth (Nextron Systems)"
id = "cc7d1a36-1214-5a14-8589-9eb2339a8700"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1947-L1970"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1947-L1970"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "80f39e77d4a34ecc6621ae0f4d5be7563ab27ea6"
logic_hash = "f9d682a9438f49cf8292c33e680537d8c2137b8cba2670430b92d0a620de85b9"
score = 60
@@ -275368,10 +275751,10 @@ rule SIGNATURE_BASE_Jc_Wineggdrop_Shell
author = "Florian Roth (Nextron Systems)"
id = "219df3a1-fe1c-5d33-ab3e-1b3cbd104c9e"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1972-L1991"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1972-L1991"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "820674b59f32f2cf72df50ba4411d7132d863ad2"
logic_hash = "af43980b4052cef56884e9d6bdbb12919f1a86420a3f189e30fba624ab37a420"
score = 60
@@ -275398,10 +275781,10 @@ rule SIGNATURE_BASE_Aspbackdoor_Asp1
author = "Florian Roth (Nextron Systems)"
id = "fa5128c5-efd5-55dd-880a-2952942e2035"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L1993-L2011"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L1993-L2011"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9ef9f34392a673c64525fcd56449a9fb1d1f3c50"
logic_hash = "7ce1911d7524e9961f907f863b3966817bcad7a571c933dac6a76e1d8a1eeaf8"
score = 60
@@ -275427,10 +275810,10 @@ rule SIGNATURE_BASE_QQ_Zip_Folder_QQ
author = "Florian Roth (Nextron Systems)"
id = "30da6292-f670-5b73-985a-3028e20607be"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2013-L2033"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2013-L2033"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9f8e3f40f1ac8c1fa15a6621b49413d815f46cfb"
logic_hash = "d2517c3646b9a3babfa767c5c57b4b576fda471c190ab66e1054c4de359713ad"
score = 60
@@ -275458,10 +275841,10 @@ rule SIGNATURE_BASE_Unpack_Rar_Folder_Tback
author = "Florian Roth (Nextron Systems)"
id = "f672f987-0d43-53df-8338-084907b6da16"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2035-L2063"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2035-L2063"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "30fc9b00c093cec54fcbd753f96d0ca9e1b2660f"
logic_hash = "89f978742ab952b727a9a8dbab0cd88cfc07440e8c4f974dcfa14ed630083761"
score = 60
@@ -275497,10 +275880,10 @@ rule SIGNATURE_BASE_Sig_238_Cmd_2
author = "Florian Roth (Nextron Systems)"
id = "5fae3c4a-aeeb-5e02-9071-3980a39a19a9"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2065-L2082"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2065-L2082"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "be4073188879dacc6665b6532b03db9f87cfc2bb"
logic_hash = "a794d6b60194a190bd8d549ad00cf90649a52d831fdc7539c68a1f6312609bc2"
score = 60
@@ -275525,10 +275908,10 @@ rule SIGNATURE_BASE_Rangescan
author = "Florian Roth (Nextron Systems)"
id = "143d9e1e-41e2-579a-beee-30da2cf068f7"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2084-L2101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2084-L2101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bace2c65ea67ac4725cb24aa9aee7c2bec6465d7"
logic_hash = "f334a59c2d95505807df642a8d5605b1b7d8b3385a552e8f5a37f344d7a75412"
score = 60
@@ -275553,10 +275936,10 @@ rule SIGNATURE_BASE_Xyzcmd_Zip_Folder_Readme
author = "Florian Roth (Nextron Systems)"
id = "cee0f8c3-f947-50a5-ae8c-4ce83ef5e433"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2103-L2117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2103-L2117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "967cb87090acd000d22e337b8ce4d9bdb7c17f70"
logic_hash = "38d69eee78ff8fa2ad064871481bd1b8a926146922952c7e199d27c809d0c980"
score = 60
@@ -275578,10 +275961,10 @@ rule SIGNATURE_BASE_Bypassfirewall_Zip_Folder_Inject
author = "Florian Roth (Nextron Systems)"
id = "bb31dc53-f3c1-5f8b-84f9-c231a4e1675b"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2119-L2134"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2119-L2134"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "34f564301da528ce2b3e5907fd4b1acb7cb70728"
logic_hash = "6350e11097bc2bb8fb0fbecf6be463aeaf39ad4169d2dd06a57577bf02b515f8"
score = 60
@@ -275604,10 +275987,10 @@ rule SIGNATURE_BASE_Sig_238_Sqlcmd
author = "Florian Roth (Nextron Systems)"
id = "0efdfac7-5a89-5251-b583-12b0a58c48ff"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2136-L2155"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2136-L2155"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b6e356ce6ca5b3c932fa6028d206b1085a2e1a9a"
logic_hash = "1e41c38da7552d6a25c918547a39ed07ec38a537fd04e2090d1199c4fb0e3b1e"
score = 40
@@ -275634,10 +276017,10 @@ rule SIGNATURE_BASE_Aspack_ASPACK
author = "Florian Roth (Nextron Systems)"
id = "ca9a25f9-a94b-5e10-b935-c6e2d38d999c"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2157-L2172"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2157-L2172"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c589e6fd48cfca99d6335e720f516e163f6f3f42"
logic_hash = "1c7abc0a126ee8c8b20e55ad85974067f1a230efc5f95a1a1e732025e39d5bab"
score = 60
@@ -275660,10 +276043,10 @@ rule SIGNATURE_BASE_Sig_238_2323
author = "Florian Roth (Nextron Systems)"
id = "445f6a49-51e6-5eb8-ae08-e5989aafb6c4"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2174-L2192"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2174-L2192"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "21812186a9e92ee7ddc6e91e4ec42991f0143763"
logic_hash = "1278c53f64a0ba7f3f6a728237eac6808b260ad36551923276bfba9b36586870"
score = 60
@@ -275689,10 +276072,10 @@ rule SIGNATURE_BASE_Jc_ALL_Wineggdropshell_Rar_Folder_Install_2
author = "Florian Roth (Nextron Systems)"
id = "ebfc8e53-328c-5deb-bf9b-e0270f171c68"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2194-L2212"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2194-L2212"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "95866e917f699ee74d4735300568640ea1a05afd"
logic_hash = "9c12e8491918a656e37b4ee6c3a42ec970cb6cf101ca5fe3fdfe9eab16526219"
score = 60
@@ -275718,10 +276101,10 @@ rule SIGNATURE_BASE_Sig_238_TFTPD32
author = "Florian Roth (Nextron Systems)"
id = "071fba15-affe-539a-bcc0-c14943fff51a"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2214-L2235"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2214-L2235"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5c5f8c1a2fa8c26f015e37db7505f7c9e0431fe8"
logic_hash = "cbf239330f8f1fd8be3ef3c93571c723447ca3b814fb7c1eff5ea4b2e7f5364f"
score = 60
@@ -275750,10 +276133,10 @@ rule SIGNATURE_BASE_Sig_238_Iecv
author = "Florian Roth (Nextron Systems)"
id = "08126db3-267b-5289-b562-40bc264f6e3e"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2237-L2254"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2237-L2254"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6e6e75350a33f799039e7a024722cde463328b6d"
logic_hash = "e2985d85030d88cb63eb8b80673812f85aea6e11c6aeb430387cdb8886958b6a"
score = 60
@@ -275778,10 +276161,10 @@ rule SIGNATURE_BASE_Antiy_Ports_1_21
author = "Florian Roth (Nextron Systems)"
id = "eb53fc91-4dec-5416-a2c7-1e8256297886"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2256-L2271"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2256-L2271"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ebf4bcc7b6b1c42df6048d198cbe7e11cb4ae3f0"
logic_hash = "fb175c413faf0ca33cf166029b217aac31126d6cabc81883c16b2de2ab00c16c"
score = 60
@@ -275804,10 +276187,10 @@ rule SIGNATURE_BASE_Perlcmd_Zip_Folder_Cmd
author = "Florian Roth (Nextron Systems)"
id = "19e4eca0-bd56-57af-afd2-ee2fc5c7c0df"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2273-L2293"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2273-L2293"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "21b5dc36e72be5aca5969e221abfbbdd54053dd8"
logic_hash = "4391207d66b7ed5ac2db127d3efcf22f8c2bbd0ee1f0c6982d656b91e5e10c8f"
score = 60
@@ -275835,10 +276218,10 @@ rule SIGNATURE_BASE_Aspbackdoor_Asp3
author = "Florian Roth (Nextron Systems)"
id = "ed86e829-449b-5088-a105-f1fe79547540"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2295-L2315"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2295-L2315"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e5588665ca6d52259f7d9d0f13de6640c4e6439c"
logic_hash = "c62ae1d32e93a8614a8288ce2df8e26806ab67b3b133067182f0396f0f080b78"
score = 60
@@ -275866,10 +276249,10 @@ rule SIGNATURE_BASE_Sig_238_Fpipe
author = "Florian Roth (Nextron Systems)"
id = "0b2f11d9-a919-5790-8724-d2f028e4fa3a"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2317-L2335"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2317-L2335"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
logic_hash = "ecf143c231aeb37cf9575c3ea8db83c9a049e85a7c95668deeac0878f9c30b9c"
score = 60
@@ -275895,10 +276278,10 @@ rule SIGNATURE_BASE_Sig_238_Concon
author = "Florian Roth (Nextron Systems)"
id = "ca7862cc-1053-5fce-a569-6ecc069314df"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2337-L2350"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2337-L2350"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "816b69eae66ba2dfe08a37fff077e79d02b95cc1"
logic_hash = "c45955cc59970657f8787ddc0e549939d2fa30d11cfd19fd12cd9067abb3bcd6"
score = 60
@@ -275919,10 +276302,10 @@ rule SIGNATURE_BASE_Aspbackdoor_Regdll
author = "Florian Roth (Nextron Systems)"
id = "37096c50-68d0-5412-847a-022062a5ff2a"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2352-L2368"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2352-L2368"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5c5e16a00bcb1437bfe519b707e0f5c5f63a488d"
logic_hash = "89606ccf4341ba9451fd1bfbc818bbcd55d45d50e06f09b9f1ecd8efb3c322af"
score = 60
@@ -275946,10 +276329,10 @@ rule SIGNATURE_BASE_Cleaniislog
author = "Florian Roth (Nextron Systems)"
id = "439726c6-3262-59ef-9a54-7dcd98cf924d"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2370-L2391"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2370-L2391"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
logic_hash = "77a26e57b36f73d4d2730bc3a4d8485718119e2ccc80b40de3515ec688616eb9"
score = 60
@@ -275978,10 +276361,10 @@ rule SIGNATURE_BASE_Sqlcheck
author = "Florian Roth (Nextron Systems)"
id = "a72d38ef-b2e7-5051-8538-724d9e95fa6a"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2393-L2410"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2393-L2410"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5a5778ac200078b627db84fdc35bf5bcee232dc7"
logic_hash = "e9c1d7cabe7236e059f4bfec917ca00c47a3db955746ebfcda0f5e733de359c7"
score = 60
@@ -276006,10 +276389,10 @@ rule SIGNATURE_BASE_Sig_238_Runasex
author = "Florian Roth (Nextron Systems)"
id = "5fe349db-c0fc-5a49-97ee-3142f4e0e4c1"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2412-L2430"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2412-L2430"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a22fa4e38d4bf82041d67b4ac5a6c655b2e98d35"
logic_hash = "dac03251539028da02c9f26f20ca751ee577c125fb4f287c61ac2ea6afb1bb28"
score = 60
@@ -276035,10 +276418,10 @@ rule SIGNATURE_BASE_Sig_238_Nbtdump
author = "Florian Roth (Nextron Systems)"
id = "fe490f72-a07d-57c2-b9bb-d791fab10ec6"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2432-L2451"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2432-L2451"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cfe82aad5fc4d79cf3f551b9b12eaf9889ebafd8"
logic_hash = "fd17851820b5036b4cc1ebb6f927bb62c898027a17b5376e9420cbfa6a166ef2"
score = 60
@@ -276065,10 +276448,10 @@ rule SIGNATURE_BASE_Sig_238_Glass2K
author = "Florian Roth (Nextron Systems)"
id = "7a2ad37a-6b55-5710-b07d-7c289cdbb04e"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2453-L2470"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2453-L2470"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b05455a1ecc6bc7fc8ddef312a670f2013704f1a"
logic_hash = "d9b6b904028d67804d095f85caea5796f528f866191d3b4250055a75511f2090"
score = 60
@@ -276093,10 +276476,10 @@ rule SIGNATURE_BASE_Splitjoin_V1_3_3_Rar_Folder_3
author = "Florian Roth (Nextron Systems)"
id = "4ffd7501-339c-52b7-8661-2c3ca57dfa1f"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2472-L2487"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2472-L2487"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "21409117b536664a913dcd159d6f4d8758f43435"
logic_hash = "79eb49413cd6919e4b91e916d2612e007fd2c4da7244d9e1e3dd04d46c461d8c"
score = 60
@@ -276119,10 +276502,10 @@ rule SIGNATURE_BASE_Aspbackdoor_EDIT
author = "Florian Roth (Nextron Systems)"
id = "cdcec370-97af-51c0-b81a-35a788f16ef4"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2489-L2508"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2489-L2508"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12196cf62931cde7b6cb979c07bb5cc6a7535cbb"
logic_hash = "0f97c831eb9f257a2a6c9a677dde2ce17d529584fb7085bc94edd83d886e469f"
score = 60
@@ -276149,10 +276532,10 @@ rule SIGNATURE_BASE_Aspbackdoor_Entice
author = "Florian Roth (Nextron Systems)"
id = "68c61920-9c3c-5bfe-976c-346b258bb406"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2510-L2527"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2510-L2527"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e273a1b9ef4a00ae4a5d435c3c9c99ee887cb183"
logic_hash = "c11313351565d26d9b16a2d5c3c4589676593fe633c441a1c1a33b3c134a2d56"
score = 60
@@ -276177,10 +276560,10 @@ rule SIGNATURE_BASE_Fpipe2_0
author = "Florian Roth (Nextron Systems)"
id = "7e104cf6-69d2-590e-8999-4f0d448719f2"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2529-L2547"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2529-L2547"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "891609db7a6787575641154e7aab7757e74d837b"
logic_hash = "b28566315ddda7765dfee722f5ad02c1206c6916363d86407fdc61b53148f511"
score = 60
@@ -276206,10 +276589,10 @@ rule SIGNATURE_BASE_Instgina
author = "Florian Roth (Nextron Systems)"
id = "ccbda689-e61a-501d-a8ed-62e3c1c20289"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2549-L2564"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2549-L2564"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5317fbc39508708534246ef4241e78da41a4f31c"
logic_hash = "a55a13ced122b9901f0505d585e7a7c984d4231b3507282c1b15ff400ce51265"
score = 60
@@ -276232,10 +276615,10 @@ rule SIGNATURE_BASE_Arttray_Zip_Folder_Arttray
author = "Florian Roth (Nextron Systems)"
id = "d29909a4-8663-54c7-8f0e-68b15def869f"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2566-L2582"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2566-L2582"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ee1edc8c4458c71573b5f555d32043cbc600a120"
logic_hash = "225be71bfd047331399162941edf06c72d2fd1afa04c78cbc51099665f50883b"
score = 60
@@ -276259,10 +276642,10 @@ rule SIGNATURE_BASE_Sig_238_Findoor
author = "Florian Roth (Nextron Systems)"
id = "61215a76-8c29-505d-bfef-a5f13fec476c"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2584-L2601"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2584-L2601"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cdb1ececceade0ecdd4479ecf55b0cc1cf11cdce"
logic_hash = "223f324ab6b61775d500dc248b9db8363ce915ec279a893a6f0ec92b273a27c0"
score = 60
@@ -276287,10 +276670,10 @@ rule SIGNATURE_BASE_Aspbackdoor_Ipclear
author = "Florian Roth (Nextron Systems)"
id = "71ebecea-721f-5c5d-9997-6a57f070d91c"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2603-L2620"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2603-L2620"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9f8fdfde4b729516330eaeb9141fb2a7ff7d0098"
logic_hash = "49fbe844a99aa8cae25db90e1d8cdeee13c81293bba7b3201afc4748cb0a6a7c"
score = 60
@@ -276315,10 +276698,10 @@ rule SIGNATURE_BASE_Wineggdropshellfinal_Zip_Folder_Injectt
author = "Florian Roth (Nextron Systems)"
id = "16f04551-050f-5a07-a35b-a3a7dbba6803"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2622-L2639"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2622-L2639"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "516e80e4a25660954de8c12313e2d7642bdb79dd"
logic_hash = "01840f4df12fbf6f5f27a3050c841002678605cd373e9ea9b182b2026caa29f9"
score = 60
@@ -276343,10 +276726,10 @@ rule SIGNATURE_BASE_Gina_Zip_Folder_Gina
author = "Florian Roth (Nextron Systems)"
id = "7ebc7218-9c7b-5595-ae7b-f316fc99d1f6"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2641-L2661"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2641-L2661"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e0429e1b59989cbab6646ba905ac312710f5ed30"
logic_hash = "1344634346f9e7e3ef96c901705ac7bd4aa9a70cfbebf71c8222544e84ca9f98"
score = 60
@@ -276374,10 +276757,10 @@ rule SIGNATURE_BASE_Superscan3_0
author = "Florian Roth (Nextron Systems)"
id = "d22aa3ae-4c62-5007-896d-7c473f0421a6"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2663-L2684"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2663-L2684"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a9a02a14ea4e78af30b8b4a7e1c6ed500a36bc4d"
logic_hash = "448d3af61062c53c5b148e58697537bd98316e6c6d4d9ed9e0ff36cbd5a0b4f5"
score = 60
@@ -276406,10 +276789,10 @@ rule SIGNATURE_BASE_Sig_238_Xsniff
author = "Florian Roth (Nextron Systems)"
id = "1e61a732-8691-5f84-beb0-c9f7e6d46538"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2686-L2707"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2686-L2707"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d61d7329ac74f66245a92c4505a327c85875c577"
logic_hash = "90c08db197a00885ffc62967bd814479a438f500316cf65e81fcec617517dd9c"
score = 60
@@ -276438,10 +276821,10 @@ rule SIGNATURE_BASE_Sig_238_Fscan
author = "Florian Roth (Nextron Systems)"
id = "7af4d38a-bc88-57ba-b602-4e01d3d95015"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2709-L2730"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2709-L2730"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d5646e86b5257f9c83ea23eca3d86de336224e55"
logic_hash = "0af558345e8c85021fd4f8d399dacb3b6e8d9c692060c31a36e943fc48bfabff"
score = 60
@@ -276470,10 +276853,10 @@ rule SIGNATURE_BASE__Iissample_Nesscan_Twwwscan
author = "Florian Roth (Nextron Systems)"
id = "a710ca8e-54dc-5a98-b173-c87b22af745f"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2732-L2758"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2732-L2758"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7f20962bbc6890bf48ee81de85d7d76a8464b862"
hash = "c0b1a2196e82eea4ca8b8c25c57ec88e4478c25b"
hash = "548f0d71ef6ffcc00c0b44367ec4b3bb0671d92f"
@@ -276507,10 +276890,10 @@ rule SIGNATURE_BASE__Fshttp_Fspop_Fssniffer
author = "Florian Roth (Nextron Systems)"
id = "5ca543af-2589-52b0-83f9-ad25ba76b633"
date = "2014-11-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2760-L2786"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2760-L2786"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9d4e7611a328eb430a8bb6dc7832440713926f5f"
hash = "ae23522a3529d3313dd883727c341331a1fb1ab9"
hash = "7ffc496cd4a1017485dfb571329523a52c9032d8"
@@ -276544,10 +276927,10 @@ rule SIGNATURE_BASE_Ammyy_Admin_AA_V3
author = "Florian Roth (Nextron Systems)"
id = "bb140cb7-9f56-5acb-883e-080dfd3f60d5"
date = "2014-12-22"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://goo.gl/gkAg2E"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2788-L2812"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2788-L2812"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b130611c92788337c4f6bb9e9454ff06eb409166"
hash = "07539abb2623fe24b9a05e240f675fa2d15268cb"
logic_hash = "6ab1de9f3b58cdb2c03f2d72986772333f8b81c98e6cbfd941f20b2fed1c5ff2"
@@ -276577,10 +276960,10 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_Scanssh
author = "Florian Roth (Nextron Systems)"
id = "9546d0d8-42af-5b4c-ac93-195d14bfbb5b"
date = "2015-01-19"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "not set"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2816-L2841"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2816-L2841"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "467398a6994e2c1a66a3d39859cde41f090623ad"
logic_hash = "cb20c28f1767ce23f60c377943d8a129fa069b1a1407bbaf43370f0ff79ade30"
score = 75
@@ -276613,10 +276996,10 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_Pscan2
author = "Florian Roth (Nextron Systems)"
id = "02d96766-6696-5410-ad48-bd8cb642ac51"
date = "2015-01-19"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "not set"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2843-L2861"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2843-L2861"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "56b476cba702a4423a2d805a412cae8ef4330905"
logic_hash = "3686ccbd53a6dcedf9b10d131a1fc76b51b265328ad10f63671b64d4bf57a0b6"
score = 75
@@ -276642,10 +277025,10 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_A
author = "Florian Roth (Nextron Systems)"
id = "2b4f52d4-b438-5040-89c5-aab1df15200e"
date = "2015-01-19"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "not set"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2863-L2881"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2863-L2881"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "458ada1e37b90569b0b36afebba5ade337ea8695"
logic_hash = "a246eb907fd6525c96c911acde6b513fca68248ef8d4f8fa64039791942950ab"
score = 75
@@ -276671,10 +277054,10 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_Mass
author = "Florian Roth (Nextron Systems)"
id = "5da0c474-2dc8-5580-bf5c-d3f464225e4c"
date = "2015-01-19"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "not set"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2883-L2900"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2883-L2900"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2054cb427daaca9e267b252307dad03830475f15"
logic_hash = "5bf17d1a8ae78681d2c3cba8511019ddf85e6d7a242900b56848521eef40ffc6"
score = 75
@@ -276699,10 +277082,10 @@ rule SIGNATURE_BASE_Linuxhacktool_Eyes_Pscan2_2
author = "Florian Roth (Nextron Systems)"
id = "3950b235-70bc-5afd-add5-38c50055b28b"
date = "2015-01-19"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "not set"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2902-L2919"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2902-L2919"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eb024dfb441471af7520215807c34d105efa5fd8"
logic_hash = "981514cf0887a1a7cb55fe9ed9dadd48adbf0f033e527b357e90e052a4c2d251"
score = 75
@@ -276727,10 +277110,10 @@ rule SIGNATURE_BASE_CN_Portscan : APT FILE
author = "Florian Roth (Nextron Systems)"
id = "fb52a89a-2270-5170-9874-9278a0177454"
date = "2013-11-29"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2921-L2934"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2921-L2934"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e1b745bd321527cee3eb203847d00c9eda4a7b1e498cb8f0ad6b588f87221759"
score = 70
quality = 85
@@ -276751,10 +277134,10 @@ rule SIGNATURE_BASE_WMI_Vbs : APT
author = "Florian Roth (Nextron Systems)"
id = "b367306a-38d8-5f4d-8f09-2bf025831f0a"
date = "2013-11-29"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2936-L2949"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2936-L2949"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "94163981c1a80838d1bea1b21f713f1d8fbdac8704319d1a145f0b4f6d8ff3f6"
score = 70
quality = 85
@@ -276775,10 +277158,10 @@ rule SIGNATURE_BASE_CN_Toolset__Xscanlib_Xscanlib_Xscanlib
author = "Florian Roth (Nextron Systems)"
id = "c32415f4-044c-50ef-9c4c-b9327cbcef69"
date = "2015-03-30"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://qiannao.com/ls/905300366/33834c0c/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2951-L2972"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2951-L2972"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "af419603ac28257134e39683419966ab3d600ed2"
hash = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
hash = "135f6a28e958c8f6a275d8677cfa7cb502c8a822"
@@ -276806,10 +277189,10 @@ rule SIGNATURE_BASE_CN_Toolset_Ntscan_Pipecmd
author = "Florian Roth (Nextron Systems)"
id = "056ee42d-23f4-5b03-b240-392bc92b90b0"
date = "2015-03-30"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://qiannao.com/ls/905300366/33834c0c/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L2974-L2998"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L2974-L2998"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a931d65de66e1468fe2362f7f2e0ee546f225c4e"
logic_hash = "2dab5a4de2abeff5659aa90fbc82bef359937ca9e45e8805b509baeb16943531"
score = 70
@@ -276840,10 +277223,10 @@ rule SIGNATURE_BASE_CN_Toolset_Lscanportss_2
author = "Florian Roth (Nextron Systems)"
id = "0a796585-5fc8-5b55-acfc-3fe87308b681"
date = "2015-03-30"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://qiannao.com/ls/905300366/33834c0c/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3000-L3020"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3000-L3020"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4631ec57756466072d83d49fbc14105e230631a0"
logic_hash = "aeecdbef3fe6d66a209df10b44046783e53ef12f67c6877309cb219db4354733"
score = 70
@@ -276870,10 +277253,10 @@ rule SIGNATURE_BASE_CN_Toolset_Sig_1433_135_Sqlr
author = "Florian Roth (Nextron Systems)"
id = "74038975-ef06-53d6-bdcc-02706408b596"
date = "2015-03-30"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://qiannao.com/ls/905300366/33834c0c/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3022-L3039"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3022-L3039"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8542c7fb8291b02db54d2dc58cd608e612bfdc57"
logic_hash = "14c9d104cfb71a2d3545bfb6274e3a282d4597f38057187d76adaf26fe2718fa"
score = 70
@@ -276897,10 +277280,10 @@ rule SIGNATURE_BASE_Vssown_VBS
author = "Florian Roth (Nextron Systems)"
id = "ffbb5faf-3522-50dc-a568-503074ac0636"
date = "2015-10-01"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3056-L3073"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3057-L3074"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f49e9d7a07d591330e16fc539bd98d019b47dd8579d0f1ad92fa987790e64189"
score = 75
quality = 85
@@ -276925,10 +277308,10 @@ rule SIGNATURE_BASE_Netview_Hacktool : FILE
author = "Florian Roth (Nextron Systems)"
id = "087e2fd7-726e-5c6b-ba99-e20dd3337d6a"
date = "2016-03-07"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/mubix/netview"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3075-L3098"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3076-L3099"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "52cec98839c3b7d9608c865cfebc904b4feae0bada058c2e8cdbd561cfa1420a"
logic_hash = "dc27d2358937d736823891c9d5c3f41f83a6f4e72d35fae0983435effda2141a"
score = 60
@@ -276958,10 +277341,10 @@ rule SIGNATURE_BASE_Netview_Hacktool_Output
author = "Florian Roth (Nextron Systems)"
id = "259db870-6293-5a55-b56a-f981c060c18f"
date = "2016-03-07"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/mubix/netview"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3100-L3115"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3101-L3116"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "38a51e583b1485bdb29400cb9d0a73ec4d5387675779f949572d2b4d74da4230"
score = 60
quality = 85
@@ -276985,8 +277368,8 @@ rule SIGNATURE_BASE_Psattack_EXE : FILE
date = "2016-03-09"
modified = "2023-01-06"
reference = "https://github.com/gdssecurity/PSAttack/releases/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3126-L3146"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3127-L3147"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ad05d75640c850ee7eeee26422ba4f157be10a4e2d6dc6eaa19497d64cf23715"
logic_hash = "b73566eb6370fbe68f0477d1179e5d6c19fb9be2c29f63d560c42adcdf19fe58"
score = 100
@@ -277011,10 +277394,10 @@ rule SIGNATURE_BASE_Powershell_Attack_Scripts
author = "Florian Roth (Nextron Systems)"
id = "e8c4a672-229b-56c8-811b-071ae9ff341e"
date = "2016-03-09"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3148-L3163"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3149-L3164"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "42a52de089ee00e229499fea23b8acd0b7c881a9c578671aea180c0c018a54e0"
score = 70
quality = 85
@@ -277037,10 +277420,10 @@ rule SIGNATURE_BASE_Psattack_ZIP : FILE
author = "Florian Roth (Nextron Systems)"
id = "4e064eb4-0b87-590c-9ee4-6764b982c006"
date = "2016-03-09"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/gdssecurity/PSAttack/releases/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3165-L3179"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3166-L3180"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3864f0d44f90404be0c571ceb6f95bbea6c527bbfb2ec4a2b4f7d92e982e15a2"
logic_hash = "4c869e8663b8c87780d4be622f86b3887511e1ac3cfc67767f1c986af7d43767"
score = 100
@@ -277061,10 +277444,10 @@ rule SIGNATURE_BASE_Linux_Portscan_Shark_1 : FILE
author = "Florian Roth (Nextron Systems)"
id = "0b264106-3536-56f4-9e8c-68f3756af07d"
date = "2016-04-01"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3190-L3207"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3191-L3208"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4da0e535c36c0c52eaa66a5df6e070c52e7ddba13816efc3da5691ea2ec06c18"
hash = "e395ca5f932419a4e6c598cae46f17b56eb7541929cdfb67ef347d9ec814dea3"
logic_hash = "e807ed6c83c8d908bfe29c65abd7b877b65655cc64cd1497fc124a2fd88cd1e9"
@@ -277089,10 +277472,10 @@ rule SIGNATURE_BASE_Linux_Portscan_Shark_2
author = "Florian Roth (Nextron Systems)"
id = "eea378d5-0399-5035-8573-139878fa1abc"
date = "2016-04-01"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3209-L3226"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3210-L3227"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5f80bd2db608a47e26290f3385eeb5bfc939d63ba643f06c4156704614def986"
hash = "90af44cbb1c8a637feda1889d301d82fff7a93b0c1a09534909458a64d8d8558"
logic_hash = "45efbbe01c45065efc07e9c75b6a7cdcae469861f84df4a1e1381fe864f7ddc0"
@@ -277117,10 +277500,10 @@ rule SIGNATURE_BASE_Dnscat2_Hacktool : FILE
author = "Florian Roth (Nextron Systems)"
id = "23cca0fe-3e4e-5b91-8b53-933de8ff264a"
date = "2016-05-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://downloads.skullsecurity.org/dnscat2/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3235-L3254"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3236-L3255"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8bc8d6c735937c9c040cbbdcfc15f17720a7ecef202a19a7bf43e9e1c66fe66a"
hash = "4a882f013419695c8c0ac41d8a0fde1cf48172a89e342c504138bc6f1d13c7c8"
logic_hash = "c163a62b607323e08ca083a7091585550c830827728a8a60e25af8db6550ed1c"
@@ -277147,10 +277530,10 @@ rule SIGNATURE_BASE_WCE_In_Memory
author = "Florian Roth (Nextron Systems)"
id = "90c90ca5-e3be-5035-b35c-c2e7faec43a5"
date = "2016-08-28"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3256-L3270"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3257-L3271"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "74ab7772db5b1de8a4eae03370e2be3cd35004730f84d472677688109a1d6d88"
score = 80
quality = 85
@@ -277171,10 +277554,10 @@ rule SIGNATURE_BASE_Pstgdump : FILE
author = "Florian Roth (Nextron Systems)"
id = "86a105a3-b5b5-58b2-99bd-ec05f31adb6b"
date = "2016-09-08"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://goo.gl/igxLyF"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3272-L3290"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3273-L3291"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "65d48a2f868ff5757c10ed796e03621961954c523c71eac1c5e044862893a106"
logic_hash = "0c4f8697b1b65007acc4fdabd1c6263a428448232f95dbb12d8f737297893157"
score = 75
@@ -277200,10 +277583,10 @@ rule SIGNATURE_BASE_Lsremora : FILE
author = "Florian Roth (Nextron Systems)"
id = "c15c583f-70cd-5a80-bdea-a14582097e50"
date = "2016-09-08"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://goo.gl/igxLyF"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3292-L3314"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3293-L3315"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "efa66f6391ec471ca52cd053159c8a8778f11f921da14e6daf76387f8c9afcd5"
hash = "e0327c1218fd3723e20acc780e20135f41abca35c35e0f97f7eccac265f4f44e"
logic_hash = "ac8f6b7284307456749b3386340a2b3deb0718bc68875bc90bccf74a96469a59"
@@ -277232,10 +277615,10 @@ rule SIGNATURE_BASE_Servpw : FILE
author = "Florian Roth (Nextron Systems)"
id = "48b9dae1-16b3-563c-ac4e-b71f3a86b38a"
date = "2016-09-08"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://goo.gl/igxLyF"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3316-L3335"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3317-L3336"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "97b39ac28794a7610ed83ad65e28c605397ea7be878109c35228c126d43e2f46"
hash = "0f340b471ef34c69f5413540acd3095c829ffc4df38764e703345eb5e5020301"
logic_hash = "150466c23ea7aa20f6e60c592ab6bd2f42e3a48a65a6665b89a9f19fa61aae8f"
@@ -277262,10 +277645,10 @@ rule SIGNATURE_BASE_Fgexec : FILE
author = "Florian Roth (Nextron Systems)"
id = "8ffe47b9-81a8-5eb4-b46f-db9d23682de4"
date = "2016-09-08"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://goo.gl/igxLyF"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3337-L3353"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3338-L3354"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8697897bee415f213ce7bc24f22c14002d660b8aaffab807490ddbf4f3f20249"
logic_hash = "3672255d7829520aa8ca792519f645b86fe4244a16652a960375f23baa7d32b3"
score = 75
@@ -277289,10 +277672,10 @@ rule SIGNATURE_BASE_Cachedump : FILE
author = "Florian Roth (Nextron Systems)"
id = "ebcaeb73-d2df-5a4c-9f50-b4a01293b88b"
date = "2016-09-08"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://goo.gl/igxLyF"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3355-L3375"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3356-L3376"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cf58ca5bf8c4f87bb67e6a4e1fb9e8bada50157dacbd08a92a4a779e40d569c4"
hash = "e38edac8c838a043d0d9d28c71a96fe8f7b7f61c5edf69f1ce0c13e141be281f"
logic_hash = "7e4d710ed9dab12114e87fa33abe6db6245c780b31bcd94fbd21e75aaa355ca8"
@@ -277320,10 +277703,10 @@ rule SIGNATURE_BASE_Pwdump_B : FILE
author = "Florian Roth (Nextron Systems)"
id = "aad974f1-76bf-5aae-8376-a4fd3f27b345"
date = "2016-09-08"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://goo.gl/igxLyF"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3377-L3397"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3378-L3398"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3c796092f42a948018c3954f837b4047899105845019fce75a6e82bc99317982"
logic_hash = "d50ad359b9433439cddda9408d227f35ee8de3280ad24f42c5e6ef1e6a1526bd"
score = 75
@@ -277350,10 +277733,10 @@ rule SIGNATURE_BASE_Msbuild_Mimikatz_Execution_Via_XML
author = "Florian Roth (Nextron Systems)"
id = "98aa68b9-6de4-5353-8d87-9e974529c044"
date = "2016-10-07"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://gist.github.com/subTee/c98f7d005683e616560bda3286b6a0d8#file-katz-xml"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3408-L3427"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3409-L3428"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f926a2d5ab987b97c6ed2a89c69eac5549d8b7885bdbf75ce40e05e6ce6cfa7a"
score = 75
quality = 85
@@ -277379,10 +277762,10 @@ rule SIGNATURE_BASE_Fscan_Portscanner : FILE
author = "Florian Roth (Nextron Systems)"
id = "400383dc-8bc0-5e77-a3f3-d6ba9f4c3c0f"
date = "2017-01-06"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://twitter.com/JamesHabben/status/817112447970480128"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3438-L3452"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3439-L3453"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "35770f040da0b14fe4492a44383e332c9912bd89943838627491196ce8f0ec37"
score = 75
quality = 85
@@ -277404,10 +277787,10 @@ rule SIGNATURE_BASE_WPR_Loader_EXE : FILE
author = "Florian Roth (Nextron Systems)"
id = "97fa3efb-9e7a-52ef-9e26-3fdd573d4d30"
date = "2017-03-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3463-L3483"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3464-L3484"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e7d158d27d9c14a4f15a52ee5bf8aa411b35ad510b1b93f5e163ae7819c621e2"
logic_hash = "26af6fe1b3dfe8e3a48c03a9f6f2033fbc909a677d35159e28b7e9b867ea5542"
score = 75
@@ -277435,10 +277818,10 @@ rule SIGNATURE_BASE_WPR_Loader_DLL : FILE
author = "Florian Roth (Nextron Systems)"
id = "d3102ab6-0473-544b-b9dd-ec7a18ae1c4b"
date = "2017-03-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3485-L3518"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3486-L3519"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7b074cb99d45fc258e0324759ee970467e0f325e5d72c0b046c4142edc6776f6"
hash = "a1f27f7fd0e03601a11b66d17cfacb202eacf34f94de3c4e9d9d39ea8d1a2612"
logic_hash = "015334828007e954d1e910e6377b37bade99df2ce86152901ec4ded8c71975de"
@@ -277472,10 +277855,10 @@ rule SIGNATURE_BASE_WPR_Passscape_Loader : FILE
author = "Florian Roth (Nextron Systems)"
id = "d8e224ce-edd2-5e2d-9b6e-a8995f5d2c1c"
date = "2017-03-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3520-L3538"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3521-L3539"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f6f2d4b9f19f9311ec419f05224a1c17cf2449f2027cb7738294479eea56e9cb"
logic_hash = "79b1a3ed1ea0d9a3ddee0b8557393318a8baf4812110a6ed03a7106b8096b31e"
score = 75
@@ -277501,10 +277884,10 @@ rule SIGNATURE_BASE_WPR_Asterisk_Hook_Library : FILE
author = "Florian Roth (Nextron Systems)"
id = "03c20c9d-bb8f-53f6-9cb5-9b059fb24949"
date = "2017-03-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3540-L3562"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3541-L3563"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "225071140e170a46da0e57ce51f0838f4be00c8f14e9922c6123bee4dffde743"
hash = "95ec84dc709af990073495082d30309c42d175c40bd65cad267e6f103852a02d"
logic_hash = "6bb75cb8c3ba18a34f4651532060154608c78e6f748148226da4416ad1171124"
@@ -277534,10 +277917,10 @@ rule SIGNATURE_BASE_WPR_Windowspasswordrecovery_EXE : FILE
author = "Florian Roth (Nextron Systems)"
id = "7fa2062c-75dd-55aa-8775-631a9c1a497e"
date = "2017-03-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3564-L3593"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3565-L3594"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c1c64cba5c8e14a1ab8e9dd28828d036581584e66ed111455d6b4737fb807783"
logic_hash = "0f2995a8ba1644d384167221560aa0c3f074e8e2cf2b79bbb06537fcaed2df7f"
score = 75
@@ -277566,10 +277949,10 @@ rule SIGNATURE_BASE_WPR_Windowspasswordrecovery_EXE_64 : FILE
author = "Florian Roth (Nextron Systems)"
id = "0f6c7695-e616-5757-b9cd-8cff5f972c3e"
date = "2017-03-15"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3595-L3612"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3596-L3613"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4e1ea81443b34248c092b35708b9a19e43a1ecbdefe4b5180d347a6c8638d055"
logic_hash = "6cdd46609d401b7c12b936de7f64bab0bc45b9d2c6079fae45a96f5be6857b82"
score = 75
@@ -277593,10 +277976,10 @@ rule SIGNATURE_BASE_Beyondexec_Remoteaccess_Tool : FILE
author = "Florian Roth (Nextron Systems)"
id = "fd68cb45-a46f-53d7-bf52-8f7bd3636d0d"
date = "2017-03-17"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://goo.gl/BvYurS"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3623-L3641"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3624-L3642"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3d3e3f0708479d951ab72fa04ac63acc7e5a75a5723eb690b34301580747032c"
logic_hash = "6f21ddf04ab0d29549c3d07a45afb3e7648a15b0c81f88b8d7ccccc436ba4084"
score = 75
@@ -277621,10 +278004,10 @@ rule SIGNATURE_BASE_Mimikatz_Gen_Strings : FILE
author = "Florian Roth (Nextron Systems)"
id = "3f4ab5d7-5a9f-55f0-9dda-e2975df582a0"
date = "2017-06-19"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3643-L3665"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3644-L3666"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "058cc8b3e4e4055f3be460332a62eb4cbef41e3a7832aceb8119fd99fea771c4"
hash = "eefd4c038afa0e80cf6521c69644e286df08c0883f94245902383f50feac0f85"
hash = "f35b589c1cc1c98c4c4a5123fd217bdf0d987c00d2561992cbfb94bd75920159"
@@ -277654,10 +278037,10 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Lpe : FILE
author = "Florian Roth (Nextron Systems)"
id = "d3693d1d-6085-5e62-8f0b-dde5b14758b7"
date = "2017-07-07"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Disclosed 0day Repos"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3677-L3698"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3678-L3699"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e10ee278f4c86d6ee1bd93a7ed71d4d59c0279381b00eb6153aedfb3a679c0b5"
hash = "a5916cefa0f50622a30c800e7f21df481d7a3e1e12083fef734296a22714d088"
hash = "5b701a5b5bbef7027711071cef2755e57984bfdff569fe99efec14a552d8ee43"
@@ -277686,10 +278069,10 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Exploit : FILE
author = "Florian Roth (Nextron Systems)"
id = "72b8aafd-d79a-5812-90fd-5d5aca109254"
date = "2017-07-07"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Disclosed 0day Repos"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3700-L3714"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3701-L3715"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "632d35a0bac27c9b2f3f485d43ebba818089cf72b3b8c4d2e87ce735b2e67d7e"
logic_hash = "12a7a04fdc621242f42107204996e44b1962b5ac5eef4f9b9cbbe0ad52b85676"
score = 75
@@ -277713,8 +278096,8 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Injectdll : FILE
date = "2017-07-07"
modified = "2022-12-21"
reference = "Disclosed 0day Repos"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3716-L3734"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3717-L3735"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "173d3f78c9269f44d069afbd04a692f5ae42d5fdc9f44f074599ec91e8a29aa2"
logic_hash = "b0a9bd4fa2d8a1192258b303cb757c8bbce7f6962a1d895f57add8a1c3887799"
score = 75
@@ -277741,8 +278124,8 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Payload_MSI : FILE
date = "2017-07-07"
modified = "2022-12-21"
reference = "Disclosed 0day Repos"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3736-L3752"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3737-L3753"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a7c498a95850e186b7749a96004a98598f45faac2de9b93354ac93e627508a87"
logic_hash = "7dfc8d2bd871ad6acb7d362a946d34ed1830f42ab625c3d3d9cb512f28ccdb57"
score = 75
@@ -277765,10 +278148,10 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Injector : FILE
author = "Florian Roth (Nextron Systems)"
id = "6de89a84-fe16-5064-8cbb-a3b9003f4c0c"
date = "2017-07-07"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Disclosed 0day Repos"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3754-L3774"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3755-L3775"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ba0e2119b2a6bad612e86662b643a404426a07444d476472a71452b7e9f94041"
logic_hash = "37ed19fe19d3645adcd5fa7d6f6b3572d2821fdb78a6d0c8afdba6ccecfc8528"
score = 75
@@ -277796,10 +278179,10 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Lpe_2 : FILE
author = "Florian Roth (Nextron Systems)"
id = "9326bbae-81ee-588e-8581-628b47d348f8"
date = "2017-07-07"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Disclosed 0day Repos"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3776-L3791"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3777-L3792"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b4f3787a19b71c47bc4357a5a77ffb456e2f71fd858079d93e694a6a79f66533"
logic_hash = "e9ca23e4375674ea189d5e9de015f6a1ae16c30d35378580bdc8f42007b716df"
score = 75
@@ -277822,10 +278205,10 @@ rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Shellcodegenerator : FILE
author = "Florian Roth (Nextron Systems)"
id = "49250cbe-7bbd-5462-9324-1a8f350386f3"
date = "2017-07-07"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Disclosed 0day Repos"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3793-L3806"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3794-L3807"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "55c4073bf8d38df7d392aebf9aed2304109d92229971ffac6e1c448986a87916"
logic_hash = "b267a816871c30e9403805b942be25ed8e28ad2fd946f234f6877a65420754d8"
score = 75
@@ -277846,10 +278229,10 @@ rule SIGNATURE_BASE_Securityxploded_Producer_String : FILE
author = "Florian Roth (Nextron Systems)"
id = "739c4ba1-5126-51cc-a2dd-cdac2737e29a"
date = "2017-07-13"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://securityxploded.com/browser-password-dump.php"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3808-L3822"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3809-L3823"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d57847db5458acabc87daee6f30173348ac5956eb25e6b845636e25f5a56ac59"
logic_hash = "101e0b8b8aeb8ed4314bc07139dcc2b40600fde82ff786d15a15c10692f9aa4a"
score = 60
@@ -277870,10 +278253,10 @@ rule SIGNATURE_BASE_Kekeo_Hacktool : FILE
author = "Florian Roth (Nextron Systems)"
id = "a4158da8-fc4d-5dc6-b44c-f5325b3bb8ca"
date = "2017-07-21"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/gentilkiwi/kekeo/releases"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3834-L3849"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3835-L3850"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ce92c0bcdf63347d84824a02b7a448cf49dd9f44db2d02722d01c72556a2b767"
hash = "49d7fec5feff20b3b57b26faccd50bc05c71f1dddf5800eb4abaca14b83bba8c"
logic_hash = "14283064e7c8fcee9cde206d25b43b02876a7a4d5de9da6dab47d7f5ba54f019"
@@ -277898,8 +278281,8 @@ rule SIGNATURE_BASE_Allthethings : FILE
date = "2017-07-27"
modified = "2022-12-21"
reference = "https://github.com/subTee/AllTheThings"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3861-L3880"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3862-L3881"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5a0e9a9ce00d843ea95bd5333b6ab50cc5b1dbea648cc819cfe48482513ce842"
logic_hash = "0d6b961afb98cfaefe930a7bc246b3f087469b752a8d4abb62b2826418fdfd53"
score = 75
@@ -277925,10 +278308,10 @@ rule SIGNATURE_BASE_Impacket_Keyword : FILE
author = "Florian Roth (Nextron Systems)"
id = "a92962e6-1b05-583b-8b06-f226bdea88e2"
date = "2017-08-04"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3882-L3899"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3883-L3900"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9388c78ea6a78dbea307470c94848ae2481481f593d878da7763e649eaab4068"
hash = "2f6d95e0e15174cfe8e30aaa2c53c74fdd13f9231406b7103da1e099c08be409"
logic_hash = "92a911dc36f8e74ad49ae09ef4dd997b968a2dde46a7500c98983fafb84a086e"
@@ -277952,10 +278335,10 @@ rule SIGNATURE_BASE_Passwordspro : FILE
author = "Florian Roth (Nextron Systems)"
id = "c749f883-364e-5f65-9eb8-3dcd74495f7c"
date = "2017-08-27"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "PasswordPro"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3912-L3930"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3913-L3931"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5b3d6654e6d9dc49ee1136c0c8e8122cb0d284562447abfdc05dfe38c79f95bf"
logic_hash = "24887c3a7e4997c9a4e5d3317a5684b0eca7ccc0ffb213660dd9b37bb220f514"
score = 75
@@ -277979,10 +278362,10 @@ rule SIGNATURE_BASE_Passwordpro_NTLM_DLL : FILE
author = "Florian Roth (Nextron Systems)"
id = "cc86b868-000f-56b1-91cd-4aa8caace1df"
date = "2017-08-27"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "PasswordPro"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3932-L3950"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3933-L3951"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "47d4755d31bb96147e6230d8ea1ecc3065da8e557e8176435ccbcaea16fe50de"
logic_hash = "1021fe1a4c7a237d7a7cfcb1db8fa5e6fa640d3dd9f14ed37910a6b847717d36"
score = 75
@@ -278004,10 +278387,10 @@ rule SIGNATURE_BASE_Keethief_PS : FILE
author = "Florian Roth (Nextron Systems)"
id = "9a54e8d1-3cae-51e8-8da0-024ac25dc6d0"
date = "2017-08-29"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/HarmJ0y/KeeThief"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3962-L3979"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3963-L3980"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a3b976279ded8e64b548c1d487212b46b03aaec02cb6e199ea620bd04b8de42f"
logic_hash = "8d3d4ff3b854c5efad99e6f20121b16d5f2f0a31a4c8efd87a937f857923a5e1"
score = 75
@@ -278029,10 +278412,10 @@ rule SIGNATURE_BASE_Keetheft_EXE : FILE
author = "Florian Roth (Nextron Systems)"
id = "65531239-c5fa-5285-8f44-2d858e211c9b"
date = "2017-08-29"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/HarmJ0y/KeeThief"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L3981-L4000"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L3982-L4001"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f06789c3e9fe93c165889799608e59dda6b10331b931601c2b5ae06ede41dc22"
logic_hash = "a6019248ad9708b1508fdf77a2ecbe92a7e8aac916fbca88aec117abeb07b9a0"
score = 75
@@ -278059,10 +278442,10 @@ rule SIGNATURE_BASE_Keetheft_Out_Shellcode : FILE
author = "Florian Roth (Nextron Systems)"
id = "1263ad5d-5d50-50e6-ad78-9d5e4e16634b"
date = "2017-08-29"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/HarmJ0y/KeeThief"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4002-L4016"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4003-L4017"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2afb1c8c82363a0ae43cad9d448dd20bb7d2762aa5ed3672cd8e14dee568e16b"
logic_hash = "2d536edf1a40defc3b3aa7ce8e595c53e7dd3b7f1daea772c13319ee5bf7675e"
score = 75
@@ -278086,8 +278469,8 @@ rule SIGNATURE_BASE_Sharpire : FILE
date = "2017-09-23"
modified = "2022-12-21"
reference = "https://github.com/0xbadjuju/Sharpire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4026-L4049"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4027-L4050"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "327a1dc2876cd9d7f6a5b3777373087296fc809d466e42861adcf09986c6e587"
logic_hash = "1437b4c5229761bcc18d97ea6328866f4b9c763461fa6ecb5c18e6f3961c3114"
score = 75
@@ -278116,10 +278499,10 @@ rule SIGNATURE_BASE_Invoke_Metasploit : FILE
author = "Florian Roth (Nextron Systems)"
id = "40452884-df3f-5b49-ad10-05006cb115f2"
date = "2017-09-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/jaredhaight/Invoke-MetasploitPayload/blob/master/Invoke-MetasploitPayload.ps1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4059-L4074"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4060-L4075"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b36d3ca7073741c8a48c578edaa6d3b6a8c3c4413e961a83ad08ad128b843e0b"
logic_hash = "7ef174008517b101be844e30890626378f49a275bad3f08ce25fb8d6118c77c3"
score = 75
@@ -278142,10 +278525,10 @@ rule SIGNATURE_BASE_Powershell_Mal_Hacktool_Gen : FILE
author = "Florian Roth (Nextron Systems)"
id = "d1fc4594-d816-5d02-bff6-3f220477b555"
date = "2017-11-02"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4076-L4092"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4077-L4093"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d442304ca839d75b34e30e49a8b9437b5ab60b74d85ba9005642632ce7038b32"
logic_hash = "273222cde3ff155cef09c25192dcb4865179e8172e625fe8f43b21a13fe1a170"
score = 75
@@ -278169,10 +278552,10 @@ rule SIGNATURE_BASE_Sig_Remoteadmin_1 : FILE
author = "Florian Roth (Nextron Systems)"
id = "da55084c-ec1f-5800-a614-189dce7b5820"
date = "2017-12-03"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4094-L4108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4095-L4109"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "81912bbfc1f6ac3ec7c54fc935b9ed531c97ad509cf2c096a19e638836cd0baf"
score = 45
quality = 85
@@ -278193,10 +278576,10 @@ rule SIGNATURE_BASE_Remcom_Remotecommandexecution
author = "Florian Roth (Nextron Systems)"
id = "90b4ce3c-a690-5b6e-95e8-7e5dc8270152"
date = "2017-12-28"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://goo.gl/tezXZt"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4110-L4125"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4111-L4126"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c39a09c8d0c1799febcb4d9eafece43f8b21e7ffc277fdfad6c235eb1a201697"
score = 50
quality = 85
@@ -278218,10 +278601,10 @@ rule SIGNATURE_BASE_Crackmapexec_EXE : FILE
author = "Florian Roth (Nextron Systems)"
id = "9fcfba98-7ba1-5810-99b7-62ad2b1aa4c0"
date = "2018-04-06"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4127-L4143"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4128-L4144"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "371f104b7876b9080c519510879235f36edb6668097de475949b84ab72ee9a9a"
logic_hash = "fa05fa41d6aaed45a9b44806a310fdb584874f7eb382e576b36e6d1db87cef88"
score = 85
@@ -278247,8 +278630,8 @@ rule SIGNATURE_BASE_SUSP_Imphash_Passrevealer_PY_EXE : FILE
date = "2018-04-06"
modified = "2021-11-09"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4145-L4163"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4146-L4164"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "371f104b7876b9080c519510879235f36edb6668097de475949b84ab72ee9a9a"
logic_hash = "684e901eebf47e2bd8b25fd302963c2761376ce4754d74f9e6f1eb3024c89144"
score = 40
@@ -278270,10 +278653,10 @@ rule SIGNATURE_BASE_MAL_Unknown_Pwdumper_Apr18_3 : FILE
author = "Florian Roth (Nextron Systems)"
id = "2431d562-dcd8-5d21-8406-7d2567b6eca9"
date = "2018-04-06"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4165-L4184"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4166-L4185"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d435e7b6f040a186efeadb87dd6d9a14e038921dc8b8658026a90ae94b4c8b05"
hash = "8c35c71838f34f7f7a40bf06e1d2e14d58d9106e6d4e6f6e9af732511a126276"
logic_hash = "bf0dff02bdfa239336b2bc865f2a9aed6d20cafb059caa87a60aa30269dd94b5"
@@ -278301,10 +278684,10 @@ rule SIGNATURE_BASE_Processinjector_Gen : HIGHVOL FILE
author = "Florian Roth (Nextron Systems)"
id = "9b0b6ac7-8432-5f93-b389-c2356ec75113"
date = "2018-04-23"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/cuckoosandbox/monitor/blob/master/bin/inject.c"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4186-L4207"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4187-L4208"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "456c1c25313ce2e2eedf24fdcd4d37048bcfff193f6848053cbb3b5e82cd527d"
logic_hash = "90d200e79c97911b105e592549bc2c04fb09ce841413c30117d421b45bb9988c"
score = 60
@@ -278329,10 +278712,10 @@ rule SIGNATURE_BASE_Lazagne_PW_Dumper
author = "Markus Neis / Florian Roth"
id = "1904029e-9336-5278-ae2e-4bc853316600"
date = "2018-03-22"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/AlessandroZ/LaZagne/releases/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4209-L4223"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4210-L4224"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2eac81d5cecdaca7eeaa83be70a688a595f8bbf54679ee565ba325b9e384552b"
score = 70
quality = 85
@@ -278353,10 +278736,10 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Tclsh : FILE
author = "Tobias Michalski"
id = "24f6b626-383e-54c9-abd4-bd67c37af937"
date = "2018-05-18"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/0x00-0x00/ShellPop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4225-L4237"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4226-L4238"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9f49d76d70d14bbe639a3c16763d3b4bee92c622ecb1c351cb4ea4371561e133"
logic_hash = "622805e8067f5158d82783971dcf31e8db05f1d52a38bd1ec3e76ddbbd78032b"
score = 65
@@ -278376,10 +278759,10 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Ruby : FILE
author = "Tobias Michalski"
id = "cb3a93d5-02a1-5a49-b37e-3f9312b993ea"
date = "2018-05-18"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/0x00-0x00/ShellPop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4239-L4251"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4240-L4252"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6b425b37f3520fd8c778928cc160134a293db0ce6d691e56a27894354b04f783"
logic_hash = "aa076540ef01d04117d3340f4d84c21f79acfc558ed4aa585d801b6a6bc797a2"
score = 65
@@ -278399,10 +278782,10 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Awk : FILE
author = "Tobias Michalski"
id = "92d1e6dd-d758-5df2-b5e5-eb275964551d"
date = "2018-05-18"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/0x00-0x00/ShellPop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4253-L4266"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4254-L4267"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7513a0a0ba786b0e22a9a7413491b4011f60af11253c596fa6857fb92a6736fc"
logic_hash = "7d676ffbd1ce083a1b8e34576125fb0805caef4423089cd72a92483467669b78"
score = 65
@@ -278423,10 +278806,10 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Netcat_UDP : FILE
author = "Tobias Michalski"
id = "67aa53b6-00bc-5d2e-b6f3-37e9121cdd01"
date = "2018-05-18"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/0x00-0x00/ShellPop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4268-L4281"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4269-L4282"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d823ad91b315c25893ce8627af285bcf4e161f9bbf7c070ee2565545084e88be"
logic_hash = "0c85b1275ccf5bbc7f6e0ab0f1fa9d1bce7d56912411f84f9946163191c79576"
score = 65
@@ -278447,10 +278830,10 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Socat : FILE
author = "Tobias Michalski"
id = "23c331ba-217c-5b17-b45e-d553eea76a56"
date = "2018-05-18"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/0x00-0x00/ShellPop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4283-L4296"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4284-L4297"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "267f69858a5490efb236628260b275ad4bbfeebf4a83fab8776e333ca706a6a0"
logic_hash = "48c06096b27be11ae12cc38294acb495b739101cabc04e89eb76e93fb42c52df"
score = 65
@@ -278471,10 +278854,10 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Perl : FILE
author = "Tobias Michalski"
id = "d597d213-a70b-5412-adde-791b4d498848"
date = "2018-05-18"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/0x00-0x00/ShellPop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4298-L4311"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4299-L4312"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "32c3e287969398a070adaad9b819ee9228174c9cb318d230331d33cda51314eb"
logic_hash = "8f3c5920acdc080b437c15b93e192a00a5037be0323cc04473e238033b7d53ec"
score = 75
@@ -278495,10 +278878,10 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Python : FILE
author = "Tobias Michalski"
id = "62fe0ae9-422e-5021-8a67-e88ff4bd2cf3"
date = "2018-05-18"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/0x00-0x00/ShellPop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4313-L4325"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4314-L4326"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aee1c9e45a1edb5e462522e266256f68313e2ff5956a55f0a84f33bc6baa980b"
logic_hash = "e4c35bb739eeabf0de558ee1b97225ed4eb3198e7e6db1817348115b848146c7"
score = 75
@@ -278518,10 +278901,10 @@ rule SIGNATURE_BASE_HKTL_Shellpop_PHP_TCP : FILE
author = "Tobias Michalski"
id = "3bafc225-62e5-5183-84aa-9c3406b6c444"
date = "2018-05-18"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/0x00-0x00/ShellPop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4327-L4340"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4328-L4341"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0412e1ab9c672abecb3979a401f67d35a4a830c65f34bdee3f87e87d060f0290"
logic_hash = "8ffab71130b4fa6efbe9864f97c33fed9359f79d51b84e8f952c911f24d1496c"
score = 75
@@ -278542,10 +278925,10 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Powershell_TCP : FILE
author = "Tobias Michalski"
id = "4f3a92db-f686-559a-9588-fb79f423c51f"
date = "2018-05-18"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/0x00-0x00/ShellPop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4342-L4355"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4343-L4356"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8328806700696ffe8cc37a0b81a67a6e9c86bb416364805b8aceaee5db17333f"
logic_hash = "8eb484ba87fa2e10af3c59445ccb4be73db2f5ae67c59118a2e188ba02fdc957"
score = 75
@@ -278566,10 +278949,10 @@ rule SIGNATURE_BASE_SUSP_Powershell_Shellcommand_May18_1 : FILE
author = "Tobias Michalski"
id = "efa81fd0-b764-5a1a-98a5-fc3135be220b"
date = "2018-05-18"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/0x00-0x00/ShellPop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4357-L4370"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4358-L4371"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8328806700696ffe8cc37a0b81a67a6e9c86bb416364805b8aceaee5db17333f"
logic_hash = "bc858d74b8aad09ff539489e961e1a51ba5fe17d3424615ffe5029587ddb9478"
score = 65
@@ -278589,10 +278972,10 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Telnet_TCP : FILE
author = "Tobias Michalski"
id = "dbd5cc65-c6f1-54f3-813f-7a7f9bcca184"
date = "2018-05-18"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/0x00-0x00/ShellPop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4372-L4385"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4373-L4386"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cf5232bae0364606361adafab32f19cf56764a9d3aef94890dda9f7fcd684a0e"
logic_hash = "e900fb8c0f1fa61f242b97ac542cb1bfd691dd50523e0023e97e3b21617053d7"
score = 75
@@ -278615,8 +278998,8 @@ rule SIGNATURE_BASE_SUSP_Shellpop_Bash
date = "2018-05-18"
modified = "2025-04-11"
reference = "https://github.com/0x00-0x00/ShellPop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4387-L4404"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4388-L4405"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "36fad575a8bc459d0c2e3ad626e97d5cf4f5f8bedc56b3cc27dd2f7d88ed889b"
logic_hash = "a557822eaaad84897acc32935f7545deb17ea3b8c6e34acd0ac5ef9fad08cb1e"
score = 70
@@ -278638,10 +279021,10 @@ rule SIGNATURE_BASE_HKTL_Shellpop_Netcat : FILE
author = "Tobias Michalski"
id = "cd55e912-b57b-5fce-98eb-5a0cd27a6e4d"
date = "2018-05-18"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/0x00-0x00/ShellPop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4406-L4421"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4407-L4422"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "98e3324f4c096bb1e5533114249a9e5c43c7913afa3070488b16d5b209e015ee"
logic_hash = "2c61da27d4bc455a9f2555fcc1c5cce7cead226a5900eeed1aaf622616051b79"
score = 75
@@ -278664,10 +279047,10 @@ rule SIGNATURE_BASE_HKTL_Berootexe : FILE
author = "yarGen Rule Generator"
id = "b91c2e0b-2e47-5339-bf48-eaa8329ea63b"
date = "2018-07-25"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4423-L4439"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4424-L4440"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "865b3b8ec9d03d3475286c3030958d90fc72b21b0dca38e5bf8e236602136dd7"
logic_hash = "8e10fddd3b3eb5e5200d9ed0bcb23961d196d9e1de03ebf03a96374ee02a9097"
score = 75
@@ -278689,10 +279072,10 @@ rule SIGNATURE_BASE_HKTL_Berootexe_Output : FILE
author = "Tobias Michalski"
id = "dfd11915-443f-5ce9-b94a-bdcb0e62104e"
date = "2018-07-25"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4441-L4455"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4442-L4456"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7886535d071092df76507f0dd431409e85c368d404f49e7f118278f6565618e6"
score = 75
quality = 85
@@ -278714,10 +279097,10 @@ rule SIGNATURE_BASE_HKTL_Embeddedpdf : FILE
author = "Tobias Michalski"
id = "d4e2d878-fb75-54c5-9879-fe94102911d1"
date = "2018-07-25"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://twitter.com/infosecn1nja/status/1021399595899731968?s=12"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4457-L4473"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4458-L4474"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "041580406e2a7c644d713d8fbf7fccb81664ff536e62df26b3c0f331409fb993"
score = 75
quality = 85
@@ -278742,8 +279125,8 @@ rule SIGNATURE_BASE_HKTL_Blackbone_Driverinjector : FILE
modified = "2025-12-18"
old_rule_name = "HTKL_BlackBone_DriverInjector"
reference = "https://github.com/DarthTon/Blackbone"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4475-L4503"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4476-L4504"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8062a4284c719412270614458150cb4abbdf77b2fc35f770ce9c45d10ccb1f4d"
hash = "2d2fc27200c22442ac03e2f454b6e1f90f2bbc17017f05b09f7824fac6beb14b"
hash = "e45da157483232d9c9c72f44b13fca2a0d268393044db00104cc1afe184ca8d1"
@@ -278775,10 +279158,10 @@ rule SIGNATURE_BASE_HKTL_Sqlmap : FILE
author = "Florian Roth (Nextron Systems)"
id = "da2029dd-c4ce-557f-a409-c468fa3deef3"
date = "2018-10-09"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/sqlmapproject/sqlmap"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4505-L4518"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4506-L4519"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9444478b03caf7af853a64696dd70083bfe67f76aa08a16a151c00aadb540fa8"
logic_hash = "9aa13bc2db40f5ab3debd617c84b1e11805d137bc55e9088bc9a0c23e185dfce"
score = 75
@@ -278799,10 +279182,10 @@ rule SIGNATURE_BASE_HKTL_Sqlmap_Backdoor : FILE
author = "Florian Roth (Nextron Systems)"
id = "bf09caac-cf15-5936-b5b4-df4f28788961"
date = "2018-10-09"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/sqlmapproject/sqlmap"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4520-L4536"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4521-L4537"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5e09135e3908442d873511b7b75c8475b2345a28f3bad41a242d6fc5a3b7c002"
score = 75
quality = 85
@@ -278818,10 +279201,10 @@ rule SIGNATURE_BASE_HKTL_Lazagne_Passworddumper_Dec18_1 : FILE
author = "Florian Roth (Nextron Systems)"
id = "bae48a4d-33b6-55b9-abf5-daf87e5da9e9"
date = "2018-12-11"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4538-L4558"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4539-L4559"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1205f5845035e3ee30f5a1ced5500d8345246ef4900bcb4ba67ef72c0f79966c"
hash = "884e991d2066163e02472ea82d89b64e252537b28c58ad57d9d648b969de6a63"
hash = "bf8f30031769aa880cdbe22bc0be32691d9f7913af75a5b68f8426d4f0c7be50"
@@ -278848,10 +279231,10 @@ rule SIGNATURE_BASE_HKTL_Lazagne_Gen_18
author = "Florian Roth (Nextron Systems)"
id = "034ea6d8-f5cf-5664-9ff9-24d19403093d"
date = "2018-12-11"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://creativecommons.org/licenses/by-nc/4.0/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4560-L4577"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4561-L4578"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "51121dd5fbdfe8db7d3a5311e3e9c904d644ff7221b60284c03347938577eecf"
logic_hash = "6f3e895080267a551a3b7a0ba2d4207b31befacbd35d1e6941e1b69d7e2689ce"
score = 80
@@ -278876,8 +279259,8 @@ rule SIGNATURE_BASE_HKTL_Nopowershell
date = "2018-12-28"
modified = "2022-12-21"
reference = "https://github.com/bitsadmin/nopowershell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4579-L4596"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4580-L4597"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2dad091dd00625762a7590ce16c3492cbaeb756ad0e31352a42751deb7cf9e70"
logic_hash = "2207af9fcc61d547dfeff347a1eae2c59024a7270d1b8cbb7abef56d80864728"
score = 75
@@ -278901,10 +279284,10 @@ rule SIGNATURE_BASE_HKTL_Htran_Go : FILE
author = "Jeff Beley"
id = "bd9409e3-3d4c-57d6-af60-b6d6bd93d46b"
date = "2019-01-09"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4598-L4611"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4599-L4612"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4acbefb9f7907c52438ebb3070888ddc8cddfe9e3849c9d0196173a422b9035f"
logic_hash = "444fe8ce2fdb67c982de26a10882d2cfebc4d2de6c4b4ba6ee10cf39130f1cc5"
score = 75
@@ -278926,14 +279309,14 @@ rule SIGNATURE_BASE_SUSP_Katz_PDB : FILE
author = "Florian Roth (Nextron Systems)"
id = "79f4f07c-b234-5203-a2ab-aba4a9cb9f8d"
date = "2019-02-04"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4613-L4626"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4614-L4627"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6888ce8116c721e7b2fc3d7d594666784cf38a942808f35e309a48e536d8e305"
logic_hash = "1a38f63d8e8baa9bc8f34c1886fc2aaea7f61d5e09792ba9cde4cf6ed8441fab"
score = 65
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -278950,10 +279333,10 @@ rule SIGNATURE_BASE_HKTL_LNX_Pnscan : FILE
author = "Florian Roth (Nextron Systems)"
id = "46c6c0d9-08bb-5de3-ad14-c1a7ab0542c6"
date = "2019-05-27"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/ptrrkssn/pnscan"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4628-L4641"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4629-L4642"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "46a064f9df9d0a0f3fad4ec7be70b1e42074e5e117f7403d8239bc725590f268"
score = 55
quality = 85
@@ -278973,10 +279356,10 @@ rule SIGNATURE_BASE_Paexec : FILE
author = "Florian Roth (Nextron Systems)"
id = "ee564534-b921-5639-a7ed-5da79d6bf86a"
date = "2017-03-27"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "http://researchcenter.paloaltonetworks.com/2017/03/unit42-shamoon-2-delivering-disttrack/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4643-L4663"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4644-L4664"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "01a461ad68d11b5b5096f45eb54df9ba62c5af413fa9eb544eacb598373a26bc"
logic_hash = "30478d90756a9ea362c40236518fe9013e5e5683641b7e7e1ad33aa3b5587e04"
score = 40
@@ -279003,10 +279386,10 @@ rule SIGNATURE_BASE_HKTL_Domainpasswordspray : FILE
author = "Arnim Rupp"
id = "890e4514-2846-54f8-8f32-cc9d2a4ef81b"
date = "2023-01-13"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/dafthack/DomainPasswordSpray"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4665-L4680"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4666-L4681"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "44d4c0ae5673d2a076f3b5acdc83063aca49d58e6dd7cf73d0b927f83d359247"
logic_hash = "aa20bf139eff36100624771fe7617c214337ae5ab2e2746143bd8e6cc1b05b4e"
score = 60
@@ -279027,10 +279410,10 @@ rule SIGNATURE_BASE_HKTL_Rusthound : FILE
author = "Arnim Rupp (https://github.com/ruppde)"
id = "d2fd79a5-9a1a-51de-920c-61653c8b0064"
date = "2023-03-30"
- modified = "2025-12-18"
+ modified = "2026-09-08"
reference = "https://github.com/OPENCYBER-FR/RustHound"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-hacktools.yar#L4682-L4709"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-hacktools.yar#L4683-L4710"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "409f61a34d9771643246f401a9670f6f7dcced9df50cbd89a2e1a5c9ba8d03ab"
hash = "b1a58a9c94b1df97a243e6c3fc2d04ffd92bc802edc7d8e738573b394be331a9"
hash = "170f4a48911f3ebef674aade05184ea0a6b1f6b089bcffd658e95b9905423365"
@@ -279062,8 +279445,8 @@ rule SIGNATURE_BASE_SUSP_VULN_DRV_PROCEXP152_May23 : FILE
date = "2023-05-05"
modified = "2023-07-28"
reference = "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor_inverse_matches.yar#L503-L521"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor_inverse_matches.yar#L503-L521"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
logic_hash = "d988bba837b91b2ad7f69be8765a948848bce21e2daa53af602f714758cda4d4"
score = 50
@@ -279087,8 +279470,8 @@ rule SIGNATURE_BASE_EXPL_RAR_Archive_With_Path_Traversal_Aug25 : CVE_2025_8088 C
date = "2025-08-11"
modified = "2026-05-15"
reference = "https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_rar_archive_with_path_traversal_aug25.yar#L1-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_rar_archive_with_path_traversal_aug25.yar#L1-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2a8fafa01f6d3863c87f20905736ebab28d6a5753ab708760c0b6cf3970828c3"
hash = "dfab2f25c9d870f30bbc4abb873d155cf4904ece536714fb9cd32b2e0126dfab"
hash = "107f3d1fe28b67397d21a6acca5b6b35def1aeb62a67bc10109bd73d567f9806"
@@ -279114,8 +279497,8 @@ rule SIGNATURE_BASE_Office_Autoopen_Macro : FILE
date = "2015-05-28"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/general_officemacros.yar#L2-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/general_officemacros.yar#L2-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4d00695d5011427efc33c9722c61ced2"
hash = "63f6b20cb39630b13c14823874bd3743"
hash = "66e67c2d84af85a569a04042141164e6"
@@ -279145,8 +279528,8 @@ rule SIGNATURE_BASE_Office_As_MHTML : CVE_2012_0158 FILE
date = "2015-05-28"
modified = "2023-12-05"
reference = "https://www.trustwave.com/Resources/SpiderLabs-Blog/Malicious-Macros-Evades-Detection-by-Using-Unusual-File-Format/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/general_officemacros.yar#L28-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/general_officemacros.yar#L28-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8391d6992bc037a891d2e91fd474b91bd821fe6cb9cfc62d1ee9a013b18eca80"
hash = "1ff3573fe995f35e70597c75d163bdd9bed86e2238867b328ccca2a5906c4eef"
hash = "d44a76120a505a9655f0224c6660932120ef2b72fee4642bab62ede136499590"
@@ -279175,11 +279558,11 @@ rule SIGNATURE_BASE_Docm_In_PDF : FILE
date = "2017-05-15"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/general_officemacros.yar#L52-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/general_officemacros.yar#L52-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "045cde0e8f9e0881c2caece7d5660e165aa67b43bed2ba6d4929951497d76494"
score = 75
- quality = 60
+ quality = 85
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
@@ -279200,8 +279583,8 @@ rule SIGNATURE_BASE_MAL_Chrysalis_Dllloader_Feb26 : FILE
date = "2026-02-02"
modified = "2026-05-15"
reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/lotusblossom_notepad_exploitation.yar#L1-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/lotusblossom_notepad_exploitation.yar#L1-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad"
logic_hash = "5e118287bd048788a746d412d00ddd2596224b30562d66c4441738fcc09cee87"
score = 80
@@ -279224,8 +279607,8 @@ rule SIGNATURE_BASE_MAL_Chrysalis_Shellcode_Loader_Feb26
date = "2026-02-02"
modified = "2026-05-15"
reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/lotusblossom_notepad_exploitation.yar#L17-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/lotusblossom_notepad_exploitation.yar#L17-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e2e3d78437cf9d48c2b2264e44bb36bc2235834fc45bbb50b5d6867f336711e3"
logic_hash = "1baf027548cc1f501e2f99d4a337eaafec1e8ac2c48420cbff25c396083b6273"
score = 80
@@ -279248,8 +279631,8 @@ rule SIGNATURE_BASE_MAL_Chrysalis_Backdoor_Feb26
date = "2026-02-02"
modified = "2026-05-15"
reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/lotusblossom_notepad_exploitation.yar#L33-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/lotusblossom_notepad_exploitation.yar#L33-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e2e3d78437cf9d48c2b2264e44bb36bc2235834fc45bbb50b5d6867f336711e3"
logic_hash = "9df8794d9927b92f0810321901aa7836f6a404d48c121818f24473e92875ecc4"
score = 80
@@ -279273,8 +279656,8 @@ rule SIGNATURE_BASE_MAL_Cobaltstrike_Beacon_Loader_Feb26 : FILE
date = "2026-02-02"
modified = "2026-05-15"
reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/lotusblossom_notepad_exploitation.yar#L53-L73"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/lotusblossom_notepad_exploitation.yar#L53-L73"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0a9b8df968df41920b6ff07785cbfebe8bda29e6b512c94a3b2a83d10014d2fd"
hash = "b4169a831292e245ebdffedd5820584d73b129411546e7d3eccf4663d5fc5be3"
logic_hash = "949e70b1fb7f270a05d1626a12595ecab22bdec37a07e83c5cf64399506302a5"
@@ -279300,8 +279683,8 @@ rule SIGNATURE_BASE_MAL_POC_Microsoft_Warbird_Loader_Feb26 : FILE
date = "2026-02-03"
modified = "2026-05-15"
reference = "https://cirosec.de/en/news/abusing-microsoft-warbird-for-shellcode-execution/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/lotusblossom_notepad_exploitation.yar#L75-L88"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/lotusblossom_notepad_exploitation.yar#L75-L88"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "29d0467ee452752286318f350ceb28a2b04ee4c6de550ba0edc34ae0fa7cbb03"
logic_hash = "daeae01f0d5103974ed011322db3b6a833ee0f67b8739a4e63d6b18704ffa605"
score = 75
@@ -279323,8 +279706,8 @@ rule SIGNATURE_BASE_APT34_Malware_HTA : FILE
date = "2017-12-07"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt34.yar#L12-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt34.yar#L12-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f6fa94cc8efea0dbd7d4d4ca4cf85ac6da97ee5cf0c59d16a6aafccd2b9d8b9a"
logic_hash = "0bf9b988b3ef46df29e0f91c3ea186aaab8a1ccb79563e97521311bf2e1215d7"
score = 75
@@ -279353,8 +279736,8 @@ rule SIGNATURE_BASE_APT34_Malware_Exeruner : FILE
date = "2017-12-07"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt34.yar#L34-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt34.yar#L34-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c75c85acf0e0092d688a605778425ba4cb2a57878925eee3dc0f4dd8d636a27a"
logic_hash = "71840d9a0f8a5dc39656e6bf1ad94fa275bcd18baf6b374dfe040c161d62a960"
score = 75
@@ -279389,8 +279772,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbrokers_Jan17_Screen_Strings : FILE
date = "2017-01-08"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message7/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_jan17.yar#L10-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_jan17.yar#L10-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8015b227c5df68fffadb86b72843b2b831d5603978ada3f50cc535a870aa94eb"
score = 75
quality = 85
@@ -279426,8 +279809,8 @@ rule SIGNATURE_BASE_Notpetya_Ransomware_Jun17 : FILE
date = "2017-06-27"
modified = "2023-12-05"
reference = "https://goo.gl/h6iaGj"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_nopetya_jun17.yar#L12-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_nopetya_jun17.yar#L12-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745"
hash = "45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0"
hash = "64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1"
@@ -279464,8 +279847,8 @@ rule SIGNATURE_BASE_EQGRP_Noclient_3_0_5 : FILE
date = "2016-08-15"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L12-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L12-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "51a6bf03c8d034942bf02fae2bea52436f53b4d437006b1dbe9c0c67387fe17a"
score = 75
quality = 85
@@ -279491,8 +279874,8 @@ rule SIGNATURE_BASE_EQGRP_Installdate : FILE
date = "2016-08-15"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L31-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L31-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "363a9c92c4d2560ba6dd0ec41acf136dff4346f20d54f971d319ed2aa531fe31"
score = 75
quality = 85
@@ -279519,8 +279902,8 @@ rule SIGNATURE_BASE_EQGRP_Teflondoor : FILE
date = "2016-08-15"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L52-L73"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L52-L73"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "38be3cfa638509d539bf4ada3b5c7e44e01ee4cfb74a53a76cd2f4287c5a56f5"
score = 75
quality = 85
@@ -279549,8 +279932,8 @@ rule SIGNATURE_BASE_EQGRP_Durablenapkin_Solaris_2_0_1 : FILE
date = "2016-08-15"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L75-L92"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L75-L92"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "113f9451d6792511baa168957c643de02f37826b32944ef882f49b68496ec596"
score = 75
quality = 85
@@ -279576,8 +279959,8 @@ rule SIGNATURE_BASE_EQGRP_Teflonhandle : FILE
date = "2016-08-15"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L94-L111"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L94-L111"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7dfa713b763c983219f008405e1ebf3dfe386672f2d4e5fb54b2b362023ae08a"
score = 75
quality = 85
@@ -279603,8 +279986,8 @@ rule SIGNATURE_BASE_EQGRP_False : FILE
date = "2016-08-15"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L113-L134"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L113-L134"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a1938bc7a5a7a1bb382c2bab976013a1adedc045e0312daabe1bdcdd65d0c606"
score = 75
quality = 85
@@ -279634,8 +280017,8 @@ rule SIGNATURE_BASE_EQGRP_Dn_1_0_2_1 : FILE
date = "2016-08-15"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L136-L152"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L136-L152"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9b6420401419b280f01f7fc73412386a19e94a57e589a043b231b6a721585c99"
score = 75
quality = 85
@@ -279660,8 +280043,8 @@ rule SIGNATURE_BASE_EQGRP_Morel : FILE
date = "2016-08-15"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L154-L170"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L154-L170"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a9152e67f507c9a179bb8478b58e5c71c444a5a39ae3082e04820a0613cd6d9f"
logic_hash = "463d628bb19e27e94dcccc4c7d435d86111d51aa9f77c5ca1a199d9aaa9017ba"
score = 75
@@ -279686,8 +280069,8 @@ rule SIGNATURE_BASE_EQGRP_Bc_Parser : FILE
date = "2016-08-15"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L172-L187"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L172-L187"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "879f2f1ae5d18a3a5310aeeafec22484607649644e5ecb7d8a72f0877ac19cee"
logic_hash = "e8911acc1173e1149fd11dd795b72ba26bc654cbc7f9d95053ce420663fcafe9"
score = 75
@@ -279711,8 +280094,8 @@ rule SIGNATURE_BASE_EQGRP_1212 : FILE
date = "2016-08-15"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L189-L207"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L189-L207"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1be7ed8fdfaecc6e55c4d1e75cf841f4620df3d2abe6aed2761aed20c42f70bd"
score = 75
quality = 85
@@ -279739,8 +280122,8 @@ rule SIGNATURE_BASE_EQGRP_1212_Dehex : FILE
date = "2016-08-15"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L209-L226"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L209-L226"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "74d1b0e820696cd5507996996bead50d283e83095bc7288a6e8e484738b6348b"
score = 75
quality = 85
@@ -279766,8 +280149,8 @@ rule SIGNATURE_BASE_Install_Get_Persistent_Filenames : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L237-L250"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L237-L250"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4a50ec4bf42087e932e9e67e0ea4c09e52a475d351981bb4c9851fda02b35291"
logic_hash = "be07e3e3e96dd4676a76b32eb8fc47b2ab1f66ebbd6c2a3f1c88fc224f9f39ef"
score = 75
@@ -279790,8 +280173,8 @@ rule SIGNATURE_BASE_EQGRP_Create_Dns_Injection
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L252-L266"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L252-L266"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "488f3cc21db0688d09e13eb85a197a1d37902612c3e302132c84e07bc42b1c32"
logic_hash = "a07cb33c459208410b326fc260e96e617385ee4eac905a92d9542cb5ec73713e"
score = 75
@@ -279815,8 +280198,8 @@ rule SIGNATURE_BASE_EQGRP_Screamingplow
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L268-L282"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L268-L282"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c7f4104c4607a03a1d27c832e1ebfc6ab252a27a1709015b5f1617b534f0090a"
logic_hash = "429ff81b6079785cc45d81b5ebf8bccd49f30484ca692017b0b66484463606d4"
score = 75
@@ -279840,8 +280223,8 @@ rule SIGNATURE_BASE_EQGRP_Mixtext
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L284-L297"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L284-L297"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e4d24e30e6cc3a0aa0032dbbd2b68c60bac216bef524eaf56296430aa05b3795"
logic_hash = "cae2437124ad6e69b04a1338b651e33c7358b7fedd0613f3fa1025cf980e14ab"
score = 75
@@ -279864,8 +280247,8 @@ rule SIGNATURE_BASE_EQGRP_Tunnel_State_Reader
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L299-L313"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L299-L313"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "49d48ca1ec741f462fde80da68b64dfa5090855647520d29e345ef563113616c"
logic_hash = "d0653650aad10e7ff69b7ef1e61fac64310c63cc68c6d924655f082925e4fd04"
score = 75
@@ -279889,8 +280272,8 @@ rule SIGNATURE_BASE_EQGRP_Payload
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L315-L329"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L315-L329"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "21bed6d699b1fbde74cbcec93575c9694d5bea832cd191f59eb3e4140e5c5e07"
logic_hash = "22e2a4809f6646437ab0824238fec791f3760ac305f9c818089797b011425b3d"
score = 75
@@ -279914,8 +280297,8 @@ rule SIGNATURE_BASE_EQGRP_Eligiblecandidate
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L331-L348"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L331-L348"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c4567c00734dedf1c875ecbbd56c1561a1610bedb4621d9c8899acec57353d86"
logic_hash = "e7e1b206f9c51ffe0ab016a93d551a9ede8f87adfc38fe70278be8c2f0fe0696"
score = 75
@@ -279941,8 +280324,8 @@ rule SIGNATURE_BASE_EQGRP_BUSURPER_2211_724
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L350-L367"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L350-L367"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d809d6ff23a9eee53d2132d2c13a9ac5d0cb3037c60e229373fc59a4f14bc744"
logic_hash = "834180ef512882cc3b22e79a6bda349678eb5042a3356a50c47eeb36ae453427"
score = 75
@@ -279969,8 +280352,8 @@ rule SIGNATURE_BASE_EQGRP_Networkprofiler_Orderscans
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L369-L383"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L369-L383"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ea986ddee09352f342ac160e805312e3a901e58d2beddf79cd421443ba8c9898"
logic_hash = "0cdf4f3d8f668ce5d5aab652c83cb4d2a9acc3471ff720448d021707b34402ef"
score = 75
@@ -279994,8 +280377,8 @@ rule SIGNATURE_BASE_EQGRP_Epicbanana_2_1_0_1
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L385-L399"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L385-L399"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4b13cc183c3aaa8af43ef3721e254b54296c8089a0cd545ee3b867419bb66f61"
logic_hash = "be0b180e0dfdda35725ac6d9c35752a0b56bdbdaf985b6932c7d2ff342d4cde3"
score = 75
@@ -280019,8 +280402,8 @@ rule SIGNATURE_BASE_EQGRP_Sniffer_Xml2Pcap
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L401-L415"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L401-L415"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f5e5d75cfcd86e5c94b0e6f21bbac886c7e540698b1556d88a83cc58165b8e42"
logic_hash = "3c3aa9f42edbca32725f8c02023e3b9644162a001ded099513d12f94d70dd4c8"
score = 75
@@ -280044,8 +280427,8 @@ rule SIGNATURE_BASE_EQGRP_Bananaaid
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L417-L433"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L417-L433"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a4fb825e63dc612de81bc83313acf5eccaa7285afc05941ac1fef199279519f"
logic_hash = "2ae52529547866dcfe66fffb3f5b37eba89844b7675129c66636ebef01b0f49a"
score = 75
@@ -280071,8 +280454,8 @@ rule SIGNATURE_BASE_EQGRP_Bo : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L435-L452"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L435-L452"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aa8b363073e8ae754b1836c30f440d7619890ded92fb5b97c73294b15d22441d"
logic_hash = "48c2d3f13283d2a1b7e1010c724f1e68e6002dd9a9779025dfc3a4952bec95bc"
score = 75
@@ -280099,8 +280482,8 @@ rule SIGNATURE_BASE_EQGRP_Seconddate_2211 : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L454-L470"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L454-L470"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2337d0c81474d03a02c404cada699cf1b86c3c248ea808d4045b86305daa2607"
logic_hash = "f51f4cfb3b1c77f03a3627cccfee72e57731b26b01907cc837f246a8f7677580"
score = 75
@@ -280126,8 +280509,8 @@ rule SIGNATURE_BASE_EQGRP_Config_Jp1_UA
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L472-L488"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L472-L488"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f50b6e9891e4d7fd24cc467e7f5cfe348f56f6248929fec4bbee42a5001ae56"
logic_hash = "8dd504bd00f72b1500375fbe451f5abb055cb2ff440f6ae4314b1e3d64097b83"
score = 75
@@ -280153,8 +280536,8 @@ rule SIGNATURE_BASE_EQGRP_Userscript
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L490-L503"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L490-L503"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5098ff110d1af56115e2c32f332ff6e3973fb7ceccbd317637c9a72a3baa43d7"
logic_hash = "718ee434c8ae61e2709df6dd431dbb0a2230085f0132ae82c7ceda4de75248cf"
score = 75
@@ -280177,8 +280560,8 @@ rule SIGNATURE_BASE_EQGRP_BBALL_M50FW08_2201 : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L505-L523"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L505-L523"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "80c0b68adb12bf3c15eff9db70a57ab999aad015da99c4417fdfd28156d8d3f7"
logic_hash = "dd180203ec4c4ddfa2c46cba672eb94179553637a9f7548b25dee7b88c3d3294"
score = 75
@@ -280206,8 +280589,8 @@ rule SIGNATURE_BASE_EQGRP_BUSURPER_3001_724 : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L525-L540"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L525-L540"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6b558a6b8bf3735a869365256f9f2ad2ed75ccaa0eefdc61d6274df4705e978b"
logic_hash = "531f7039290b386f070378cb4ba49a57b5031fb16b3972b61f4fb904770fc4ac"
score = 75
@@ -280232,8 +280615,8 @@ rule SIGNATURE_BASE_EQGRP_Workit
date = "2016-08-16"
modified = "2023-01-27"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L542-L566"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L542-L566"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fb533b4d255b4e6072a4fa2e1794e38a165f9aa66033340c2f4f8fd1da155fac"
logic_hash = "1fa61e8c2012e664fee97ff608bcd8845bbd9701fa02d39d49379f7f83a5636d"
score = 75
@@ -280266,8 +280649,8 @@ rule SIGNATURE_BASE_EQGRP_Tinyhttp_Setup : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L568-L584"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L568-L584"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3d12c83067a9f40f2f5558d3cf3434bbc9a4c3bb9d66d0e3c0b09b9841c766a0"
logic_hash = "0d560206e634f3bfeffe5b7de3edf02f6c76443ffb5c0de37180e63276a19457"
score = 75
@@ -280293,8 +280676,8 @@ rule SIGNATURE_BASE_EQGRP_Shellcode
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L586-L605"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L586-L605"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ac9decb971dd44127a6ca0d35ac153951f0735bb4df422733046098eca8f8b7f"
logic_hash = "69a04db721a0d17720f9db9386d47309f01d1fc31bd5e833cedb9e1c2eb573ae"
score = 75
@@ -280321,8 +280704,8 @@ rule SIGNATURE_BASE_EQGRP_EPBA : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L607-L626"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L607-L626"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "53e1af1b410ace0934c152b5df717d8a5a8f5fdd8b9eb329a44d94c39b066ff7"
logic_hash = "c483efdcfbb0dd8602a552b519d3aa52fca12549c0ec1660d813a2a1da66c3a6"
score = 75
@@ -280351,8 +280734,8 @@ rule SIGNATURE_BASE_EQGRP_BPIE : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L628-L648"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L628-L648"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "697e80cf2595c85f7c931693946d295994c55da17a400f2c9674014f130b4688"
logic_hash = "ab13dde40015fba80f55bc9d1b82c94ec2421e9ea263b70ad8ec0a7a74c43c9a"
score = 75
@@ -280382,8 +280765,8 @@ rule SIGNATURE_BASE_EQGRP_Jetplow_SH
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L650-L666"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L650-L666"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ee266f84a1a4ccf2e789a73b0a11242223ed6eba6868875b5922aea931a2199c"
logic_hash = "8ae203527c4e41ae169c63521bb08d5199c43dfd1028574a1791ab1f8f198105"
score = 75
@@ -280409,8 +280792,8 @@ rule SIGNATURE_BASE_EQGRP_BBANJO : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L668-L687"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L668-L687"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f09c2f90464781a08436321f6549d350ecef3d92b4f25b95518760f5d4c9b2c3"
logic_hash = "8ee2e817732674bf7ff5f396271a2a90da8f401d7ea0f0a3f51c21712adb3ea4"
score = 75
@@ -280439,8 +280822,8 @@ rule SIGNATURE_BASE_EQGRP_BPATROL_2201 : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L689-L706"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L689-L706"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aa892750b893033eed2fedb2f4d872f79421174eb217f0c34a933c424ae66395"
logic_hash = "a2e9aa4627924c99dd3a342174855df3f0d545a67fd2293ca5601eeae70ae010"
score = 75
@@ -280467,8 +280850,8 @@ rule SIGNATURE_BASE_EQGRP_Extrabacon
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L708-L725"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L708-L725"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "59d60835fe200515ece36a6e87e642ee8059a40cb04ba5f4b9cce7374a3e7735"
logic_hash = "1a010d5e6324715f8e1bf29e957c365fabd2986fece53aaea23bba8ee59bd808"
score = 75
@@ -280495,8 +280878,8 @@ rule SIGNATURE_BASE_EQGRP_Sploit_Py
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L727-L742"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L727-L742"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
logic_hash = "874eaffcbc191951db39ba6c85e8c80b83b0df8d33136b6cdcdefcb28e596474"
score = 75
@@ -280521,8 +280904,8 @@ rule SIGNATURE_BASE_EQGRP_Uninstallpbd
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L744-L759"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L744-L759"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "692fdb449f10057a114cf2963000f52ce118d9a40682194838006c66af159bd0"
logic_hash = "51be8a491a1e228dfc6156a86e9f2ffc923c39d0649bbc031ea1bafe1af22a45"
score = 75
@@ -280547,8 +280930,8 @@ rule SIGNATURE_BASE_EQGRP_BICECREAM : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L761-L782"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L761-L782"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4842076af9ba49e6dfae21cf39847b4172c06a0bd3d2f1ca6f30622e14b77210"
logic_hash = "adaa6b7d4bf9e6f95fbae781382e72afc07993582473cbee7139a93df0fe3283"
score = 75
@@ -280579,8 +280962,8 @@ rule SIGNATURE_BASE_EQGRP_Create_Http_Injection : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L784-L802"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L784-L802"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "de52f5621b4f3896d4bd1fb93ee8be827e71a2b189a9f8552b68baed062a992d"
logic_hash = "3a2ee46c6fec1b7a501e8c0e2963d4873ede89d192d0f4701d051f782e8ece99"
score = 75
@@ -280607,8 +280990,8 @@ rule SIGNATURE_BASE_EQGRP_BFLEA_2201 : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L804-L823"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L804-L823"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "15e8c743770e44314496c5f27b6297c5d7a4af09404c4aa507757e0cc8edc79e"
logic_hash = "d0fd4d0ffe98856abed685c4b9ff770daba22aa16bd860440874fd94df2d54ea"
score = 75
@@ -280637,8 +281020,8 @@ rule SIGNATURE_BASE_EQGRP_Bpfcreator_RHEL4 : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L825-L842"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L825-L842"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bd7303393409623cabf0fcf2127a0b81fae52fe40a0d2b8db0f9f092902bbd92"
logic_hash = "8586425b13355170137d66fe8d52ed98982d7c5699b26a8c0132f107b4af43d8"
score = 75
@@ -280665,8 +281048,8 @@ rule SIGNATURE_BASE_EQGRP_Storefc
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L844-L859"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L844-L859"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f155cce4eecff8598243a721389046ae2b6ca8ba6cb7b4ac00fd724601a56108"
logic_hash = "f07c3ef83808852f70fb5cbc4436d531675344ab74f83888cd70d987c3544cce"
score = 75
@@ -280691,8 +281074,8 @@ rule SIGNATURE_BASE_EQGRP_Hexdump : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L861-L877"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L861-L877"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "95a9a6a8de60d3215c1c9f82d2d8b2640b42f5cabdc8b50bd1f4be2ea9d7575a"
logic_hash = "ed36aa5a69296088bdd1db42e6561377294b7bd99c30104b9d4a618d899d7e9a"
score = 75
@@ -280718,8 +281101,8 @@ rule SIGNATURE_BASE_EQGRP_BBALL : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L879-L898"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L879-L898"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "498fc9f20b938b8111adfa3ca215325f265a08092eefd5300c4168876deb7bf6"
logic_hash = "b02d17a13725b5215c89590abf77f960e79f9fd155c9ea4e9eb903710a7a375e"
score = 75
@@ -280748,8 +281131,8 @@ rule SIGNATURE_BASE_EQGRP_BARPUNCH_BPICKER : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L902-L921"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L902-L921"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
hash = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
logic_hash = "f5d0cc881bedad736a90109933da8dbd32c4435aa255676c68ae3541bbb61e74"
@@ -280778,8 +281161,8 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen6 : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L923-L951"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L923-L951"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
hash = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
hash = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
@@ -280817,8 +281200,8 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen5 : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L953-L978"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L953-L978"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
hash = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
hash = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
@@ -280852,8 +281235,8 @@ rule SIGNATURE_BASE_EQGRP_Pandarock : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L980-L1007"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L980-L1007"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1214e282ac7258e616ebd76f912d4b2455d1b415b7216823caa3fc0d09045a5f"
hash = "c8a151df7605cb48feb8be2ab43ec965b561d2b6e2a837d645fdf6a6191ab5fe"
logic_hash = "d0a61410d7c5f309489ef4553f41a3a6fb7d0f24bcdb1f0d88e896265513add2"
@@ -280888,8 +281271,8 @@ rule SIGNATURE_BASE_EQGRP_Bananausurper_Writejetplow : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1009-L1028"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1009-L1028"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
hash = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
logic_hash = "101e75800291a7603e03145bff298d7587c9b5f19102e7ba9ed3bf2b544fa5cf"
@@ -280917,8 +281300,8 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen4 : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1030-L1051"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1030-L1051"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
hash = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
hash = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
@@ -280949,8 +281332,8 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen3 : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1053-L1076"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1053-L1076"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
hash = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
hash = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
@@ -280982,8 +281365,8 @@ rule SIGNATURE_BASE_EQGRP_BLIAR_BLIQUER : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1078-L1111"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1078-L1111"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
hash = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
logic_hash = "59b7303dba0a79919d79627697a8724337145cd6d7b5c53cda970bf437162865"
@@ -281024,8 +281407,8 @@ rule SIGNATURE_BASE_EQGRP_Sploit : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1113-L1135"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1113-L1135"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
hash = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
logic_hash = "083f103dee6b209626c4d790dff0e53af757945ded63409b26bbe143c78e30eb"
@@ -281057,8 +281440,8 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen2 : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1137-L1168"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1137-L1168"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
hash = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
hash = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
@@ -281098,8 +281481,8 @@ rule SIGNATURE_BASE_EQGRP_Implants_Gen1 : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1170-L1199"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1170-L1199"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
hash = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
hash = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
@@ -281138,8 +281521,8 @@ rule SIGNATURE_BASE_EQGRP_Eligiblebombshell_Generic : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1201-L1218"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1201-L1218"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
hash = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
logic_hash = "a2e13300736f99aff30c7b4f7f0b148d62ecb1e72435a3e15e4f85b30d904ffd"
@@ -281166,8 +281549,8 @@ rule SIGNATURE_BASE_EQGRP_Ssh_Telnet_29 : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1220-L1241"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1220-L1241"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "630d464b1d08c4dfd0bd50552bee2d6a591fb0b5597ecebaa556a3c3d4e0aa4e"
hash = "07f4c60505f4d5fb5c4a76a8c899d9b63291444a3980d94c06e1d5889ae85482"
logic_hash = "e93a54f4de089d460bfb966feacc377c0467863f481a210c81970f4909fb3bd8"
@@ -281198,8 +281581,8 @@ rule SIGNATURE_BASE_EQGRP_Tinyexec : FILE
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1245-L1258"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1245-L1258"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "19b8d7e946d72424f81cd48ad4bf8791bf50a4cc146866e55ad501443a8d1e45"
score = 75
quality = 85
@@ -281222,8 +281605,8 @@ rule SIGNATURE_BASE_EQGRP_Callbacks
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1260-L1272"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1260-L1272"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "34881cf8f9f29482a1e129f0f61470d4cc3fa6b78b9f6dda25862371896deca7"
score = 75
quality = 85
@@ -281245,8 +281628,8 @@ rule SIGNATURE_BASE_EQGRP_Extrabacon_Output
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1274-L1290"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1274-L1290"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5e71a4380dd30e68d89add1718976d3207a161d2d61fd4c3250fc4b10a0f53a0"
score = 75
quality = 85
@@ -281272,8 +281655,8 @@ rule SIGNATURE_BASE_EQGRP_Unique_Strings
date = "2016-08-16"
modified = "2023-12-05"
reference = "Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1292-L1305"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1292-L1305"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "070358ec9cccb5d9daa4e5a016d4f9a988b600d675484f06dc9a897cadf7af0c"
score = 75
quality = 85
@@ -281296,8 +281679,8 @@ rule SIGNATURE_BASE_EQGRP_RC5_RC6_Opcode
date = "2016-08-17"
modified = "2023-12-05"
reference = "https://securelist.com/blog/incidents/75812/the-equation-giveaway/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1307-L1326"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1307-L1326"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a79208c5924e1d5cc9db922f80403514e516eadb725393c1ebc9a6236ca90b98"
score = 75
quality = 85
@@ -281319,8 +281702,8 @@ rule SIGNATURE_BASE_Equationgroup_Modifyaudit_Implant : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1337-L1353"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1337-L1353"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b7902809a15c4c3864a14f009768693c66f9e9234204b873d29a87f4c3009a50"
logic_hash = "ec8b54f3489b1eeef491b03641805e0e4db0b5cbbb67a3ae3d37dad184f54b01"
score = 75
@@ -281346,8 +281729,8 @@ rule SIGNATURE_BASE_Equationgroup_Modifyaudit_Lp : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1355-L1372"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1355-L1372"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2a1f2034e80421359e3bf65cbd12a55a95bd00f2eb86cf2c2d287711ee1d56ad"
logic_hash = "a908d44b831a27bb584c5da936346f77f0e205658ec2ebe0e600004645894593"
score = 75
@@ -281374,8 +281757,8 @@ rule SIGNATURE_BASE_Equationgroup_Processhide_Lp : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1374-L1393"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1374-L1393"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66"
logic_hash = "407045f5ac8eeec4403560de406e5d382d38ae2f34d0e4c7d3cc9b94debdfad8"
score = 75
@@ -281404,8 +281787,8 @@ rule SIGNATURE_BASE_Equationgroup_Pwdump_Implant : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1395-L1410"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1395-L1410"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dfd5768a4825d1c7329c2e262fde27e2b3d9c810653585b058fcf9efa9815964"
logic_hash = "20df7ef04154e317ee844545e541d62b3b8db4ac4800ba45a26b1092499c6e69"
score = 75
@@ -281430,8 +281813,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_5 : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1412-L1428"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1412-L1428"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4ebfc1f6ec6a0e68e47e5b231331470a4483184cf715a578191b91ba7c32094d"
logic_hash = "834a7175a23c30301fce01482a2768d453368c7ca5c72ae52b2d266b31005991"
score = 75
@@ -281457,8 +281840,8 @@ rule SIGNATURE_BASE_Equationgroup_PC_Level3_Http_Flav_Dll : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1430-L1447"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1430-L1447"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "27972d636b05a794d17cb3203d537bcf7c379fafd1802792e7fb8e72f130a0c4"
logic_hash = "579539961e29c4da60dc632b1afd348e0d799e266f175a3bae7206b615d90f5b"
score = 75
@@ -281485,8 +281868,8 @@ rule SIGNATURE_BASE_Equationgroup_LSADUMP_Lp : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1449-L1462"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1449-L1462"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
logic_hash = "f67a64ae7fece949d37367d85a28a879e90844e5cc56e88a85a1cce890990f55"
score = 75
@@ -281509,8 +281892,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Mstcp32 : FILE
date = "2017-01-13"
modified = "2023-01-06"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1464-L1485"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1464-L1485"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
logic_hash = "aff97f8360a0c24bfde6a1b2616749d6cad3b19993716231d32b8bb59579c638"
score = 75
@@ -281540,8 +281923,8 @@ rule SIGNATURE_BASE_Equationgroup_Nethide_Lp : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1487-L1504"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1487-L1504"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d"
logic_hash = "70e96a8ef5f75e05b3f6d32b9b8392316c3a70cb479549a3700134435b690473"
score = 75
@@ -281568,8 +281951,8 @@ rule SIGNATURE_BASE_Equationgroup_PC_Level4_Flav_Dll_X64 : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1506-L1521"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1506-L1521"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c"
logic_hash = "9c874581567909055deeae4f992bd99c1e08d5f62655d1cc9a7316beb8513d8f"
score = 75
@@ -281594,8 +281977,8 @@ rule SIGNATURE_BASE_Equationgroup_PC_Level4_Flav_Exe : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1523-L1541"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1523-L1541"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "33ba9f103186b6e52d8d69499512e7fbac9096e7c5278838127488acc3b669a9"
logic_hash = "975d327d5922e4b179a677501c2613186ea85299958a996dcdeb503b02495ff7"
score = 75
@@ -281623,8 +282006,8 @@ rule SIGNATURE_BASE_Equationgroup_Processinfo_Implant : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1543-L1558"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1543-L1558"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aadfa0b1aec4456b10e4fb82f5cfa918dbf4e87d19a02bcc576ac499dda0fb68"
logic_hash = "b0aace3c6fa20c5bb238264b2aa484d548945a4c2ccb65482cce71427f061604"
score = 75
@@ -281649,8 +282032,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_2 : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1560-L1574"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1560-L1574"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "964762416840738b1235ed4ae479a4b117b8cdcc762a6737e83bc2062c0cf236"
logic_hash = "fcbc518d23dc21d482abcac29505c5404fc9e309554ca7dc9f1014adbff83e1a"
score = 75
@@ -281674,8 +282057,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Ntevt : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1577-L1591"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1577-L1591"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "45e5e1ea3456d7852f5c610c7f4447776b9f15b56df7e3a53d57996123e0cebf"
logic_hash = "c5259c89dfedc34ca032775bda4ead04985da6b3d042b8a6635f5f848570d8c6"
score = 75
@@ -281699,8 +282082,8 @@ rule SIGNATURE_BASE_Equationgroup_Nethide_Implant : FILE
date = "2017-01-13"
modified = "2023-01-27"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1593-L1608"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1593-L1608"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b2daf9058fdc5e2affd5a409aebb90343ddde4239331d3de8edabeafdb3a48fa"
logic_hash = "bd25d05b001ac7d41e60270b62aeecd520a570e76557c68d78d9680c7beb90ab"
score = 75
@@ -281724,8 +282107,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_4 : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1610-L1624"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1610-L1624"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "227faeb770ba538fb85692b3dfcd00f76a0a5205d1594bd0969a1e535ee90ee1"
logic_hash = "3046cbfa4b4f5eb5d0efc1b2b658567391b0c219650437088a0d6c179e9235fb"
score = 75
@@ -281749,8 +282132,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Tdi6 : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1626-L1642"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1626-L1642"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12c082f74c0916a0e926488642236de3a12072a18d29c97bead15bb301f4b3f8"
logic_hash = "ba7e14a3bf158795ecee498976847fbbcc80635799be4574f05aa80d1a85a4ef"
score = 75
@@ -281776,8 +282159,8 @@ rule SIGNATURE_BASE_Equationgroup_Modifyauthentication_Implant : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1644-L1661"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1644-L1661"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e1dff24af5bfc991dca21b4e3a19ffbc069176d674179eef691afc6b1ac6f805"
logic_hash = "8bdc4c9e9a3e327bb55781670d8f373d5a8904ccd47cc4b67673c47a76c54927"
score = 75
@@ -281804,8 +282187,8 @@ rule SIGNATURE_BASE_Equationgroup_Ntfltmgr : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1663-L1679"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1663-L1679"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5"
logic_hash = "3e931088f363c7dfb6057019faf9e5c674c90f6bdae6211dcc871464b410efd3"
score = 75
@@ -281831,8 +282214,8 @@ rule SIGNATURE_BASE_Equationgroup_DXGHLP16 : FILE
date = "2017-01-13"
modified = "2023-01-06"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1681-L1702"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1681-L1702"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
logic_hash = "5244cef876af4c0c02109599e6250254c854ed5c9bd2d0ccc44676dca21a1650"
score = 75
@@ -281862,8 +282245,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Msgkd : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1704-L1718"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1704-L1718"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "25eec68fc9f0d8d1b5d72c9eae7bee29035918e9dcbeab13e276dec4b2ad2a56"
logic_hash = "60336294ef5fa0221fc6a0e8b05bb279ac0e167024568cd9efa78e678e763704"
score = 75
@@ -281887,8 +282270,8 @@ rule SIGNATURE_BASE_Equationgroup_Runaschild_Lp : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1720-L1735"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1720-L1735"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464"
logic_hash = "77bea554ead64f85f4efdc49f91ea3b24d1759ae9d91718d443938ab862b0191"
score = 75
@@ -281913,8 +282296,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_6 : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1737-L1752"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1737-L1752"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "339855618fb3ef53987b8c14a61bd4519b2616e766149e0c21cbd7cbe7a632c9"
logic_hash = "5a14bd8efe2cf68beec207e5deec28fd5b9d89c506593214eccbceae3cb862a7"
score = 75
@@ -281939,8 +282322,8 @@ rule SIGNATURE_BASE_Equationgroup_PC_Level3_Http_Flav_Dll_X64 : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1754-L1771"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1754-L1771"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4e0209b4f5990148f5d6dee47dbc7021bf78a782b85cef4d6c8be22d698b884f"
logic_hash = "b304cb747e609ad5de46624e2d0d005d5f8521e16f0b36cab31535709d7ab72f"
score = 75
@@ -281967,8 +282350,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_3 : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1773-L1787"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1773-L1787"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "69dcc150468f7707cc8ef618a4cea4643a817171babfba9290395ada9611c63c"
logic_hash = "6b43280a94f1f5c62185f6b879126bcd258e9875beeb0f7ec1e3569494a60669"
score = 75
@@ -281992,8 +282375,8 @@ rule SIGNATURE_BASE_Equationgroup_Getadmin_Lp : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1789-L1802"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1789-L1802"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78"
logic_hash = "5bff3858c59b1bb44c5e24ca5f77d8e1e582224cc1caad3955d1adb0efea318a"
score = 75
@@ -282016,8 +282399,8 @@ rule SIGNATURE_BASE_Equationgroup_Modifygroup_Lp : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1805-L1819"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1805-L1819"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520"
logic_hash = "8fe5102cacd9149a0ed60440c563953d487aa2b28a3b947d821d0cc3f3396a4a"
score = 75
@@ -282041,8 +282424,8 @@ rule SIGNATURE_BASE_Equationgroup_Pwdump_Lp : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1821-L1834"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1821-L1834"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5"
logic_hash = "7381ffd9b2b720fa99d52bc5805fea942e5a966bf3fd611f1a80a875edd06dad"
score = 75
@@ -282065,8 +282448,8 @@ rule SIGNATURE_BASE_Equationgroup_Eventlogedit_Implant : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1836-L1851"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1836-L1851"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0bb750195fbd93d174c2a8e20bcbcae4efefc881f7961fdca8fa6ebd68ac1edf"
logic_hash = "1d391eaed77150ab2a26dfed60ebd82aa2c6802b6b604791fb78d08db7fe5ec9"
score = 75
@@ -282091,8 +282474,8 @@ rule SIGNATURE_BASE_Equationgroup_Portmap_Lp : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1853-L1868"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1853-L1868"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b8876498882624a6"
logic_hash = "9666e64b40dc01c5b3756b1334519730765f7075ba9a124a79f5b7ea4bc91e03"
score = 75
@@ -282117,8 +282500,8 @@ rule SIGNATURE_BASE_Equationgroup_Processoptions_Lp : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1870-L1883"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1870-L1883"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "31d86f77137f0b3697af03dd28d6552258314cecd3c1d9dc18fcf609eb24229a"
logic_hash = "cc9cd566f57d28ccea6d53d2eba71187f01cdf6e140771cace33349f6439461d"
score = 75
@@ -282141,8 +282524,8 @@ rule SIGNATURE_BASE_Equationgroup_Passfreely_Lp : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1885-L1900"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1885-L1900"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb"
logic_hash = "c3ceb04b42b6e741b1578ec9ecb83b72c599d9af457d6d4e8de572e481d3aa5c"
score = 75
@@ -282167,8 +282550,8 @@ rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_1 : FILE
date = "2017-01-13"
modified = "2023-12-05"
reference = "https://goo.gl/tcSoiJ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1904-L1933"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1904-L1933"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "694be2698bcc5c7a1cce11f8ef65c1c96a883d14b98148c36b32888fb58b6a7e"
hash = "73d1d55493886639c619e9f5e312daab93e4feeb74f24dbe51593842baac8d15"
hash = "e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78"
@@ -282208,8 +282591,8 @@ rule SIGNATURE_BASE_Equationdrug_MS_Identifier
date = "2015-03-11"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp.yar#L1937-L1948"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp.yar#L1937-L1948"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7b919c82b6e765be5adb927bf79d13f9b37a214a6f8a1f7b237a88ba46ae958c"
score = 75
quality = 85
@@ -282231,8 +282614,8 @@ rule SIGNATURE_BASE_Reaver3_Malware_Nov17_1 : FILE
date = "2017-11-11"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_reaver_sunorcal.yar#L14-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_reaver_sunorcal.yar#L14-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1813f10bcf74beb582c824c64fff63cb150d178bef93af81d875ca84214307a1"
logic_hash = "fa141a1d3868bd4a004794bf51dc20086eb2e1446e1fa374834a6f2d84940c0d"
score = 75
@@ -282256,8 +282639,8 @@ rule SIGNATURE_BASE_Reaver3_Malware_Nov17_2 : FILE
date = "2017-11-11"
modified = "2023-01-06"
reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_reaver_sunorcal.yar#L29-L53"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_reaver_sunorcal.yar#L29-L53"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9213f70bce491991c4cbbbd7dc3e67d3a3d535b965d7064973b35c50f265e59b"
hash = "98eb5465c6330b9b49df2e7c9ad0b1164aa5b35423d9e80495a178eb510cdc1c"
logic_hash = "f987876dae35d17fb3ac0d4d3cfe1e00f8977aa696194cc48e53ac1db9d55fca"
@@ -282286,8 +282669,8 @@ rule SIGNATURE_BASE_Reaver3_Malware_Nov17_3 : FILE
date = "2017-11-11"
modified = "2023-01-06"
reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_reaver_sunorcal.yar#L55-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_reaver_sunorcal.yar#L55-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "18ac3b14300ecfeed4b64a844c16dccb06b0e3513d0954d6c6182f2ea14e4c92"
hash = "c0f8bb77284b96e07cab1c3fab8800b1bbd030720c74628c4ee5666694ef903d"
hash = "c906250e0a4c457663e37119ebe1efa1e4b97eef1d975f383ac3243f9f09908c"
@@ -282318,8 +282701,8 @@ rule SIGNATURE_BASE_Sunorcal_Malware_Nov17_1 : FILE
date = "2017-11-11"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_reaver_sunorcal.yar#L82-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_reaver_sunorcal.yar#L82-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cb7c0cf1750baaa11783e93369230ee666b9f3da7298e4d1bb9a07af6a439f2f"
hash = "799139b5278dc2ac24279cc6c3db44f4ef0ea78ee7b721b0ace38fd8018c51ac"
hash = "38ea33dab0ba2edd16ecd98cba161c550d1036b253c8666c4110d198948329fb"
@@ -282350,8 +282733,8 @@ rule SIGNATURE_BASE_Sharpcat : FILE
date = "2016-06-10"
modified = "2023-12-05"
reference = "https://github.com/Cn33liz/SharpCat"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_sharpcat.yar#L8-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_sharpcat.yar#L8-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "96dcdf68b06c3609f486f9d560661f4fec9fe329e78bd300ad3e2a9f07e332e9"
logic_hash = "4a38812b07b40bdde03049dbff1f9de38cadaf9941ab8b40b84016b1d5cbfd51"
score = 75
@@ -282376,8 +282759,8 @@ rule SIGNATURE_BASE_MAL_Xbash_PY_Sep18 : FILE
date = "2018-09-18"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_xbash.yar#L13-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_xbash.yar#L13-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a18c7bdf0c504832c8552766dcfe0ba33dd5493daa3d9dbe9c985c1ce36e5aa"
logic_hash = "d686c42e6bf440507735f846463f2df5fbf4f7bd5f5656883655a5278a1fc252"
score = 75
@@ -282399,8 +282782,8 @@ rule SIGNATURE_BASE_MAL_Xbash_SH_Sep18 : FILE
date = "2018-09-18"
modified = "2023-01-06"
reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_xbash.yar#L27-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_xbash.yar#L27-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a27acc07844bb751ac33f5df569fd949d8b61dba26eb5447482d90243fc739af"
hash = "de63ce4a42f06a5903b9daa62b67fcfbdeca05beb574f966370a6ae7fd21190d"
logic_hash = "b48cbd64002025d861e2fd381be5a68efd7f6fc5fd239850c940f887e2b01673"
@@ -282430,8 +282813,8 @@ rule SIGNATURE_BASE_MAL_Xbash_JS_Sep18 : FILE
date = "2018-09-18"
modified = "2023-01-06"
reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_xbash.yar#L50-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_xbash.yar#L50-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f888dda9ca1876eba12ffb55a7a993bd1f5a622a30045a675da4955ede3e4cb8"
logic_hash = "cf2f9006e0ab07f6ff1a0ce4946af34468f7c74143c853c5d77c6db725bb590a"
score = 75
@@ -282456,8 +282839,8 @@ rule SIGNATURE_BASE_STUXSHOP_Config
date = "2019-04-09"
modified = "2023-12-05"
reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stuxshop.yar#L2-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stuxshop.yar#L2-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c1961e54d60e34bbec397c9120564e8d08f2f243ae349d2fb20f736510716579"
logic_hash = "9dd57f8b4e25a53dcf54dc75a1bb26675c7dd04dbb4d96286bcc0a6527a21782"
score = 75
@@ -282490,8 +282873,8 @@ rule SIGNATURE_BASE_STUXSHOP_Oscheck
date = "2019-04-09"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stuxshop.yar#L32-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stuxshop.yar#L32-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c1961e54d60e34bbec397c9120564e8d08f2f243ae349d2fb20f736510716579"
logic_hash = "3dca26e622289c2d244e3af035e892455a47daa67dbe0c6fad29d9f7403cbc6b"
score = 75
@@ -282518,8 +282901,8 @@ rule SIGNATURE_BASE_MAL_Cisco_Rayinitiator_Stage_1
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L1-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L1-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e657de97954545f06fc6997a3221eb77037fb89c6c56f08eeb78be615512a3e4"
score = 85
quality = 85
@@ -282546,8 +282929,8 @@ rule SIGNATURE_BASE_MAL_Cisco_Rayinitiator_Stage_2
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L22-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L22-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "27f040bc14caec745f04fa32de08955a09857a801e5f2f04936fffca991c9d19"
score = 85
quality = 85
@@ -282572,8 +282955,8 @@ rule SIGNATURE_BASE_MAL_Cisco_Rayinitiator_Stage_3
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L41-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L41-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "332756bc77cc17c3330ce1ffb0af9d1a7c0f5f9a457f7e9ad7f4081d7aba50c6"
score = 85
quality = 85
@@ -282598,8 +282981,8 @@ rule SIGNATURE_BASE_MAL_Cisco_Rayinitiator_Stage_3_LINE_VIPER_Shellcode
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/RayInitiator-LINE-VIPER/ncsc-mar-rayinitiator-line-viper.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L60-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L60-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e509bde73d8843b188d632fa44bb4d90ff9d1766138c830c2932e503c5a07197"
score = 85
quality = 85
@@ -282624,8 +283007,8 @@ rule SIGNATURE_BASE_MAL_Cisco_LINE_VIPER_Shellcode_Deobfuscation_Routine
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L78-L98"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L78-L98"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9feb3703a99c529b28c12646a0834e77d3377f1fd75ec69c46201cb0d4d22775"
score = 85
quality = 85
@@ -282653,8 +283036,8 @@ rule SIGNATURE_BASE_MAL_Cisco_LINE_VIPER_Shellcode_Initial_Execution
date = "2025-09-25"
modified = "2025-09-27"
reference = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L100-L123"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L100-L123"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "813aa79525bb43f62d98142eced501f793764e90a86c7176a686f9017f32eb4b"
score = 85
quality = 85
@@ -282681,8 +283064,8 @@ rule SIGNATURE_BASE_MAL_Cisco_LINE_VIPER_RSA_Enc_Random_AES_Key_Gen
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L125-L154"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L125-L154"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c382158e21300f49ed3da58e3e02c4578c10fd854c87a18227a01b7d6f7723bc"
score = 85
quality = 85
@@ -282719,8 +283102,8 @@ rule SIGNATURE_BASE_MAL_Cisco_LINE_VIPER_AES_Enc_Tasking_Exfil
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L156-L185"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L156-L185"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b6181701b512709c812f303a33e13115bb52f28be7095c086ef2a3b17f6ef4fd"
score = 85
quality = 85
@@ -282757,8 +283140,8 @@ rule SIGNATURE_BASE_MAL_Cisco_LINE_VIPER_ICMP_Tasking_Shellcode_Payloads
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L187-L217"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L187-L217"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a11d8cebae498340065244ddaf6863925ef8368cea20af1d1f21c46fc51280ee"
score = 85
quality = 85
@@ -282796,8 +283179,8 @@ rule SIGNATURE_BASE_GRIZZLY_STEPPE_Malware_1 : FILE
date = "2016-12-29"
modified = "2023-12-05"
reference = "https://goo.gl/WVflzO"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L10-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L10-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9f918fb741e951a10e68ce6874b839aef5a26d60486db31e509f8dcaa13acec5"
logic_hash = "d4a06fbf875ba2dbe64abcc21fab4eea1fe1b092498a09d9a310214562c1869e"
score = 75
@@ -282825,8 +283208,8 @@ rule SIGNATURE_BASE_GRIZZLY_STEPPE_Malware_2 : FILE
date = "2016-12-29"
modified = "2023-12-05"
reference = "https://goo.gl/WVflzO"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L30-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L30-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9acba7e5f972cdd722541a23ff314ea81ac35d5c0c758eb708fb6e2cc4f598a0"
hash = "55058d3427ce932d8efcbe54dccf97c9a8d1e85c767814e34f4b2b6a6b305641"
logic_hash = "134a76129ef2169ac60f21541ef51a223720badfad02f0822acc7fd6d49cf7e7"
@@ -282855,8 +283238,8 @@ rule SIGNATURE_BASE_PAS_TOOL_PHP_WEB_KIT_Mod : FILE
date = "2016-12-29"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L52-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L52-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fab894d9609c1fca4a85457e6799d082dfd3eb9ca0564abc04a1a0dd07a7b546"
score = 75
quality = 85
@@ -282883,8 +283266,8 @@ rule SIGNATURE_BASE_Webshell_PHP_Web_Kit_V3 : FILE
date = "2016-01-01"
modified = "2023-12-05"
reference = "https://github.com/wordfence/grizzly"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L76-L95"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L76-L95"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "21bf0afcd3f8de813ddfe41ef32e45806e9f9d7d3b08ae7ce65017c35e32a868"
score = 75
quality = 85
@@ -282910,8 +283293,8 @@ rule SIGNATURE_BASE_Webshell_PHP_Web_Kit_V4 : FILE
date = "2016-01-01"
modified = "2023-12-05"
reference = "https://github.com/wordfence/grizzly"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L97-L116"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L97-L116"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e2eaa0abd14f4dd08815c44797df707a08df1ea4e04ae69ba67d128a0fe4eff5"
score = 75
quality = 85
@@ -282936,8 +283319,8 @@ rule SIGNATURE_BASE_APT_APT29_Wellmess_Dotnet_Unique_Strings : FILE
date = "2016-12-30"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L120-L136"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L120-L136"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2285a264ffab59ab5a1eb4e2b9bcab9baf26750b6c551ee3094af56a4442ac41"
logic_hash = "90e8480aa50e18202007bcffdc8348290ad0ac0588c924b4f75ea425a6cae32d"
score = 75
@@ -282964,8 +283347,8 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Key_Schedule : FILE
date = "2016-12-30"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L138-L153"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L138-L153"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
logic_hash = "d4f7ec82e51f1063b4d61302e5ff9268dd3233bb44269fc32cb57fb9240f96e2"
score = 75
@@ -282991,8 +283374,8 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Key_2B62 : FILE
date = "2016-12-30"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L155-L167"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L155-L167"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
logic_hash = "39ad6de70883fbe0377379c3cab15962372793043ebbf4054efb7cee3aff9104"
score = 75
@@ -283014,8 +283397,8 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Directory_Enumeration_Output_Strings : FI
date = "2016-12-30"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L169-L183"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L169-L183"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
logic_hash = "8f029269f5a383737f38af04b05a16a71af5453bffe83e04ac53191eaa49d3e7"
score = 75
@@ -283039,8 +283422,8 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Command_Elem_Cookie_Ga_Boundary_String :
date = "2016-12-30"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L185-L199"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L185-L199"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
logic_hash = "65b31a12d8abb88fbb99fcc6b2707bec90e4edc35d0cf21903213eda5cacec88"
score = 75
@@ -283064,8 +283447,8 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Round_Function : FILE
date = "2016-12-30"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L201-L214"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L201-L214"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
logic_hash = "c4979b7ec31581b43b6975be5d4b1bfa5562e5fe25bbb51bb7c388550ed80ac6"
score = 75
@@ -283088,8 +283471,8 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Add_Random_Commas_Spaces : FILE
date = "2016-12-30"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L216-L229"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L216-L229"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
logic_hash = "046e222aabc9e596d9536702521b4729d990e1f327ded004ca984b73a8511a83"
score = 75
@@ -283112,8 +283495,8 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Modify_Alphabet_Custom_Encode : FILE
date = "2016-12-30"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L231-L243"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L231-L243"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
logic_hash = "f0f5bcad52b0b15dc74a51973ef2752234bd12d677c846b2f96fe569d906ea3b"
score = 75
@@ -283136,8 +283519,8 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Custom_Encode_Decode : FILE
date = "2016-12-30"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L245-L274"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L245-L274"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
logic_hash = "536147bda9603d68748010f9db260af732fe0865a601ae1104538933b19c519b"
score = 75
@@ -283176,8 +283559,8 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Remove_Chars_Comma_Space_Dot : FILE
date = "2016-12-30"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L276-L289"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L276-L289"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
logic_hash = "652607e0cfe6f5ad6ede169e28f63e8262fc37cbc7baa2525e52e79572d9a468"
score = 75
@@ -283201,8 +283584,8 @@ rule SIGNATURE_BASE_APT_APT29_Sorefang_Disk_Enumeration_Strings : FILE
date = "2016-12-30"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_grizzly_steppe.yar#L291-L310"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_grizzly_steppe.yar#L291-L310"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064"
logic_hash = "4a225b767dc922625c333aea866638bc5e239137592e46c17563b9cc380b0eea"
score = 75
@@ -283231,8 +283614,8 @@ rule SIGNATURE_BASE_Ysoserial_Payload_Mozillarhino1 : FILE
date = "2017-02-04"
modified = "2023-12-05"
reference = "https://github.com/frohoff/ysoserial"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_ysoserial_payloads.yar#L10-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_ysoserial_payloads.yar#L10-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0143fee12fea5118be6dcbb862d8ba639790b7505eac00a9f1028481f874baa8"
logic_hash = "ca8cdd2781812ed373ca558b3a5a2fac5d236e16e6dbb8d66caa45081aef968b"
score = 75
@@ -283255,8 +283638,8 @@ rule SIGNATURE_BASE_Ysoserial_Payload_C3P0 : FILE
date = "2017-02-04"
modified = "2023-12-05"
reference = "https://github.com/frohoff/ysoserial"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_ysoserial_payloads.yar#L25-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_ysoserial_payloads.yar#L25-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9932108d65e26d309bf7d97d389bc683e52e91eb68d0b1c8adfe318a4ec6e58b"
logic_hash = "53188caff69e1dbf655f4df7cda1406dd357af14a92ca4e686f514299b0adafc"
score = 75
@@ -283279,8 +283662,8 @@ rule SIGNATURE_BASE_Ysoserial_Payload_Spring1
date = "2017-02-04"
modified = "2023-12-05"
reference = "https://github.com/frohoff/ysoserial"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_ysoserial_payloads.yar#L40-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_ysoserial_payloads.yar#L40-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bf9b5f35bc1556d277853b71da24faf23cf9964d77245018a0fdf3359f3b1703"
hash = "9c0be107d93096066e82a5404eb6829b1daa6aaa1a7b43bcda3ddac567ce715a"
hash = "8cfa85c16d37fb2c38f277f39cafb6f0c0bd7ee62b14d53ad1dd9cb3f4b25dd8"
@@ -283309,8 +283692,8 @@ rule SIGNATURE_BASE_Ysoserial_Payload : FILE
date = "2017-02-04"
modified = "2023-12-05"
reference = "https://github.com/frohoff/ysoserial"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_ysoserial_payloads.yar#L61-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_ysoserial_payloads.yar#L61-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9c0be107d93096066e82a5404eb6829b1daa6aaa1a7b43bcda3ddac567ce715a"
hash = "adf895fa95526c9ce48ec33297156dd69c3dbcdd2432000e61b2dd34ffc167c7"
hash = "1da04d838141c64711d87695a4cdb4eedfd4a206cc80922a41cfc82df8e24187"
@@ -283348,8 +283731,8 @@ rule SIGNATURE_BASE_Ysoserial_Payload_3 : FILE
date = "2017-02-04"
modified = "2023-12-05"
reference = "https://github.com/frohoff/ysoserial"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_ysoserial_payloads.yar#L92-L113"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_ysoserial_payloads.yar#L92-L113"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f0d2f1095da0164c03a0e801bd50f2f06793fb77938e53b14b57fd690d036929"
hash = "5466d47363e11cd1852807b57d26a828728b9d5a0389214181b966bd0d8d7e56"
logic_hash = "49491d1c15af8c271fbbb7dedc678a91df74dcb093abe3f056b1ffc2fced99fe"
@@ -283379,8 +283762,8 @@ rule SIGNATURE_BASE_Slingshot_APT_Spork_Downloader : FILE
date = "2018-03-09"
modified = "2023-12-05"
reference = "https://securelist.com/apt-slingshot/84312/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_slingshot.yar#L11-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_slingshot.yar#L11-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5dac11c595d838cb6b5f1e548307ea79d119c890c54e954453cf1a264e1d14ed"
score = 75
quality = 85
@@ -283403,8 +283786,8 @@ rule SIGNATURE_BASE_Slingshot_APT_Minisling : FILE
date = "2018-03-09"
modified = "2023-12-05"
reference = "https://securelist.com/apt-slingshot/84312/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_slingshot.yar#L26-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_slingshot.yar#L26-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7d370271fea6c607c051eb49681600b4f59878c2fd2d43d71194bddda78d7b09"
score = 75
quality = 85
@@ -283426,8 +283809,8 @@ rule SIGNATURE_BASE_Slingshot_APT_Ring0_Loader : FILE
date = "2018-03-09"
modified = "2023-12-05"
reference = "https://securelist.com/apt-slingshot/84312/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_slingshot.yar#L40-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_slingshot.yar#L40-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c231158e44de01585e9fb4bd9768b388016972e2026e049070cdc6cd35362609"
score = 75
quality = 85
@@ -283456,8 +283839,8 @@ rule SIGNATURE_BASE_Slingshot_APT_Malware_1 : FILE
date = "2018-03-09"
modified = "2023-12-05"
reference = "https://securelist.com/apt-slingshot/84312/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_slingshot.yar#L60-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_slingshot.yar#L60-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4b250304e28648574b441831bf579b844e8e1fda941fb7f86a7ea7c4291bbca6"
logic_hash = "43cf94058fe3833a4623ecb784eea50e199536d4903fb9457843b7b5e9a244e3"
score = 75
@@ -283482,8 +283865,8 @@ rule SIGNATURE_BASE_Slingshot_APT_Malware_2 : FILE
date = "2018-03-09"
modified = "2023-12-05"
reference = "https://securelist.com/apt-slingshot/84312/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_slingshot.yar#L81-L100"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_slingshot.yar#L81-L100"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2a51ef6d115daa648ddd57d1e4480f5a18daf40986bfde32aab19349aa010e67"
logic_hash = "d56dadf747c64cb518ddc9aaee38fd50c67fe7344d7569d9ef3169099e7f36c5"
score = 75
@@ -283512,8 +283895,8 @@ rule SIGNATURE_BASE_Slingshot_APT_Malware_3 : FILE
date = "2018-03-09"
modified = "2023-12-05"
reference = "https://securelist.com/apt-slingshot/84312/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_slingshot.yar#L102-L122"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_slingshot.yar#L102-L122"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fa513c65cded25a7992e2b0ab03c5dd5c6d0fc2282cd64a1e11a387a3341ce18"
logic_hash = "420c54ce90a13258e0dd54524fe7df4dd97d3e8f1eeaa8ca14350670a87e87c6"
score = 75
@@ -283539,8 +283922,8 @@ rule SIGNATURE_BASE_Slingshot_APT_Malware_4 : FILE
date = "2018-03-09"
modified = "2023-12-05"
reference = "https://securelist.com/apt-slingshot/84312/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_slingshot.yar#L124-L144"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_slingshot.yar#L124-L144"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38c4f5320b03cbaf5c14997ea321507730a8c16906e5906cbf458139c91d5945"
logic_hash = "a9f4b7b4079ebd5ffbee4c82032d28b0015968cb369fae2b0f19b054bf5a1c3c"
score = 75
@@ -283567,8 +283950,8 @@ rule SIGNATURE_BASE_Lokibot_Dropper_Scancopypdf_Feb18 : FILE
date = "2018-02-14"
modified = "2023-12-05"
reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_loki_bot.yar#L11-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_loki_bot.yar#L11-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6f8ff26a5daf47effdea5795cdadfff9265c93a0ebca0ce5a4144712f8cab5be"
logic_hash = "b9f10a09d91c10731e34dc88f87104693cdc794ddc3c63ee382f976d0a75f30f"
score = 75
@@ -283595,8 +283978,8 @@ rule SIGNATURE_BASE_Lokibot_Dropper_Packed_R11_Feb18 : FILE
date = "2018-02-14"
modified = "2023-12-05"
reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_loki_bot.yar#L33-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_loki_bot.yar#L33-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029"
logic_hash = "9ca39cac8dcbbbe1697ef96bde60c522bb9cc190c208483220aa96bc672f325a"
score = 75
@@ -283619,8 +284002,8 @@ rule SIGNATURE_BASE_Foudre_Backdoor_1 : FILE
date = "2017-08-01"
modified = "2023-12-05"
reference = "https://goo.gl/Nbqbt6"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_foudre.yar#L13-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_foudre.yar#L13-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7e73a727dc8f3c48e58468c3fd0a193a027d085f25fa274a6e187cf503f01f74"
hash = "7ce2c5111e3560aa6036f98b48ceafe83aa1ac3d3b33392835316c859970f8bc"
logic_hash = "e42959162017ddf6da1d0b2950096e93e0e98c3e5f88ae28fc48e82ef98ca87b"
@@ -283646,8 +284029,8 @@ rule SIGNATURE_BASE_Foudre_Backdoor_Dropper_1 : FILE
date = "2017-08-01"
modified = "2023-01-07"
reference = "https://goo.gl/Nbqbt6"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_foudre.yar#L31-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_foudre.yar#L31-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6bc9f6ac2f6688ed63baa29913eaf8c64738cf19933d974d25a0c26b7d01b9ac"
hash = "da228831089c56743d1fbc8ef156c672017cdf46a322d847a270b9907def53a5"
logic_hash = "77ae856e74ceb04e73c26154d7b4cf98ed0e1d8b9ac6ed78775becbff2473e13"
@@ -283676,8 +284059,8 @@ rule SIGNATURE_BASE_Foudre_Backdoor_Component_1 : FILE
date = "2017-08-01"
modified = "2023-01-07"
reference = "https://goo.gl/Nbqbt6"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_foudre.yar#L53-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_foudre.yar#L53-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7c6206eaf0c5c9c6c8d8586a626b49575942572c51458575e51cba72ba2096a4"
hash = "db605d501d3a5ca2b0e3d8296d552fbbf048ee831be21efca407c45bf794b109"
logic_hash = "2eb267ab93c297101aef0cfcca78d0299ca7baa96b983a5f2ff547394cbac82d"
@@ -283703,8 +284086,8 @@ rule SIGNATURE_BASE_Foudre_Backdoor_SFX : FILE
date = "2017-08-01"
modified = "2023-12-05"
reference = "https://goo.gl/Nbqbt6"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_foudre.yar#L77-L93"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_foudre.yar#L77-L93"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b37ce9e31625d8b9e51b88418d4bf38ed28c77d98ca59a09daab01be36d405a"
hash = "4d51a0ea4ecc62456295873ff135e4d94d5899c4de749621bafcedbf4417c472"
logic_hash = "dd5492f5314cb87fdb7c8b29bdf31e1fcd8541ed47b20f309538437d9c6ac600"
@@ -283730,8 +284113,8 @@ rule SIGNATURE_BASE_MAL_Etoroloro_Malicious_Nodepackage_Dec25 : FILE
date = "2025-12-12"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_etoroloro_nodepackage_dec25.yar#L2-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_etoroloro_nodepackage_dec25.yar#L2-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f08c5b748c91dd45fd73c5e85920f656e361d94b869e2147410b2b528c6ae78f"
logic_hash = "bd890359c38fb7f2af31390666691af70a202dcf352ef44e95493dc340c07e94"
score = 80
@@ -283764,8 +284147,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_DLL_Moveit_Jun23_1 : FILE
date = "2023-06-01"
modified = "2023-12-05"
reference = "https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/?utm_content=251159938&utm_medium=social&utm_source=twitter&hss_channel=tw-403811306"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_moveit_0day_jun23.yar#L2-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_moveit_0day_jun23.yar#L2-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6cbf38f5f27e6a3eaf32e2ac73ed02898cbb5961566bb445e3c511906e2da1fa"
logic_hash = "47c2ec1e833852941434586b61d6f435b9acb32b2ff48e0a9e8006e0f9ff8056"
score = 85
@@ -283790,8 +284173,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Moveit_Jun23_1 : FILE
date = "2023-06-01"
modified = "2023-12-05"
reference = "https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_moveit_0day_jun23.yar#L24-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_moveit_0day_jun23.yar#L24-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5"
hash = "48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a"
hash = "e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e"
@@ -283817,8 +284200,8 @@ rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_1
date = "2023-06-01"
modified = "2023-12-05"
reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_moveit_0day_jun23.yar#L43-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_moveit_0day_jun23.yar#L43-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "26674d8dea5cb2e95e442c4c75d80ca610f7373f0b216c0b1c83a5b1f9f70316"
score = 70
quality = 85
@@ -283840,8 +284223,8 @@ rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_2
date = "2023-06-03"
modified = "2023-12-05"
reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_moveit_0day_jun23.yar#L58-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_moveit_0day_jun23.yar#L58-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "56328d078801a702ad47f01f356df6f00be8da593d03c549e77312af9b47b5be"
score = 70
quality = 85
@@ -283868,8 +284251,8 @@ rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_3
date = "2023-06-13"
modified = "2023-12-05"
reference = "https://attackerkb.com/topics/mXmV0YpC3W/cve-2023-34362/rapid7-analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_moveit_0day_jun23.yar#L81-L94"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_moveit_0day_jun23.yar#L81-L94"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2eaa06c31687c6368f036a705fdc1b1c42355f19c098ae764a998039cc4aebb5"
score = 70
quality = 85
@@ -283891,11 +284274,11 @@ rule SIGNATURE_BASE_LOG_EXPL_Confluence_RCE_CVE_2021_26084_Sep21 : LOG CVE_2021_
date = "2021-09-01"
modified = "2023-12-05"
reference = "https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cve_2021_26084_confluence_log.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cve_2021_26084_confluence_log.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "04542570b4814efde3d96ba5be8b5f9fd6e3c51be09f0e8a1c4eba45bfd8f5ff"
score = 55
- quality = 60
+ quality = 85
tags = "LOG, CVE-2021-26084"
strings:
@@ -283922,8 +284305,8 @@ rule SIGNATURE_BASE_MAL_Neshta_Generic : HIGHVOL FILE
date = "2018-01-15"
modified = "2021-04-14"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_netsha.yar#L3-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_netsha.yar#L3-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "27c67eb1378c2fd054c6649f92ec8ee9bfcb6f790224036c974f6c883c46f586"
hash = "0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e"
hash = "b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb"
@@ -283956,8 +284339,8 @@ rule SIGNATURE_BASE_ATM_Malware_XFSADM_1 : FILE
date = "2019-06-21"
modified = "2023-12-05"
reference = "https://twitter.com/r3c0nst/status/1149043362244308992"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_atm_xfsadm.yar#L1-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_atm_xfsadm.yar#L1-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2740bd2b7aa0eaa8de2135dd710eb669d4c4c91d29eefbf54f1b81165ad2da4d"
logic_hash = "f2c1761407c5e499be43e546badd27428821f828a470fd3e3dcddd08db04aaa5"
score = 75
@@ -283989,8 +284372,8 @@ rule SIGNATURE_BASE_APT_MAL_Fujinama : FILE
date = "2021-01-07"
modified = "2023-12-05"
reference = "https://reaqta.com/2021/01/fujinama-analysis-leonardo-spa"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fujinama_rat.yar#L1-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fujinama_rat.yar#L1-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9bff8ee5424a939b5278b2d1b349d898d138b9efb3cf783221826abb4d8015ef"
score = 75
quality = 51
@@ -284021,8 +284404,8 @@ rule SIGNATURE_BASE_Korplug_FAST : FILE
date = "2015-08-20"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_korplug_fast.yar#L1-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_korplug_fast.yar#L1-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c437465db42268332543fbf6fd6a560ca010f19e0fd56562fb83fb704824b371"
logic_hash = "31aeb634eecc0f93353432b0dde113bfb54810ea74b02f959447a1d42e7e9e1b"
score = 75
@@ -284053,8 +284436,8 @@ rule SIGNATURE_BASE_BKDR_Snarasite_Oct17 : FILE
date = "2017-10-07"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_snarasite.yar#L3-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_snarasite.yar#L3-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "36ba92cba23971ca9d16a0b4f45c853fd5b3108076464d5f2027b0f56054fd62"
logic_hash = "79f49bce6de996d20b64476feb73987fdcd7555963ea1a596648d8702fbd2898"
score = 75
@@ -284075,8 +284458,8 @@ rule SIGNATURE_BASE_SUSP_Xored_Mozilla_Oct19
modified = "2023-11-03"
old_rule_name = "SUSP_XORed_Mozilla"
reference = "https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_xor_hunting.yar#L2-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_xor_hunting.yar#L2-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e1b5c7a0adb4dc65cdf0a653255ac865a0ecebbf1ff08b7fc46d510d5e8aa6c9"
score = 60
quality = 85
@@ -284101,8 +284484,8 @@ rule SIGNATURE_BASE_SUSP_Xored_MSDOS_Stub_Message : FILE
date = "2019-10-28"
modified = "2023-10-11"
reference = "https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_xor_hunting.yar#L27-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_xor_hunting.yar#L27-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b6d7d7242511d2c26122fe2b880cfe39facb5f68ae45e19c1558163f0427c304"
score = 55
quality = 85
@@ -284136,8 +284519,8 @@ rule SIGNATURE_BASE_Rehashed_RAT_1 : FILE
date = "2017-09-08"
modified = "2023-12-05"
reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rehashed_rat.yar#L13-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rehashed_rat.yar#L13-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "37bd97779e854ea2fc43486ddb831a5acfd19cf89f06823c9fd3b20134cb1c35"
logic_hash = "06a98e87d931bdea697a2cf3de604f03654f9aa2b3f2346e78ba92e492c0fc7c"
score = 75
@@ -284168,8 +284551,8 @@ rule SIGNATURE_BASE_Rehashed_RAT_2 : FILE
date = "2017-09-08"
modified = "2023-12-05"
reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rehashed_rat.yar#L41-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rehashed_rat.yar#L41-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "49efab1dedc6fffe5a8f980688a5ebefce1be3d0d180d5dd035f02ce396c9966"
logic_hash = "96c4582981792eb5f8180c06a5fe824fd439cfa0ede294eccff3afa7d318a6e9"
score = 75
@@ -284198,8 +284581,8 @@ rule SIGNATURE_BASE_Rehashed_RAT_3 : FILE
date = "2017-09-08"
modified = "2022-12-21"
reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rehashed_rat.yar#L69-L85"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rehashed_rat.yar#L69-L85"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9cebae97a067cd7c2be50d7fd8afe5e9cf935c11914a1ab5ff59e91c1e7e5fc4"
logic_hash = "46f21f11959f863c85a1cfac74a28ba86d5b9789fea5a428168d157c13cce022"
score = 75
@@ -284224,8 +284607,8 @@ rule SIGNATURE_BASE_EXPL_Zoho_RCE_Fix_Lines_Dec21_1 : FILE
date = "2021-12-06"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1467784104930385923"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_zoho_rcef_logs.yar#L2-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_zoho_rcef_logs.yar#L2-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e6d9c3364da57c03a5e838f485deefabec2f3ec67d19a9017e564ba702a72d03"
score = 65
quality = 85
@@ -284251,8 +284634,8 @@ rule SIGNATURE_BASE_SUSP_Appdomaininjection_Keyword_May26 : FILE
date = "2026-05-27"
modified = "2026-06-01"
reference = "https://attack.mitre.org/techniques/T1574/014/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_generic_rules_may26.yar#L1-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_generic_rules_may26.yar#L1-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eee657ffdb2af8ed6412221e7d5fbf4f5742f2ac2c88f43f12db46af0697de71"
logic_hash = "a2a46b4f868235bf7f90c4e037a735cc670586f1f37aa4fe385ba4ded094848e"
score = 70
@@ -284275,8 +284658,8 @@ rule SIGNATURE_BASE_SUSP_PE_Contains_Encrypted_Executable_May26 : FILE
date = "2026-05-20"
modified = "2026-06-01"
reference = "https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_generic_rules_may26.yar#L22-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_generic_rules_may26.yar#L22-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eee657ffdb2af8ed6412221e7d5fbf4f5742f2ac2c88f43f12db46af0697de71"
logic_hash = "9fa6d5b569e28fa020d757fdbb4ae97a80d1ba54ee6a78d5bacb981adf044e88"
score = 70
@@ -284298,8 +284681,8 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber : FILE
date = "2015-05-05"
modified = "2023-12-05"
reference = "http://blogs.cisco.com/security/talos/rombertik"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_rombertik_carbongrabber.yar#L10-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_rombertik_carbongrabber.yar#L10-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f9b26b90311e62662c5946a1ac600d2996d3758"
hash = "aeb94064af2a6107a14fd32f39cb502e704cd0ab"
hash = "c2005c8d1a79da5e02e6a15d00151018658c264c"
@@ -284330,8 +284713,8 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber_Panel_Installscript : FILE
date = "2015-05-05"
modified = "2023-12-05"
reference = "http://blogs.cisco.com/security/talos/rombertik"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_rombertik_carbongrabber.yar#L33-L53"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_rombertik_carbongrabber.yar#L33-L53"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cd6c152dd1e0689e0bede30a8bd07fef465fbcfa"
logic_hash = "a0edc53aea21bc317f510a4a463ca677d9dc1ec234ca9824bc46711c851f2ccc"
score = 75
@@ -284361,8 +284744,8 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber_Panel : FILE
date = "2015-05-05"
modified = "2023-12-05"
reference = "http://blogs.cisco.com/security/talos/rombertik"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_rombertik_carbongrabber.yar#L55-L73"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_rombertik_carbongrabber.yar#L55-L73"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e6e9e4fc3772ff33bbeeda51f217e9149db60082"
logic_hash = "8b7fde3c3894b7aa83e05f6a1b820195276f8738fde218485c0465afaed88427"
score = 75
@@ -284390,8 +284773,8 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber_Builder : FILE
date = "2015-05-05"
modified = "2023-12-05"
reference = "http://blogs.cisco.com/security/talos/rombertik"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_rombertik_carbongrabber.yar#L75-L92"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_rombertik_carbongrabber.yar#L75-L92"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b50ecc0ba3d6ec19b53efe505d14276e9e71285f"
logic_hash = "e9d13913ee03926920eba33a4dac2a6e9aeaaa54949c5bfea8dd956cf233abae"
score = 75
@@ -284418,8 +284801,8 @@ rule SIGNATURE_BASE_Rombertik_Carbongrabber_Builder_Server : FILE
date = "2015-05-05"
modified = "2023-12-05"
reference = "http://blogs.cisco.com/security/talos/rombertik"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_rombertik_carbongrabber.yar#L94-L117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_rombertik_carbongrabber.yar#L94-L117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "895fab8d55882eac51d4b27a188aa67205ff0ae5"
logic_hash = "693c92128166c72aded066fa66eef906a9f6027c65b889f3a487a38382f29982"
score = 75
@@ -284452,8 +284835,8 @@ rule SIGNATURE_BASE_HKTL_Solarwinds_Credential_Stealer : FILE
date = "2021-01-20"
modified = "2023-12-05"
reference = "https://github.com/mubix/solarflare"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_solarwinds_credential_stealer.yar#L2-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_solarwinds_credential_stealer.yar#L2-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b2e5186464ed0bdd38fcd9f4ab294a7ba28bd829bf296584cbc32e2889037e4"
hash = "4adb69d4222c80d97f8d64e4d48b574908a518f8d504f24ce93a18b90bd506dc"
logic_hash = "ccf55ba7b66ff8d0f926999f3d68dc3b2fdc1c9ce15e1f08b75d003c62393312"
@@ -284487,8 +284870,8 @@ rule SIGNATURE_BASE_APT_APT28_Generic_Poco_Openssl
date = "2020-08-13"
modified = "2026-05-15"
reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt28_drovorub.yar#L1-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt28_drovorub.yar#L1-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b6a78c358b3aee6b172ec29e72ce810c6fbf332f180d5879f0889f47688225e1"
score = 50
quality = 85
@@ -284516,8 +284899,8 @@ rule SIGNATURE_BASE_APT_APT28_Drovorub_Library_And_Unique_Strings : FILE
date = "2020-08-13"
modified = "2026-05-15"
reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt28_drovorub.yar#L24-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt28_drovorub.yar#L24-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "adb0d4cb6d589213e6a125d3cc20fcea8164b697bdd24d897ce75e7c7f06120a"
score = 75
quality = 85
@@ -284544,8 +284927,8 @@ rule SIGNATURE_BASE_APT_APT28_Drovorub_Unique_Network_Comms_Strings
date = "2020-08-13"
modified = "2026-05-15"
reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt28_drovorub.yar#L45-L73"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt28_drovorub.yar#L45-L73"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8c82766b76c36fe64c6aa99577e1997d7181dbd36a4c27329845ae8a413f5327"
score = 75
quality = 85
@@ -284582,8 +284965,8 @@ rule SIGNATURE_BASE_MAL_OSX_Fancybear_Agent_Jul18_1 : FILE
date = "2018-07-15"
modified = "2023-12-05"
reference = "https://twitter.com/DrunkBinary/status/1018448895054098432"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fancybear_osxagent.yar#L1-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fancybear_osxagent.yar#L1-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d3be93f6ce59b522ff951cef9d59ef347081ffe33d4203cd5b5df0aaa9721aa2"
logic_hash = "099235424f22f3591a891726ea0c13ebf831fae0456ab1b6baba329c090a9535"
score = 75
@@ -284612,8 +284995,8 @@ rule SIGNATURE_BASE_SUSP_Macos_Plist_Suspicious : FILE
modified = "2025-06-03"
old_rule_name = "gen_malware_MacOS_plist_suspicious"
reference = "https://objective-see.com/blog/blog_0x3A.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_malware_MacOS_plist_suspicious.yar#L1-L73"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_malware_MacOS_plist_suspicious.yar#L1-L73"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0541fc6a11f4226d52ae3d4158deb8f50ed61b25bb5f889d446102e1ee57b76d"
hash = "6cc6abec7d203f99c43ce16630edc39451428d280b02739757f17fd01fc7dca3"
hash = "76eb97aba93979be06dbf0a872518f9514d0bb20b680c887d6fd5cc79dce3681"
@@ -284625,7 +285008,7 @@ rule SIGNATURE_BASE_SUSP_Macos_Plist_Suspicious : FILE
hash = "cdb2fb9c8e84f0140824403ec32a2431fb357cd0f184c1790152834cc3ad3c1b"
logic_hash = "52076ec107b5bcbbe35265dfc4034a6a25a453459d22392848980b22115f68bc"
score = 60
- quality = 58
+ quality = 83
tags = "FILE"
strings:
@@ -284672,8 +285055,8 @@ rule SIGNATURE_BASE_Duqu1_5_Modules
date = "2019-04-09"
modified = "2023-12-05"
reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_duqu1_5_modules.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_duqu1_5_modules.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bb3961e2b473c22c3d5939adeb86819eb846ccd07f5736abb5e897918580aace"
logic_hash = "795107e227cfb73f6ea09fcdb078f8b57a30d47a2cb702b2d47cc936dea5ae9f"
score = 75
@@ -284699,8 +285082,8 @@ rule SIGNATURE_BASE_PUP_Computraceagent : FILE
date = "2018-05-01"
modified = "2023-12-05"
reference = "https://asert.arbornetworks.com/lojack-becomes-a-double-agent/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fancybear_computrace_agent.yar#L1-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fancybear_computrace_agent.yar#L1-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "65e964e68be1e286ab3aa39677e250cf5994a7a08d0f6db286c0260cf77d6c48"
score = 75
quality = 85
@@ -284723,8 +285106,8 @@ rule SIGNATURE_BASE_Irongate_APT_Step7Prosim_Gen : FILE
date = "2016-06-04"
modified = "2023-12-05"
reference = "https://goo.gl/Mr6M2J"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irongate.yar#L10-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irongate.yar#L10-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0539af1a0cc7f231af8f135920a990321529479f6534c3b64e571d490e1514c3"
hash = "fa8400422f3161206814590768fc1a27cf6420fc5d322d52e82899ac9f49e14f"
hash = "5ab1672b15de9bda84298e0bb226265af09b70a9f0b26d6dfb7bdd6cbaed192d"
@@ -284761,8 +285144,8 @@ rule SIGNATURE_BASE_Irongate_Pyinstaller_Update_EXE : FILE
date = "2016-06-04"
modified = "2023-01-06"
reference = "https://goo.gl/Mr6M2J"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irongate.yar#L42-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irongate.yar#L42-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2044712ceb99972d025716f0f16aa039550e22a63000d2885f7b7cd50f6834e0"
logic_hash = "b55e02af900b3510743502bd72d5e14c9235985b5a7b05def0f5c462b28f2216"
score = 60
@@ -284790,8 +285173,8 @@ rule SIGNATURE_BASE_Nirsoft_Netresview : FILE
date = "2016-06-04"
modified = "2023-12-05"
reference = "https://goo.gl/Mr6M2J"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irongate.yar#L67-L82"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irongate.yar#L67-L82"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "83f0352c14fa62ae159ab532d85a2b481900fed50d32cc757aa3f4ccf6a13bee"
logic_hash = "56c3c7a98bcefa609ee604ea0d7d3f4dd237d91a9439eeed66e0d6f3a20dfdd0"
score = 40
@@ -284815,8 +285198,8 @@ rule SIGNATURE_BASE_SUSP_RDP_File_Indicators_Oct24_1 : FILE
date = "2024-10-25"
modified = "2024-12-12"
reference = "https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nobellium_rdp_phish.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nobellium_rdp_phish.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0"
hash = "8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5"
hash = "9b8cb8b01ce4eafb9204250a3c28bfaf70cc76a99ce411ad52bbf1aa2b6cce34"
@@ -284846,8 +285229,8 @@ rule SIGNATURE_BASE_MAL_WIN_Megazord_Apr25 : FILE
date = "2025-04-11"
modified = "2026-05-15"
reference = "https://ish.com.br/wp-content/uploads/2025/04/A-Anatomia-do-Ransomware-Akira-e-sua-expansao-multiplataforma.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_win_megazord_apr25.yar#L1-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_win_megazord_apr25.yar#L1-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fd380db23531bb7bb610a7b32fc2a6d5"
logic_hash = "1a73e67b9a43c4f1bbe9f3dbebeb428bbfa705f7c858909a7bbf0673951d677e"
score = 80
@@ -284880,8 +285263,8 @@ rule SIGNATURE_BASE_APT_Apt_Duqu2_Loaders : FILE
date = "2015-06-09"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_kaspersky_duqu2.yar#L10-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_kaspersky_duqu2.yar#L10-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "79f205745e61b55c43c239d9da9086fd72312ea2741351183d32f7c227174ff8"
score = 75
quality = 83
@@ -284918,8 +285301,8 @@ rule SIGNATURE_BASE_APT_Apt_Duqu2_Drivers : FILE
date = "2015-06-09"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_kaspersky_duqu2.yar#L40-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_kaspersky_duqu2.yar#L40-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "023a51408f86814a8f810d0f89b185aca07dd60a1abb6de47f86ad8eeda4c4c4"
score = 75
quality = 85
@@ -284947,8 +285330,8 @@ rule SIGNATURE_BASE_Duqu2_Generic1 : FILE
date = "2015-06-10"
modified = "2023-12-05"
reference = "https://goo.gl/7yKyOj"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_kaspersky_duqu2.yar#L61-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_kaspersky_duqu2.yar#L61-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3f9168facb13429105a749d35569d1e91465d313"
hash = "0a574234615fb2382d85cd6d1a250d6c437afecc"
hash = "38447ed1d5e3454fe17699f86c0039f30cc64cde"
@@ -284987,8 +285370,8 @@ rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Procexp : FILE
date = "2015-06-10"
modified = "2023-12-05"
reference = "https://goo.gl/7yKyOj"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_kaspersky_duqu2.yar#L92-L114"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_kaspersky_duqu2.yar#L92-L114"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2422835716066b6bcecb045ddd4f1fbc9486667a"
hash = "b120620b5d82b05fee2c2153ceaf305807fa9f79"
hash = "288ebfe21a71f83b5575dfcc92242579fb13910d"
@@ -285019,8 +285402,8 @@ rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Samsungprint : FILE
date = "2015-06-10"
modified = "2023-12-05"
reference = "https://goo.gl/7yKyOj"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_kaspersky_duqu2.yar#L116-L134"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_kaspersky_duqu2.yar#L116-L134"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ce39f41eb4506805efca7993d3b0b506ab6776ca"
logic_hash = "9b2d80cfe3c47ac315b76c773acc3290668e06e4bbd99402e203b72af593fab8"
score = 75
@@ -285048,8 +285431,8 @@ rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Msi3_32 : FILE
date = "2015-06-10"
modified = "2023-12-05"
reference = "https://goo.gl/7yKyOj"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_kaspersky_duqu2.yar#L136-L157"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_kaspersky_duqu2.yar#L136-L157"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "53d9ef9e0267f10cc10f78331a9e491b3211046b"
logic_hash = "718223d1ff82ffa0f3204e0cdaf0d441ed133f1f069d9ba2eb818bd3445f63ca"
score = 75
@@ -285080,8 +285463,8 @@ rule SIGNATURE_BASE_Winnti_Signing_Cert : FILE
date = "2015-10-10"
modified = "2025-08-11"
reference = "https://securelist.com/analysis/publications/72275/i-am-hdroot-part-1/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L9-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L9-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a9a8dc4ae77b1282f0c8bdebd2643458fc1ceb3145db4e30120dd81676ff9b61"
hash = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
logic_hash = "6fd5f2808e7d683b9c4b7f5d4ccfd0eb87037eb2e70700b2c083db8c6ddf4a26"
@@ -285107,8 +285490,8 @@ rule SIGNATURE_BASE_Winnti_Malware_Nsiproxy : FILE
date = "2015-10-10"
modified = "2025-08-11"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L28-L54"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L28-L54"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
hash = "cf1e006694b33f27d7c748bab35d0b0031a22d193622d47409b6725b395bffb0"
hash = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
@@ -285142,8 +285525,8 @@ rule SIGNATURE_BASE_Winnti_Malware_Updatedll : FILE
date = "2015-10-10"
modified = "2025-08-11"
reference = "VTI research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L56-L89"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L56-L89"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
hash = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
hash = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
@@ -285181,8 +285564,8 @@ rule SIGNATURE_BASE_Winnti_Malware_FWPK : FILE
date = "2015-10-10"
modified = "2023-01-06"
reference = "VTI research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L90-L117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L90-L117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1098518786c84b0d31f215122275582bdcd1666653ebc25d50a142b4f5dabf2c"
hash = "9a684ffad0e1c6a22db1bef2399f839d8eff53d7024fb014b9a5f714d11febd7"
hash = "a836397817071c35e24e94b2be3c2fa4ffa2eb1675d3db3b4456122ff4a71368"
@@ -285217,8 +285600,8 @@ rule SIGNATURE_BASE_Winnti_Malware_Streamportal_Gen : FILE
date = "2015-10-10"
modified = "2025-08-11"
reference = "VTI research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L119-L141"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L119-L141"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
hash = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
hash = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
@@ -285250,8 +285633,8 @@ rule SIGNATURE_BASE_WINNTI_Kingsoft_Moz_Confustion : FILE
date = "2018-04-13"
modified = "2025-08-11"
reference = "https://www.virustotal.com/en/file/070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496/analysis/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L143-L159"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L143-L159"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496"
logic_hash = "ebd8465f484e1142ac741263282ea1c6f98e6bd0637ebdcec6ecc6233193407e"
score = 75
@@ -285270,8 +285653,8 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_1 : FILE
date = "2019-12-06"
modified = "2025-06-03"
reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L160-L181"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L160-L181"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2ffeb40b096e5112adbb9c07b27b954424d6ef11a0a9bd736b43df9aa1e9af3e"
score = 75
quality = 85
@@ -285297,8 +285680,8 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_2
date = "2019-12-06"
modified = "2025-08-11"
reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L183-L206"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L183-L206"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "216557999b7100f26556f9f7088b16ba125ac39b308cb77c997d620ce9591d24"
score = 75
quality = 85
@@ -285330,8 +285713,8 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_3
date = "2019-12-06"
modified = "2025-08-11"
reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L208-L224"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L208-L224"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "601f8a3cba57fea46c16c36f8276631fcd22feef4ea1388a1ea35b00929b9fbb"
score = 75
quality = 85
@@ -285356,8 +285739,8 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_4
date = "2019-12-06"
modified = "2025-08-11"
reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L226-L240"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L226-L240"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "32909e915a6e602ad1e8698cf5c128c2e54670770b97f54b1414c5798c42cc00"
score = 75
quality = 85
@@ -285380,8 +285763,8 @@ rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_5
date = "2019-12-06"
modified = "2025-08-11"
reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L242-L269"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L242-L269"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "977d11fbb7cf4678d4da179c43d5566520ee97ac528e269a9b985e5bc75641b7"
score = 75
quality = 85
@@ -285417,8 +285800,8 @@ rule SIGNATURE_BASE_APT_CN_Group_Loader_Jan20_1
date = "2020-02-01"
modified = "2025-08-11"
reference = "https://twitter.com/VK_Intel/status/1223411369367785472?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L271-L283"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L271-L283"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "30a180ada2390ca8df4bf7883624a5a176249622b4c34ce96931fe62b09ea8e3"
score = 80
quality = 85
@@ -285439,8 +285822,8 @@ rule SIGNATURE_BASE_Winnti_Dropper_X64_Libtomcrypt_Fns : TAU CN APT
date = "2019-08-26"
modified = "2025-08-11"
reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L285-L332"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L285-L332"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "794e127d627b3af9015396810a35af1c"
logic_hash = "39d23f2a12a3b78182e52847e2fdb2d09386765138c37eb7f75edfc680505531"
score = 75
@@ -285493,8 +285876,8 @@ rule SIGNATURE_BASE_Winnti_Dropper_X86_Libtomcrypt_Fns : TAU CN APT
date = "2019-08-26"
modified = "2025-08-11"
reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti.yar#L334-L375"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti.yar#L334-L375"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "da3b64ec6468a4ec56f977afb89661b1"
logic_hash = "84bfe001758677ff3a0d60d98e29c33ad1525a0afb27b73df750b2131e298879"
score = 75
@@ -285542,8 +285925,8 @@ rule SIGNATURE_BASE_Gen_Excel_Xll_Addin_Suspicious : FILE
date = "2020-10-16"
modified = "2023-12-05"
reference = "https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_excel_xll_addin_suspicious.yar#L3-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_excel_xll_addin_suspicious.yar#L3-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0bad4e4bc5093dcfc2737c4d8be89d6f093509a7b91a1e022050cb890d90e4e0"
hash = "133e47eedfede46d1a4529ce7f047e09521ed8c7cad2e49d3522064695bd6c43"
hash = "1994a39d5639b4eea5c3cdf084a8eacf8610a96702e580d88a6ec18887d0ec6b"
@@ -285580,8 +285963,8 @@ rule SIGNATURE_BASE_TA17_318B_Volgmer : FILE
date = "2017-11-15"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_318B.yar#L9-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_318B.yar#L9-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2b3a7e501214767b7d79b33fb560b5611fa3726036a0c98d6f1904a55f306e40"
score = 75
quality = 85
@@ -285603,8 +285986,8 @@ rule SIGNATURE_BASE_Volgmer_Malware : FILE
date = "2017-11-15"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_318B.yar#L34-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_318B.yar#L34-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ff2eb800ff16745fc13c216ff6d5cc2de99466244393f67ab6ea6f8189ae01dd"
hash = "8fcd303e22b84d7d61768d4efa5308577a09cc45697f7f54be4e528bbb39435b"
hash = "eff3e37d0406c818e3430068d90e7ed2f594faa6bb146ab0a1c00a2f4a4809a5"
@@ -285645,8 +286028,8 @@ rule SIGNATURE_BASE_Waterbear_1_Jun17 : FILE
date = "2017-06-23"
modified = "2023-12-05"
reference = "https://goo.gl/L9g9eR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbear.yar#L11-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbear.yar#L11-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dd3676f478ee6f814077a12302d38426760b0701bb629f413f7bf2ec71319db5"
logic_hash = "f1d5bd0c9f85dd90217bdbd7e44100bcfbf77839f83416ad17121713c189b9fd"
score = 75
@@ -285670,8 +286053,8 @@ rule SIGNATURE_BASE_Waterbear_2_Jun17 : FILE
date = "2017-06-23"
modified = "2023-12-05"
reference = "https://goo.gl/L9g9eR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbear.yar#L27-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbear.yar#L27-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dcb5c350af76c590002a8ea00b01d862b4d89cccbec3908bfe92fdf25eaa6ea4"
logic_hash = "ec0b8d7313f925adafb7f03c8b7fd12c0176b75c74c642eeee900e911e0662a7"
score = 75
@@ -285697,8 +286080,8 @@ rule SIGNATURE_BASE_Waterbear_4_Jun17 : FILE
date = "2017-06-23"
modified = "2023-12-05"
reference = "https://goo.gl/L9g9eR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbear.yar#L45-L68"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbear.yar#L45-L68"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2e9cb7cadb3478edc9ef714ca4ddebb45e99d35386480e12792950f8a7a766e1"
logic_hash = "46c43dbdcbc183995a8cd00c9888afcdd3adb9f3caf38ed42a0af1e7df39715f"
score = 75
@@ -285730,8 +286113,8 @@ rule SIGNATURE_BASE_Waterbear_5_Jun17 : FILE
date = "2017-06-23"
modified = "2023-01-07"
reference = "https://goo.gl/L9g9eR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbear.yar#L70-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbear.yar#L70-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d3678cd9744b3aedeba23a03a178be5b82d5f8059a86f816007789a9dd06dc7d"
logic_hash = "a1572db08242fffadedbfb89f3652b2eb93c910f3b61f9db0622bc18d069827c"
score = 75
@@ -285759,8 +286142,8 @@ rule SIGNATURE_BASE_Waterbear_6_Jun17 : FILE
date = "2017-06-23"
modified = "2023-12-05"
reference = "https://goo.gl/L9g9eR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbear.yar#L92-L106"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbear.yar#L92-L106"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "409cd490feb40d08eb33808b78d52c00e1722eee163b60635df6c6fe2c43c230"
logic_hash = "af5c2a29e0a62c54e706492ae85b9786a6d9e5f42fe4d9c43693576e1a63b825"
score = 75
@@ -285784,8 +286167,8 @@ rule SIGNATURE_BASE_Waterbear_7_Jun17 : FILE
date = "2017-06-23"
modified = "2023-12-05"
reference = "https://goo.gl/L9g9eR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbear.yar#L108-L125"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbear.yar#L108-L125"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6891aa78524e442f4dda66dff51db9798e1f92e6fefcdf21eb870b05b0293134"
logic_hash = "6a760abca78e799b194864ad56457ccb0b05123307da6bfcad0c66da47f485a1"
score = 75
@@ -285812,8 +286195,8 @@ rule SIGNATURE_BASE_Waterbear_8_Jun17 : FILE
date = "2017-06-23"
modified = "2023-01-07"
reference = "https://goo.gl/L9g9eR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbear.yar#L127-L145"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbear.yar#L127-L145"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bd06f6117a0abf1442826179f6f5e1932047b4a6c14add9149e8288ab4a902c3"
hash = "5dba8ddf05cb204ef320a72a0c031e55285202570d7883f2ff65135ec35b3dd0"
logic_hash = "3b1dfe486ea141342f253963ce6cc1e73d063ce880cf2fcee1aaa6aa6e919349"
@@ -285840,8 +286223,8 @@ rule SIGNATURE_BASE_Waterbear_9_Jun17 : FILE
date = "2017-06-23"
modified = "2023-12-05"
reference = "https://goo.gl/L9g9eR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbear.yar#L147-L166"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbear.yar#L147-L166"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fc74d2434d48b316c9368d3f90fea19d76a20c09847421d1469268a32f59664c"
logic_hash = "b54f3032b31c5a48e879e49bd97adf3222db46a7789afc4ea2f5eca32536a2e4"
score = 75
@@ -285868,8 +286251,8 @@ rule SIGNATURE_BASE_Waterbear_10_Jun17 : FILE
date = "2017-06-23"
modified = "2023-12-05"
reference = "https://goo.gl/L9g9eR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbear.yar#L168-L182"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbear.yar#L168-L182"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3b1e67e0e86d912d7bc6dee5b0f801260350e8ce831c93c3e9cfe5a39e766f41"
logic_hash = "1e71a317f782b73c876f0cb5fee25b69d8f1c45c20c58e4f204b7aeb7484cf14"
score = 75
@@ -285893,8 +286276,8 @@ rule SIGNATURE_BASE_Waterbear_11_Jun17 : FILE
date = "2017-06-23"
modified = "2023-12-05"
reference = "https://goo.gl/L9g9eR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbear.yar#L185-L201"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbear.yar#L185-L201"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b046b2e2569636c2fc3683a0da8cfad25ff47bc304145be0f282a969c7397ae8"
logic_hash = "ea61c348847614ad2872bfd385f433c5a30c7f6b5f5a2f135a7d83c553157ccd"
score = 75
@@ -285920,8 +286303,8 @@ rule SIGNATURE_BASE_Waterbear_12_Jun17 : FILE
date = "2017-06-23"
modified = "2023-12-05"
reference = "https://goo.gl/L9g9eR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbear.yar#L203-L217"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbear.yar#L203-L217"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "15d9db2c90f56cd02be38e7088db8ec00fc603508ec888b4b85d60d970966585"
logic_hash = "343e6f36190372cd5599a84834edc3935d27a1e01aeab53c5765598b5b4071fe"
score = 75
@@ -285945,8 +286328,8 @@ rule SIGNATURE_BASE_Waterbear_13_Jun17 : FILE
date = "2017-06-23"
modified = "2023-12-05"
reference = "https://goo.gl/L9g9eR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbear.yar#L219-L243"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbear.yar#L219-L243"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "734e5972ab5ac1e9bc5470c666a55e0d2bd57c4e2ea2da11dc9bf56fb2ea6f23"
hash = "8bde3f71575aa0d5f5a095d9d0ea10eceadba38be888e10d3ca3776f7b361fe7"
hash = "c4b3b0a7378bfc3824d4178fd7fb29475c42ab874d69abdfb4898d0bcd4f8ce1"
@@ -285980,8 +286363,8 @@ rule SIGNATURE_BASE_Waterbear_14_Jun17 : FILE
date = "2017-06-23"
modified = "2023-12-05"
reference = "https://goo.gl/L9g9eR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbear.yar#L245-L261"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbear.yar#L245-L261"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "00a1068645dbe982a9aa95e7b8202a588989cd37de2fa1b344abbc0102c27d05"
hash = "53330a80b3c4f74f3f10a8621dbef4cd2427723e8b98c5b7aed58229d0c292ba"
hash = "bdcb23a82ac4eb1bc9254d77d92b6f294d45501aaea678a3d21c8b188e31e68b"
@@ -286007,8 +286390,8 @@ rule SIGNATURE_BASE_Line_Dancer
date = "2024-04-24"
modified = "2024-04-29"
reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-dancer.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cisco_asa_line_dancer_apr24.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_line_dancer_apr24.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "179e58274a792bc4a16787d251f5ad25de1271084323e62e153fa6d461e3c07e"
score = 75
quality = 85
@@ -286031,8 +286414,8 @@ rule SIGNATURE_BASE_EXPL_LNX_Copy_Fail_Artefacts_CVE_2026_31431_Apr26 : CVE_2026
date = "2026-04-30"
modified = "2026-05-15"
reference = "https://github.com/iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_copy_fail_cve_2026_31431.yar#L1-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_copy_fail_cve_2026_31431.yar#L1-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cb392f5bd4d3c1cc1a841e3912d2d58047bcef601fa090581824259b11b59add"
score = 75
quality = 83
@@ -286078,8 +286461,8 @@ rule SIGNATURE_BASE_PUA_Anydesk_Compromised_Certificate_Revoked_Jan24 : FILE
date = "2024-02-05"
modified = "2024-04-24"
reference = "https://anydesk.com/en/public-statement"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_anydesk_compromised_cert_feb23.yar#L3-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_anydesk_compromised_cert_feb23.yar#L3-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a1f148dbf15579bd6a65e7c93fa64f00ea481d6b314a444fa924a4604adb9a6d"
score = 50
quality = 85
@@ -286098,8 +286481,8 @@ rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_1 : FILE
date = "2024-02-02"
modified = "2024-04-24"
reference = "https://anydesk.com/en/public-statement"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_anydesk_compromised_cert_feb23.yar#L19-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_anydesk_compromised_cert_feb23.yar#L19-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1b2268b1efa09ee8578f4c1ae07617ac6bebeacd3ed50598a2fc2ec4d709baa7"
score = 75
quality = 85
@@ -286120,8 +286503,8 @@ rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_2 : FILE
date = "2024-02-02"
modified = "2024-04-24"
reference = "https://anydesk.com/en/public-statement"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_anydesk_compromised_cert_feb23.yar#L38-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_anydesk_compromised_cert_feb23.yar#L38-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "86f708233d5a6a46d367430dcc65b128e8dc7ec24eda774ff3860101cc16c9fc"
score = 65
quality = 85
@@ -286145,8 +286528,8 @@ rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_3 : FILE
date = "2024-02-02"
modified = "2024-04-24"
reference = "https://anydesk.com/en/public-statement"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_anydesk_compromised_cert_feb23.yar#L58-L77"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_anydesk_compromised_cert_feb23.yar#L58-L77"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fdd1068abfba52c9a40fd2b6628a5c67775eb31815e6d53bfc4655080d9b240e"
score = 75
quality = 85
@@ -286164,8 +286547,8 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Powerup : FILE
date = "2016-09-04"
modified = "2023-12-05"
reference = "https://github.com/vysec/ps1-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_toolkit.yar#L10-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_toolkit.yar#L10-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
logic_hash = "64562c623de89df59d15db48990c25886c67b79ac9341cf8f21ef372057ccd85"
score = 80
@@ -286195,8 +286578,8 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce : FILE
date = "2016-09-04"
modified = "2023-12-05"
reference = "https://github.com/vysec/ps1-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_toolkit.yar#L33-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_toolkit.yar#L33-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
logic_hash = "b23b6ad66e054e435415464262004ead6e7ee121185d76c02110506293b3867b"
score = 80
@@ -286221,8 +286604,8 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Shellcode : FILE
date = "2016-09-04"
modified = "2023-12-05"
reference = "https://github.com/vysec/ps1-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_toolkit.yar#L51-L69"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_toolkit.yar#L51-L69"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "24abe9f3f366a3d269f8681be80c99504dea51e50318d83ee42f9a4c7435999a"
logic_hash = "03e9a8c5e45781d73fd13c331d82802a18e4255b506e896019d6f08c5a67dedf"
score = 80
@@ -286249,8 +286632,8 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Mimikatz : FILE
date = "2016-09-04"
modified = "2023-12-05"
reference = "https://github.com/vysec/ps1-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_toolkit.yar#L71-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_toolkit.yar#L71-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
logic_hash = "0bca6245befb5183f6a45406823c45267b0a31fb0d4505606b98025f6494f2cc"
score = 80
@@ -286278,8 +286661,8 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Relfectivepeinjection : FILE
date = "2016-09-04"
modified = "2023-12-05"
reference = "https://github.com/vysec/ps1-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_toolkit.yar#L92-L111"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_toolkit.yar#L92-L111"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
logic_hash = "910b8b1dbc7306369f90eae0dfd5949347b2c41fa0eb5f590aed8e90e8db199a"
score = 80
@@ -286307,8 +286690,8 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Persistence : FILE
date = "2016-09-04"
modified = "2023-12-05"
reference = "https://github.com/vysec/ps1-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_toolkit.yar#L113-L134"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_toolkit.yar#L113-L134"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
logic_hash = "bfe6b20fb712fcf7b45d0ef80075bc9a254867d2251109f377a378f887b38494"
score = 80
@@ -286338,8 +286721,8 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Mimikatz_Relfectivepeinjection : FILE
date = "2016-09-04"
modified = "2023-12-05"
reference = "https://github.com/vysec/ps1-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_toolkit.yar#L136-L162"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_toolkit.yar#L136-L162"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
hash = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
logic_hash = "220597cb76c189adc33a9ac740c8164b52743f61523898aefb7a74206b23b76b"
@@ -286374,8 +286757,8 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce_2 : FILE
date = "2016-09-04"
modified = "2023-12-05"
reference = "https://github.com/vysec/ps1-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_toolkit.yar#L164-L181"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_toolkit.yar#L164-L181"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
logic_hash = "5c035898a9574e2516cbc66efcf57f7380fd979c4a5099f8a0a190ad21af32c0"
score = 80
@@ -286401,8 +286784,8 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Powerup_2 : FILE
date = "2016-09-04"
modified = "2023-12-05"
reference = "https://github.com/vysec/ps1-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_toolkit.yar#L183-L202"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_toolkit.yar#L183-L202"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
logic_hash = "8cbd86f103d8b49e72787cbb85fc97e6a02d5332039ce29359cb673c273760b7"
score = 80
@@ -286430,8 +286813,8 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Persistence_2 : FILE
date = "2016-09-04"
modified = "2023-12-05"
reference = "https://github.com/vysec/ps1-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_toolkit.yar#L204-L226"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_toolkit.yar#L204-L226"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
logic_hash = "47d1c3593edeba02e1c08cc53b4ba3d375b73dd04816b84e807e28be2bcf917e"
score = 80
@@ -286462,8 +286845,8 @@ rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce_3 : FILE
date = "2016-09-04"
modified = "2023-12-05"
reference = "https://github.com/vysec/ps1-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_toolkit.yar#L228-L248"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_toolkit.yar#L228-L248"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
logic_hash = "09afe669e90bd73318a9f9f68fda362451f6611f8585de67176c5dc43f05f937"
score = 80
@@ -286492,8 +286875,8 @@ rule SIGNATURE_BASE_Hermes2_1 : FILE
date = "2017-10-11"
modified = "2023-12-05"
reference = "https://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_hermes_ransom.yar#L1-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_hermes_ransom.yar#L1-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b27881f59c8d8cc529fa80a58709db36"
logic_hash = "85a7b3ec89f2bf32e5520a7c5c84661383be71abd8dae3d072d75d5b1118db24"
score = 75
@@ -286526,8 +286909,8 @@ rule SIGNATURE_BASE_APT_Crywiper_Dec22
date = "2022-12-05"
modified = "2023-12-05"
reference = "https://securelist-ru.translate.goog/novyj-troyanec-crywiper/106114/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ru_crywiper.yar#L2-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ru_crywiper.yar#L2-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7c22e02ed996cd820ed87a0c5d50e3264629cdd887aad4ea466cadeccaee2b2f"
score = 75
quality = 85
@@ -286551,8 +286934,8 @@ rule SIGNATURE_BASE_Bluenoroffpos_DLL
date = "2018-06-07"
modified = "2023-12-05"
reference = "http://blog.trex.re.kr/3?category=737685"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_bluenoroff_pos.yar#L2-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_bluenoroff_pos.yar#L2-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "39f23045b3e5ef60c199091b7f01ac2a3a31bcb95219aebb9a4cfd0764886f19"
score = 75
quality = 73
@@ -286580,8 +286963,8 @@ rule SIGNATURE_BASE_PHISH_02Dez2015_Dropped_P0O6543F_1 : FILE
date = "2015-12-02"
modified = "2023-12-05"
reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_phish_gina_dec15.yar#L8-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_phish_gina_dec15.yar#L8-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "db788d6d3a8ed1a6dc9626852587f475e7671e12fa9c9faa73b7277886f1e210"
logic_hash = "91fc1b4682c1490b916b11685e1ecc74a964d657e544c0b84e8301b299154d02"
score = 75
@@ -286612,8 +286995,8 @@ rule SIGNATURE_BASE_PHISH_02Dez2015_Dropped_P0O6543F_2 : FILE
date = "2015-12-03"
modified = "2023-12-05"
reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_phish_gina_dec15.yar#L31-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_phish_gina_dec15.yar#L31-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d6b21ded749b57042eede07c3af1956a3c9f1faddd22d2f78e43003a11ae496f"
hash = "561b16643992b92d37cf380bc2ed7cd106e4dcaf25ca45b4ba876ce59533fb02"
logic_hash = "f5eb21d0f635171e1edcfecc909bc3508dfb6c32e7fdd7263edd5cd98e6ba411"
@@ -286639,8 +287022,8 @@ rule SIGNATURE_BASE_PHISH_02Dez2015_Attach_P_ORD_C_10156_124658 : FILE
date = "2015-12-02"
modified = "2023-12-05"
reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_phish_gina_dec15.yar#L49-L73"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_phish_gina_dec15.yar#L49-L73"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
hash = "e6c5b55586e9d99551adc27a0fc9c080cea6201fae60104b82d5a2ec518fafb6"
hash = "80f278b7268ea6814f8b336e07c5f4b03289519e199fbe4cbd9ef6a38cf25df6"
@@ -286675,8 +287058,8 @@ rule SIGNATURE_BASE_WEBSHELL_Z_Webshell_2 : FILE
modified = "2023-12-05"
old_rule_name = "z_webshell"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta18_074A.yar#L9-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta18_074A.yar#L9-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2c9095c965a55efc46e16b86f9b7d6c6"
logic_hash = "d41aa107e54af5d45531a46d24b24f9f14635dbcb50ed26f7c787883854f961f"
score = 75
@@ -286699,8 +287082,8 @@ rule SIGNATURE_BASE_TA18_074A_Screen : FILE
date = "2018-03-16"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta18_074A.yar#L34-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta18_074A.yar#L34-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
logic_hash = "e96f70e3d9c7ff5812724111788365c47e2b478a35b39771c12a3d3636a6a020"
score = 75
@@ -286727,8 +287110,8 @@ rule SIGNATURE_BASE_TA18_074A_Scripts : FILE
date = "2018-03-16"
modified = "2022-08-18"
reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta18_074A.yar#L53-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta18_074A.yar#L53-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
logic_hash = "888ddd59b388033604474fc008f830159a9a104683fb052e7497b83118cbb8aa"
score = 75
@@ -286751,8 +287134,8 @@ rule SIGNATURE_BASE_CN_Honker_MAC_IPMAC : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L10-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L10-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "24d55b6bec5c9fff4cd6f345bacac7abadce1611"
logic_hash = "395dfb840346bbf3f68fa198e76349cf65c703b28fd168b85d846d07df1845fe"
score = 70
@@ -286777,8 +287160,8 @@ rule SIGNATURE_BASE_CN_Honker_Getsyskey : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L28-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L28-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17cec5e75cda434d0a1bc8cdd5aa268b42633fe9"
logic_hash = "1f12ea9d62d4aaf695328fb335445f3dae3996595402586d2ee52098e6727d10"
score = 70
@@ -286802,8 +287185,8 @@ rule SIGNATURE_BASE_CN_Honker_Churrasco : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L45-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L45-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5a3c935d82a5ff0546eff51bb2ef21c88198f5b8"
logic_hash = "f60589bda76367578388cbe6af912c80c9364a7047ed52ca2b4156a1b277e7ca"
score = 70
@@ -286831,8 +287214,8 @@ rule SIGNATURE_BASE_CN_Honker_Mysql_Injectv1_1_Creak : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L66-L81"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L66-L81"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a1f066789f48a76023598c5777752c15f91b76b0"
logic_hash = "f61557216a7e90ff9655ad8aea4a9adf0e4435c7a3f7958423e46fd2265bad07"
score = 70
@@ -286856,8 +287239,8 @@ rule SIGNATURE_BASE_CN_Honker_ASP_Wshell : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L83-L100"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L83-L100"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3ae33c835e7ea6d9df74fe99fcf1e2fb9490c978"
logic_hash = "f6f83acb76248a1b00f1acac621e68888c93b34d4813d8f8613d5d9095c53a8a"
score = 70
@@ -286883,8 +287266,8 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Iis7 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L102-L119"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L102-L119"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
logic_hash = "91ceec96297e5cc027e261fd708899787b9be4ac15e209e0734a3b8563ae31b5"
score = 70
@@ -286910,8 +287293,8 @@ rule SIGNATURE_BASE_CN_Honker_Segmentweapon : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L121-L136"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L121-L136"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "494ef20067a7ce2cc95260e4abc16fcfa7177fdf"
logic_hash = "9afb70a3ae158b7abbda6725b8c9901121b78fa0e874db12b4ac08bf59b26fb5"
score = 70
@@ -286935,8 +287318,8 @@ rule SIGNATURE_BASE_CN_Honker_Alien_Iispwd : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L138-L153"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L138-L153"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5d157a1b9644adbe0b28c37d4022d88a9f58cedb"
logic_hash = "16dc6ec4b668fdc43e3a9a8ea31ad0caa1a80b1015ab60eec0eb76bfacd69c5f"
score = 70
@@ -286960,8 +287343,8 @@ rule SIGNATURE_BASE_CN_Honker_Md5Cracktools : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L155-L170"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L155-L170"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9dfd9c9923ae6f6fe4cbfa9eb69688269285939c"
logic_hash = "a176393c0324bcc634a31c261aa6b528fb5a5893c40a5534b34253a1922c8285"
score = 70
@@ -286985,8 +287368,8 @@ rule SIGNATURE_BASE_CN_Honker_Coolscan_Scan : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L172-L187"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L172-L187"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e1c5fb6b9f4e92c4264c7bea7f5fba9a5335c328"
logic_hash = "89c7d24d821e907f79ab5630eed13275c5216cff6bf203b5c8f66bb1a178039b"
score = 70
@@ -287010,8 +287393,8 @@ rule SIGNATURE_BASE_CN_Honker_Mempodipper2_6 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L189-L203"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L189-L203"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ba2c79911fe48660898039591e1742b3f1a9e923"
logic_hash = "1a2c42757199818b94a73b9faff3380911655992ef3214a33a220eac15850c4b"
score = 70
@@ -287034,8 +287417,8 @@ rule SIGNATURE_BASE_CN_Honker_COOKIE_Cookie : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L205-L220"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L205-L220"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f7727160257e0e716e9f0cf9cdf9a87caa986cde"
logic_hash = "6d942e53a253cb157e535f86ca457c93a6039b2c5ebb3969dc3e271242b478d4"
score = 70
@@ -287059,8 +287442,8 @@ rule SIGNATURE_BASE_CN_Honker_Wwwscan_1_Wwwscan : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L222-L237"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L222-L237"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6bed45629c5e54986f2d27cbfc53464108911026"
logic_hash = "7b0b6bbcba49c8f950ea3cf5a364059ba784c87a41eba6d825a9ca4e3a07bfbc"
score = 70
@@ -287084,8 +287467,8 @@ rule SIGNATURE_BASE_CN_Honker_D_Injection_V2_32 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L239-L254"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L239-L254"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3a000b976c79585f62f40f7999ef9bdd326a9513"
logic_hash = "0107903a481b09faa92a5fbb162fd981f976ed864be3a0840b43063461e20974"
score = 70
@@ -287109,8 +287492,8 @@ rule SIGNATURE_BASE_CN_Honker_Net_Priv_Esc2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L256-L271"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L256-L271"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4851e0088ad38ac5b3b1c75302a73698437f7f17"
logic_hash = "53cf3d984bc82428eb0a6ee416bcd5429718a1d615ce1c1ba399cda42268d26c"
score = 70
@@ -287134,8 +287517,8 @@ rule SIGNATURE_BASE_CN_Honker_Oracle_V1_0_Oracle : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L273-L289"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L273-L289"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0264f4efdba09eaf1e681220ba96de8498ab3580"
logic_hash = "6f1bb6b14445a9ca29768ab2dcf831a98cb5d153d03ebc4bc497bb8f8144a365"
score = 70
@@ -287160,8 +287543,8 @@ rule SIGNATURE_BASE_CN_Honker_Interception : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L291-L306"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L291-L306"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ea813aed322e210ea6ae42b73b1250408bf40e7a"
logic_hash = "d1ae5f8ff21659b95f6e62b1d5e3ec15b122a2b5889e8984f3d9f6d2fa938d17"
score = 70
@@ -287185,8 +287568,8 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_Dubrute_V3_0_RC3_3_0 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L308-L324"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L308-L324"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "49b311add0940cf183e3c7f3a41ea6e516bf8992"
logic_hash = "6d2f6721c942332af1be0b6537e9b9d0b5b3e91eb3912dcd095aa18bccfc4ad5"
score = 70
@@ -287211,8 +287594,8 @@ rule SIGNATURE_BASE_CN_Honker_Windows_Exp : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L326-L341"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L326-L341"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "04334c396b165db6e18e9b76094991d681e6c993"
logic_hash = "6a146545fd12e7603bf1e2ccb9b2d308b13fe2acdb9248a79c80b6c1de37fd73"
score = 70
@@ -287236,8 +287619,8 @@ rule SIGNATURE_BASE_CN_Honker_Safe3Wvs_Cgiscan : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L343-L358"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L343-L358"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f94bbf2034ad9afa43cca3e3a20f142e0bb54d75"
logic_hash = "990dcede3bb83216af7e72e2a49bc2355ebd45ebd3fc658ba337a285dcdf799f"
score = 70
@@ -287261,8 +287644,8 @@ rule SIGNATURE_BASE_CN_Honker_Pr_Debug : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L360-L375"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L360-L375"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
logic_hash = "0b7508e3a508adc9416f16549290e06468520c156dbd5192e5a352820586af9f"
score = 70
@@ -287286,8 +287669,8 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V4_0 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L377-L392"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L377-L392"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "98f21f72c761e504814f0a7db835a24a2413a6c2"
logic_hash = "bd6f9b6e831573164fddf7f0188087eb0076410b77c9c06cfacadebe6a53b525"
score = 70
@@ -287311,8 +287694,8 @@ rule SIGNATURE_BASE_CN_Honker_Matrixay1073 : FILE
date = "2015-06-23"
modified = "2023-01-27"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L394-L412"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L394-L412"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fef951e47524f827c7698f4508ba9551359578a5"
logic_hash = "e64cae48344e5dae8ec80b2897305a0b380340bdd2973eb0828582f18ef8bf2b"
score = 70
@@ -287338,8 +287721,8 @@ rule SIGNATURE_BASE_CN_Honker_Sword1_5 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L414-L431"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L414-L431"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
logic_hash = "0f7630b2ec983df2a065b049000cef6de38f884254748a342b2fd84d8c5985af"
score = 70
@@ -287365,8 +287748,8 @@ rule SIGNATURE_BASE_CN_Honker_Havij_Havij : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L433-L448"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L433-L448"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0d8b275bd1856bc6563dd731956f3b312e1533cd"
logic_hash = "e8aff3e1e536cd35b10bdaab4818542bce284e7ed3aa7ef1920763669faf4c8a"
score = 70
@@ -287390,8 +287773,8 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Ms11011 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L450-L468"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L450-L468"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
logic_hash = "f92d71f163a49a158d85b821d71fd17e84e0d3deb19515ae0cf6a063a05c027b"
score = 70
@@ -287418,8 +287801,8 @@ rule SIGNATURE_BASE_CN_Honker_DLL_Passive_Privilege_Escalation_Ws2Help : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L470-L485"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L470-L485"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e539b799c18d519efae6343cff362dcfd8f57f69"
logic_hash = "e13f33e48d5c1aeaef6c50287f74e03fb7b65667d597768d448e76f5a375b34f"
score = 70
@@ -287443,8 +287826,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L487-L503"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L487-L503"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c85bd09d241c2a75b4e4301091aa11ddd5ad6d59"
logic_hash = "d48a10313afcb5a2084229937703bbc11958a5cd11f8f27fbc8dae15ddfd5ed1"
score = 70
@@ -287469,8 +287852,8 @@ rule SIGNATURE_BASE_CN_Honker_Aspxclient : FILE
date = "2015-06-23"
modified = "2022-12-21"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L505-L523"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L505-L523"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "67569a89128f503a459eab3daa2032261507f2d2"
logic_hash = "4d0a93434673952fed38e384db526275b9eb32bac9a207c91f792d4d113c40f1"
score = 70
@@ -287496,8 +287879,8 @@ rule SIGNATURE_BASE_CN_Honker_Fckeditor : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L525-L540"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L525-L540"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4b16ae12c204f64265acef872526b27111b68820"
logic_hash = "0fd231fc81b2b7b5647a8016774f35751ac68646856a15c17ce4d2c07eaf1761"
score = 70
@@ -287521,8 +287904,8 @@ rule SIGNATURE_BASE_CN_Honker_Codeeer_Explorer : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L542-L557"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L542-L557"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f32e05f3fefbaa2791dd750e4a3812581ce0f205"
logic_hash = "299d0181beb5032dcb327516a7526d6131e2212623ffa9e592f54f80473b098d"
score = 70
@@ -287546,8 +287929,8 @@ rule SIGNATURE_BASE_CN_Honker_Swordhonkeredition : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L559-L575"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L559-L575"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3f9479151c2cada04febea45c2edcf5cece1df6c"
logic_hash = "cc18e68f7c3eff69a75333f3b605c89b024c6763f7b97e0ce20ce14bfe28df0d"
score = 70
@@ -287572,8 +287955,8 @@ rule SIGNATURE_BASE_CN_Honker_HASH_Pwdump7 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L577-L594"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L577-L594"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "93a2d7c3a9b83371d96a575c15fe6fce6f9d50d3"
logic_hash = "05f735ba3f377f71ccf3a97b3597cee7b9f36213ee2ebba19db69667529d9fac"
score = 70
@@ -287599,8 +287982,8 @@ rule SIGNATURE_BASE_CN_Honker_Chinachopper : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L596-L612"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L596-L612"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fa347fdb23ab0b8d0560a0d20c434549d78e99b5"
logic_hash = "e5e6a8a17592e7c82af830153905a52f8202a65c8e2f4b09dbebb19d04e2f8d7"
score = 70
@@ -287625,8 +288008,8 @@ rule SIGNATURE_BASE_CN_Honker_Dedecms5_7 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L614-L629"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L614-L629"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f9cbb25883828ca266e32ff4faf62f5a9f92c5fb"
logic_hash = "57ff887906d3c5e7eafc900581eea7432c7a18364b0061d0e4deba0229663c65"
score = 70
@@ -287650,8 +288033,8 @@ rule SIGNATURE_BASE_CN_Honker_Alien_Ee : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L631-L646"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L631-L646"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "15a7211154ee7aca29529bd5c2500e0d33d7f0b3"
logic_hash = "1f40f6c53e13aeb6b44c58f6e048a35cf3fd9fb956f26d70b3fe91bcac340ab5"
score = 70
@@ -287675,8 +288058,8 @@ rule SIGNATURE_BASE_CN_Honker_Smsniff_Smsniff : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L648-L663"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L648-L663"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8667a785a8ced76d0284d225be230b5f1546f140"
logic_hash = "6949f992d4734f18d9caffe83f2abccca0e0decef4169954518eed078d39e561"
score = 70
@@ -287700,8 +288083,8 @@ rule SIGNATURE_BASE_CN_Honker_Happy_Happy : FILE
date = "2015-06-23"
modified = "2023-01-27"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L665-L683"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L665-L683"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "92067d8dad33177b5d6c853d4d0e897f2ee846b0"
logic_hash = "667cd6629ca49f2200fdc0a5eb28c77c412ca25313fd9a8afb77dedfa66d2fa1"
score = 70
@@ -287727,8 +288110,8 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V3_0 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L685-L701"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L685-L701"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fa47c4affbac01ba5606c4862fdb77233c1ef656"
logic_hash = "fa65de4a135072f4d9a5d5711a4e2833b9d4a268a2a37c33d17e4546d172b6f1"
score = 70
@@ -287753,8 +288136,8 @@ rule SIGNATURE_BASE_CN_Honker_Netfuke_Netfuke : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L703-L718"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L703-L718"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f89e223fd4f6f5a3c2a2ea225660ef0957fc07ba"
logic_hash = "86f6040b743b17fb300498b02a202d1a9090054a30d490f082b116d799c4bdb2"
score = 70
@@ -287778,8 +288161,8 @@ rule SIGNATURE_BASE_CN_Honker_Manualinjection : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L720-L735"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L720-L735"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e83d427f44783088a84e9c231c6816c214434526"
logic_hash = "fe8eba3b79f5bc4cf820ff51816c3f2a27d6ed8f6ab3963f88a3232c9a4b5c1e"
score = 70
@@ -287803,8 +288186,8 @@ rule SIGNATURE_BASE_CN_Honker_Cncert_Ccdoor_CMD : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L737-L754"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L737-L754"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1c6ed7d817fa8e6534a5fd36a94f4fc2f066c9cd"
logic_hash = "3c068c3d21de8c071b3eec354f03423d4902ef0156bb9dcad370cf688bc03426"
score = 70
@@ -287830,8 +288213,8 @@ rule SIGNATURE_BASE_CN_Honker_Termsrvhack : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L756-L771"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L756-L771"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1c456520a7b7faf71900c71167038185f5a7d312"
logic_hash = "ef0b9965e2d419230a7a8425674edb356347d1e41538d19fc67f8b0fbc69091f"
score = 70
@@ -287855,8 +288238,8 @@ rule SIGNATURE_BASE_CN_Honker_IIS6_Iis6 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L773-L790"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L773-L790"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f0c9106d6d2eea686fd96622986b641968d0b864"
logic_hash = "51b2fdae6437d64661f20342711d516201740eceb2273704a6e415be2cac54f6"
score = 70
@@ -287882,8 +288265,8 @@ rule SIGNATURE_BASE_CN_Honker_Struts2_Catbox : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L792-L807"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L792-L807"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ee8fbd91477e056aef34fce3ade474cafa1a4304"
logic_hash = "20bda5c918ea38810603528a20f3406ec4e79ce999681649e8e806bf549b5359"
score = 70
@@ -287907,8 +288290,8 @@ rule SIGNATURE_BASE_CN_Honker_Getlsasrvaddr : FILE
date = "2015-06-23"
modified = "2022-12-21"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L809-L826"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L809-L826"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a897d5da98dae8d80f3c0a0ef6a07c4b42fb89ce"
logic_hash = "e626724430d0b74aee52783dd5abdb8ccc7b951c56041e5c166b78b7370bc402"
score = 70
@@ -287933,8 +288316,8 @@ rule SIGNATURE_BASE_CN_Honker_Ms10048_X64 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L828-L843"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L828-L843"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
logic_hash = "49addce6bef7588bf7683836a54bec6a2a646ecc3f7547083174d2255454cdf0"
score = 70
@@ -287958,8 +288341,8 @@ rule SIGNATURE_BASE_CN_Honker_Logcleaner : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L845-L860"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L845-L860"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ab77ed5804b0394d58717c5f844d9c0da5a9f03e"
logic_hash = "3be059627c39e262e7621fce637df21ddcabef91753192cec356f2f8cd58c1a3"
score = 70
@@ -287983,8 +288366,8 @@ rule SIGNATURE_BASE_CN_Honker_Shell_Brute_Tool : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L862-L877"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L862-L877"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f6903a15453698c35dce841e4d09c542f9480f01"
logic_hash = "723fd18e59c0017b67a035ec7c685169c517d673c2bbc8fe93071b8dbd1e606a"
score = 70
@@ -288008,8 +288391,8 @@ rule SIGNATURE_BASE_CN_Honker_Hxdef100 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L879-L895"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L879-L895"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bf30ccc565ac40073b867d4c7f5c33c6bc1920d6"
logic_hash = "49f15482104297f0c57713712a7add49d58007afeefd11151dc5749b755860ba"
score = 70
@@ -288034,8 +288417,8 @@ rule SIGNATURE_BASE_CN_Honker_Arp_EMP_V1_0 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L897-L911"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L897-L911"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
logic_hash = "457035b1685ac7f1bdccaab0b64bb1ad3ca1bf5e0747222347ced2a11b9b9504"
score = 70
@@ -288058,8 +288441,8 @@ rule SIGNATURE_BASE_CN_Honker_Getwebshell : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L913-L930"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L913-L930"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b63b53259260a7a316932c0a4b643862f65ee9f8"
logic_hash = "5d6638596607884950e702144416eb6fd3b009c88e4af5f81a50f346d7491c95"
score = 70
@@ -288085,8 +288468,8 @@ rule SIGNATURE_BASE_CN_Honker_Cracker_SHELL : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L932-L949"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L932-L949"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c1dc349ff44a45712937a8a9518170da8d4ee656"
logic_hash = "03da662e8d5dfbae524c4949d90e143714e6c4783e02600e059172e8b09ebc57"
score = 70
@@ -288112,8 +288495,8 @@ rule SIGNATURE_BASE_CN_Honker_MSTSC_Can_Direct_Copy : FILE
date = "2015-06-23"
modified = "2022-12-21"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L951-L968"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L951-L968"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f3cbfd9f82f8abafdb1d33235fa6bfa1e1f71ae"
logic_hash = "5437abd979a8df5ee3f8508f7a5fff85714b5d8a22ab1760fe1e7a8168a8c255"
score = 70
@@ -288138,8 +288521,8 @@ rule SIGNATURE_BASE_CN_Honker_Lcx_Lcx : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L970-L988"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L970-L988"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
logic_hash = "6e81cac14baa9f0ae35eb26f30291cba6f7ef1864f8970b97a3e6e7205d10eb9"
score = 70
@@ -288166,8 +288549,8 @@ rule SIGNATURE_BASE_CN_Honker_Postgresql : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L990-L1005"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L990-L1005"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
logic_hash = "f6921e7a7c88d70c77fc30dc273aac3679a3c0ab44d4d4706d7a405f16cff6a1"
score = 70
@@ -288191,8 +288574,8 @@ rule SIGNATURE_BASE_CN_Honker_Webrobot : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1007-L1023"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1007-L1023"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "af054994c911b4301490344fca4bb19a9f394a8f"
logic_hash = "7d7fc9fb9156aa20993dcb809f4e1d3d357f6826dcac7e628dbe6e0f81e5a61a"
score = 70
@@ -288217,8 +288600,8 @@ rule SIGNATURE_BASE_CN_Honker_Baidu_Extractor_Ver1_0 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1025-L1042"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1025-L1042"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1899f979360e96245d31082e7e96ccedbdbe1413"
logic_hash = "cba7357ab3cb840b3b115abe00e1a3a712feb036cae816c8ded10d73029efe2b"
score = 70
@@ -288244,8 +288627,8 @@ rule SIGNATURE_BASE_CN_Honker_FTP_Scanning : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1044-L1061"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1044-L1061"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5a3543ee5aed110c87cbc3973686e785bcb5c44e"
logic_hash = "5f1c312dc9fa80c120699bacd17d5e4c147ab96f90c619a8c39ec27646a1307f"
score = 70
@@ -288271,8 +288654,8 @@ rule SIGNATURE_BASE_CN_Honker_Dirdown_Dirdown : FILE
date = "2015-06-23"
modified = "2022-12-21"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1063-L1080"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1063-L1080"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7b8d51c72841532dded5fec7e7b0005855b8a051"
logic_hash = "5e8349096b7d07757c3779e13fba87f770a5ef090bc7efe36fd151c7c180edad"
score = 70
@@ -288297,8 +288680,8 @@ rule SIGNATURE_BASE_CN_Honker_Xiaokui_Conversion_Tool : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1082-L1098"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1082-L1098"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dccd163e94a774b01f90c1e79f186894e2f27de3"
logic_hash = "66a77c1fbfecdc02f591c12f69b46e39b7077dfbb5ed2a26a7dcfb11c8b464dc"
score = 70
@@ -288323,8 +288706,8 @@ rule SIGNATURE_BASE_CN_Honker_Grouppolicyremover : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1100-L1116"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1100-L1116"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7475d694e189b35899a2baa462957ac3687513e5"
logic_hash = "936d5dea2d44f638abfb5e42f45c0678bcbf769b575b5056db1a1fc41d1643be"
score = 70
@@ -288349,8 +288732,8 @@ rule SIGNATURE_BASE_CN_Honker_Wordpressscanner : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1118-L1135"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1118-L1135"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b3c5015ba3616cbc616fc9ba805fea73e98bc83"
logic_hash = "c6c36ad5ff0ddfbc41464008d293d453bf2d312a6db885217785adf816bd8b20"
score = 70
@@ -288376,8 +288759,8 @@ rule SIGNATURE_BASE_CN_Honker_Htran_V2_40_Htran20 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1137-L1156"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1137-L1156"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
logic_hash = "41a85430875df622e7940ef26c6eceaa4e0720b2995521fbb2d4b072207c8e15"
score = 70
@@ -288405,8 +288788,8 @@ rule SIGNATURE_BASE_CN_Honker_Dictionarygenerator : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1158-L1173"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1158-L1173"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b3071c64953e97eeb2ca6796fab302d8a77d27bc"
logic_hash = "228bdbca3eb206e22a130e91caa2486174efba9356dbee67e80333c0cf0bb643"
score = 70
@@ -288430,8 +288813,8 @@ rule SIGNATURE_BASE_CN_Honker_Ms11080_Withcmd : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1175-L1190"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1175-L1190"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "745e5058acff27b09cfd6169caf6e45097881a49"
logic_hash = "1f673f845ad40efae143ec244c7c70d1e26fb51f22be6bf445085c6a7379f193"
score = 70
@@ -288455,8 +288838,8 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1192-L1208"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1192-L1208"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a995451d9108687b8892ad630a79660a021d670a"
logic_hash = "979f3fe9795798743f2a57aa3b82a34e304774de58ffda5278991cf5a753a8ba"
score = 70
@@ -288481,8 +288864,8 @@ rule SIGNATURE_BASE_CN_Honker_HASH_32 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1210-L1226"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1210-L1226"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bf4a8b4b3e906e385feab5ea768f604f64ba84ea"
logic_hash = "819e70979ae1d5e237bbadaa52b504c566b4b7436747ceb0d72e206e4fc45708"
score = 70
@@ -288507,8 +288890,8 @@ rule SIGNATURE_BASE_CN_Honker_Windows_Mstsc_Enhanced_RMDSTC : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1228-L1243"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1228-L1243"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3ca2b1b6f31219baf172abcc8f00f07f560e465f"
logic_hash = "de676b033613beebfe9fc5a71cf5f5911f0af35d34e77d56d222c6f00114dfb6"
score = 70
@@ -288532,8 +288915,8 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_Mstsc_MSTSCAX : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1245-L1261"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1245-L1261"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2fa006158b2d87b08f1778f032ab1b8e139e02c6"
logic_hash = "2bfe10ec4af5d0f32fc03714c0cb01d9b0d446daa67cc0cce0b83f6a57e7c5a5"
score = 70
@@ -288558,8 +288941,8 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Scanner : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1263-L1278"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1263-L1278"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70b04b910d82b32b90cd7f355a0e3e17dd260cb3"
logic_hash = "558abb651ce410520811ca96aaad78710cb9bf597b59ed89d9a678377716d721"
score = 70
@@ -288583,8 +288966,8 @@ rule SIGNATURE_BASE_CN_Honker_Gethashes : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1280-L1296"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1280-L1296"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc8bcebf565ffffda0df24a77e28af681227b7fe"
logic_hash = "fb5ab5e6d8b522caf27478b0589b39d06b96fb0f913673ede768a814836e11f8"
score = 70
@@ -288609,8 +288992,8 @@ rule SIGNATURE_BASE_CN_Honker_Hashq_Hashq : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1298-L1314"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1298-L1314"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7518b647db5275e8a9e0bf4deda3d853cc9d5661"
logic_hash = "a71ad182f7dd33790e59badfba6149c6dea627858414f0a8f3e64fd3bb2e2a64"
score = 70
@@ -288635,8 +289018,8 @@ rule SIGNATURE_BASE_CN_Honker_Shiftbackdoor_Server : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1316-L1333"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1316-L1333"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b24d761c6bbf216792c4833890460e8b37d86b37"
logic_hash = "17f1d7f2345ed1bc9b240c4851f41891244ec9d13b296a24ab6b42cca32ddf87"
score = 70
@@ -288662,8 +289045,8 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Win2003 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1335-L1351"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1335-L1351"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "47164c8efe65d7d924753fadf6cdfb897a1c03db"
logic_hash = "d1616c53b26eefaa2578efb7defee182e8c88c869cfffb16c8767ddc1869ad46"
score = 70
@@ -288688,8 +289071,8 @@ rule SIGNATURE_BASE_CN_Honker_Interception3389_Setup : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1353-L1371"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1353-L1371"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f5b2f86f8e7cdc00aa1cb1b04bc3d278eb17bf5c"
logic_hash = "d3f543683810a985a190cc3ea8edb7bfcd316d56a13d45c6532c488a4536ad0a"
score = 70
@@ -288716,8 +289099,8 @@ rule SIGNATURE_BASE_CN_Honker_Cncert_Ccdoor_CMD_2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1373-L1390"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1373-L1390"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7f3a6fb30845bf366e14fa21f7e05d71baa1215a"
logic_hash = "8f33f2999eae3f080e8e5ec51ced3e7d596a07b6e5c9830cc1ca552701ed6502"
score = 70
@@ -288743,8 +289126,8 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Ms11046 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1392-L1409"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1392-L1409"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
logic_hash = "0496e5c062c1a248b118c2f6009c95bfddf753e5491529d4ec43cfaf1ea0c0c5"
score = 70
@@ -288770,8 +289153,8 @@ rule SIGNATURE_BASE_CN_Honker_Master_Beta_1_7 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1411-L1426"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1411-L1426"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3be7a370791f29be89acccf3f2608fd165e8059e"
logic_hash = "13c9cc0bf8aaed2ba86baeee6f0b32bf71108dc1350dcffd03e70393fa975c9f"
score = 70
@@ -288795,8 +289178,8 @@ rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck_2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1428-L1446"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1428-L1446"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0783661077312753802bd64bf5d35c4666ad0a82"
logic_hash = "85c73d480019929eef5951b0395f49cea86dc83b334860e940cc6e36c2d96d3a"
score = 70
@@ -288823,8 +289206,8 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_80_Antifw : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1448-L1466"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1448-L1466"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5fbc75900e48f83d0e3592ea9fa4b70da72ccaa3"
logic_hash = "5e940406b713458ae7168d4e140f15a262b7f0834d29db9c88f1f04bedb41e43"
score = 70
@@ -288851,8 +289234,8 @@ rule SIGNATURE_BASE_CN_Honker_Wwwscan_Gui : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1468-L1483"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1468-L1483"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
logic_hash = "9c25cf33fc2f675c8db7b24f2abe03d54c0ae17927e0ca9ccd3e5b97ffc56f73"
score = 70
@@ -288876,8 +289259,8 @@ rule SIGNATURE_BASE_CN_Honker_Swordcolledition : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1485-L1500"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1485-L1500"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6e14f21cac6e2aa7535e45d81e8d1f6913fd6e8b"
logic_hash = "bbc5c9bb91bdd60582e2d7f6fa9b1a1cc3799e0809b670d575d9b2c77bf5e884"
score = 70
@@ -288901,8 +289284,8 @@ rule SIGNATURE_BASE_CN_Honker_Hconstfportable : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1502-L1517"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1502-L1517"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "00253a00eadb3ec21a06911a3d92728bbbe80c09"
logic_hash = "d4368994d38b87a4c0a53321a468fa8a72411ccb17befa0bbc62bdd6de9e1a52"
score = 70
@@ -288926,8 +289309,8 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V3_LPK : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1519-L1536"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1519-L1536"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
logic_hash = "20e949bef1c1631ef2a48c78c2ccc4dcea2f842275ec5df3e31c5d915e8a2a04"
score = 70
@@ -288953,8 +289336,8 @@ rule SIGNATURE_BASE_CN_Honker_Without_A_Trace_Wywz : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1538-L1554"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1538-L1554"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f443c43fde643228ee95def5c8ed3171f16daad8"
logic_hash = "0f6ca7d44312afef49d3094af7b33af5e41f4531e7e7f9f37cf050700755bb3e"
score = 70
@@ -288979,8 +289362,8 @@ rule SIGNATURE_BASE_CN_Honker_LPK2_0_LPK : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1556-L1573"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1556-L1573"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5a1226e73daba516c889328f295e728f07fdf1c3"
logic_hash = "d693b880d5419277d9189d44ace60fe5f328b4662c1975a8bc97e63dc073d1e6"
score = 70
@@ -289006,8 +289389,8 @@ rule SIGNATURE_BASE_CN_Honker_Cleaniis : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1575-L1590"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1575-L1590"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "372bc64c842f6ff0d9a1aa2a2a44659d8b88cb40"
logic_hash = "6f3fe22c9ce8b576116a3fc185910488f37b687c1158d49a93feaa68a144a8db"
score = 70
@@ -289031,8 +289414,8 @@ rule SIGNATURE_BASE_CN_Honker_Arp3_7_Arp3_7 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1592-L1607"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1592-L1607"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "db641a9dfec103b98548ac7f6ca474715040f25c"
logic_hash = "9930d5f13c4dc5cae25dece811911e71e858e3fef51a09c99883699e7feb4908"
score = 70
@@ -289056,8 +289439,8 @@ rule SIGNATURE_BASE_CN_Honker_Exp_Ms11080 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1609-L1624"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1609-L1624"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
logic_hash = "57eb1cdd1108c82da399b0aa869edc9e377e0185896504716bec8925599c07f0"
score = 70
@@ -289081,8 +289464,8 @@ rule SIGNATURE_BASE_CN_Honker_Injection_Transit : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1626-L1642"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1626-L1642"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f4fef2e3d310494a3c3962a49c7c5a9ea072b2ea"
logic_hash = "3e6fe804b9b6e8555c847a165bb0a8b266004653531fe8f11e3937108757f2ff"
score = 70
@@ -289107,8 +289490,8 @@ rule SIGNATURE_BASE_CN_Honker_Safe3Wvs : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1644-L1662"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1644-L1662"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fee3acacc763dc55df1373709a666d94c9364a7f"
logic_hash = "803591fa9427c3001f78ae6274076f3a2f070770d568909d6cba8cee5124ee4c"
score = 70
@@ -289135,8 +289518,8 @@ rule SIGNATURE_BASE_CN_Honker_NBSI_3_0 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1664-L1681"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1664-L1681"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "93bf0f64bec926e9aa2caf4c28df9af27ec0e104"
logic_hash = "017b5f76a3168089f3186134e7a4c0352158bb866228776240f0d014834e6ee0"
score = 70
@@ -289162,8 +289545,8 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_Dubrute_V3_0_RC3_2_0 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1683-L1699"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1683-L1699"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e8ee982421ccff96121ffd24a3d84e3079f3750f"
logic_hash = "8c9be7e8cc04eba6b131acc3c85ac48d7663260a2e4064ad55ed8f40e0875cf4"
score = 70
@@ -289188,8 +289571,8 @@ rule SIGNATURE_BASE_CN_Honker_Hkmjjiis6 : FILE
date = "2015-06-23"
modified = "2023-01-27"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1701-L1718"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1701-L1718"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
logic_hash = "a087b9731444152b717e0fbae557004d94f3fb69a4ec65aa38b7a3dab3e3cddf"
score = 70
@@ -289214,8 +289597,8 @@ rule SIGNATURE_BASE_CN_Honker_Clearlogs : FILE
date = "2015-06-23"
modified = "2023-01-27"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1720-L1736"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1720-L1736"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "490f3bc318f415685d7e32176088001679b0da1b"
logic_hash = "ed961d2850ba86743177976a4516e7d4a8b90b7e8f180c03f5dbbcc794ad1084"
score = 70
@@ -289239,8 +289622,8 @@ rule SIGNATURE_BASE_CN_Honker_No_Net_Priv_Esc_Adduser : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1738-L1754"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1738-L1754"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4c95046be6ae40aee69a433e9a47f824598db2d4"
logic_hash = "743e67e2aa95830034db1afda1f346c30467c7b59e030ed27415e5127013be74"
score = 70
@@ -289265,8 +289648,8 @@ rule SIGNATURE_BASE_CN_Honker_Injection : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1756-L1771"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1756-L1771"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
logic_hash = "8de3e59bd118fbbf1a012c6bfb358dba7c8fb758e3ac17277f2ad3a92c0284ba"
score = 70
@@ -289290,8 +289673,8 @@ rule SIGNATURE_BASE_CN_Honker_Sqlserver_Inject_Creaked : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1773-L1788"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1773-L1788"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "af3c41756ec8768483a4cf59b2e639994426e2c2"
logic_hash = "2a7e913a4b7bb6c1270d862108eae7ed3998114b672ca7fa19bd0b199fc27dc2"
score = 70
@@ -289315,8 +289698,8 @@ rule SIGNATURE_BASE_CN_Honker_Webscan_Webscan : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1790-L1805"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1790-L1805"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a0b0e2422e0e9edb1aed6abb5d2e3d156b7c8204"
logic_hash = "a714fe90dce33180b8074e2c3a16fc1829ed2a7b387eb92aec8a147cff9e57a4"
score = 70
@@ -289340,8 +289723,8 @@ rule SIGNATURE_BASE_CN_Honker_Gethashes_2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1807-L1823"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1807-L1823"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "35ae9ccba8d607d8c19a065cf553070c54b091d8"
logic_hash = "778fde2c59d4523142c0ac5b5c953c9eedbbf3c00b406541c00c1aa1f1a9cc58"
score = 70
@@ -289366,8 +289749,8 @@ rule SIGNATURE_BASE_SUSP_Patcher_Keygen_Indicators_Jun15 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1825-L1841"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1825-L1841"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e32f5de730e324fb386f97b6da9ba500cf3a4f8d"
logic_hash = "07735c380cf34aaabd5cc0e1b38e32b3d4ad86b7bb184188d446df537f66775e"
score = 70
@@ -289392,8 +289775,8 @@ rule SIGNATURE_BASE_CN_Honker_Tuoku_Script_Oracle_2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1843-L1858"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1843-L1858"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "865dd591b552787eda18ee0ab604509bae18c197"
logic_hash = "627d81323266d67a2402367918b4f6e7277367c3eb027af57ac6966f2a49472c"
score = 70
@@ -289417,8 +289800,8 @@ rule SIGNATURE_BASE_CN_Honker_Net_Packet_Capt : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1860-L1878"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1860-L1878"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2d45a2bd9e74cf14c1d93fff90c2b0665f109c52"
logic_hash = "b158199a27f1260da5f5c1a8e99bb1cc3d19fe2a10577cc5932f097ff39d4ef8"
score = 70
@@ -289445,8 +289828,8 @@ rule SIGNATURE_BASE_CN_Honker_Cleaniislog : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1880-L1894"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1880-L1894"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
logic_hash = "35b428d6178196b0dc6ac2ea3f0ee1dfbf6a98ead2356cb2a35d3d6b780538cc"
score = 70
@@ -289469,8 +289852,8 @@ rule SIGNATURE_BASE_CN_Honker_HASH_Pwhash : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1896-L1911"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1896-L1911"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "689056588f95749f0382d201fac8f58bac393e98"
logic_hash = "a77ae11c35dac3cfb1a2970460d4883feed7fbd3e8a860fa7facaad7ddcd1182"
score = 70
@@ -289494,8 +289877,8 @@ rule SIGNATURE_BASE_CN_Honker_Cleaner_Cl_2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1913-L1928"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1913-L1928"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "523084e8975b16e255b56db9af0f9eecf174a2dd"
logic_hash = "865354152f8441009aaad9022f64c3a014c4df0549b648d66959df56893ab98a"
score = 70
@@ -289519,8 +289902,8 @@ rule SIGNATURE_BASE_CN_Honker_Sqlmap_Python_Run : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1930-L1946"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1930-L1946"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a51479a1c589f17c77d22f6cf90b97011c33145f"
logic_hash = "86d53a06e2f71b7ce7785c4c8ac017a4552b40c16d64474db4e22dbe1afd9e52"
score = 70
@@ -289545,8 +289928,8 @@ rule SIGNATURE_BASE_CN_Honker_Saminside : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1948-L1963"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1948-L1963"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "707ba507f9a74d591f4f2e2f165ff9192557d6dd"
logic_hash = "8f095a554121e16b63fdd8d47d957665aed7a2a5885813fa78bc4cee3b8923d3"
score = 70
@@ -289570,8 +289953,8 @@ rule SIGNATURE_BASE_CN_Honker_Webscan_Wwwscan : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1965-L1981"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1965-L1981"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
logic_hash = "9d2eee1c1783a08a2eae86d4ea77bdb67db8cf0055a24d88ea09411e63018e8c"
score = 70
@@ -289596,8 +289979,8 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_2_3389 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L1983-L1999"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L1983-L1999"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "48d1974215e5cb07d1faa57e37afa91482b5a376"
logic_hash = "97e2a08dd391de44fc01c44ca6463aa009e93ad199a330eb99aaa809f14f2ef0"
score = 70
@@ -289622,8 +290005,8 @@ rule SIGNATURE_BASE_CN_Honker_PHP_Php11 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2001-L2017"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2001-L2017"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dcc8226e7eb20e4d4bef9e263c14460a7ee5e030"
logic_hash = "d32b0540521a6b1d65c224bdee463813d72846c26f27326a092bdf3b90c3ae7c"
score = 70
@@ -289648,8 +290031,8 @@ rule SIGNATURE_BASE_CN_Honker_Webcruiserwvs : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2019-L2034"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2019-L2034"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6c90a9ed4c8a141a343dab1b115cc840a7190304"
logic_hash = "dd37765488f07299048e9b8fc552120e76d628e0adcaf474fce9bfe60774a0c8"
score = 70
@@ -289673,8 +290056,8 @@ rule SIGNATURE_BASE_CN_Honker_Hookmsgina : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2036-L2053"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2036-L2053"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f4d9b329b45fbcf6a3b9f29f2633d5d3d76c9f9d"
logic_hash = "1e268624a5f8df200ef1a03ce167f38feda59836a864e17297473ba223c5895a"
score = 70
@@ -289700,8 +290083,8 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_Xp3389 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2055-L2071"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2055-L2071"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d776eb7596803b5b94098334657667d34b60d880"
logic_hash = "7fd7947a802a65dfd63ece3fc6eaf2da8207e99276a9f6b1ff2c937cf4327945"
score = 70
@@ -289726,8 +290109,8 @@ rule SIGNATURE_BASE_CN_Honker_Cookiesview : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2073-L2089"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2073-L2089"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c54e1f16d79066edfa0f84e920ed1f4873958755"
logic_hash = "9711bb15f08c18ba068325d1cca0ded8e252ded4ceddfb134d1317ad8a19fbe8"
score = 70
@@ -289752,8 +290135,8 @@ rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V4_LPK : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2091-L2108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2091-L2108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b2ab50753006f62965bba83460e3960ca7e1926"
logic_hash = "a7382d61b53706ad51b36bc686a1c3f0018ee111bdc8ae9b05af144230dfbba3"
score = 70
@@ -289779,8 +290162,8 @@ rule SIGNATURE_BASE_CN_Honker_Scanhistory : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2110-L2126"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2110-L2126"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "14c31e238924ba3abc007dc5a3168b64d7b7de8d"
logic_hash = "657a25b5103799446fa88abda39d36a05e080c18d41e9dd98199b506f2bfc419"
score = 70
@@ -289805,8 +290188,8 @@ rule SIGNATURE_BASE_CN_Honker_Invasionerasor : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2128-L2146"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2128-L2146"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b37ecd9ee6b137a29c9b9d2801473a521b168794"
logic_hash = "d2f742693682e9409284706a3eb63536a576cb162629bf76bfabf2e0210984a3"
score = 70
@@ -289833,8 +290216,8 @@ rule SIGNATURE_BASE_CN_Honker_Super_Injection1 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2148-L2164"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2148-L2164"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ff2df40c461f6c42b92b86095296187f2b59b14"
logic_hash = "11a3628b7c34a34dc37604430195e24063d3f0dd0889d6d782ce0ee42cafbb02"
score = 70
@@ -289859,8 +290242,8 @@ rule SIGNATURE_BASE_CN_Honker_Pk_Pker : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2166-L2186"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2166-L2186"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "631787f27f27c46f79e58e1accfcc9ecfb4d3a2f"
logic_hash = "ea29bc82131751f0aaa4f10cc7576a27d243fb7dade03db7ae3dcb029b306505"
score = 70
@@ -289889,8 +290272,8 @@ rule SIGNATURE_BASE_CN_Honker_Getpass_Getpass : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2188-L2204"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2188-L2204"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
logic_hash = "90d802da512f5d460eda6d644660711601d361e2402522d085d3225931a3fca3"
score = 70
@@ -289916,8 +290299,8 @@ rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_Blackmoon_Jun15 : FILE
modified = "2023-12-05"
old_rule_name = "CN_Honker_F4ck_Team_f4ck_3"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2206-L2227"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2206-L2227"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7e3bf9b26df08cfa10f10e2283c6f21f5a3a0014"
logic_hash = "85db31c6bca6e5ddd45168a3adbc382d5a9e8128e0b2a6ed5efe1a2fcd42ff3d"
score = 70
@@ -289946,8 +290329,8 @@ rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck_3 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2229-L2248"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2229-L2248"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b3e9381930f02e170e484f12233bbeb556f3731"
logic_hash = "870d22be85da127b3ebfd3f8ec547b6ad1cdc8048b56aea494e8d2643bd61d77"
score = 70
@@ -289975,8 +290358,8 @@ rule SIGNATURE_BASE_CN_Honker_ACCESS_Brute : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2250-L2268"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2250-L2268"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f552e05facbeb21cb12f23c34bb1881c43e24c34"
logic_hash = "5bd0cbb1c2f5863ef1365dc115c736ade05c290cd6fa09a24c2d344314b522cb"
score = 70
@@ -290003,8 +290386,8 @@ rule SIGNATURE_BASE_CN_Honker_Fpipe_Fpipe : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2270-L2286"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2270-L2286"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a2c51c6fa93a3dfa14aaf31fb1c48a3a66a32d11"
logic_hash = "bde46f2508dc82f91e39cc7bd88960e836522b068546ce65ebc07db69b3d4493"
score = 50
@@ -290029,8 +290412,8 @@ rule SIGNATURE_BASE_CN_Honker_Layer_Layer : FILE
date = "2015-06-23"
modified = "2022-12-21"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2288-L2305"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2288-L2305"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0f4f27e842787cb854bd61f9aca86a63f653eb41"
logic_hash = "03e2d875de6dc45a0cede55071c071944c4cdf4610f52fe4a21f6dd5dedac41d"
score = 70
@@ -290055,8 +290438,8 @@ rule SIGNATURE_BASE_CN_Honker_Ms10048_X86 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2307-L2321"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2307-L2321"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e57b453966e4827e2effa4e153f2923e7d058702"
logic_hash = "2f67b3be31b1d1eb420b40ec291db7271acd692af9f061d5db17415685cf7546"
score = 70
@@ -290079,8 +290462,8 @@ rule SIGNATURE_BASE_CN_Honker_Htran2_4 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2323-L2338"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2323-L2338"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "524f986692f55620013ab5a06bf942382e64d38a"
logic_hash = "dd1332d3dca12513b1f8a1d10148f6fa2eb7cc809ac7cf6f4dcc9090746718b5"
score = 70
@@ -290104,8 +290487,8 @@ rule SIGNATURE_BASE_CN_Honker_Skinhrootkit_Skinh : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2340-L2356"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2340-L2356"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d593f03ae06e54b653c7850c872c0eed459b301f"
logic_hash = "97314a8c908c714c39ea8962c87709fdc422c3e2998a2b1694950fa127204335"
score = 70
@@ -290130,8 +290513,8 @@ rule SIGNATURE_BASE_CN_Honker__Postgresql_Mysql_Injectv1_1_Creak_Oracle_Sqlserve
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2358-L2378"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2358-L2378"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
hash = "a1f066789f48a76023598c5777752c15f91b76b0"
hash = "0264f4efdba09eaf1e681220ba96de8498ab3580"
@@ -290160,8 +290543,8 @@ rule SIGNATURE_BASE_CN_Honker__Wwwscan_Wwwscan_Wwwscan_Gui : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2380-L2398"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2380-L2398"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
hash = "6bed45629c5e54986f2d27cbfc53464108911026"
hash = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
@@ -290188,8 +290571,8 @@ rule SIGNATURE_BASE_CN_Honker__LPK_LPK_LPK : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2400-L2421"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2400-L2421"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5a1226e73daba516c889328f295e728f07fdf1c3"
hash = "2b2ab50753006f62965bba83460e3960ca7e1926"
hash = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
@@ -290219,8 +290602,8 @@ rule SIGNATURE_BASE_CN_Honker__Builder_Shift_Skinh : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2423-L2444"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2423-L2444"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6b5a84cdc3d27c435d49de3f68872d015a5aadfc"
hash = "ee127c1ea1e3b5bf3d2f8754fabf9d1101ed0ee0"
hash = "d593f03ae06e54b653c7850c872c0eed459b301f"
@@ -290250,8 +290633,8 @@ rule SIGNATURE_BASE_CN_Honker__Lcx_Htran2_4_Htran20 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2446-L2465"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2446-L2465"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
hash = "524f986692f55620013ab5a06bf942382e64d38a"
hash = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
@@ -290279,8 +290662,8 @@ rule SIGNATURE_BASE_CN_Honker__D_Injection_V2_32_D_Injection_V2_32_D_Injection_V
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_tools.yar#L2467-L2488"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_tools.yar#L2467-L2488"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3a000b976c79585f62f40f7999ef9bdd326a9513"
hash = "3a000b976c79585f62f40f7999ef9bdd326a9513"
hash = "3a000b976c79585f62f40f7999ef9bdd326a9513"
@@ -290310,8 +290693,8 @@ rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Obfuscation : FILE
date = "2023-04-02"
modified = "2023-05-08"
reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_sparc_sbz_apr23.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_sparc_sbz_apr23.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3d45dc8d8dbc62cee6b7ec4aa842eaa88bd23aea17e995eef4850fd91e7069a3"
score = 60
quality = 85
@@ -290333,8 +290716,8 @@ rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Uniquestrings
date = "2023-04-02"
modified = "2023-05-08"
reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_sparc_sbz_apr23.yar#L26-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_sparc_sbz_apr23.yar#L26-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "bb95fc6bda0a0ed8ffc6db9734c725c487b0e70909d60119bf58d60987daaaeb"
score = 60
quality = 85
@@ -290358,8 +290741,8 @@ rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Modulestruct : FILE
date = "2023-04-02"
modified = "2023-05-08"
reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_sparc_sbz_apr23.yar#L49-L65"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_sparc_sbz_apr23.yar#L49-L65"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dc9608c769dcb14ba01559bfe2e8ed03eebf5695b867b53742f26e3fcce389ca"
score = 60
quality = 85
@@ -290381,8 +290764,8 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_1 : FILE
date = "2017-07-07"
modified = "2023-12-05"
reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_molerats_jul17.yar#L11-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_molerats_jul17.yar#L11-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a"
logic_hash = "1b7f00dfb83f5da46663d94f238b55e375743edbdb01701a78922b87c72c518a"
score = 75
@@ -290405,8 +290788,8 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_2 : FILE
date = "2017-07-07"
modified = "2023-12-05"
reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_molerats_jul17.yar#L27-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_molerats_jul17.yar#L27-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7e122a882d625f4ccac019efb7bf1b1024b9e0919d205105e7e299fb1a20a326"
logic_hash = "35a517039474dcc5d503a48ca17e544166ee2ed44417ea5e7711093d3956f80c"
score = 75
@@ -290431,8 +290814,8 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_3 : FILE
date = "2017-07-07"
modified = "2023-12-05"
reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_molerats_jul17.yar#L44-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_molerats_jul17.yar#L44-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "995eee4122802c2dc83bb619f8c53173a5a9c656ad8f43178223d78802445131"
hash = "fec657a19356753008b0f477083993aa5c36ebaf7276742cf84bfe614678746b"
logic_hash = "4829905ede523fd9ed2cdf610f8fce4c0a5d993885e1897d1782ca70e96fa9a2"
@@ -290457,8 +290840,8 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_4 : FILE
date = "2017-07-07"
modified = "2023-12-05"
reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_molerats_jul17.yar#L61-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_molerats_jul17.yar#L61-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "512a14130a7a8b5c2548aa488055051ab7e725106ddf2c705f6eb4cfa5dc795c"
logic_hash = "dec058ae52a860f4850d7b8024b96c5a9044fdcebadbc12b384f5a6dfae91634"
score = 75
@@ -290483,8 +290866,8 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_5 : FILE
date = "2017-07-07"
modified = "2023-12-05"
reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_molerats_jul17.yar#L78-L95"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_molerats_jul17.yar#L78-L95"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a"
logic_hash = "eb2bb54fc1749d8422cdc8e084e1fa66981611128f56e7d7d678f177d37b7cdd"
score = 75
@@ -290510,8 +290893,8 @@ rule SIGNATURE_BASE_Molerats_Jul17_Sample_Dropper : FILE
date = "2017-07-07"
modified = "2023-12-05"
reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_molerats_jul17.yar#L97-L112"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_molerats_jul17.yar#L97-L112"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ad0b3ac8c573d84c0862bf1c912dba951ec280d31fe5b84745ccd12164b0bcdb"
logic_hash = "b356d8dbca8f4d11dda976e7eb03c993d05af35d13113b8c85fb07531a0203dc"
score = 75
@@ -290536,8 +290919,8 @@ rule SIGNATURE_BASE_Greenbug_Malware_1 : FILE
date = "2017-01-25"
modified = "2023-12-05"
reference = "https://goo.gl/urp4CD"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_greenbug.yar#L12-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_greenbug.yar#L12-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dab460a0b73e79299fbff2fa301420c1d97a36da7426acc0e903c70495db2b76"
logic_hash = "e060a197dec0ce5da385abd282f0c4397bace8945b36198955925d02444b37a3"
score = 75
@@ -290561,8 +290944,8 @@ rule SIGNATURE_BASE_Greenbug_Malware_2 : FILE
date = "2017-01-25"
modified = "2023-12-05"
reference = "https://goo.gl/urp4CD"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_greenbug.yar#L28-L54"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_greenbug.yar#L28-L54"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6b28a43eda5b6f828a65574e3f08a6d00e0acf84cbb94aac5cec5cd448a4649d"
hash = "21f5e60e9df6642dbbceca623ad59ad1778ea506b7932d75ea8db02230ce3685"
hash = "319a001d09ee9d754e8789116bbb21a3c624c999dae9cf83fde90a3fbe67ee6c"
@@ -290597,8 +290980,8 @@ rule SIGNATURE_BASE_Greenbug_Malware_3
date = "2017-01-25"
modified = "2023-12-05"
reference = "https://goo.gl/urp4CD"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_greenbug.yar#L56-L73"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_greenbug.yar#L56-L73"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "44bdf5266b45185b6824898664fd0c0f2039cdcb48b390f150e71345cd867c49"
hash = "7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c"
logic_hash = "f4e8672da2ed9d90d4ebfccca977c4aeb93656d9e467cf479699cefd03611f32"
@@ -290625,8 +291008,8 @@ rule SIGNATURE_BASE_Greenbug_Malware_4 : FILE
date = "2017-01-25"
modified = "2023-12-05"
reference = "https://goo.gl/urp4CD"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_greenbug.yar#L75-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_greenbug.yar#L75-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f"
hash = "82beaef407f15f3c5b2013cb25901c9fab27b086cadd35149794a25dce8abcb9"
logic_hash = "869832536d838e062227ccd3b84f8559d2215360c0e09ec791db623d7d3d7a3b"
@@ -290662,8 +291045,8 @@ rule SIGNATURE_BASE_Greenbug_Malware_5 : FILE
date = "2017-01-25"
modified = "2023-01-27"
reference = "https://goo.gl/urp4CD"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_greenbug.yar#L103-L128"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_greenbug.yar#L103-L128"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f"
hash = "44bdf5266b45185b6824898664fd0c0f2039cdcb48b390f150e71345cd867c49"
hash = "7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c"
@@ -290694,8 +291077,8 @@ rule SIGNATURE_BASE_Greenbug_Malware_Nov17_1 : FILE
date = "2017-11-26"
modified = "2023-12-05"
reference = "http://www.clearskysec.com/greenbug/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_greenbug.yar#L141-L169"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_greenbug.yar#L141-L169"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6e55e161dc9ace3076640a36ef4a8819bb85c6d5e88d8e852088478f79cf3b7c"
hash = "a9f1375da973b229eb649dc3c07484ae7513032b79665efe78c0e55a6e716821"
logic_hash = "afd006d7e53cdedbed5938e5dea71273dd21a1382239bac03194662e95d053c8"
@@ -290727,8 +291110,8 @@ rule SIGNATURE_BASE_Wildneutron_Sample_1 : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wildneutron.yar#L10-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wildneutron.yar#L10-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94"
logic_hash = "d8044761fa51f2afd16eb096aa9e896483387c47e10ce922f2ef32ebcbd1a520"
score = 60
@@ -290761,8 +291144,8 @@ rule SIGNATURE_BASE_Wildneutron_Sample_2 : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wildneutron.yar#L36-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wildneutron.yar#L36-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8d80f9ef55324212759f4b6070cb8fce18a008ae9dd8b9598553206654d13a6f"
logic_hash = "3a796199a2e9f2711e5fbdc1050234a8f3c09f762bc645f49a705d9f112d9cdc"
score = 60
@@ -290792,8 +291175,8 @@ rule SIGNATURE_BASE_Wildneutron_Sample_3 : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wildneutron.yar#L59-L83"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wildneutron.yar#L59-L83"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0"
logic_hash = "16d511412576df2eb6d9646856d37bd94af7648cc602510696b74fa0534e405d"
score = 60
@@ -290824,8 +291207,8 @@ rule SIGNATURE_BASE_Wildneutron_Sample_4 : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wildneutron.yar#L85-L108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wildneutron.yar#L85-L108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45"
logic_hash = "4882b7c5f469615436490cd628ee3bb5b0dded43fb556ac6477cdadc6c8eff05"
score = 60
@@ -290856,8 +291239,8 @@ rule SIGNATURE_BASE_Wildneutron_Sample_5 : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wildneutron.yar#L110-L133"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wildneutron.yar#L110-L133"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1604e36ccef5fa221b101d7f043ad7f856b84bf1a80774aa33d91c2a9a226206"
logic_hash = "57792a54c96c59a1e9ed961715c72187936aee6f001c2ed4f95ca84e799e9c8c"
score = 60
@@ -290889,8 +291272,8 @@ rule SIGNATURE_BASE_Wildneutron_Sample_6 : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wildneutron.yar#L135-L149"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wildneutron.yar#L135-L149"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4bd548fe07b19178281edb1ee81c9711525dab03dc0b6676963019c44cc75865"
logic_hash = "7dc7f9815f2b2c934ecf93f5813bdb87364b2b9e2a5aebc04f76cfff43e46d30"
score = 60
@@ -290913,8 +291296,8 @@ rule SIGNATURE_BASE_Wildneutron_Sample_7 : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wildneutron.yar#L151-L176"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wildneutron.yar#L151-L176"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c"
logic_hash = "8a081932be8fd03c37a87486570a02a31756ba6bd125dbed7da9703197447ea5"
score = 60
@@ -290948,8 +291331,8 @@ rule SIGNATURE_BASE_Wildneutron_Sample_9 : FILE
date = "2015-07-10"
modified = "2023-01-06"
reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wildneutron.yar#L203-L223"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wildneutron.yar#L203-L223"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
logic_hash = "2029c94088e075cbcbae8d7d514cfc56add022d8776e59f04824d9ce9fd12794"
score = 60
@@ -290977,8 +291360,8 @@ rule SIGNATURE_BASE_Wildneutron_Sample_10 : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wildneutron.yar#L225-L267"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wildneutron.yar#L225-L267"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1d3bdabb350ba5a821849893dabe5d6056bf7ba1ed6042d93174ceeaa5d6dad7"
logic_hash = "b282b6892f9cb6769bf0e302deaa8062fd69bfd51144bc06fc9501fde9537dae"
score = 60
@@ -291024,8 +291407,8 @@ rule SIGNATURE_BASE_APT_MAL_Wildneutron_Javacpl : FILE
modified = "2023-01-06"
old_rule_name = "WildNeutron_javacpl"
reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wildneutron.yar#L272-L300"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wildneutron.yar#L272-L300"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9"
hash = "758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92"
hash = "8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a"
@@ -291056,8 +291439,8 @@ rule SIGNATURE_BASE_MAL_Sednit_Delphidownloader_Apr18_2 : FILE
date = "2018-04-24"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sednit_delphidownloader.yar#L11-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sednit_delphidownloader.yar#L11-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda"
hash = "657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4"
hash = "5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182"
@@ -291093,8 +291476,8 @@ rule SIGNATURE_BASE_MAL_Sednit_Delphidownloader_Apr18_3 : FILE
date = "2018-04-24"
modified = "2023-01-06"
reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sednit_delphidownloader.yar#L40-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sednit_delphidownloader.yar#L40-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ecb835d03060db1ea3496ceca2d79d7c4c6c671c9907e0b0e73bf8d3371fa931"
hash = "e355a327479dcc4e71a38f70450af02411125c5f101ba262e8df99f9f0fef7b6"
logic_hash = "20446692842ec9481f34dd976f6b309515c33159653f9988a59335d2f04e4138"
@@ -291125,8 +291508,8 @@ rule SIGNATURE_BASE_Unspecified_Malware_Oct16_A : FILE
date = "2016-10-08"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_malware_set_oct16.yar#L10-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_malware_set_oct16.yar#L10-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d112a7e21902287e4a37112bf17d7c73a7b206e7bc81780fd87991c1519f38c8"
logic_hash = "d71e6640be1b10790d49c084b9ba248e35a6a56dfe9c5a3f219a209024ebec27"
score = 80
@@ -291164,8 +291547,8 @@ rule SIGNATURE_BASE_Sality_Malware_Oct16 : FILE
date = "2016-10-08"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_malware_set_oct16.yar#L48-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_malware_set_oct16.yar#L48-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8eaff5e1d4b55dd6e25f007549271da10afd1fa25064d7105de0ca2735487aad"
logic_hash = "5bf14bbb0a7298a7bc896029c4b92ef9adf24307e4d05dcf86a518b266d1c2a8"
score = 80
@@ -291189,8 +291572,8 @@ rule SIGNATURE_BASE_Unspecified_Malware_Oct16_C : FILE
date = "2016-10-08"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_malware_set_oct16.yar#L65-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_malware_set_oct16.yar#L65-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a451157f75627b2fef3d663946c94ef7dacb58f08b31d0ec4c0a542a1c4e6205"
logic_hash = "1f212ef700e77c82954d997beef1157835da38330b583d02df418e10b6c182ee"
score = 80
@@ -291214,8 +291597,8 @@ rule SIGNATURE_BASE_Bladabindi_Malware_B64 : FILE
date = "2016-10-08"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_malware_set_oct16.yar#L91-L108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_malware_set_oct16.yar#L91-L108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dda668b0792b7679979e61f2038cf9a8ec39415cc161be00d2c8301e7d48768d"
logic_hash = "081a6361e29fc231f1467b837c51a39b8cccf8caa20844b22d469ce2bbd0c7fb"
score = 75
@@ -291242,8 +291625,8 @@ rule SIGNATURE_BASE_Dorkbot_Injector_Malware : FILE
date = "2016-10-08"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_malware_set_oct16.yar#L110-L129"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_malware_set_oct16.yar#L110-L129"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bc3c5ac7180c8ac21d6908d747aa6122154d2bb51bb99ff0e0b1c65088d275dc"
logic_hash = "36138520b0d39dc311b8e9355d1d1c215908a5fe1c01eec76c689f7e74a84303"
score = 75
@@ -291272,8 +291655,8 @@ rule SIGNATURE_BASE_Unspecified_Malware_Oct16_D : FILE
date = "2016-10-08"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_malware_set_oct16.yar#L131-L150"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_malware_set_oct16.yar#L131-L150"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cd5f3bc0176a6803093ffdea6a7442c416e0d2945b6903063d17f5bb8d17519d"
logic_hash = "78cde422987d2aff64967b86b6cf9279c112a2bfb713a2ea40fe952379d2e326"
score = 75
@@ -291301,8 +291684,8 @@ rule SIGNATURE_BASE_Unspecified_Malware_Oct16_E : FILE
date = "2016-10-08"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_malware_set_oct16.yar#L152-L167"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_malware_set_oct16.yar#L152-L167"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "28093385130b61f22920c0ce6e56de1f2cd8eef589bebe2af31f36f51f2b4d01"
logic_hash = "2040a8cee840560a5aa6065df17206c0313d85b2d11ce482baab05c492360f35"
score = 75
@@ -291327,8 +291710,8 @@ rule SIGNATURE_BASE_Ironpanda_Dnstunclient : FILE
date = "2015-09-16"
modified = "2023-12-05"
reference = "https://goo.gl/E4qia9"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger.yar#L10-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger.yar#L10-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a08db49e198068709b7e52f16d00a10d72b4d26562c0d82b4544f8b0fb259431"
logic_hash = "07c142f6eb11ecc8ed5f55d6b0cc7110c6268e189f3ce29215f75b7aba91a290"
score = 80
@@ -291361,8 +291744,8 @@ rule SIGNATURE_BASE_Ironpanda_Malware1 : FILE
date = "2015-09-16"
modified = "2023-12-05"
reference = "https://goo.gl/E4qia9"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger.yar#L38-L55"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger.yar#L38-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a0cee5822ddf254c254a5a0b7372c9d2b46b088a254a1208cb32f5fe7eca848a"
logic_hash = "4b50a2c7f0f94b678fc560eefb217c067e934f8e7d64bc0f0d16afcccccd0d08"
score = 75
@@ -291389,8 +291772,8 @@ rule SIGNATURE_BASE_Ironpanda_Webshell_JSP : FILE
date = "2015-09-16"
modified = "2023-12-05"
reference = "https://goo.gl/E4qia9"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger.yar#L57-L72"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger.yar#L57-L72"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3be95477e1d9f3877b4355cff3fbcdd3589bb7f6349fd4ba6451e1e9d32b7fa6"
logic_hash = "747ce812b156bf03f8d14ef84e7d2e8535c7c70590dfcb50ce3e957bec745efc"
score = 75
@@ -291415,8 +291798,8 @@ rule SIGNATURE_BASE_Ironpanda_Malware_Htran : FILE
date = "2015-09-16"
modified = "2023-12-05"
reference = "https://goo.gl/E4qia9"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger.yar#L74-L102"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger.yar#L74-L102"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7903f94730a8508e9b272b3b56899b49736740cea5037ea7dbb4e690bcaf00e7"
logic_hash = "e7312a2d0ffc247eda20cb5453538a501bde6683bf34e7f4bf2230243474ba76"
score = 75
@@ -291452,8 +291835,8 @@ rule SIGNATURE_BASE_Ironpanda_Malware2 : FILE
date = "2015-09-16"
modified = "2023-12-05"
reference = "https://goo.gl/E4qia9"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger.yar#L104-L121"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger.yar#L104-L121"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a89c21dd608c51c4bf0323d640f816e464578510389f9edcf04cd34090decc91"
logic_hash = "060c681e7127349464cd98f99cef6e184fbd18d2ec415dc6c95d8ac329e6fe7e"
score = 75
@@ -291480,8 +291863,8 @@ rule SIGNATURE_BASE_Ironpanda_Malware3 : FILE
date = "2015-09-16"
modified = "2023-12-05"
reference = "https://goo.gl/E4qia9"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger.yar#L123-L141"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger.yar#L123-L141"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5cd2af844e718570ae7ba9773a9075738c0b3b75c65909437c43201ce596a742"
logic_hash = "ca55fc5aa655fb221808b4c82db520cae24e0d93422293b6ed5e573b343e93ac"
score = 75
@@ -291509,8 +291892,8 @@ rule SIGNATURE_BASE_Ironpanda_Malware4 : FILE
date = "2015-09-16"
modified = "2023-12-05"
reference = "https://goo.gl/E4qia9"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger.yar#L143-L159"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger.yar#L143-L159"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0d6da946026154416f49df2283252d01ecfb0c41c27ef3bc79029483adc2240c"
logic_hash = "12661c8862eeb82d55a3912e0a499beb6bb19f7abe9ccfe6fa0506e6a032cfe4"
score = 75
@@ -291536,8 +291919,8 @@ rule SIGNATURE_BASE_Tidepool_Malware : FILE
date = "2016-05-24"
modified = "2023-12-05"
reference = "http://goo.gl/m2CXWR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_tidepool.yar#L8-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_tidepool.yar#L8-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
hash = "67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed"
hash = "2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18"
@@ -291570,8 +291953,8 @@ rule SIGNATURE_BASE_HKTL_EXPL_WIN_PS1_Badsuccessor_May25 : FILE
date = "2025-05-22"
modified = "2026-05-15"
reference = "https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/hktl_badsuccessor_helper_may25.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_badsuccessor_helper_may25.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a023bced4aec2b2c601088367766f42a3fcf36053c7eb92985cc7468c7cd6cb0"
score = 75
quality = 85
@@ -291594,8 +291977,8 @@ rule SIGNATURE_BASE_Merlinagent
date = "2017-12-26"
modified = "2023-12-05"
reference = "https://github.com/Ne0nd0g/merlin"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_merlin_agent.yar#L2-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_merlin_agent.yar#L2-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "21743230556cc11a78942de30be476ad8e73731bbda9a4feb83bd8140a703d01"
score = 75
quality = 85
@@ -291629,8 +292012,8 @@ rule SIGNATURE_BASE_APT_MAL_SLOTHFULMEDIA_Oct20_1 : FILE
date = "2020-10-01"
modified = "2023-12-05"
reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_iamtheking.yar#L2-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_iamtheking.yar#L2-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273"
hash = "927d945476191a3523884f4c0784fb71c16b7738bd7f2abd1e3a198af403f0ae"
hash = "f0503f0131040b805e106eafe64a65d9404a0e279f052237b868e456c34d36e6"
@@ -291683,8 +292066,8 @@ rule SIGNATURE_BASE_Crimsonrat_Mar18_1 : FILE
date = "2018-03-06"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_crimson_rat.yar#L11-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_crimson_rat.yar#L11-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "acf2e8013b6fafcf436d5a05049896504ffa2e982bca05155d19981d1931c611"
hash = "7ca6e5ef1d346ec35993c910128a3526b098a07445131784a9358bf5679e3975"
hash = "be4264973de9886caedae1cb707586588d0da85ac7a2ad277db4258033ea12a8"
@@ -291723,8 +292106,8 @@ rule SIGNATURE_BASE_Susp_File_Enumerator_With_Encrypted_Resource_101 : FILE
date = "2026-01-04"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stonedrill.yar#L12-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stonedrill.yar#L12-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2cd0a5f1e9bcce6807e57ec8477d222a"
hash = "c843046e54b755ec63ccb09d0a689674"
logic_hash = "0a207038b3cbba88d05cd6a053fd14337ac1fbb08b2a532b542ee2bb6b881a5a"
@@ -291751,8 +292134,8 @@ rule SIGNATURE_BASE_Stonedrill_Main_Sub : FILE
date = "2017-03-07"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stonedrill.yar#L43-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stonedrill.yar#L43-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d01781f1246fd1b64e09170bd6600fe1"
hash = "ac3c25534c076623192b9381f926ba0d"
logic_hash = "794094c0cbb81f6f971e16de36d444351b17cf38a91d8210f914b80da7d9ed26"
@@ -291776,8 +292159,8 @@ rule SIGNATURE_BASE_Stonedrill_BAT_1 : FILE
date = "2017-03-07"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stonedrill.yar#L65-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stonedrill.yar#L65-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d7263a527cae45072082c0f2fd0abc33acb2a25b34c06becf36fbd36f0697d5c"
score = 75
quality = 85
@@ -291803,8 +292186,8 @@ rule SIGNATURE_BASE_Stonedrill_Service_Install : FILE
date = "2017-03-07"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stonedrill.yar#L82-L96"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stonedrill.yar#L82-L96"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "52abe90c7f87ffeace4b58f9959e5a21c475bfa7ae2c5bc2744fe5fe43ffdda8"
score = 75
quality = 85
@@ -291829,8 +292212,8 @@ rule SIGNATURE_BASE_Stonedrill_Ntssrvr32 : FILE
date = "2017-03-07"
modified = "2023-01-27"
reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stonedrill.yar#L98-L118"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stonedrill.yar#L98-L118"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b"
logic_hash = "f1122aba53f32b10bd5f43cb619aa5d668b1457f3a5ea2a68c97254ab8631faa"
score = 75
@@ -291858,8 +292241,8 @@ rule SIGNATURE_BASE_Stonedrill_Malware_2 : FILE
date = "2017-03-07"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stonedrill.yar#L120-L145"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stonedrill.yar#L120-L145"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "69530d78c86031ce32583c6800f5ffc629acacb18aac4c8bb5b0e915fc4cc4db"
logic_hash = "cb1f8b24465ad8ca19dd540b1f8b63a73bc2624958bf45547b15c10583d07281"
score = 75
@@ -291893,8 +292276,8 @@ rule SIGNATURE_BASE_Stonedrill : FILE
date = "2017-03-07"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stonedrill.yar#L147-L170"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stonedrill.yar#L147-L170"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2bab3716a1f19879ca2e6d98c518debb107e0ed8e1534241f7769193807aac83"
hash = "62aabce7a5741a9270cddac49cd1d715305c1d0505e620bbeaec6ff9b6fd0260"
hash = "69530d78c86031ce32583c6800f5ffc629acacb18aac4c8bb5b0e915fc4cc4db"
@@ -291925,8 +292308,8 @@ rule SIGNATURE_BASE_Stonedrill_VBS_1 : FILE
date = "2017-03-07"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stonedrill.yar#L172-L192"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stonedrill.yar#L172-L192"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0f4d608a87e36cb0dbf1b2d176ecfcde837070a2b2a049d532d3d4226e0c9587"
logic_hash = "79416d27a6a09d544becd84f8e551c09b94c97181f8fddc481f47e42763d47ac"
score = 75
@@ -291955,8 +292338,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lorenz_May21_1 : FILE
date = "2021-05-04"
modified = "2023-12-05"
reference = "Internal Research - DACH TE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_ransom_lorenz.yar#L1-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_ransom_lorenz.yar#L1-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4b1170f7774acfdc5517fbe1c911f2bd9f1af498f3c3d25078f05c95701cc999"
hash = "8258c53a44012f6911281a6331c3ecbd834b6698b7d2dbf4b1828540793340d1"
hash = "c0c99b141b014c8e2a5c586586ae9dc01fd634ea977e2714fbef62d7626eb3fb"
@@ -291986,8 +292369,8 @@ rule SIGNATURE_BASE_SUSP_CMD_Var_Expansion : FILE
date = "2018-09-26"
modified = "2023-12-05"
reference = "https://twitter.com/asfakian/status/1044859525675843585"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_cmd_var_expansion.yar#L2-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_cmd_var_expansion.yar#L2-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "68ce14cac07494645f3b5f1d61012e4fe21cfa9fa7ad4019add2368b568fe043"
score = 60
quality = 85
@@ -292008,8 +292391,8 @@ rule SIGNATURE_BASE_SUSP_EXPL_Commvault_CVE_2025_57791_Aug25_1 : FILE
date = "2025-08-21"
modified = "2026-05-15"
reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_commvault_cve_2025_57791.yar#L1-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_commvault_cve_2025_57791.yar#L1-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d5c6815a5ca3b03ef8f76ed7b378800012c763f90fcba2187bb07d81ce01d832"
score = 60
quality = 85
@@ -292031,8 +292414,8 @@ rule SIGNATURE_BASE_SUSP_EXPL_Commvault_CVE_2025_57791_Aug25_2 : FILE
date = "2025-08-21"
modified = "2026-05-15"
reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_commvault_cve_2025_57791.yar#L17-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_commvault_cve_2025_57791.yar#L17-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "61e3ddc09157badb2a1abf30da2cc35cac1a723db1134a37cb667be78209b845"
score = 65
quality = 85
@@ -292054,11 +292437,11 @@ rule SIGNATURE_BASE_SUSP_EXPL_Commvault_CVE_2025_57791_Artifact_Aug25 : FILE
date = "2025-08-21"
modified = "2026-05-15"
reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_commvault_cve_2025_57791.yar#L32-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_commvault_cve_2025_57791.yar#L32-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7a3f57509dc7e986fd6d00204deb5baec815e04e0e140a7751bab8ce18e8da62"
score = 75
- quality = 35
+ quality = 60
tags = "FILE"
strings:
@@ -292079,8 +292462,8 @@ rule SIGNATURE_BASE_EXPL_JSP_Commvault_CVE_2025_57791_Aug25_1 : FILE
date = "2025-08-21"
modified = "2026-05-15"
reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_commvault_cve_2025_57791.yar#L50-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_commvault_cve_2025_57791.yar#L50-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "359b35ced874244901f64bc09456cfec7079421ef6bab58ea95a3b1887ecc858"
score = 75
quality = 85
@@ -292102,8 +292485,8 @@ rule SIGNATURE_BASE_EXPL_JSP_Commvault_CVE_2025_57791_Aug25_2 : FILE
date = "2025-08-21"
modified = "2026-05-15"
reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_commvault_cve_2025_57791.yar#L65-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_commvault_cve_2025_57791.yar#L65-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3375a33556a9b479f0c170de6e06c80ab0277f1356e4ac44bfe51d6a65a578fe"
score = 75
quality = 85
@@ -292126,11 +292509,11 @@ rule SIGNATURE_BASE_EXPL_LOG_Commvault_CVE_2025_57791_Indicator_Shell_Drop_Aug25
date = "2025-08-21"
modified = "2026-05-15"
reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_commvault_cve_2025_57791.yar#L81-L93"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_commvault_cve_2025_57791.yar#L81-L93"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f0e9fedba803b0cd8b1469bad7a50bf4647f7e2f786520caf5a79ac626879125"
score = 70
- quality = 60
+ quality = 85
tags = ""
strings:
@@ -292148,8 +292531,8 @@ rule SIGNATURE_BASE_HTA_With_Wscript_Shell
date = "2017-06-21"
modified = "2023-12-05"
reference = "https://twitter.com/msftmmpc/status/877396932758560768"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_hta_anomalies.yar#L11-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_hta_anomalies.yar#L11-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ca7b653cf41e980c44311b2cd701ed666f8c1dbc"
logic_hash = "7ce2728fbd3023a6b96291cdb63f30dc9b71e5fc506f8b00ad97e3062b103478"
score = 80
@@ -292173,8 +292556,8 @@ rule SIGNATURE_BASE_HTA_Embedded
date = "2017-06-21"
modified = "2023-12-05"
reference = "https://twitter.com/msftmmpc/status/877396932758560768"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_hta_anomalies.yar#L28-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_hta_anomalies.yar#L28-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ca7b653cf41e980c44311b2cd701ed666f8c1dbc"
logic_hash = "843f0ad5e39e5492db8ff7372f6d2038e7dbb7823ec9b33f863ab891a108b1ec"
score = 50
@@ -292197,8 +292580,8 @@ rule SIGNATURE_BASE_Derusbi_Kernel : FILE
date = "2015-12-09"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_derusbi.yar#L9-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_derusbi.yar#L9-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d5a0ce0b0116c3a84d52c22369dbf3cb9cf3ad8f8a05cea5565ba9bb99255fab"
score = 75
quality = 85
@@ -292221,8 +292604,8 @@ rule SIGNATURE_BASE_Derusbi_Linux : FILE
date = "2015-12-09"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_derusbi.yar#L24-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_derusbi.yar#L24-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "68d5af17b33d1aa0388516e5d2a1ad29c22dc04451e232dfbdf1ef0714baeb10"
score = 75
quality = 85
@@ -292247,8 +292630,8 @@ rule SIGNATURE_BASE_Derusbi_Kernel_Driver_WD_UDFS : FILE
date = "2015-12-15"
modified = "2023-12-05"
reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_derusbi.yar#L48-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_derusbi.yar#L48-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
hash = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
hash = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
@@ -292284,8 +292667,8 @@ rule SIGNATURE_BASE_Derusbi_Code_Signing_Cert : FILE
date = "2015-12-15"
modified = "2023-12-05"
reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_derusbi.yar#L81-L96"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_derusbi.yar#L81-L96"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dae976a4896a4f6b6a1b415582db84f3da5aac03bf4079f75e11c790dcf23900"
score = 60
quality = 85
@@ -292309,8 +292692,8 @@ rule SIGNATURE_BASE_XOR_4Byte_Key : FILE
date = "2015-12-15"
modified = "2023-12-05"
reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_derusbi.yar#L98-L121"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_derusbi.yar#L98-L121"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "61cbdac3fd9a486d85261234698f33aa04d505b32dfec731de6fc61d103bf609"
score = 60
quality = 85
@@ -292332,8 +292715,8 @@ rule SIGNATURE_BASE_Derusbi_Backdoor_Mar17_1 : FILE
date = "2017-03-03"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_derusbi.yar#L123-L143"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_derusbi.yar#L123-L143"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f87915f21dcc527981ebb6db3d332b5b341129b4af83524f59d7178e9d2a3a32"
logic_hash = "068a8d5c7378c6cf9d0369374550cd34b54e9f913aa7512a6beb46395fc15b19"
score = 75
@@ -292363,8 +292746,8 @@ rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_1 : FILE
date = "2023-01-27"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_onenote_phish.yar#L2-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_onenote_phish.yar#L2-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c7c5fc86f1dbe54da2d3ff8f039c5e53c3d1f67c9271cb467b2318310f744f93"
score = 65
quality = 85
@@ -292402,8 +292785,8 @@ rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_2 : FILE
date = "2023-01-27"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_onenote_phish.yar#L41-L61"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_onenote_phish.yar#L41-L61"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "eb6f992ce186022f04613af3bf4df629b00d85eac151f8bbd4b8ef96e6892eab"
score = 65
quality = 85
@@ -292428,8 +292811,8 @@ rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_1 : FIL
date = "2023-01-27"
modified = "2023-02-27"
reference = "https://blog.didierstevens.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_onenote_phish.yar#L63-L106"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_onenote_phish.yar#L63-L106"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d91ca297ea96f80534085f174d335ffe961c569534f043c5c2ae8d6a9f7ac083"
score = 65
quality = 85
@@ -292479,8 +292862,8 @@ rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_2 : FIL
date = "2023-01-27"
modified = "2023-12-05"
reference = "https://blog.didierstevens.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_onenote_phish.yar#L108-L125"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_onenote_phish.yar#L108-L125"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "bc07598570b6d4ebc5d14cedfed146c1ad309b8890bc0b9ee5f9ad645c1352e2"
score = 65
quality = 85
@@ -292502,8 +292885,8 @@ rule SIGNATURE_BASE_HKTL_EDR_Freeze_Sep25_2 : FILE
date = "2025-09-30"
modified = "2026-05-15"
reference = "https://github.com/TwoSevenOneT/EDR-Freeze"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/hktl_edr_freeze_sep25.yar#L1-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_edr_freeze_sep25.yar#L1-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "193ca17f574fa5e23866560170425f83696f78e83dabd7e831dd7827a69283fd"
hash = "36a17919a97732f1ddc31b421c6ebb0c535924f895d7caaff04a5da908c42f76"
hash = "394b768bfd3506a9ee6b7bbe6f87c40fb23c28f7919a2a9eb333b27db635eafe"
@@ -292539,8 +292922,8 @@ rule SIGNATURE_BASE_Fireball_De_Svr : FILE
date = "2017-06-02"
modified = "2023-12-05"
reference = "https://goo.gl/4pTkGQ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_fireball.yar#L12-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_fireball.yar#L12-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f964a4b95d5c518fd56f06044af39a146d84b801d9472e022de4c929a5b8fdcc"
logic_hash = "9ac858b3ce50daac811ded4664f2a602a32d8811825733d235125fc81a488e58"
score = 75
@@ -292567,8 +292950,8 @@ rule SIGNATURE_BASE_Fireball_Lancer : FILE
date = "2017-06-02"
modified = "2023-12-05"
reference = "https://goo.gl/4pTkGQ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_fireball.yar#L31-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_fireball.yar#L31-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7d68386554e514f38f98f24e8056c11c0a227602ed179d54ed08f2251dc9ea93"
logic_hash = "74df144556121609da0820c319a86a9de0f49eeb2d4b1ed59c3a4d0c1d7788cb"
score = 75
@@ -292597,8 +292980,8 @@ rule SIGNATURE_BASE_Qqbrowser : FILE
date = "2017-06-02"
modified = "2023-12-05"
reference = "https://goo.gl/4pTkGQ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_fireball.yar#L53-L70"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_fireball.yar#L53-L70"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "adcf6b8aa633286cd3a2ce7c79befab207802dec0e705ed3c74c043dabfc604c"
logic_hash = "525d134f57aaa314bcf0676678264e518edb785970478cb31a8fb6f1c8c92263"
score = 50
@@ -292624,8 +293007,8 @@ rule SIGNATURE_BASE_Chrome_Elf : FILE
date = "2017-06-02"
modified = "2023-12-05"
reference = "https://goo.gl/4pTkGQ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_fireball.yar#L72-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_fireball.yar#L72-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e4d4f6fbfbbbf3904ca45d296dc565138a17484c54aebbb00ba9d57f80dfe7e5"
logic_hash = "89f0ab16f164222ecf2a4b14bee02d0c24517d03d1c12b25f5158eebc31b3e3d"
score = 75
@@ -292653,8 +293036,8 @@ rule SIGNATURE_BASE_Fireball_Regkey : FILE
date = "2017-06-02"
modified = "2022-12-21"
reference = "https://goo.gl/4pTkGQ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_fireball.yar#L92-L108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_fireball.yar#L92-L108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fff2818caa9040486a634896f329b8aebaec9121bdf9982841f0646763a1686b"
logic_hash = "f8fe8b1edb009ac84acf6159feada91d364507c53a9f92abd6b245b38fa058f5"
score = 75
@@ -292679,8 +293062,8 @@ rule SIGNATURE_BASE_Fireball_Winsap : FILE
date = "2017-06-02"
modified = "2023-12-05"
reference = "https://goo.gl/4pTkGQ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_fireball.yar#L110-L128"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_fireball.yar#L110-L128"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c7244d139ef9ea431a5b9cc6a2176a6a9908710892c74e215431b99cd5228359"
logic_hash = "de722d90d82f82faa5dfe5991c846e5c16deb919ae653b8f9fe4d1ad0384c41d"
score = 75
@@ -292708,8 +293091,8 @@ rule SIGNATURE_BASE_Fireball_Archer : FILE
date = "2017-06-02"
modified = "2022-12-21"
reference = "https://goo.gl/4pTkGQ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_fireball.yar#L130-L149"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_fireball.yar#L130-L149"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022"
logic_hash = "f566ba477ccf1325914b6c9785e2b85f732b211e9321eea24d6c5a0339ccc4d1"
score = 75
@@ -292736,8 +293119,8 @@ rule SIGNATURE_BASE_Clearlog : FILE
date = "2017-06-02"
modified = "2023-12-05"
reference = "https://goo.gl/4pTkGQ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_fireball.yar#L151-L171"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_fireball.yar#L151-L171"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "14093ce6d0fe8ab60963771f48937c669103842a0400b8d97f829b33c420f7e3"
logic_hash = "6b6fd74ad184cafa7885385f808034e9211ff37e04ed5e8ea4af2c7fb7d697bd"
score = 75
@@ -292766,8 +293149,8 @@ rule SIGNATURE_BASE_Fireball_Gubed : FILE
date = "2017-06-02"
modified = "2022-12-21"
reference = "https://goo.gl/4pTkGQ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_fireball.yar#L173-L191"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_fireball.yar#L173-L191"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e3f69a1fb6fcaf9fd93386b6ba1d86731cd9e5648f7cff5242763188129cd158"
logic_hash = "e8053d8a95d41d81940bbaf7945323849613dbcfe727559a07bc294bd834b65f"
score = 75
@@ -292795,8 +293178,8 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1 : FILE
date = "2023-03-29"
modified = "2023-04-20"
reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L3-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L3-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
hash = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
hash = "cc4eedb7b1f77f02b962f4b05278fa7f8082708b5a12cacf928118520762b5e2"
@@ -292827,8 +293210,8 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_2 : FILE
date = "2023-03-29"
modified = "2023-12-05"
reference = "https://twitter.com/dan__mayer/status/1641170769194672128?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L32-L54"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L32-L54"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
logic_hash = "dec8310c1f5b304a755737a0005bb33b1762f21ed380b2b98b0f5427948ab930"
score = 80
@@ -292856,8 +293239,8 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_3
date = "2023-03-29"
modified = "2023-12-05"
reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L56-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L56-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
logic_hash = "adfe04904d796690631e5841ee1ee10c767f9f4c340e5b9df78918e981359d4d"
score = 80
@@ -292884,8 +293267,8 @@ rule SIGNATURE_BASE_SUSP_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1
date = "2023-03-29"
modified = "2023-04-20"
reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L81-L98"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L81-L98"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
hash = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
hash = "cc4eedb7b1f77f02b962f4b05278fa7f8082708b5a12cacf928118520762b5e2"
@@ -292910,8 +293293,8 @@ rule SIGNATURE_BASE_APT_SUSP_NK_3CX_RC4_Key_Mar23_1 : FILE
date = "2023-03-29"
modified = "2023-12-05"
reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L100-L117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L100-L117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
hash = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
hash = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
@@ -292937,8 +293320,8 @@ rule SIGNATURE_BASE_SUSP_3CX_App_Signed_Binary_Mar23_1 : FILE
date = "2023-03-29"
modified = "2023-12-05"
reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L119-L139"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L119-L139"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405"
hash = "dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc"
logic_hash = "3834b5ebb5a0db27a452fda1c97c921b2c9c8702505738232b15a3ed4a47dc47"
@@ -292963,8 +293346,8 @@ rule SIGNATURE_BASE_SUSP_3CX_MSI_Signed_Binary_Mar23_1 : FILE
date = "2023-03-29"
modified = "2023-12-05"
reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L141-L166"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L141-L166"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
hash = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
logic_hash = "b0fa9821a02803473ce8139b19d005968b03c9765cff5b9ae5428a259d88cc9f"
@@ -292990,8 +293373,8 @@ rule SIGNATURE_BASE_APT_MAL_Macos_NK_3CX_Malicious_Samples_Mar23_1 : FILE
date = "2023-03-30"
modified = "2023-12-05"
reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L168-L184"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L168-L184"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb"
hash = "ac99602999bf9823f221372378f95baa4fc68929bac3a10e8d9a107ec8074eca"
hash = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
@@ -293016,8 +293399,8 @@ rule SIGNATURE_BASE_APT_MAL_Macos_NK_3CX_DYLIB_Mar23_1
date = "2023-03-30"
modified = "2023-12-05"
reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
hash = "fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7"
logic_hash = "e52c76de1e995cc7084ddb390b60f4bc66e5bdf89aaa28ef3fd70578ed3145a6"
@@ -293049,8 +293432,8 @@ rule SIGNATURE_BASE_APT_SUSP_NK_3CX_Malicious_Samples_Mar23_1
date = "2023-03-30"
modified = "2023-12-05"
reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L216-L232"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L216-L232"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
hash = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
hash = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
@@ -293075,8 +293458,8 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_4
date = "2023-03-29"
modified = "2023-12-05"
reference = "https://twitter.com/WhichbufferArda/status/1641404343323688964?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L234-L249"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L234-L249"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "851c2c99ebafd4e5e9e140cfe3f2d03533846ca16f8151ae8ee0e83c692884b7"
logic_hash = "2fd56527a094b1f155cf33af402328835d4fb8aee9a058742d3e3763acef9e46"
score = 80
@@ -293100,8 +293483,8 @@ rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Backdoor_Mar23 : FILE
date = "2023-03-30"
modified = "2023-12-05"
reference = "https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
logic_hash = "777a0a29c376f3697021dd627e716c31bda7933c5f40a8fe79b80e3cea46ce43"
score = 80
@@ -293126,8 +293509,8 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1 : FILE
date = "2023-03-31"
modified = "2023-12-05"
reference = "https://github.com/volexity/threat-intel/blob/main/2023/2023-03-30%203CX/attachments/iconicstealer.7z"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L279-L304"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L279-L304"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423"
logic_hash = "1f57a2af4a5b9e71e2b72ddc3839400731d9d37eb4349c393b37b3f86c0c7f73"
score = 80
@@ -293156,8 +293539,8 @@ rule SIGNATURE_BASE_APT_MAL_NK_3CX_Macos_Elextron_App_Mar23_1 : FILE
date = "2023-03-31"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L306-L328"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L306-L328"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
hash = "f7ba7f9bf608128894196cf7314f68b78d2a6df10718c8e0cd64dbe3b86bc730"
logic_hash = "00dd28c3edd94e04e35ee9e3a43c30b5a0a1ad21ec8ecf2099bbeb9de2fca8d0"
@@ -293183,8 +293566,8 @@ rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Updateagent_Mar23 : FILE
date = "2023-03-30"
modified = "2023-12-05"
reference = "https://twitter.com/patrickwardle/status/1641692164303515653?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L330-L354"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L330-L354"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9e9a5f8d86356796162cee881c843cde9eaedfb3"
logic_hash = "0818a8f0b59a9baaefaa0b505f8261e0e0df283e79da8e95dc71e9afdca224ab"
score = 80
@@ -293210,8 +293593,8 @@ rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_2
date = "2023-04-29"
modified = "2023-12-05"
reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L373-L392"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L373-L392"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c4887a5cd6d98e273ba6e9ea3c1d8f770ef26239819ea24a1bfebd81d6870505"
logic_hash = "a15f7f06be5e620baf33d595afc35246dae0307978984af832940a74ef2c84eb"
score = 80
@@ -293238,8 +293621,8 @@ rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_3
date = "2023-04-29"
modified = "2023-12-05"
reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L394-L410"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L394-L410"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "595392959b609caf088d027a23443cf2fefd043607ccdec3de19ad3bb43a74b1"
logic_hash = "58f860926db4a7dfefbd39ee35efaa0081b7e31a361efce02f5144266ab652a6"
score = 80
@@ -293264,8 +293647,8 @@ rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_4
date = "2023-04-29"
modified = "2023-12-05"
reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_3cx_compromise_mar23.yar#L412-L428"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_3cx_compromise_mar23.yar#L412-L428"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b0761f81afb102bb784b398b16faa965594e469a7fcfdfd553ced19cc17e70b"
logic_hash = "ad22df404d948073428fc35b0c8fbfea25da3bc66e46ea6397ff751ae65d5939"
score = 80
@@ -293291,8 +293674,8 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_1 : FILE
date = "2018-02-22"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_mosquito.yar#L13-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_mosquito.yar#L13-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b295032919143f5b6b3c87ad22bcf8b55ecc9244aa9f6f88fc28f36f5aa2925e"
logic_hash = "22d799531986c30da19943f1dda305e61a305083478549e93c0ecddeade77b39"
score = 75
@@ -293317,8 +293700,8 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_2 : FILE
date = "2018-02-22"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_mosquito.yar#L32-L52"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_mosquito.yar#L32-L52"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "68c6e9dea81f082601ae5afc41870cea3f71b22bfc19bcfbc61d84786e481cb4"
hash = "05254971fe3e1ca448844f8cfcfb2b0de27e48abd45ea2a3df897074a419a3f4"
logic_hash = "f1f93d3bc1c4bd55fc7558716a0a1eb7a6c4c2381a4532d37f4e3559f7c809ea"
@@ -293346,8 +293729,8 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_3 : FILE
date = "2018-02-22"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_mosquito.yar#L54-L77"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_mosquito.yar#L54-L77"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "443cd03b37fca8a5df1bbaa6320649b441ca50d1c1fcc4f5a7b94b95040c73d1"
logic_hash = "0f59c130b500625466da0c8b5bfd84051ee59a3b6261ee3d990d4c355b10672b"
score = 75
@@ -293375,8 +293758,8 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_4 : FILE
date = "2018-02-22"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_mosquito.yar#L79-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_mosquito.yar#L79-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b362b235539b762734a1833c7e6c366c1b46474f05dc17b3a631b3bff95a5eec"
logic_hash = "4765b912258491f38c03513204d9af8bc62c37df2fe583e371cbbeff6fc12298"
score = 75
@@ -293397,8 +293780,8 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_5 : FILE
date = "2018-02-22"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_mosquito.yar#L92-L103"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_mosquito.yar#L92-L103"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "26a1a42bc74e14887616f9d6048c17b1b4231466716a6426e7162426e1a08030"
logic_hash = "5b0366194410f36c47dd41f6a36c45edbce75e3ddad19520b17bed59513e1dbc"
score = 75
@@ -293418,8 +293801,8 @@ rule SIGNATURE_BASE_Turlamosquito_Mal_6 : FILE
date = "2018-02-22"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_mosquito.yar#L105-L127"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_mosquito.yar#L105-L127"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b79cdf929d4a340bdd5f29b3aeccd3c65e39540d4529b64e50ebeacd9cdee5e9"
logic_hash = "9ca6ae4313ad8f009b17188aa7184ff01a4b7e35926f3f68dc3aea12bffb9bb1"
score = 75
@@ -293448,8 +293831,8 @@ rule SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1 : FILE
date = "2022-10-25"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_mosquito.yar#L129-L156"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_mosquito.yar#L129-L156"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6b9e48e3f4873cfb95639d9944fe60e3b056daaa2ea914add14c982e3e11128b"
hash = "b868b674476418bbdffbe0f3d617d1cce4c2b9dae0eaf3414e538376523e8405"
hash = "e7fd14ca45818044690ca67f201cc8cfb916ccc941a105927fc4c932c72b425d"
@@ -293479,8 +293862,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Nov21_1 : FILE
date = "2021-11-23"
modified = "2023-12-05"
reference = "https://www.ic3.gov/Media/News/2021/211117-2.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_spring4shell.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_spring4shell.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1dac7706421961c71ba6f8d7a223b80e4b77bf206bfb64ee18c7cc894b062a3c"
score = 70
quality = 85
@@ -293504,8 +293887,8 @@ rule SIGNATURE_BASE_EXPL_POC_Springcore_0Day_Indicators_Mar22_1
date = "2022-03-30"
modified = "2023-12-05"
reference = "https://twitter.com/vxunderground/status/1509170582469943303"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_spring4shell.yar#L19-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_spring4shell.yar#L19-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "39fb62ec7953dae0a88e39e73e3ff286fc19cb8f21f8feb869a1875f6ba70cfb"
score = 70
quality = 85
@@ -293529,8 +293912,8 @@ rule SIGNATURE_BASE_EXPL_POC_Springcore_0Day_Webshell_Mar22_1 : FILE
date = "2022-03-30"
modified = "2023-12-05"
reference = "https://twitter.com/vxunderground/status/1509170582469943303"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_spring4shell.yar#L36-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_spring4shell.yar#L36-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "17282b66899356a6051f0b47a7a3f02265737283d760f2256e03a2b934bb63b8"
score = 70
quality = 85
@@ -293553,8 +293936,8 @@ rule SIGNATURE_BASE_APT_UNC5221_Ivanti_Forensicartifacts_Jan24_1 : FILE
date = "2024-01-11"
modified = "2024-04-24"
reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_report_ivanti_mandiant_jan24.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_report_ivanti_mandiant_jan24.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7f485f41072f5584dc76e71564e13066d9fe41685f33bff9c2886fa7d2155f94"
score = 75
quality = 85
@@ -293577,8 +293960,8 @@ rule SIGNATURE_BASE_M_Hunting_Backdoor_ZIPLINE_1 : FILE
date = "2024-01-11"
modified = "2024-04-24"
reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_report_ivanti_mandiant_jan24.yar#L18-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_report_ivanti_mandiant_jan24.yar#L18-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "41857ba465dd1f2e1aa8c1eed36b73606385eeedf233fd480bb8a4ef15499174"
score = 75
quality = 85
@@ -293604,8 +293987,8 @@ rule SIGNATURE_BASE_M_Hunting_Dropper_WIREFIRE_1 : FILE
date = "2024-01-11"
modified = "2024-04-24"
reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_report_ivanti_mandiant_jan24.yar#L40-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_report_ivanti_mandiant_jan24.yar#L40-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6de651357a15efd01db4e658249d4981"
logic_hash = "c389a666bd093cdd7700385da43c8fa58b9f3d899e658c516df0f3aca439401d"
score = 75
@@ -293631,8 +294014,8 @@ rule SIGNATURE_BASE_M_Hunting_Webshell_LIGHTWIRE_2 : FILE
date = "2024-01-11"
modified = "2024-01-12"
reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_report_ivanti_mandiant_jan24.yar#L60-L81"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_report_ivanti_mandiant_jan24.yar#L60-L81"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3d97f55a03ceb4f71671aa2ecf5b24e9"
logic_hash = "37b22a6c45dd53bc7b3f0c75cc5072e990246fea24591d192176c0b496e92084"
score = 75
@@ -293658,8 +294041,8 @@ rule SIGNATURE_BASE_M_Hunting_Dropper_THINSPOOL_1 : FILE
date = "2024-01-11"
modified = "2024-04-24"
reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_report_ivanti_mandiant_jan24.yar#L83-L100"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_report_ivanti_mandiant_jan24.yar#L83-L100"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "677c1aa6e2503b56fe13e1568a814754"
logic_hash = "a8043822cd36a802ba6656c42085f09d67cedb0689c9da48438d788b320bd6c0"
score = 75
@@ -293684,8 +294067,8 @@ rule SIGNATURE_BASE_M_Hunting_Credtheft_WARPWIRE_1 : FILE
date = "2024-01-11"
modified = "2024-04-24"
reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_report_ivanti_mandiant_jan24.yar#L102-L120"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_report_ivanti_mandiant_jan24.yar#L102-L120"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d0c7a334a4d9dcd3c6335ae13bee59ea"
logic_hash = "8029df5998166ab3db3319b0dd765ef3356b4b44dc16d2d418015a0f7ffac97e"
score = 75
@@ -293711,8 +294094,8 @@ rule SIGNATURE_BASE_Gazer_Certificate_1 : FILE
date = "2017-08-30"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_gazer.yar#L27-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_gazer.yar#L27-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ef248ac5cdde0034d940f80b32966fe64841dcf99923dfc0a7035354af963f56"
score = 75
quality = 85
@@ -293734,8 +294117,8 @@ rule SIGNATURE_BASE_Gazer_Logfile_Name_1 : FILE
date = "2017-08-30"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_gazer.yar#L41-L54"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_gazer.yar#L41-L54"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c893ec41884f106329350c079b087e41a5b9f1040ab0892c90c03972d49dc070"
score = 75
quality = 85
@@ -293758,8 +294141,8 @@ rule SIGNATURE_BASE_EXPL_CVE_2021_40444_Document_Rels_XML : CVE_2021_40444 FILE
date = "2021-09-10"
modified = "2023-12-05"
reference = "https://twitter.com/AlteredBytes/status/1435811407249952772"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cve_2021_40444.yar#L6-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cve_2021_40444.yar#L6-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b05c3b33c3cab2c9109d808ed197758bc987f07beee77e1f61094715e0c1a1e7"
score = 75
quality = 85
@@ -293784,8 +294167,8 @@ rule SIGNATURE_BASE_EXPL_MAL_Maldoc_OBFUSCT_MHTML_Sep21_1 : CVE_2021_40444 FILE
date = "2021-09-18"
modified = "2023-12-05"
reference = "https://twitter.com/decalage2/status/1438946225190014984?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cve_2021_40444.yar#L27-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cve_2021_40444.yar#L27-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
logic_hash = "11a73572970d2d85d308330119a2c5243f2848ae78a861decdb0cdbde0d9d1c2"
score = 90
@@ -293808,13 +294191,13 @@ rule SIGNATURE_BASE_EXPL_XML_Encoded_CVE_2021_40444 : CVE_2021_40444 FILE
date = "2021-09-18"
modified = "2021-09-19"
reference = "https://twitter.com/sudosev/status/1439205606129377282"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cve_2021_40444.yar#L44-L61"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cve_2021_40444.yar#L44-L61"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "13de9f39b1ad232e704b5e0b5051800fcd844e9f661185ace8287a23e9b3868e"
hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
logic_hash = "feaeadd8e7e262f191ea0c2f85377531208262e5ac19d6706703e62cf8b4ec90"
score = 70
- quality = 60
+ quality = 85
tags = "CVE-2021-40444, FILE"
strings:
@@ -293834,8 +294217,8 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_1 : WINDOWS CVE FI
date = "2021-09-18"
modified = "2023-12-05"
reference = "https://twitter.com/sudosev/status/1439205606129377282"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cve_2021_40444.yar#L64-L81"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cve_2021_40444.yar#L64-L81"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "13de9f39b1ad232e704b5e0b5051800fcd844e9f661185ace8287a23e9b3868e"
hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
logic_hash = "fc8f0dd02460ab8f8cc6717c66eba51e6ed74881a48e92fd0bf978467dfb40e3"
@@ -293860,8 +294243,8 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_2 : WINDOWS CVE FI
date = "2021-09-18"
modified = "2023-12-05"
reference = "https://twitter.com/sudosev/status/1439205606129377282"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cve_2021_40444.yar#L83-L98"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cve_2021_40444.yar#L83-L98"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "82c70e0f0b72a57302e5853cc53ae18dbb0bc8dabdfd27b473a7664b2fc5e874"
score = 65
quality = 85
@@ -293885,8 +294268,8 @@ rule SIGNATURE_BASE_APT_Lazarus_Aug18_Downloader_1 : FILE
date = "2018-08-24"
modified = "2023-12-05"
reference = "https://securelist.com/operation-applejeus/87553/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_applejeus.yar#L13-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_applejeus.yar#L13-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d555dcb6da4a6b87e256ef75c0150780b8a343c4a1e09935b0647f01d974d94d"
hash = "bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb"
hash = "e2199fc4e4b31f7e4c61f6d9038577633ed6ad787718ed7c39b36f316f38befd"
@@ -293918,8 +294301,8 @@ rule SIGNATURE_BASE_APT_Lazarus_Aug18_1 : FILE
date = "2018-08-24"
modified = "2023-12-05"
reference = "https://securelist.com/operation-applejeus/87553/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_applejeus.yar#L39-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_applejeus.yar#L39-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ef400d73c6920ac811af401259e376458b498eb0084631386136747dfc3dcfa8"
hash = "1b8d3e69fc214cb7a08bef3c00124717f4b4d7fd6be65f2829e9fd337fc7c03c"
logic_hash = "efd43e2d84ba964e7fc7e6c03eaba3dd5181c9cbe51b4a06a7a723dca95fab17"
@@ -293947,8 +294330,8 @@ rule SIGNATURE_BASE_APT_Lazarus_Aug18_2 : FILE
date = "2018-08-24"
modified = "2023-12-05"
reference = "https://securelist.com/operation-applejeus/87553/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_applejeus.yar#L62-L82"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_applejeus.yar#L62-L82"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ae766795cda6336fd5cad9e89199ea2a1939a35e03eb0e54c503b1029d870c4"
hash = "d3ef262bae0beb5d35841d131b3f89a9b71a941a86dab1913bda72b935744d2e"
logic_hash = "75d52ad829383392d9eb20a8308278d073d16f7624e60010356534bdc6acc81f"
@@ -293976,8 +294359,8 @@ rule SIGNATURE_BASE_APT_Fallchill_RC4_Keys : FILE
date = "2018-08-21"
modified = "2023-12-05"
reference = "https://securelist.com/operation-applejeus/87553/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_applejeus.yar#L84-L100"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_applejeus.yar#L84-L100"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "59861618dba256996d7bbcd94a6efccdb64589fc75086bfe7d980fa51761ef97"
score = 75
quality = 85
@@ -294002,8 +294385,8 @@ rule SIGNATURE_BASE_Base64_PS1_Shellcode
date = "2018-11-14"
modified = "2023-12-05"
reference = "https://twitter.com/ItsReallyNick/status/1062601684566843392"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_ps1_shellcode.yar#L1-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_ps1_shellcode.yar#L1-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fac6f41965eb2209f1552763800d6a2b172f28cd29bb7586d180654aab1e6d56"
score = 65
quality = 85
@@ -294026,8 +294409,8 @@ rule SIGNATURE_BASE_APT_MAL_BKA_Goldenspy_Aug20_1 : FILE
date = "2020-08-21"
modified = "2023-12-05"
reference = "https://www.bka.de/SharedDocs/Kurzmeldungen/DE/Warnhinweise/200821_Cyberspionage.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_goldenspy.yar#L1-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_goldenspy.yar#L1-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ba81a2b081842aaf06bbf623640a87946894df83fd0d7b7149c48afa8ed0a081"
score = 75
quality = 85
@@ -294056,11 +294439,11 @@ rule SIGNATURE_BASE_EXPL_Exchange_Proxynotshell_Patterns_CVE_2022_41040_Oct22_1
modified = "2023-03-15"
old_rule_name = "EXPL_Exchange_ProxyNoShell_Patterns_CVE_2022_41040_Oct22_1"
reference = "https://github.com/kljunowsky/CVE-2022-41040-POC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cve_2022_41040_proxynoshell.yar#L2-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cve_2022_41040_proxynoshell.yar#L2-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "81b0f0fea2762beb47826ff95545c87e960e098b9d5f45eacfe07b3ecf319ac5"
score = 75
- quality = 60
+ quality = 85
tags = "SCRIPT"
strings:
@@ -294084,8 +294467,8 @@ rule SIGNATURE_BASE_Glassrat
date = "2015-11-03"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_glassRAT.yar#L8-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_glassRAT.yar#L8-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "939d2cb11ff414641f68b2913fe8d24458e1fd7ba450b8781072bb10da3ad039"
score = 75
quality = 85
@@ -294116,8 +294499,8 @@ rule SIGNATURE_BASE_Glassrat_Generic : FILE
date = "2015-11-23"
modified = "2023-12-05"
reference = "https://blogs.rsa.com/peering-into-glassrat/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_glassRAT.yar#L45-L72"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_glassRAT.yar#L45-L72"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "30d26aebcee21e4811ff3a44a7198a5c519843a24f334880384a7158e07ae399"
hash = "3bdeb3805e9230361fb93c6ffb0bfec8d3aee9455d95b2428c7f6292d387d3a4"
hash = "79993f1912958078c4d98503e00dc526eb1d0ca4d020d17b010efa6c515ca92e"
@@ -294153,8 +294536,8 @@ rule SIGNATURE_BASE_Badrabbit_Gen : FILE
date = "2017-10-25"
modified = "2023-12-05"
reference = "https://pastebin.com/Y7pJv3tK"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_badrabbit.yar#L11-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_badrabbit.yar#L11-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93"
hash = "579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648"
hash = "630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da"
@@ -294192,8 +294575,8 @@ rule SIGNATURE_BASE_Badrabbit_Mimikatz_Comp : FILE
date = "2017-10-25"
modified = "2023-12-05"
reference = "https://pastebin.com/Y7pJv3tK"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_badrabbit.yar#L42-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_badrabbit.yar#L42-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035"
logic_hash = "9d12d9331686a54e8d32f94761e4889710bbd2432d4cb2e4e7e3f21ef6aa082a"
score = 75
@@ -294219,8 +294602,8 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Scripts
date = "2016-08-08"
modified = "2023-12-05"
reference = "https://goo.gl/eFoP4A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron_extras.yar#L1-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron_extras.yar#L1-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "275ec8de40ae973b4ec4c891c56a70fc2fd05abff258b8015d986d0106506367"
score = 75
quality = 85
@@ -294254,8 +294637,8 @@ rule SIGNATURE_BASE_HKTL_Dsniff
date = "2019-02-19"
modified = "2023-12-05"
reference = "https://goo.gl/eFoP4A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron_extras.yar#L27-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron_extras.yar#L27-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0edd3ba7e78ee2810aa3c7643a96382c1fe0b5e627913a5a9bac2e83c8d40274"
score = 55
quality = 85
@@ -294276,8 +294659,8 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Arping_Module
date = "2016-08-08"
modified = "2023-12-05"
reference = "https://goo.gl/eFoP4A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron_extras.yar#L41-L55"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron_extras.yar#L41-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d87e91441994c4ed863596d79c108c9f72adfb708f885cb63a881eb25aa089b7"
score = 75
quality = 85
@@ -294301,8 +294684,8 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Kblogi_Module
date = "2016-08-08"
modified = "2023-12-05"
reference = "https://goo.gl/eFoP4A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron_extras.yar#L57-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron_extras.yar#L57-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "bba87b17a62fc968e89d4f6d10de06875c6b7f47c8bb7ae3f7932804b23a8e87"
score = 75
quality = 85
@@ -294326,8 +294709,8 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Basex_Module
date = "2016-08-08"
modified = "2023-12-05"
reference = "https://goo.gl/eFoP4A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron_extras.yar#L73-L87"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron_extras.yar#L73-L87"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "90cfb58017d62312c56908aca1a48bb7425f5cd51540298ecf65305b46ffb2c8"
score = 75
quality = 85
@@ -294351,8 +294734,8 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Dext_Module
date = "2016-08-08"
modified = "2023-12-05"
reference = "https://goo.gl/eFoP4A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron_extras.yar#L89-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron_extras.yar#L89-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7dbfb3ddfffa6fa65800e07fdcc527650474740afa658567efe46830587cedae"
score = 75
quality = 85
@@ -294377,8 +294760,8 @@ rule SIGNATURE_BASE_Hacktool_This_Cruft : FILE
date = "2016-08-08"
modified = "2023-12-05"
reference = "https://goo.gl/eFoP4A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron_extras.yar#L106-L119"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron_extras.yar#L106-L119"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "875c34e8048c3f98afc97683d0b3086c3396753cd9fb14bc68681c63ed77fd51"
score = 60
quality = 85
@@ -294400,8 +294783,8 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M1 : FILE
date = "2016-08-09"
modified = "2023-12-05"
reference = "https://goo.gl/eFoP4A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron_extras.yar#L130-L148"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron_extras.yar#L130-L148"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9"
logic_hash = "c81c996e487bdd840111513724ccf1220ee3bd8280d776aa4c128ef5263ee136"
score = 75
@@ -294428,8 +294811,8 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M2 : FILE
date = "2016-08-09"
modified = "2023-12-05"
reference = "https://goo.gl/eFoP4A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron_extras.yar#L150-L167"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron_extras.yar#L150-L167"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8"
logic_hash = "57099a802ee62a5183156f0b30713553b6fd83bbb5e1b453e9b25da0109b8777"
score = 75
@@ -294455,8 +294838,8 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M3 : FILE
date = "2016-08-09"
modified = "2023-12-05"
reference = "https://goo.gl/eFoP4A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron_extras.yar#L169-L186"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron_extras.yar#L169-L186"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a4736de88e9208eb81b52f29bab9e7f328b90a86512bd0baadf4c519e948e5ec"
logic_hash = "739414990d112dd16e01831408ba745b04fae7621eb9074f73babbc40b69e1ad"
score = 75
@@ -294482,8 +294865,8 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M4 : FILE
date = "2016-08-09"
modified = "2023-12-05"
reference = "https://goo.gl/eFoP4A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron_extras.yar#L188-L206"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron_extras.yar#L188-L206"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e12e66a6127cfd2cbb42e6f0d57c9dd019b02768d6f1fb44d91f12d90a611a57"
logic_hash = "0735ba9591a9cf06cd13ba480b4559ef83105ab08ffcec21ebbbfdf3766edb93"
score = 75
@@ -294510,8 +294893,8 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M6 : FILE
date = "2016-08-09"
modified = "2023-12-05"
reference = "https://goo.gl/eFoP4A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron_extras.yar#L208-L226"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron_extras.yar#L208-L226"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8"
logic_hash = "95ca9a0b2e71e7152d20a01d238e7362024c6dac6fc95ed2ebfa96dcbc8dbd40"
score = 75
@@ -294538,8 +294921,8 @@ rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M7 : FILE
date = "2016-08-09"
modified = "2023-12-05"
reference = "https://goo.gl/eFoP4A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron_extras.yar#L228-L261"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron_extras.yar#L228-L261"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd"
hash = "7cc0bf547e78c8aaf408495ceef58fa706e6b5d44441fefdce09d9f06398c0ca"
logic_hash = "d132ddeb1d26b035565d3707b73d401fb413315febe26ac291cb05bfeca7c41d"
@@ -294576,8 +294959,8 @@ rule SIGNATURE_BASE_Malware_QA_Not_Copy : FILE
date = "2016-08-29"
modified = "2023-12-05"
reference = "VT Research QA"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_malware_set_qa.yar#L13-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_malware_set_qa.yar#L13-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1410f38498567b64a4b984c69fe4f2859421e4ac598b9750d8f703f1d209f836"
logic_hash = "4001d71101a9c6d4134e7ed4b9b03d34ada62241a668970e21a60d7a23dd7b86"
score = 80
@@ -294608,8 +294991,8 @@ rule SIGNATURE_BASE_Malware_QA_Update : FILE
date = "2016-08-29"
modified = "2023-12-05"
reference = "VT Research QA"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_malware_set_qa.yar#L39-L69"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_malware_set_qa.yar#L39-L69"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541"
hash = "6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e"
logic_hash = "97e0fec7bb4ebf326b449cc0d65eb9f024b33e1d2e54c6d3893164b66c024b2a"
@@ -294646,8 +295029,8 @@ rule SIGNATURE_BASE_Malware_QA_Tls : FILE
date = "2016-08-29"
modified = "2023-12-05"
reference = "VT Research QA"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_malware_set_qa.yar#L71-L87"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_malware_set_qa.yar#L71-L87"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f06d1f2bee2eb6590afbfa7f011ceba9bd91ba31cdc721bc728e13b547ac9370"
logic_hash = "20c849d8c60acd77a28244c7ebcbb2f96b233e74af6c52112a0c828e1de2ed84"
score = 80
@@ -294672,8 +295055,8 @@ rule SIGNATURE_BASE_Malware_QA_Get_The_Fucking_IP : FILE
date = "2016-08-29"
modified = "2023-12-05"
reference = "VT Research QA"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_malware_set_qa.yar#L89-L107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_malware_set_qa.yar#L89-L107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7b2c04e384919075be96e3412d92c14fc1165d1bc7556fd207488959c5c4d2f7"
logic_hash = "ab6a60142ef0e7a6e079a1b62da0b962dc3b59584b785516e93c74669574a81b"
score = 80
@@ -294700,8 +295083,8 @@ rule SIGNATURE_BASE_Malware_QA_Vqgk : FILE
date = "2016-08-29"
modified = "2022-12-21"
reference = "VT Research QA"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_malware_set_qa.yar#L109-L137"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_malware_set_qa.yar#L109-L137"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
logic_hash = "19b7099cdb8a984f1ba6cf88024db398a81ac4f4bf3c16cac40c5ee0e5b465fd"
score = 80
@@ -294736,8 +295119,8 @@ rule SIGNATURE_BASE_Malware_QA_1177 : FILE
date = "2016-08-29"
modified = "2023-12-05"
reference = "VT Research QA"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_malware_set_qa.yar#L139-L161"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_malware_set_qa.yar#L139-L161"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ff3a2740330a6cbae7888e7066942b53015728c367cf9725e840af5b2a3fa247"
logic_hash = "0fa8e6c048bcc51553e8078a71416013696dd937c1508cd636873eab56c3797f"
score = 80
@@ -294767,8 +295150,8 @@ rule SIGNATURE_BASE_KHRAT_Malware : FILE
date = "2017-08-31"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_khrat.yar#L13-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_khrat.yar#L13-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "53e27fd13f26462a58fa5587ecd244cab4da23aa80cf0ed6eb5ee9f9de2688c1"
logic_hash = "cfc1a9fb4dbec4deb70616ab7c4cce3cf56429f61fd36f78245621527d011e20"
score = 75
@@ -294788,8 +295171,8 @@ rule SIGNATURE_BASE_MAL_KHRAT_Script
date = "2017-08-31"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_khrat.yar#L26-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_khrat.yar#L26-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8c88b4177b59f4cac820b0019bcc7f6d3d50ce4badb689759ab0966780ae32e3"
logic_hash = "c27a89028794b50b95850d90ee29b56606e6b58b862a26e287077e7f7be7f096"
score = 75
@@ -294814,8 +295197,8 @@ rule SIGNATURE_BASE_MAL_KHRAT_Scritplet : FILE
date = "2017-08-31"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_khrat.yar#L43-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_khrat.yar#L43-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cdb9104636a6f7c6018fe99bc18fb8b542689a84c23c10e9ea13d5aa275fd40e"
logic_hash = "cbbabd8e2f17827d96aeef4ea362f133cf3fcc31716c517b86a05a010ff62510"
score = 75
@@ -294843,8 +295226,8 @@ rule SIGNATURE_BASE_Cobaltstrike_CN_Group_Beacondropper_Aug17 : FILE
date = "2017-08-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cobaltgang.yar#L15-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cobaltgang.yar#L15-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fc0fad39b461eb1cfc6be57932993fcea94fca650564271d1b74dd850c81602f"
hash = "1c845bb0f6b9a96404af97dcafdc77f1629246e840c01dd9f1580a341f554926"
hash = "6206e372870ea4f363be53557477f9748f1896831a0cdef3b8450a7fb65b86e1"
@@ -294878,8 +295261,8 @@ rule SIGNATURE_BASE_Cobaltgang_Malware_Aug17_1 : FILE
date = "2017-08-09"
modified = "2023-12-05"
reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cobaltgang.yar#L41-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cobaltgang.yar#L41-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6d70673b723f338b3febc9f1d69463bdd4775539cb92b5a5d8fccc0d977fa2f0"
logic_hash = "46077106bd19dd38a714a220b887742f5a29424ac8eb89f469975f863b3782ec"
score = 75
@@ -294905,8 +295288,8 @@ rule SIGNATURE_BASE_Cobaltgang_Malware_Aug17_2 : FILE
date = "2017-08-09"
modified = "2023-12-05"
reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cobaltgang.yar#L59-L72"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cobaltgang.yar#L59-L72"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "80791d5e76782cc3cd14f37f351e33b860818784192ab5b650f1cdf4f131cf72"
logic_hash = "54095d2f447b6478aefe956133fb9b97171c1e07d7d9186a70bf242a094e4156"
score = 75
@@ -294930,8 +295313,8 @@ rule SIGNATURE_BASE_MAL_CRIME_Cobaltgang_Malware_Oct19_1 : FILE
date = "2019-10-24"
modified = "2023-12-05"
reference = "https://twitter.com/vxsh4d0w/status/1187353649015611392"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cobaltgang.yar#L74-L95"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cobaltgang.yar#L74-L95"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "72125933265f884ceb8ab64ab303ea76aaeb7877faee8976d398acd0d0b7356b"
hash = "893339624602c7b3a6f481aed9509b53e4e995d6771c72d726ba5a6b319608a7"
hash = "3c34bbf641df25f9accd05b27b9058e25554fdfea0e879f5ca21ffa460ad2b01"
@@ -294957,8 +295340,8 @@ rule SIGNATURE_BASE_CVE_2015_1674_CNGSYS : CVE_2015_1674 FILE
date = "2015-05-14"
modified = "2023-12-05"
reference = "http://www.binvul.com/viewthread.php?tid=508"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2015_1674.yar#L10-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2015_1674.yar#L10-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "af4eb2a275f6bbc2bfeef656642ede9ce04fad36"
logic_hash = "d751ef739a6fb8b0871f92cb4aba21544f444944710407c723f0452dc3b85522"
score = 75
@@ -294985,8 +295368,8 @@ rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_1 : FILE
date = "2020-01-02"
modified = "2022-12-21"
reference = "Saudi National Cybersecurity Authority - Destructive Attack DUSTMAN"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dustman.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dustman.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
logic_hash = "90345b8358d72b6616c6277222fb1091cb3a88b844391ac3766e7d1ee1192fbe"
score = 65
@@ -295015,8 +295398,8 @@ rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_2 : FILE
date = "2020-01-02"
modified = "2022-12-21"
reference = "https://twitter.com/jfslowik/status/1212501454549741568?s=09"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dustman.yar#L26-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dustman.yar#L26-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
logic_hash = "73e4a88b749e3b2654e9021290932d2e556c29cfa772785b23bebad9f3a3f90a"
score = 65
@@ -295046,8 +295429,8 @@ rule SIGNATURE_BASE_VUL_Jquery_Fileupload_CVE_2018_9206 : CVE_2018_9206
date = "2018-10-19"
modified = "2023-12-05"
reference = "https://blogs.akamai.com/sitr/2018/10/having-the-security-rug-pulled-out-from-under-you.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vul_jquery_fileupload_cve_2018_9206.yar#L1-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vul_jquery_fileupload_cve_2018_9206.yar#L1-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ef7cc13130c60ece346802cb6efec96065f84407fb84b89703628fdf32c0ee53"
score = 75
quality = 85
@@ -295070,8 +295453,8 @@ rule SIGNATURE_BASE_APT_MAL_APT27_Rshell_Jul24 : MALWARE RSHELL___SYSUPDATE FILE
date = "2024-07-11"
modified = "2024-12-12"
reference = "https://x.com/bfv_bund/status/1811364839656185985?s=12&t=C0_T_re0wRP_NfKa27Xw9w"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt27_rshell.yar#L2-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt27_rshell.yar#L2-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0433edfad648e1e29be54101abaded690302dc7e49ad916cfbbddf99b3ade12c"
hash = "10bb89fdf25c88d3c5623e8d68573124c9a42549750014e3675e2ca342aeba4a"
hash = "2603e1f61363451891c97b0c4ce8acfbfb680d3df4282f9d151ecce3a5679616"
@@ -295108,8 +295491,8 @@ rule SIGNATURE_BASE_Generic_Dropper : FILE
date = "2018-03-03"
modified = "2023-12-05"
reference = "https://goo.gl/JAHZVL"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_dropper_pdb.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_dropper_pdb.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e4ef83796d232edf34a6339e00db486612a88ff2d054f1afcd524def2e53b3b7"
score = 75
quality = 85
@@ -295134,8 +295517,8 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos : FILE
date = "2020-11-02"
modified = "2023-12-05"
reference = "https://github.com/eset/malware-ioc/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lnx_kobalos.yar#L32-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lnx_kobalos.yar#L32-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "48aec47b70633d4c8cb55d90a2e168f3c2027ef27cfe1cd5d30dcdc08a2ff717"
score = 75
quality = 85
@@ -295166,8 +295549,8 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos_SSH_Credential_Stealer : FILE
date = "2020-11-02"
modified = "2023-12-05"
reference = "https://github.com/eset/malware-ioc/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lnx_kobalos.yar#L59-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lnx_kobalos.yar#L59-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fdabaea0c838e43b8716bcd102bdeebf2f08fc041b0b909333e3d9d6f94391fc"
score = 75
quality = 85
@@ -295190,8 +295573,8 @@ rule SIGNATURE_BASE_Powerkatz_DLL_Generic : FILE
date = "2016-02-05"
modified = "2023-12-05"
reference = "PowerKatz Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powerkatz.yar#L9-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powerkatz.yar#L9-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c20f30326fcebad25446cf2e267c341ac34664efad5c50ff07f0738ae2390eae"
hash = "1e67476281c1ec1cf40e17d7fc28a3ab3250b474ef41cb10a72130990f0be6a0"
hash = "49e7bac7e0db87bf3f0185e9cf51f2539dbc11384fefced465230c4e5bce0872"
@@ -295222,8 +295605,8 @@ rule SIGNATURE_BASE_MAL_Passwordstate_Moserware_Backdoor_Apr21_1 : FILE
date = "2021-04-25"
modified = "2023-12-05"
reference = "https://thehackernews.com/2021/04/passwordstate-password-manager-update.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_passwordstate_backdoor.yar#L1-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_passwordstate_backdoor.yar#L1-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c2169ab4a39220d21709964d57e2eafe4b68c115061cbb64507cfbbddbe635c6"
hash = "f23f9c2aaf94147b2c5d4b39b56514cd67102d3293bdef85101e2c05ee1c3bf9"
logic_hash = "46bf5b7f4f75997535742021d1d5c2129daae0b3836c08383058e5e5b8e27d93"
@@ -295252,8 +295635,8 @@ rule SIGNATURE_BASE_Fakem_Generic : FILE
date = "2016-01-25"
modified = "2023-01-06"
reference = "http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fakem_backdoor.yar#L8-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fakem_backdoor.yar#L8-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "631fc66e57acd52284aba2608e6f31ba19e2807367e33d8704f572f6af6bd9c3"
hash = "3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520"
hash = "53af257a42a8f182e97dcbb8d22227c27d654bea756d7f34a80cc7982b70aa60"
@@ -295297,8 +295680,8 @@ rule SIGNATURE_BASE_Zeus_Panda : FILE
date = "2017-08-04"
modified = "2023-12-05"
reference = "https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_zeus_panda.yar#L11-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_zeus_panda.yar#L11-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bd956b2e81731874995b9b92e20f75dbf67ac5f12f9daa194525e1b673c7f83c"
logic_hash = "63312763196259204dcee6b6c46ae1a16abeab0afabbce9e2e8413131856b04e"
score = 75
@@ -295329,8 +295712,8 @@ rule SIGNATURE_BASE_PS_AMSI_Bypass : FILE
date = "2017-07-19"
modified = "2026-04-01"
reference = "https://gist.github.com/mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_scripts.yar#L4-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_scripts.yar#L4-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "87188c6cbb7d89c25faafb297a7c0e52321c661c84cdefd5604785c687190fcd"
score = 65
quality = 85
@@ -295352,8 +295735,8 @@ rule SIGNATURE_BASE_JS_Suspicious_Obfuscation_Dropbox
date = "2017-07-19"
modified = "2026-04-01"
reference = "https://twitter.com/ItsReallyNick/status/887705105239343104"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_scripts.yar#L19-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_scripts.yar#L19-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "19d1dd25c4a5e18dca131709a64c3537278754ec9d67b0bb49bde9b1493d3dc7"
score = 70
quality = 85
@@ -295376,8 +295759,8 @@ rule SIGNATURE_BASE_JS_Suspicious_MSHTA_Bypass
date = "2017-07-19"
modified = "2026-04-01"
reference = "https://twitter.com/ItsReallyNick/status/887705105239343104"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_scripts.yar#L35-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_scripts.yar#L35-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "df68cac0da19c5705353f26fc3f2a99556b7230f9d4f52e7a2e35cb48997b699"
score = 70
quality = 85
@@ -295401,8 +295784,8 @@ rule SIGNATURE_BASE_Javascript_Run_Suspicious
date = "2017-08-23"
modified = "2026-04-01"
reference = "https://twitter.com/craiu/status/900314063560998912"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_scripts.yar#L52-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_scripts.yar#L52-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "39d2292d3749c63780dc7ca7a2414ba02e2b0e1edec7ec6a16b42aba2c44c23a"
score = 60
quality = 85
@@ -295425,8 +295808,8 @@ rule SIGNATURE_BASE_Certutil_Decode_OR_Download : FILE
date = "2017-08-29"
modified = "2026-04-01"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_scripts.yar#L70-L94"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_scripts.yar#L70-L94"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1e46668041bad057a44a4257cadc159a1689ec6e06a501541c8bbe9395eb7751"
score = 40
quality = 85
@@ -295455,8 +295838,8 @@ rule SIGNATURE_BASE_Suspicious_JS_Script_Content : FILE
date = "2017-12-02"
modified = "2026-04-01"
reference = "Research on Leviathan https://goo.gl/MZ7dRg"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_scripts.yar#L96-L113"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_scripts.yar#L96-L113"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fc0fad39b461eb1cfc6be57932993fcea94fca650564271d1b74dd850c81602f"
logic_hash = "1dbc1a266d710a70a77c81d5b872d0d324423250a9f34455faef53ac4c41b5f2"
score = 70
@@ -295482,8 +295865,8 @@ rule SIGNATURE_BASE_Universal_Exploit_Strings : FILE
date = "2017-12-02"
modified = "2026-04-01"
reference = "not set"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_scripts.yar#L115-L132"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_scripts.yar#L115-L132"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b07dacf8a45218ede6d64327c38478640ff17d0f1e525bd392c002e49fe3629"
logic_hash = "6436a1cf6d0acc3162ec99c95ef20b3e6dd110c77d5a0b26ac790551316c0a69"
score = 50
@@ -295509,8 +295892,8 @@ rule SIGNATURE_BASE_VBS_Obfuscated_Mal_Feb18_1 : FILE
date = "2018-02-12"
modified = "2026-04-01"
reference = "https://goo.gl/zPsn83"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_scripts.yar#L134-L156"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_scripts.yar#L134-L156"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "06960cb721609fe5a857fe9ca3696a84baba88d06c20920370ddba1b0952a8ab"
hash = "c5c0e28093e133d03c3806da0061a35776eed47d351e817709d2235b95d3a036"
hash = "e1765a2b10e2ff10235762b9c65e9f5a4b3b47d292933f1a710e241fe0417a74"
@@ -295541,8 +295924,8 @@ rule SIGNATURE_BASE_Icefog_Malware_Feb18_1 : FILE
date = "2018-02-26"
modified = "2023-01-06"
reference = "https://twitter.com/ClearskySec/status/968104465818669057"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_icefog.yar#L11-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_icefog.yar#L11-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "480373cffc4e60aa5be2954a156e37d689b92e6e33969958230f2ce59d30b9ec"
logic_hash = "8bba0f7f6f6aad6586c2c5ed29f30514d2f88703134f331724cc2ff86ccffe87"
score = 75
@@ -295572,8 +295955,8 @@ rule SIGNATURE_BASE_Mimikatz_Kirbi_Ticket : FILE
date = "2016-08-13"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_kirbi_mimkatz.yar#L10-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_kirbi_mimkatz.yar#L10-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2a62c24954d64346e419985ef5bf2b357b2aee41ac6b33d379dbd65cf5c9f92b"
score = 75
quality = 85
@@ -295595,8 +295978,8 @@ rule SIGNATURE_BASE_MAL_Sharpshooter_Excel4 : FILE
date = "2020-03-27"
modified = "2023-12-05"
reference = "https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/00b5dd7d-51ca-4938-b7b7-483fe0e5933b"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_Excel4Macro_Sharpshooter.yar#L1-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_Excel4Macro_Sharpshooter.yar#L1-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ccef64586d25ffcb2b28affc1f64319b936175c4911e7841a0e28ee6d6d4a02d"
logic_hash = "4aec8bb7ec8ce7ebd8228416133ea7eec995864aeec78c11548387d832b5fa65"
score = 70
@@ -295623,8 +296006,8 @@ rule SIGNATURE_BASE_SUSP_Excel4Macro_Autoopen : FILE
date = "2020-03-26"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_Excel4Macro_Sharpshooter.yar#L27-L69"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_Excel4Macro_Sharpshooter.yar#L27-L69"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f"
logic_hash = "074aab8e1d3b66e34e8e8d8e8489e1dfee1091df0424b22cd1bfd3cf904754e1"
score = 50
@@ -295651,8 +296034,8 @@ rule SIGNATURE_BASE_Codoso_Plugx_3 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L11-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L11-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "74e1e83ac69e45a3bee78ac2fac00f9e897f281ea75ed179737e9b6fe39971e3"
logic_hash = "51615c2583bb672f148f216e4856e7e346b17884f0740d69f6a24f08b594bda4"
score = 75
@@ -295678,8 +296061,8 @@ rule SIGNATURE_BASE_Codoso_Plugx_2 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L28-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L28-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b9510e4484fa7e3034228337768176fce822162ad819539c6ca3631deac043eb"
logic_hash = "5ee652a135d4865340d2ce6421144ec76ccc7ab69704e92904b2e2ebfc72edfc"
score = 75
@@ -295706,8 +296089,8 @@ rule SIGNATURE_BASE_Codoso_Customtcp_4 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L46-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L46-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ea67d76e9d2e9ce3a8e5f80ff9be8f17b2cd5b1212153fdf36833497d9c060c0"
hash = "130abb54112dd47284fdb169ff276f61f2b69d80ac0a9eac52200506f147b5f8"
hash = "3ea6b2b51050fe7c07e2cf9fa232de6a602aa5eff66a2e997b25785f7cf50daa"
@@ -295740,8 +296123,8 @@ rule SIGNATURE_BASE_Codoso_Customtcp_3 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L72-L93"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L72-L93"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d66106ec2e743dae1d71b60a602ca713b93077f56a47045f4fc9143aa3957090"
logic_hash = "fb486985587fc28c45cbdf6a63550e60e8d6c18f218544adc19c5604193fe8ea"
score = 75
@@ -295772,8 +296155,8 @@ rule SIGNATURE_BASE_Codoso_Customtcp_2 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L94-L114"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L94-L114"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3577845d71ae995762d4a8f43b21ada49d809f95c127b770aff00ae0b64264a3"
logic_hash = "a355ac60dca5ca880a90a5c2720690b4691630fd434411758fa7ff006f7389ba"
score = 75
@@ -295803,8 +296186,8 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_6 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L115-L129"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L115-L129"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4b16f6e8414d4192d0286b273b254fa1bd633f5d3d07ceebd03dfdfc32d0f17f"
logic_hash = "0907274bd6c97b7d7b2913e42aa748c92012aeeb32196ddcbcd30332f4e95ac9"
score = 75
@@ -295828,8 +296211,8 @@ rule SIGNATURE_BASE_Codoso_Gh0St_3 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L130-L151"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L130-L151"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bf52ca4d4077ae7e840cf6cd11fdec0bb5be890ddd5687af5cfa581c8c015fcd"
logic_hash = "e24d434d8f08b83f8e4b1f4aa75a84a040e4f56cdbd9a58ff49c463437e78c24"
score = 75
@@ -295859,8 +296242,8 @@ rule SIGNATURE_BASE_Codoso_Gh0St_2 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L152-L170"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L152-L170"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
logic_hash = "5864e52820578769a31a6925795d13283d7b3bc5f9ac50ac8aea6578a5919e71"
score = 75
@@ -295888,8 +296271,8 @@ rule SIGNATURE_BASE_Codoso_Customtcp : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L171-L188"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L171-L188"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b95d7f56a686a05398198d317c805924c36f3abacbb1b9e3f590ec0d59f845d8"
logic_hash = "4f0333de25b9f84ecaa3e63c5f600f53929244cd63a681d21cb78cfe17ca15f9"
score = 75
@@ -295916,8 +296299,8 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_5 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L192-L208"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L192-L208"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
hash = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
logic_hash = "e248bada3ac46611bbe2cf1e1afee902191a2c1fb9611c4a052318e5e093b015"
@@ -295943,8 +296326,8 @@ rule SIGNATURE_BASE_Codoso_Gh0St_1 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L209-L247"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L209-L247"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
hash = "7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8"
hash = "d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297"
@@ -295988,8 +296371,8 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_4 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L248-L275"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L248-L275"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
hash = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
hash = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
@@ -296025,8 +296408,8 @@ rule SIGNATURE_BASE_Codoso_Plugx_1 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L276-L294"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L276-L294"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b8cbc9b4761ab35acce2aa12ba2c0a283afd596b565705514fd802c8b1e144b"
hash = "448711bd3f689ceebb736d25253233ac244d48cb766834b8f974c2e9d4b462e8"
hash = "fd22547497ce52049083092429eeff0599d0b11fe61186e91c91e1f76b518fe2"
@@ -296054,8 +296437,8 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_3
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L295-L314"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L295-L314"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "126fbdcfed1dfb31865d4b18db2fb963f49df838bf66922fea0c37e06666aee1"
hash = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
hash = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
@@ -296084,8 +296467,8 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_2 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L315-L337"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L315-L337"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
hash = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
hash = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
@@ -296117,8 +296500,8 @@ rule SIGNATURE_BASE_Codoso_PGV_PVID_1 : FILE
date = "2016-01-30"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_codoso.yar#L339-L367"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_codoso.yar#L339-L367"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "41a936b0d1fd90dffb2f6d0bcaf4ad0536f93ca7591f7b75b0cd1af8804d0824"
hash = "58334eb7fed37e3104d8235d918aa5b7856f33ea52a74cf90a5ef5542a404ac3"
hash = "934b87ddceabb2063b5e5bc4f964628fe0c63b63bb2346b105ece19915384fc7"
@@ -296154,8 +296537,8 @@ rule SIGNATURE_BASE_MAL_Fake_Document_Software_Indicators_Nov23 : FILE
date = "2023-11-13"
modified = "2024-04-24"
reference = "https://nochlab.blogspot.com/2023/09/net-in-javascript-fake-pdf-converter.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_fake_document_software.yar#L1-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_fake_document_software.yar#L1-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ac5356ae011effb9d401bf428c92a48cf82c9b61f4c24a29a9718e3379f90f1d"
hash = "d1c29c2243c511ca3264ad568a6be62f374e104b903eca93debce6691e1c5007"
logic_hash = "5f0a088bf672559fbac90313768d41b79be7f1f56c6ddb36f0dcd265a07f98b2"
@@ -296182,8 +296565,8 @@ rule SIGNATURE_BASE_Winpayloads_Powershell : FILE
date = "2017-07-11"
modified = "2023-12-05"
reference = "https://github.com/nccgroup/Winpayloads"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_winpayloads.yar#L12-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_winpayloads.yar#L12-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "011eba8f18b66634f6eb47527b4ceddac2ae615d6861f89a35dbb9fc591cae8e"
logic_hash = "e9e75f7190327f08c5e204977c6714c93951a6db0ddf000c8b37db37131b9def"
score = 75
@@ -296209,8 +296592,8 @@ rule SIGNATURE_BASE_Winpayloads_Payload : FILE
date = "2017-07-11"
modified = "2023-12-05"
reference = "https://github.com/nccgroup/Winpayloads"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_winpayloads.yar#L30-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_winpayloads.yar#L30-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "23a24f99c3c6c00cd4bf6cb968f813ba2ceadfa846c7f169f412bcbb71ba6573"
hash = "35069905d9b7ba1fd57c8df03614f563504194e4684f47aafa08ebb8d9409d0b"
hash = "a28d107f168d85c38fc76229b14561b472e60e60973eb10b6b554c1f57469322"
@@ -296240,8 +296623,8 @@ rule SIGNATURE_BASE_P0Wnedpowercat : FILE
date = "2017-01-14"
modified = "2023-12-05"
reference = "https://github.com/Cn33liz/p0wnedShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_p0wnshell.yar#L10-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_p0wnshell.yar#L10-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6a3ba991d3b5d127c4325bc194b3241dde5b3a5853b78b4df1bce7cbe87c0fdf"
logic_hash = "5882d0f91f237d2abe1149421db0e217e6dfcca70130d346a70d5c851eca085f"
score = 75
@@ -296270,8 +296653,8 @@ rule SIGNATURE_BASE_Hacktool_Strings_P0Wnedshell : FILE
date = "2017-01-14"
modified = "2023-02-10"
reference = "https://github.com/Cn33liz/p0wnedShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_p0wnshell.yar#L31-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_p0wnshell.yar#L31-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60"
logic_hash = "faec8f0af877f1a80ff994e08c756728cea5f58000f7124c1a6e7e4c86e7f5c0"
score = 75
@@ -296308,8 +296691,8 @@ rule SIGNATURE_BASE_P0Wnedpotato
date = "2017-01-14"
modified = "2023-12-05"
reference = "https://github.com/Cn33liz/p0wnedShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_p0wnshell.yar#L64-L81"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_p0wnshell.yar#L64-L81"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aff2b694a01b48ef96c82daf387b25845abbe01073b76316f1aab3142fdb235b"
logic_hash = "d9107db6c6460429358a2f9f1f47d103e96811152e8d03517871ff0c66578d05"
score = 75
@@ -296336,8 +296719,8 @@ rule SIGNATURE_BASE_P0Wnedexploits
date = "2017-01-14"
modified = "2023-12-05"
reference = "https://github.com/Cn33liz/p0wnedShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_p0wnshell.yar#L83-L97"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_p0wnshell.yar#L83-L97"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "54548e7848e742566f5596d8f02eca1fd2cbfeae88648b01efb7bab014b9301b"
logic_hash = "40f23316117faa63fa9e9a5d281600f8e9d41857aac815d22559391c74dec157"
score = 75
@@ -296361,8 +296744,8 @@ rule SIGNATURE_BASE_P0Wnedshellx64
date = "2017-01-14"
modified = "2021-09-15"
reference = "https://github.com/Cn33liz/p0wnedShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_p0wnshell.yar#L99-L118"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_p0wnshell.yar#L99-L118"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d8b4f5440627cf70fa0e0e19e0359b59e671885f8c1855517211ba331f48c449"
logic_hash = "d7cd33548ed3485cc6f3cd289813a8eb83b34e800b839c5c8f8add5f9e01a3da"
score = 75
@@ -296389,8 +296772,8 @@ rule SIGNATURE_BASE_P0Wnedlistenerconsole
date = "2017-01-14"
modified = "2023-12-05"
reference = "https://github.com/Cn33liz/p0wnedShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_p0wnshell.yar#L120-L140"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_p0wnshell.yar#L120-L140"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d2d84e65fad966a8556696fdaab5dc8110fc058c9e9caa7ea78aa00921ae3169"
logic_hash = "068e590f6f4f99c27814f2bf96d51e1c8c6422afcf8b99bb9f1852216335da7b"
score = 75
@@ -296420,8 +296803,8 @@ rule SIGNATURE_BASE_P0Wnedbinaries
date = "2017-01-14"
modified = "2023-12-05"
reference = "https://github.com/Cn33liz/p0wnedShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_p0wnshell.yar#L142-L161"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_p0wnshell.yar#L142-L161"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fd7014625b58d00c6e54ad0e587c6dba5d50f8ca4b0f162d5af3357c2183c7a7"
logic_hash = "4df7fcf508a9257ea418bd1995158c3676037b310dc884d44658977fda81b13b"
score = 75
@@ -296450,8 +296833,8 @@ rule SIGNATURE_BASE_P0Wnedamsibypass
date = "2017-01-14"
modified = "2023-12-05"
reference = "https://github.com/Cn33liz/p0wnedShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_p0wnshell.yar#L163-L178"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_p0wnshell.yar#L163-L178"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "345e8e6f38b2914f4533c4c16421d372d61564a4275537e674a2ac3360b19284"
logic_hash = "1f7613506058706fc74979fdd4f9e425e9d16527120e0f2f49bc21e3e43d3b16"
score = 75
@@ -296476,8 +296859,8 @@ rule SIGNATURE_BASE_P0Wnedshell_Outputs
date = "2017-01-14"
modified = "2023-12-05"
reference = "https://github.com/Cn33liz/p0wnedShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_p0wnshell.yar#L180-L196"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_p0wnshell.yar#L180-L196"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60"
logic_hash = "85d5317a473d981fe6ee1362789f34653a838c63d823bb62028a25c9db27cf6e"
score = 75
@@ -296503,8 +296886,8 @@ rule SIGNATURE_BASE_Powershell_Isesteroids_Obfuscation
date = "2017-06-23"
modified = "2025-02-12"
reference = "https://twitter.com/danielhbohannon/status/877953970437844993"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_obfuscation.yar#L11-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_obfuscation.yar#L11-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6d9476f679614e34a0d13664baffd15b0bdb896f7eeca2c9de66bdc0d65a2eec"
score = 75
quality = 85
@@ -296529,8 +296912,8 @@ rule SIGNATURE_BASE_SUSP_Obfuscted_Powershell_Code
date = "2018-12-13"
modified = "2025-02-12"
reference = "https://twitter.com/silv0123/status/1073072691584880640"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_obfuscation.yar#L28-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_obfuscation.yar#L28-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "afd7e4b88c812b23441549565a18fde18c24fe91ec467455002ef338e092ebf9"
score = 65
quality = 85
@@ -296544,6 +296927,29 @@ rule SIGNATURE_BASE_SUSP_Obfuscted_Powershell_Code
condition:
#s1> 11 and #s2 > 10 and #s3 > 10
}
+rule SIGNATURE_BASE_SUSP_Powershell_Caret_Obfuscation_2
+{
+ meta:
+ description = "Detects powershell keyword obfuscated with carets"
+ author = "Florian Roth (Nextron Systems)"
+ id = "976e261a-029c-5703-835f-a235c5657471"
+ date = "2019-07-20"
+ modified = "2025-02-12"
+ reference = "Internal Research"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_obfuscation.yar#L43-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
+ logic_hash = "0aa21df64d61cb299b0f77da8b97e8cfc379622a8092e71657c478519d83fd31"
+ score = 65
+ quality = 31
+ tags = ""
+
+ strings:
+ $r1 = /p[\^]?o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l\^l/ ascii wide nocase fullword
+ $r2 = /p\^o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l[\^]?l/ ascii wide nocase fullword
+
+ condition:
+ 1 of them
+}
rule SIGNATURE_BASE_SUSP_OBFUSC_Powershell_True_Jun20_1 : FILE
{
meta:
@@ -296553,8 +296959,8 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_Powershell_True_Jun20_1 : FILE
date = "2020-06-27"
modified = "2025-02-12"
reference = "https://github.com/corneacristian/mimikatz-bypass/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_obfuscation.yar#L57-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_obfuscation.yar#L57-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8f33762e6e93fcf6b423b34eb1abefae2ae91b51048303947f7c1601823630d7"
score = 75
quality = 85
@@ -296581,8 +296987,8 @@ rule SIGNATURE_BASE_Poseidongroup_Malware : FILE
date = "2016-02-09"
modified = "2023-01-27"
reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_poseidon_group.yar#L8-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_poseidon_group.yar#L8-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "337e94119cfad0b3144af81b72ac3b2688a219ffa0bdf23ca56c7a68fbe0aea4"
hash = "344034c0bf9fcd52883dbc158abf6db687150d40a118d9cd6ebd843e186128d3"
hash = "432b7f7f7bf94260a58ad720f61d91ba3289bf0a9789fc0c2b7ca900788dae61"
@@ -296628,8 +297034,8 @@ rule SIGNATURE_BASE_Poseidongroup_Maldoc_1 : FILE
date = "2016-02-09"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_poseidon_group.yar#L50-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_poseidon_group.yar#L50-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0983526d7f0640e5765ded6be6c9e64869172a02c20023f8a006396ff358999b"
logic_hash = "0d8c255f56bb33b6a720c98727127c07a2d77245b18da381706a40339bebd20b"
score = 80
@@ -296652,8 +297058,8 @@ rule SIGNATURE_BASE_Poseidongroup_Maldoc_2 : FILE
date = "2016-02-09"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_poseidon_group.yar#L66-L89"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_poseidon_group.yar#L66-L89"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3e4cacab0ff950da1c6a1c640fe6cf5555b99e36d4e1cf5c45f04a2048f7620c"
hash = "1f77475d7740eb0c5802746d63e93218f16a7a19f616e8fddcbff07983b851af"
hash = "f028ee20363d3a17d30175508bbc4738dd8e245a94bfb200219a40464dd09b3a"
@@ -296685,8 +297091,8 @@ rule SIGNATURE_BASE_Windowsshell_S3 : FILE
date = "2016-03-26"
modified = "2023-12-05"
reference = "https://github.com/odzhan/shells/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_winshells.yar#L10-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_winshells.yar#L10-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
logic_hash = "b9274f909b50247a4f5111a14806faadba7814e26805bef7d61eaaf8be4b46ed"
score = 75
@@ -296717,8 +297123,8 @@ rule SIGNATURE_BASE_Windosshell_S1 : FILE
date = "2016-03-26"
modified = "2023-12-05"
reference = "https://github.com/odzhan/shells/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_winshells.yar#L33-L53"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_winshells.yar#L33-L53"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
logic_hash = "29fcddc549c615ca5cdda60272926671bc1446c3c7b51c9a2fd867b6b68858b2"
score = 75
@@ -296748,8 +297154,8 @@ rule SIGNATURE_BASE_Windowsshell_S4 : FILE
date = "2016-03-26"
modified = "2023-12-05"
reference = "https://github.com/odzhan/shells/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_winshells.yar#L55-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_winshells.yar#L55-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
logic_hash = "fff280debdd32a736e37a73800f226bf6def5dd107abd1d9237d92904622c9ec"
score = 75
@@ -296779,8 +297185,8 @@ rule SIGNATURE_BASE_Windowsshell_Gen : FILE
date = "2016-03-26"
modified = "2023-12-05"
reference = "https://github.com/odzhan/shells/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_winshells.yar#L79-L99"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_winshells.yar#L79-L99"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a7c3d85eabac01e7a7ec914477ea9f17e3020b3b2f8584a46a98eb6a2a7611c5"
hash = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
hash = "df0693caae2e5914e63e9ee1a14c1e9506f13060faed67db5797c9e61f3907f0"
@@ -296810,8 +297216,8 @@ rule SIGNATURE_BASE_Windowsshell_Gen2 : FILE
date = "2016-03-26"
modified = "2023-12-05"
reference = "https://github.com/odzhan/shells/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_winshells.yar#L101-L122"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_winshells.yar#L101-L122"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
hash = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
logic_hash = "c5ce27554b2ee25b974b567ef5a9ae877906250073da477f0ab5d71d162ac81a"
@@ -296842,8 +297248,8 @@ rule SIGNATURE_BASE_Mal_Dropper_Httpexe_From_CAB : FILE
date = "2016-05-25"
modified = "2023-12-05"
reference = "https://goo.gl/13Wgy1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_danti_svcmondr.yar#L10-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_danti_svcmondr.yar#L10-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9e7e5f70c4b32a4d5e8c798c26671843e76bb4bd5967056a822e982ed36e047b"
logic_hash = "d114a3ab348bba49a78852b87b712908bc974bf35a2b841099a232e761cad8f2"
score = 60
@@ -296867,8 +297273,8 @@ rule SIGNATURE_BASE_Mal_Http_EXE : FILE
date = "2016-05-25"
modified = "2023-01-27"
reference = "https://goo.gl/13Wgy1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_danti_svcmondr.yar#L27-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_danti_svcmondr.yar#L27-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ad191d1d18841f0c5e48a5a1c9072709e2dd6359a6f6d427e0de59cfcd1d9666"
logic_hash = "0e28b64bbfd2b6d40f4bd82373624d22df3d5c45c22d7155747f0ff33976207d"
score = 80
@@ -296906,8 +297312,8 @@ rule SIGNATURE_BASE_Mal_Potplayer_DLL : FILE
date = "2016-05-25"
modified = "2023-12-05"
reference = "https://goo.gl/13Wgy1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_danti_svcmondr.yar#L60-L77"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_danti_svcmondr.yar#L60-L77"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "705409bc11fb45fa3c4e2fa9dd35af7d4613e52a713d9c6ea6bc4baff49aa74a"
logic_hash = "1d1b68fa8de2e4ddfa71cbcd5e166181370172cc8a3167ade2da393e4f7998f1"
score = 70
@@ -296932,8 +297338,8 @@ rule SIGNATURE_BASE_SUSP_Autocad_Lsp_Malware : FILE
date = "2019-02-04"
modified = "2023-12-05"
reference = "http://cadablog.blogspot.com/2012/06/acadmedrea-malware-autocad-based-virus.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_autocad_lsp_malware.yar#L1-L52"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_autocad_lsp_malware.yar#L1-L52"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1313398e2f39fcf17225c7e915b92bd74292d427163112d70b82f271359b84d5"
hash = "2382e6908e6b44c0676c537cb8caa239c8938cb01e62a45c7247d40ab7dbf0ad"
hash = "23cf3e7f41a755a45e396e5caa3e753e64655b91fe665808f71aa68718670dc8"
@@ -296957,7 +297363,7 @@ rule SIGNATURE_BASE_SUSP_Autocad_Lsp_Malware : FILE
hash = "f9d6b894ca907145464058a4e2c78de84bf592609b46f3573bfd9e0029e1c778"
logic_hash = "4a5fe7016e27431407435541ab71ab00e6fd53418e2ebc19f8764c98728b89a6"
score = 65
- quality = 27
+ quality = 52
tags = "FILE"
strings:
@@ -296983,8 +297389,8 @@ rule SIGNATURE_BASE_Powershell_Suite_Hacktools_Gen_Strings : FILE
date = "2017-12-27"
modified = "2023-12-05"
reference = "https://github.com/FuzzySecurity/PowerShell-Suite"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_suite.yar#L2-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_suite.yar#L2-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "79071ba5a984ee05903d566130467483c197cbc2537f25c1e3d7ae4772211fe0"
hash = "db31367410d0a9ffc9ed37f423a4b082639591be7f46aca91f5be261b23212d5"
hash = "4f51e7676a4d54c1962760ca0ac81beb28008451511af96652c31f4f40e8eb8e"
@@ -297038,8 +297444,8 @@ rule SIGNATURE_BASE_Powershell_Suite_Eidolon : FILE
date = "2017-12-27"
modified = "2023-12-05"
reference = "https://github.com/FuzzySecurity/PowerShell-Suite"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_suite.yar#L48-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_suite.yar#L48-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "db31367410d0a9ffc9ed37f423a4b082639591be7f46aca91f5be261b23212d5"
logic_hash = "587a9a8569801e2aa96a6f171705fdc1db5632734b54e5a9eb8282502e1efc63"
score = 75
@@ -297065,8 +297471,8 @@ rule SIGNATURE_BASE_Kaspermalware_Oct17_1 : FILE
date = "2017-10-24"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_kasper_oct17.yar#L13-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_kasper_oct17.yar#L13-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "758bdaf26a0bd309a5458cb4569fe1c789cf5db087880d6d1676dec051c3a28d"
logic_hash = "15758407fb3039f1453f13d579d7df9525645e4717078f6b1fa482ab335e3a56"
score = 75
@@ -297090,8 +297496,8 @@ rule SIGNATURE_BASE_Royalroad_Code_Pattern1 : FILE
date = "2020-01-15"
modified = "2023-12-05"
reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_royalroad.yar#L25-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_royalroad.yar#L25-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ebd507d95c454562fa0b364072120b35b1bf8dd2be129a419d893f6708ab9cca"
score = 80
quality = 85
@@ -297113,8 +297519,8 @@ rule SIGNATURE_BASE_Royalroad_Code_Pattern2 : FILE
date = "2020-01-15"
modified = "2023-12-05"
reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_royalroad.yar#L42-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_royalroad.yar#L42-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e252868042e5150d99de2c2f4642f3d91d764d5a062f3a8de9ab316e299e00ac"
score = 80
quality = 85
@@ -297136,8 +297542,8 @@ rule SIGNATURE_BASE_Royalroad_Code_Pattern3 : FILE
date = "2020-01-15"
modified = "2023-12-05"
reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_royalroad.yar#L59-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_royalroad.yar#L59-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3b5d9872eb86d1a220e5b70c560e7054bee8b2bc1fa2a75781d87616674e2927"
score = 80
quality = 85
@@ -297159,8 +297565,8 @@ rule SIGNATURE_BASE_Royalroad_Code_Pattern4Ab : FILE
date = "2020-01-15"
modified = "2023-12-05"
reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_royalroad.yar#L77-L92"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_royalroad.yar#L77-L92"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dd9468b3208a27b6f3b56037013f06c4d2adbd201a12df141bc980ad595a75c0"
score = 80
quality = 85
@@ -297182,8 +297588,8 @@ rule SIGNATURE_BASE_Royalroad_Code_Pattern4Ce : FILE
date = "2020-01-15"
modified = "2023-12-05"
reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_royalroad.yar#L94-L109"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_royalroad.yar#L94-L109"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7033c5874b406341a68f761b45fd6a9b73a9875c80b14d52a7c2240202c8fb40"
score = 80
quality = 85
@@ -297205,8 +297611,8 @@ rule SIGNATURE_BASE_Royalroad_Code_Pattern4D : FILE
date = "2020-01-15"
modified = "2023-12-05"
reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_royalroad.yar#L113-L128"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_royalroad.yar#L113-L128"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9b531063d2a5ae36ae4e708a749dcf2cdc4c85fc43769a8525049e6facfca674"
score = 80
quality = 85
@@ -297228,8 +297634,8 @@ rule SIGNATURE_BASE_Royalroad_RTF : FILE
date = "2020-01-15"
modified = "2023-12-05"
reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_royalroad.yar#L133-L148"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_royalroad.yar#L133-L148"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "20031fe6d6a0b2fad43f7e04bb82321c2ea75193f23194edead7ca530af8ac55"
score = 80
quality = 85
@@ -297251,8 +297657,8 @@ rule SIGNATURE_BASE_Royalroad_RTF_V7 : FILE
date = "2020-01-15"
modified = "2023-12-05"
reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_royalroad.yar#L150-L166"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_royalroad.yar#L150-L166"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "da043123cf72e19295634720196d78bef3af89f44cba795dbbcee4c0f5c8159a"
score = 60
quality = 85
@@ -297275,8 +297681,8 @@ rule SIGNATURE_BASE_Royalroad_Encode_In_RTF : FILE
date = "2020-01-15"
modified = "2023-12-05"
reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_royalroad.yar#L168-L189"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_royalroad.yar#L168-L189"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "00a703a0d7b3a74ec9bfc8ad0e570ee04b3cb6b7f2c062cc2886b41f6fbea49d"
score = 60
quality = 85
@@ -297305,8 +297711,8 @@ rule SIGNATURE_BASE_HKTL_Buckeye_Osinfo : FILE
date = "2016-09-05"
modified = "2025-03-19"
reference = "http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_buckeye.yar#L10-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_buckeye.yar#L10-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "782ae4293db0839190a9533d2c45baff92527867bfcd048ccae82611f165601b"
score = 70
quality = 85
@@ -297334,8 +297740,8 @@ rule SIGNATURE_BASE_HKTL_Remotecmd : FILE
date = "2016-09-08"
modified = "2022-12-21"
reference = "http://goo.gl/igxLyF"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_buckeye.yar#L31-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_buckeye.yar#L31-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5264d1de687432f8346617ac88ffcb31e025e43fc3da1dad55882b17b44f1f8b"
logic_hash = "873cc02674e386577e86cb9b702265c25dd24b1f203741e8628e30c191dc99e0"
score = 70
@@ -297363,8 +297769,8 @@ rule SIGNATURE_BASE_HKTL_Chromepass : FILE
date = "2016-09-08"
modified = "2025-03-10"
reference = "http://goo.gl/igxLyF"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_buckeye.yar#L53-L77"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_buckeye.yar#L53-L77"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5ff43049ae18d03dcc74f2be4a870c7056f6cfb5eb636734cca225140029de9a"
logic_hash = "bda90d2718be5cf9ddb95b88171c937c5fad5729aa1717a13a34a8b48dd1865c"
score = 75
@@ -297395,8 +297801,8 @@ rule SIGNATURE_BASE_LOG_EXPL_Adselfservice_CVE_2021_40539_ADSLOG_Sep21 : LOG CVE
date = "2021-09-20"
modified = "2023-12-05"
reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_adselfservice_cve_2021_40539.yar#L2-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_adselfservice_cve_2021_40539.yar#L2-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "49b7857187c15f48e928747266adca44c227964cef72914616ea269b0e88fe73"
score = 70
quality = 85
@@ -297417,8 +297823,8 @@ rule SIGNATURE_BASE_LOG_EXPL_Adselfservice_CVE_2021_40539_Weblog_Sep21_1 : LOG C
date = "2021-09-20"
modified = "2023-12-05"
reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_adselfservice_cve_2021_40539.yar#L16-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_adselfservice_cve_2021_40539.yar#L16-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "bc27afd63d32ac95711e5b4e70764fe0d1bcbb4b4b9b4e3f324e058bba2ef8f6"
score = 60
quality = 85
@@ -297441,8 +297847,8 @@ rule SIGNATURE_BASE_Freemilk_APT_Mal_1 : FILE
date = "2017-10-05"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_freemilk.yar#L13-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_freemilk.yar#L13-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9"
hash = "35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2"
hash = "0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313"
@@ -297474,8 +297880,8 @@ rule SIGNATURE_BASE_Freemilk_APT_Mal_2 : FILE
date = "2017-10-05"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_freemilk.yar#L41-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_freemilk.yar#L41-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df"
logic_hash = "ad2cc04542e93add3e7856574d4de5aa371cc31542f87b1e90d30e12e0149341"
score = 75
@@ -297501,8 +297907,8 @@ rule SIGNATURE_BASE_Freemilk_APT_Mal_3 : FILE
date = "2017-10-05"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_freemilk.yar#L62-L78"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_freemilk.yar#L62-L78"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2"
logic_hash = "be68f624a2a374525857193d27f0645be5d10c198954dd90350448c3127e4bb5"
score = 75
@@ -297529,8 +297935,8 @@ rule SIGNATURE_BASE_Freemilk_APT_Mal_4 : FILE
date = "2017-10-05"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_freemilk.yar#L80-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_freemilk.yar#L80-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
logic_hash = "deedb1da7e3421cd300fceea354a690e22005bab16eb0cc20b46f912393b637d"
score = 75
@@ -297559,8 +297965,8 @@ rule SIGNATURE_BASE_Powershell_Susp_Parameter_Combo : HIGHVOL FILE
date = "2017-03-12"
modified = "2025-12-16"
reference = "https://goo.gl/uAic1X"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_invocation.yar#L2-L77"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_invocation.yar#L2-L77"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c359a1d2a460f2939a1dd0959687ed4fbc2d874e689b42ae4bc73ee05145cce3"
score = 60
quality = 31
@@ -297630,8 +298036,8 @@ rule SIGNATURE_BASE_APT_MAL_Winntilinux_Dropper_Azazelfork_May19 : AZAZEL_FORK F
date = "2019-05-15"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_linux.yar#L1-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_linux.yar#L1-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a"
logic_hash = "0af32675dccfd0ad0c7919683fddced6ad49c65800ffa523773b7342b431379f"
score = 75
@@ -297657,8 +298063,8 @@ rule SIGNATURE_BASE_APT_MAL_Winntilinux_Main_Azazelfork_May19 : FILE
date = "2019-05-15"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_linux.yar#L18-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_linux.yar#L18-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae9d6848f33644795a0cc3928a76ea194b99da3c10f802db22034d9f695a0c23"
logic_hash = "3ff38795179f6c32f2ff014b06ac126ae3a0de3fe7515f0e49f12f9c8ff14b43"
score = 75
@@ -297690,8 +298096,8 @@ rule SIGNATURE_BASE_CN_Honker_Mafix_Root : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L8-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L8-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "826778ef9c22177d41698b467586604e001fed19"
logic_hash = "db54561ba4b9c1bd4d9b183658b98f6fd3165b05c8d6d7f006ae3b5fc96ba549"
score = 70
@@ -297716,8 +298122,8 @@ rule SIGNATURE_BASE_CN_Honker_Passwd_Dict_3389 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L26-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L26-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2897e909e48a9f56ce762244c3a3e9319e12362f"
logic_hash = "2be79fc7388ca12f06577e689944bcfa72ed1e1b6da5a7fa15c8da69a4555a9a"
score = 70
@@ -297746,8 +298152,8 @@ rule SIGNATURE_BASE_CN_Honker_Perl_Serv_U : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L48-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L48-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f333c597ff746ebd5a641fbc248497d61e3ec17b"
logic_hash = "deb4ee54f9127bc093f96f7dbf3633fbfc3f66358c76fb15928dabbbffdd4963"
score = 70
@@ -297771,8 +298177,8 @@ rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L65-L81"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L65-L81"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e216f4ba3a07de5cdbb12acc038cd8156618759e"
logic_hash = "be4817bcaae952eb13c35dd89606ec733c682b2e197054bb348c3934012bd105"
score = 70
@@ -297797,8 +298203,8 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L83-L97"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L83-L97"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f92b74f41a2138cc05c6b6993bcc86c706017e49"
logic_hash = "32603edd3f188a9f4919795df04112883d7b88da46b13fcd0b0e0065fd4c016b"
score = 70
@@ -297821,8 +298227,8 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389_2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L99-L114"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L99-L114"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5ff92f39ade12f8ba6cb75dfdc9bb907e49f0ebd"
logic_hash = "637b3368fac624ca78d2f573b8b937b6b265426d7ed923f3a3d06039663c97ad"
score = 70
@@ -297846,8 +298252,8 @@ rule SIGNATURE_BASE_CN_Honker_Injection_Transit_Jmcook : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L116-L131"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L116-L131"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
logic_hash = "f7a9aca65b92d4b9c787d83a421b54a23844fa8e061c6c627ddde8ab5b7f4396"
score = 70
@@ -297871,8 +298277,8 @@ rule SIGNATURE_BASE_CN_Honker_Pwdump7_Pwdump7 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L133-L147"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L133-L147"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "67d0e215c96370dcdc681bb2638703c2eeea188a"
logic_hash = "50e4ec9716b4e9d824fb301bb493dcdcd9782d87c0fb8040b82a87faf56292cb"
score = 70
@@ -297895,8 +298301,8 @@ rule SIGNATURE_BASE_CN_Honker_Portrecall_Pr : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L149-L165"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L149-L165"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "583cf6dc2304121d835f2879803a22fea76930f3"
logic_hash = "f33373e87887506651b1fac464f860a3cf18ad681ba124b606524f6f2255e693"
score = 70
@@ -297921,8 +298327,8 @@ rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389_3 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L167-L183"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L167-L183"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cfedec7bd327897694f83501d76063fe16b13450"
logic_hash = "df07958e44c7896bc7bdf2b79bc95969593eb21b9c9ed51213fd15affb731ec2"
score = 70
@@ -297947,8 +298353,8 @@ rule SIGNATURE_BASE_CN_Honker_Alien_D : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L185-L203"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L185-L203"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "de9cd4bd72b1384b182d58621f51815a77a5f07d"
logic_hash = "2eca697dd1f2ad80c5cd71507cd5f8abd2364b11dfe3206a1043e3d4f5835797"
score = 70
@@ -297975,8 +298381,8 @@ rule SIGNATURE_BASE_CN_Honker_Chinachopper_Db : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L205-L221"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L205-L221"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "af79ff2689a6b7a90a5d3c0ebe709e42f2a15597"
logic_hash = "b650498df99c4620e3904ce8980cd58eb0cb5e0a7a275d54bdbcc41a687bec8e"
score = 70
@@ -298001,8 +298407,8 @@ rule SIGNATURE_BASE_CN_Honker_Syconfig : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L223-L237"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L223-L237"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ff75353df77d610d3bccfbffb2c9dfa258b2fac9"
logic_hash = "6b7f918b83bac84df5ac6b247d4162dd385aba0a32570366c62fc4830199e86e"
score = 70
@@ -298025,8 +298431,8 @@ rule SIGNATURE_BASE_CN_Honker_Linux_Bin : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L239-L254"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L239-L254"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "26e71e6ebc6a3bdda9467ce929610c94de8a7ca0"
logic_hash = "d02fcf23e46a0b6d44c382e34d73ef6239b6a1afc690e417aa0e6b0898e277c0"
score = 70
@@ -298050,8 +298456,8 @@ rule SIGNATURE_BASE_CN_Honker_Intersect2_Beta : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L256-L272"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L256-L272"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3ba5f720c4994cd4ad519b457e232365e66f37cc"
logic_hash = "bc6a83f8f851f7fb5b620be889619fcbd9f34ba27d495c2040e207caf95854bb"
score = 70
@@ -298076,8 +298482,8 @@ rule SIGNATURE_BASE_CN_Honker_IIS_Logcleaner1_0_Readme : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L274-L289"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L274-L289"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2ab47d876b49e9a693f602f3545381415e82a556"
logic_hash = "3cbd7b2e1710c78bc8ab8d2730cc6da8eb95038f8431d5d0081db984b3d706cf"
score = 70
@@ -298101,8 +298507,8 @@ rule SIGNATURE_BASE_CN_Honker_Alien_Command : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L291-L306"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L291-L306"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5896b74158ef153d426fba76c2324cd9c261c709"
logic_hash = "a55be30fdb6598669d144308af5a9b6a21ab6140c75fdfc18cecf5d9add4a530"
score = 70
@@ -298126,8 +298532,8 @@ rule SIGNATURE_BASE_CN_Honker_Portrecall_Bc : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L308-L324"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L308-L324"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2084990406398afd856b2309c7f579d7d61c3767"
logic_hash = "f51644f195e42b91dae80ba1770aeb40790ea8528b6d09f5fed0f71d93bda5fc"
score = 70
@@ -298152,8 +298558,8 @@ rule SIGNATURE_BASE_CN_Honker_Tuoku_Script_MSSQL_ : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L326-L342"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L326-L342"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7097c21f92306983add3b5b29a517204cd6cd819"
logic_hash = "4d721fd9711799cf3fd8ba6c300e270ed25faa2fb938ea01464e9bc9a3768e22"
score = 70
@@ -298178,8 +298584,8 @@ rule SIGNATURE_BASE_CN_Honker_Nc_MOVE : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L344-L360"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L344-L360"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4195370c103ca467cddc8f2724a8e477635be424"
logic_hash = "49f41162919bb04744041ae6f7438e61d98fb7d5984a17535d9c4ce4d398671b"
score = 70
@@ -298204,8 +298610,8 @@ rule SIGNATURE_BASE_CN_Honker_Mssqlpw_Scan : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_scripts.yar#L362-L377"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_scripts.yar#L362-L377"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e49def9d72bfef09a639ef3f7329083a0b8b151c"
logic_hash = "eb3bd38ca317f0b10358581fc3dbb8ca81b991b9a4f4f2d256d81a31028411b9"
score = 70
@@ -298229,11 +298635,11 @@ rule SIGNATURE_BASE_SUSP_Themebleed_Theme_Sep23 : FILE
date = "2023-09-13"
modified = "2023-12-05"
reference = "https://github.com/gabe-k/themebleed"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2023_38146.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2023_38146.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "577003741f07aeffafd2b0b22913de44ea4f5ed264f4104ee013104355f65311"
score = 75
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -298253,14 +298659,14 @@ rule SIGNATURE_BASE_Trojan_ISMRAT_Gen : FILE
date = "2017-05-04"
modified = "2023-12-05"
reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/february/ism-rat/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ism_rat.yar#L9-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ism_rat.yar#L9-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "146a112cb01cd4b8e06d36304f6bdf7b"
hash = "fa3dbe37108b752c38bf5870b5862ce5"
hash = "bf4b07c7b4a4504c4192bd68476d63b5"
logic_hash = "c4d26f79b8110e92a5e427de303eca6eaf79765a4c9cc437864dc5160ef2e343"
score = 75
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -298282,8 +298688,8 @@ rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample1 : FILE
date = "2018-05-30"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta18_149A.yar#L13-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta18_149A.yar#L13-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ea46ed5aed900cd9f01156a1cd446cbb3e10191f9f980e9f710ea1c20440c781"
logic_hash = "746c74713ac52f62d5a5c41d2c9321e00481a45aa2c23f1695fab0f5b6d5dfb4"
score = 75
@@ -298311,8 +298717,8 @@ rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample2 : FILE
date = "2018-05-30"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta18_149A.yar#L36-L55"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta18_149A.yar#L36-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "077d9e0e12357d27f7f0c336239e961a7049971446f7a3f10268d9439ef67885"
logic_hash = "046135e4a1161841835cd9d10e13224b440e914ce3f409bad84a1df2638a7d5f"
score = 75
@@ -298339,8 +298745,8 @@ rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample3 : FILE
date = "2018-05-30"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta18_149A.yar#L57-L78"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta18_149A.yar#L57-L78"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717"
logic_hash = "a3da6c70d2ab94820324a55f1bcdcf5507a8ddf26efc80904daf0d9b27ac9312"
score = 75
@@ -298368,8 +298774,8 @@ rule SIGNATURE_BASE_Wannacry_Ransomware : FILE
date = "2017-05-12"
modified = "2023-12-05"
reference = "https://goo.gl/HG2j5T"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_wannacry.yar#L12-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_wannacry.yar#L12-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa"
logic_hash = "a652444d7946dbbc4fae76cd01f2e20993999fd1e6fc48a9ac0da57aab87a2da"
score = 75
@@ -298411,8 +298817,8 @@ rule SIGNATURE_BASE_Wannacry_Ransomware_Gen : FILE
date = "2017-05-12"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-132A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_wannacry.yar#L48-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_wannacry.yar#L48-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05"
hash = "8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df"
hash = "4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359"
@@ -298440,8 +298846,8 @@ rule SIGNATURE_BASE_Wanncry_M_Vbs : FILE
date = "2017-05-12"
modified = "2023-12-05"
reference = "https://goo.gl/HG2j5T"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_wannacry.yar#L68-L83"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_wannacry.yar#L68-L83"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "51432d3196d9b78bdc9867a77d601caffd4adaa66dcac944a5ba0b3112bbea3b"
logic_hash = "e4606834535b4cad2e0d4a9bf6519fc4d749422fa4920f91fed9147ccfdff090"
score = 75
@@ -298466,8 +298872,8 @@ rule SIGNATURE_BASE_Wanncry_BAT : FILE
date = "2017-05-12"
modified = "2023-12-05"
reference = "https://goo.gl/HG2j5T"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_wannacry.yar#L85-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_wannacry.yar#L85-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077"
logic_hash = "472c6aa0f1b5229d639ef347ea39947d3fd292cda3c4086e29a19b64daad4f3f"
score = 75
@@ -298493,8 +298899,8 @@ rule SIGNATURE_BASE_Wannacry_Ransomnote : FILE
date = "2017-05-12"
modified = "2023-12-05"
reference = "https://goo.gl/HG2j5T"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_wannacry.yar#L103-L117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_wannacry.yar#L103-L117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e"
logic_hash = "da814848f4616166bd7b92fa1d55a54b565fa8e6036cb895e5795448e989a99d"
score = 75
@@ -298518,8 +298924,8 @@ rule SIGNATURE_BASE_APT_Lazaruswannacry : FILE
date = "2017-05-15"
modified = "2023-12-05"
reference = "https://twitter.com/neelmehta/status/864164081116225536"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_wannacry.yar#L121-L147"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_wannacry.yar#L121-L147"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9c7c7149387a1c79679a87dd1ba755bc"
hash = "ac21c8ad899727137c4b94458d7aa8d8"
logic_hash = "8b32f1ea45a346088a18761540df3387997b53ea853f7a53cd292c9224f11209"
@@ -298556,8 +298962,8 @@ rule SIGNATURE_BASE_APT_APT10_Malware_Imphash_Dec18_1 : FILE
date = "2018-12-28"
modified = "2023-12-05"
reference = "AlienVault OTX IOCs - statistical sample analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt10.yar#L1390-L1406"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt10.yar#L1390-L1406"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d6e2f23f3809e7a7064bfe4859db3480454a9c8b21ffac2e1e8b7b8a8906de93"
score = 75
quality = 85
@@ -298575,8 +298981,8 @@ rule SIGNATURE_BASE_MAL_Qbot_HTML_Smuggling_Indicators_Oct22_1 : FILE
date = "2022-10-07"
modified = "2023-12-05"
reference = "https://twitter.com/ankit_anubhav/status/1578257383133876225?s=20&t=Bu3CCJCzImpTGOQX_KGsdA"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_qbot_payloads.yar#L2-L55"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_qbot_payloads.yar#L2-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4f384bcba31fda53e504d0a6c85cee0ce3ea9586226633d063f34c53ddeaca3f"
hash = "8e61c2b751682becb4c0337f5a79b2da0f5f19c128b162ec8058104b894cae9b"
hash = "c5d23d991ce3fbcf73b177bc6136d26a501ded318ccf409ca16f7c664727755a"
@@ -298627,8 +299033,8 @@ rule SIGNATURE_BASE_BKDR_Xzutil_Script_CVE_2024_3094_Mar24_1 : CVE_2024_3094
date = "2024-03-30"
modified = "2024-04-24"
reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/bkdr_xz_util_cve_2024_3094.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/bkdr_xz_util_cve_2024_3094.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d44d0425769fa2e0b6875e5ca25d45b251bbe98870c6b9bef34f7cea9f84c9c3"
logic_hash = "8d3f5f078a5c827208e04acb7ac1496f473e1236f92561f94d2a3c8156c68ea6"
score = 80
@@ -298652,8 +299058,8 @@ rule SIGNATURE_BASE_BKDR_Xzutil_Binary_CVE_2024_3094_Mar24_1 : CVE_2024_3094 FIL
date = "2024-03-30"
modified = "2024-04-24"
reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/bkdr_xz_util_cve_2024_3094.yar#L19-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/bkdr_xz_util_cve_2024_3094.yar#L19-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "319feb5a9cddd81955d915b5632b4a5f8f9080281fb46e2f6d69d53f693c23ae"
hash = "605861f833fc181c7cdcabd5577ddb8989bea332648a8f498b4eef89b8f85ad4"
hash = "8fa641c454c3e0f76de73b7cc3446096b9c8b9d33d406d38b8ac76090b0344fd"
@@ -298683,8 +299089,8 @@ rule SIGNATURE_BASE_BKDR_Xzutil_Killswitch_CVE_2024_3094_Mar24_1 : CVE_2024_3094
date = "2024-03-30"
modified = "2024-04-24"
reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01?permalink_comment_id=5006558#gistcomment-5006558"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/bkdr_xz_util_cve_2024_3094.yar#L48-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/bkdr_xz_util_cve_2024_3094.yar#L48-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b2024d4b8346c4f74524bb7f3c6b2850684c19471a00e6fa60fff1c41e4a86b6"
score = 85
quality = 85
@@ -298705,8 +299111,8 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_SH_Indicators_Mar24_1 : FILE
date = "2024-04-06"
modified = "2024-04-24"
reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4/1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/bkdr_xz_util_cve_2024_3094.yar#L62-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/bkdr_xz_util_cve_2024_3094.yar#L62-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b5abf8184e0b1b18ccc513e00e9db241b4983923ae97f495396d73f0fb162192"
score = 60
quality = 85
@@ -298727,8 +299133,8 @@ rule SIGNATURE_BASE_Tofu_Backdoor
date = "2017-02-28"
modified = "2023-12-05"
reference = "https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ham_tofu_chches.yar#L11-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ham_tofu_chches.yar#L11-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "67c49456dbe4dc4c8bc54139ce6d493ea5588392d8c64010d029d7a63ac7f976"
score = 75
quality = 85
@@ -298751,8 +299157,8 @@ rule SIGNATURE_BASE_Susp_Indicators_EXE : FILE
date = "2018-01-05"
modified = "2023-12-05"
reference = "https://pastebin.com/8qaiyPxs"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_netwire_rat.yar#L11-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_netwire_rat.yar#L11-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6de7f0276afa633044c375c5c630740af51e29b6a6f17a64fbdd227c641727a4"
logic_hash = "9cb66435b78893daa5583475b14f0df2a5e8612f3aaf5cb02160991ab4d57d1b"
score = 60
@@ -298780,8 +299186,8 @@ rule SIGNATURE_BASE_Suspicious_BAT_Strings : FILE
date = "2018-01-05"
modified = "2023-12-05"
reference = "https://pastebin.com/8qaiyPxs"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_netwire_rat.yar#L32-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_netwire_rat.yar#L32-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e643a5ef41d084e1b1a20be2c56328b72fedddbbce3c79d1e93cc8cfaa633e12"
score = 60
quality = 85
@@ -298803,8 +299209,8 @@ rule SIGNATURE_BASE_Malicious_BAT_Strings : FILE
date = "2018-01-05"
modified = "2023-12-05"
reference = "https://pastebin.com/8qaiyPxs"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_netwire_rat.yar#L47-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_netwire_rat.yar#L47-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1f39b3fd11e7450eb1eaddeeca60aa4970568efda6053029f85df42e2f9fdd6e"
score = 60
quality = 85
@@ -298826,8 +299232,8 @@ rule SIGNATURE_BASE_PLEAD_Downloader_Jun18_1 : FILE
date = "2018-06-16"
modified = "2023-12-05"
reference = "https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_plead_downloader.yar#L1-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_plead_downloader.yar#L1-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a26df4f62ada084a596bf0f603691bc9c02024be98abec4a9872f0ff0085f940"
logic_hash = "82fa4629aeb67a657af8b40527414e59d1c45a7c4e3c68398d3472c080c9487b"
score = 75
@@ -298854,8 +299260,8 @@ rule SIGNATURE_BASE_Servantshell : FILE
date = "2017-02-02"
modified = "2023-12-05"
reference = "https://tinyurl.com/jmp7nrs"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_servantshell.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_servantshell.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "739057dc95831c9ed35981b40c606ecd0b3fd2118b42ed7c09e200dc0bc395db"
score = 70
quality = 85
@@ -298880,8 +299286,8 @@ rule SIGNATURE_BASE_APT_Hiddencobra_Enc_PK_Header : HIDDEN_COBRA TYPEFRAME FILE
date = "2018-04-12"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ar18_165a.yar#L2-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ar18_165a.yar#L2-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3229a6cea658b1b3ca5ca9ad7b40d8d4"
logic_hash = "d0c8345b69e5f421fd93bc239031f2e51a120ae64be1eca0c1fdae2aa55ac42a"
score = 75
@@ -298908,8 +299314,8 @@ rule SIGNATURE_BASE_APT_Hiddencobra_Import_Obfuscation_2 : HIDDEN_COBRA TYPEFRAM
date = "2018-04-12"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ar18_165a.yar#L21-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ar18_165a.yar#L21-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bfb41bc0c3856aa0a81a5256b7b8da51"
logic_hash = "d52fc053afc6b3beb35a6dfd0f9b3714a5bad4e9b0dcfcce7be87d65f0a0c23e"
score = 75
@@ -298939,8 +299345,8 @@ rule SIGNATURE_BASE_APT_NK_AR18_165A_Hiddencobra_Import_Deob : HIDDEN_COBRA TYPE
date = "2018-04-12"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ar18_165a.yar#L43-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ar18_165a.yar#L43-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae769e62fef4a1709c12c9046301aa5d"
hash = "e48fe20eblf5a5887f2ac631fed9ed63"
logic_hash = "2eff83738ca4f2db8327c1ee2a9539d7ce882a315025a656d391c16079e432cb"
@@ -298967,8 +299373,8 @@ rule SIGNATURE_BASE_APT_NK_AR18_165A_1 : FILE
date = "2018-06-15"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ar18_165a.yar#L62-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ar18_165a.yar#L62-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "089e49de61701004a5eff6de65476ed9c7632b6020c2c0f38bb5761bca897359"
logic_hash = "7b87c537c9ff38329a5e1e39d5ad1d6cef724c580f246721443eab603534b29d"
score = 75
@@ -298992,8 +299398,8 @@ rule SIGNATURE_BASE_Industroyer_Malware_1 : FILE
date = "2017-06-13"
modified = "2023-12-05"
reference = "https://goo.gl/x81cSy"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_industroyer.yar#L12-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_industroyer.yar#L12-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910"
hash = "018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81"
logic_hash = "276b7abdf43b62c3943a8dc362e1c68b23cc505d288e4395a6ac3cb4795371f2"
@@ -299027,8 +299433,8 @@ rule SIGNATURE_BASE_Industroyer_Malware_2 : FILE
date = "2017-06-13"
modified = "2023-12-05"
reference = "https://goo.gl/x81cSy"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_industroyer.yar#L39-L77"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_industroyer.yar#L39-L77"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3e3ab9674142dec46ce389e9e759b6484e847f5c1e1fc682fc638fc837c13571"
hash = "37d54e3d5e8b838f366b9c202f75fa264611a12444e62ae759c31a0d041aa6e4"
hash = "ecaf150e087ddff0ec6463c92f7f6cca23cc4fd30fe34c10b3cb7c2a6d135c77"
@@ -299074,8 +299480,8 @@ rule SIGNATURE_BASE_Industroyer_Portscan_3 : FILE
date = "2017-06-13"
modified = "2023-12-05"
reference = "https://goo.gl/x81cSy"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_industroyer.yar#L79-L100"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_industroyer.yar#L79-L100"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "893e4cca7fe58191d2f6722b383b5e8009d3885b5913dcd2e3577e5a763cdb3f"
logic_hash = "539a420989c178b3fa26e313d23e9f9c6804aa6dbd2d94f463ae924d46ac2851"
score = 75
@@ -299105,8 +299511,8 @@ rule SIGNATURE_BASE_Industroyer_Portscan_3_Output
date = "2017-06-13"
modified = "2023-12-05"
reference = "https://goo.gl/x81cSy"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_industroyer.yar#L102-L115"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_industroyer.yar#L102-L115"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6a2fc7b66b1e93f523e08e12ba420d261bae198918bb09eac1a7cdecc04a6737"
score = 75
quality = 85
@@ -299129,8 +299535,8 @@ rule SIGNATURE_BASE_Industroyer_Malware_4 : FILE
date = "2017-06-13"
modified = "2023-12-05"
reference = "https://goo.gl/x81cSy"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_industroyer.yar#L117-L134"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_industroyer.yar#L117-L134"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "21c1fdd6cfd8ec3ffe3e922f944424b543643dbdab99fa731556f8805b0d5561"
logic_hash = "cb850445eaf3e1a6c9a9d6c453ed0f6729a95a671a01ce8fbaddf15599e4f2ba"
score = 75
@@ -299155,8 +299561,8 @@ rule SIGNATURE_BASE_Industroyer_Malware_5 : FILE
date = "2017-06-13"
modified = "2023-12-05"
reference = "https://goo.gl/x81cSy"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_industroyer.yar#L136-L158"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_industroyer.yar#L136-L158"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad"
logic_hash = "9dfd3cfc724f0dfe090b1bcbf03b9ebd0d01b3d781f833a8ca6ba1451a63d5ad"
score = 75
@@ -299188,8 +299594,8 @@ rule SIGNATURE_BASE_Silence_Malware_1 : FILE
date = "2017-11-01"
modified = "2023-12-05"
reference = "https://securelist.com/the-silence/83009/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_silence.yar#L13-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_silence.yar#L13-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f24b160e9e9d02b8e31524b8a0b30e7cdc66dd085e24e4c58240e4c4b6ec0ac2"
logic_hash = "b88795268c080fe19f7e185d1542b520616fe6c00bae23a99981aa1ee8abacb3"
score = 75
@@ -299220,8 +299626,8 @@ rule SIGNATURE_BASE_Silence_Malware_2 : FILE
date = "2017-11-01"
modified = "2023-12-05"
reference = "https://securelist.com/the-silence/83009/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_silence.yar#L40-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_silence.yar#L40-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "75b8f534b2f56f183465ba2b63cfc80b7d7d1d155697af141447ec7144c2ba27"
logic_hash = "8cb6320eac984b7a332c1c84582a7ca7e90d409e518106c4e7655948f6863889"
score = 75
@@ -299250,8 +299656,8 @@ rule SIGNATURE_BASE_SUSP_Gobfuscate_May21 : FILE
date = "2021-05-14"
modified = "2024-04-02"
reference = "https://github.com/unixpickle/gobfuscate"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_gobfuscate.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_gobfuscate.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f71078dd6354a482a2ead2f0d25f4172cd40e62440a70c2da7916b68f26909a3"
score = 70
quality = 85
@@ -299273,8 +299679,8 @@ rule SIGNATURE_BASE_BTC_Miner_Lsass1_Chrome_2 : FILE
date = "2017-06-22"
modified = "2023-12-05"
reference = "Internal Research - CN Actor"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cn_group_btc.yar#L10-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cn_group_btc.yar#L10-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "048e9146387d6ff2ac055eb9ddfbfb9a7f70e95c7db9692e2214fa4bec3d5b2e"
hash = "c8db8469287d47ffdc74fe86ce0e9d6e51de67ba1df318573c9398742116a6e8"
logic_hash = "ef80dba71c901d6e821b2e08a701a82f8147e41a8f14c5fd324d5e043b0ff322"
@@ -299300,8 +299706,8 @@ rule SIGNATURE_BASE_CN_Actor_RA_Tool_Ammyy_Mscorsvw : FILE
date = "2017-06-22"
modified = "2023-12-05"
reference = "Internal Research - CN Actor"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cn_group_btc.yar#L29-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cn_group_btc.yar#L29-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed"
hash = "d9ec0a1be7cd218042c54bfbc12000662b85349a6b78731a09ed336e5d3cf0b4"
logic_hash = "c4b64b3aa63d80fa1a73b021bf49539af5888f53090555555c1f3fd7fbb90230"
@@ -299327,8 +299733,8 @@ rule SIGNATURE_BASE_CN_Actor_Ammyyadmin : FILE
date = "2017-06-22"
modified = "2023-12-05"
reference = "Internal Research - CN Actor"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cn_group_btc.yar#L47-L61"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cn_group_btc.yar#L47-L61"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed"
logic_hash = "b628c7e6debdd2b21a321dc2ec5838fd56107f4cac21bda8b9faa1c1d5b23b71"
score = 60
@@ -299351,8 +299757,8 @@ rule SIGNATURE_BASE_MAL_LNX_Redmenshen_Bpfdoor_May23_1 : FILE
date = "2023-05-11"
modified = "2023-12-05"
reference = "https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lnx_implant_may22.yar#L3-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lnx_implant_may22.yar#L3-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7"
logic_hash = "c58971a43443800256e791b4f9fe7c3221518b0050e5f2964b6c843ddb4549ac"
score = 80
@@ -299382,8 +299788,8 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_1 : FILE
date = "2022-05-05"
modified = "2023-12-05"
reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lnx_implant_may22.yar#L45-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lnx_implant_may22.yar#L45-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
hash = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
hash = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
@@ -299421,8 +299827,8 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_2 : FILE
date = "2022-05-07"
modified = "2023-12-05"
reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lnx_implant_may22.yar#L78-L100"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lnx_implant_may22.yar#L78-L100"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
hash = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
hash = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
@@ -299451,8 +299857,8 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_3 : FILE
date = "2022-05-08"
modified = "2023-12-05"
reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lnx_implant_may22.yar#L102-L119"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lnx_implant_may22.yar#L102-L119"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3"
hash = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
logic_hash = "afec0bfeddf5c5c2abc1a3173f636c385437e5d7c0b68665f6274011113a6a9c"
@@ -299477,8 +299883,8 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_Generic_May22_1 :
date = "2022-05-09"
modified = "2023-12-05"
reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lnx_implant_may22.yar#L121-L156"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lnx_implant_may22.yar#L121-L156"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
hash = "1925e3cd8a1b0bba0d297830636cdb9ebf002698c8fa71e0063581204f4e8345"
hash = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
@@ -299521,8 +299927,8 @@ rule SIGNATURE_BASE_SUSP_VHD_Suspicious_Small_Size : FILE
date = "2019-12-21"
modified = "2023-01-27"
reference = "https://twitter.com/MeltX0R/status/1208095892877774850"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_vhd_anomaly.yar#L2-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_vhd_anomaly.yar#L2-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3382a75bd959d2194c4b1a8885df93e8770f4ebaeaff441a5180ceadf1656cd9"
logic_hash = "0bd5b113714854feaa89d52d4bab6a4a00f0dcb7fd816fa7b036eb43d3ea0dd8"
score = 50
@@ -299550,8 +299956,8 @@ rule SIGNATURE_BASE_APT_MAL_RU_WIN_Snake_Malware_May23_1 : MEMORY
date = "2023-05-10"
modified = "2025-03-21"
reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_mal_ru_snake_may23.yar#L17-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_mal_ru_snake_may23.yar#L17-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7cff7152259bb17a9b72b91f0fbef220aad2f35a1d2758d7225316a9896bf845"
score = 70
quality = 71
@@ -299581,8 +299987,8 @@ rule SIGNATURE_BASE_APT_MAL_RU_Snake_Indicators_May23_1
date = "2023-05-10"
modified = "2025-03-21"
reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_mal_ru_snake_may23.yar#L45-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_mal_ru_snake_may23.yar#L45-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "10b854d66240d9ee1ce4296d2f7857d2b1c6f062ca836d13d777930d678b3ca6"
hash = "15ac5a61fb3e751045de2d7f5ff26c673f3883e326cd1b3a63889984a4fb2a8f"
hash = "315ec991709eb45eccf724dfe31bccb7affcac7f8e8007e688ba8d02827205e0"
@@ -299626,11 +300032,11 @@ rule SIGNATURE_BASE_EXPL_CVE_2021_31166_Accept_Encoding_May21_1 : CVE_2021_31166
date = "2021-05-21"
modified = "2023-12-05"
reference = "https://github.com/0vercl0k/CVE-2021-31166"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2021_31166.yar#L2-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2021_31166.yar#L2-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5bb5b4093a7abe9d4297a4c047803b92f7c08f56f15b0f7bd163203ae47e026d"
score = 70
- quality = 60
+ quality = 85
tags = "CVE-2021-31166"
strings:
@@ -299648,8 +300054,8 @@ rule SIGNATURE_BASE_MAL_DOC_Zloader_Oct20_1 : FILE
date = "2020-10-10"
modified = "2023-12-05"
reference = "https://twitter.com/JohnLaTwC/status/1314602421977452544"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_zloader_maldocs.yar#L2-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_zloader_maldocs.yar#L2-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "668ca7ede54664360b0a44d5e19e76beb92c19659a8dec0e7085d05528df42b5"
hash = "a2ffabbb1b5a124f462a51fee41221081345ec084d768ffe1b1ef72d555eb0a0"
hash = "d268af19db475893a3d19f76be30bb063ab2ca188d1b5a70e51d260105b201da"
@@ -299677,8 +300083,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Fakefilemaker : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/DamonMohammadbagher/FakeFileMaker"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L3-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L3-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "27d402835f31b6383c837e90248ae5c6d22f4c267d52625ebfbcc2ee5099ccad"
score = 75
quality = 85
@@ -299701,8 +300107,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Wmipersistence : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/mdsecactivebreach/WMIPersistence"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L18-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L18-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f8f5e1b6d9b9e8e2f76a7e02385142bbeb755d1b1e41e501f4f74fcaba0a7dad"
score = 75
quality = 85
@@ -299725,8 +300131,8 @@ rule SIGNATURE_BASE_HKTL_NET_Adcollector_Sep22_1 : FILE
date = "2022-09-15"
modified = "2026-02-23"
reference = "https://github.com/dev-2null/ADCollector"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L55-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L55-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "241390219a0a773463601ca68b77af97453c20af00a66492a7a78c04d481d338"
hash = "cc086eb7316e68661e3d547b414890d5029c5cc460134d8b628f4b0be7f27fb3"
logic_hash = "66d5363e885378c442e7532f69d4c36618d7a0f5dbe67490631d1ed5078d3fba"
@@ -299754,8 +300160,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Maliciousclickoncegenerator : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/Mr-Un1k0d3r/MaliciousClickOnceGenerator"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L77-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L77-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "91e5878d49ad9af5420d4e29afaa600337fb8051951598a997cd74d72c884206"
score = 75
quality = 85
@@ -299778,8 +300184,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Directinjectorpoc : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/badBounty/directInjectorPOC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L92-L105"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L92-L105"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ffdc5694668af6c82b493403373d2e2e915e45bca8d58ec1ab41c5a8bd28d781"
score = 75
quality = 85
@@ -299802,8 +300208,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Asstrongasfuck : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/Charterino/AsStrongAsFuck"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L107-L120"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L107-L120"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4765f2099bf8fa8ebccd8cdcc561354f4aeba28c2473fd8556f1ef1d5d28dadd"
score = 75
quality = 85
@@ -299826,8 +300232,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Magentoscanner : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/soufianetahiri/MagentoScanner"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L122-L135"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L122-L135"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "245dce3be07c8e84dfcd2cdb2d9f24406a9b11b437e74969f1472a6ee149fd9c"
score = 75
quality = 85
@@ -299850,8 +300256,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Revengerat_Stub_Cssharp : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/NYAN-x-CAT/RevengeRAT-Stub-CSsharp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L137-L150"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L137-L150"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a3bd1f8e52e6ed468b6a4fea83456ca813b69e2d676dfab687bbea5a746fed3c"
score = 75
quality = 85
@@ -299874,8 +300280,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpyshell : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/antonioCoco/SharPyShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L152-L165"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L152-L165"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "89d0010c08349f8982c7f5aa5f7855702556ce10f9f3b5b18b61349c5233e001"
score = 75
quality = 85
@@ -299898,8 +300304,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostloader : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/TheWover/GhostLoader"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L167-L180"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L167-L180"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "91527b4b35f2bb1aeee236647c5169c67f2b9cfb867f2b6d486bd8d8b7455d4b"
score = 75
quality = 85
@@ -299922,8 +300328,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetinject : FILE
date = "2021-01-22"
modified = "2022-06-28"
reference = "https://github.com/dtrizna/DotNetInject"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L182-L202"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L182-L202"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "07ba4ba23372dbc2618dcea89ef643cd68371ace1116bfeb939b0f9adfc425bb"
score = 75
quality = 85
@@ -299948,8 +300354,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Atpminidump : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/b4rtik/ATPMiniDump"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L204-L217"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L204-L217"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7498ed5d11b9c3646ebd2d1330a239c43e9c5b270b1778871c2821a2fefb5137"
score = 75
quality = 85
@@ -299972,8 +300378,8 @@ rule SIGNATURE_BASE_SUSP_NET_NAME_Confuserex : FILE
date = "2021-01-22"
modified = "2021-01-25"
reference = "https://github.com/yck1509/ConfuserEx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L219-L234"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L219-L234"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "beecb7b66830a033e2048da246d320c1ffc5015b280b34fb61aee87c8a42fff3"
score = 40
quality = 85
@@ -299996,8 +300402,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpbuster : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/passthehashbrowns/SharpBuster"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L236-L249"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L236-L249"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cdc19e03f75f34e6349937c0bff313298fc9310f361eec7af022c450d083ad96"
score = 75
quality = 85
@@ -300020,8 +300426,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Recon_AD : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/outflanknl/Recon-AD"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L273-L286"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L273-L286"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7bfafb2d3e85bb584bd02cb92457d22b07626f71d071c44a4aefbb5748045446"
score = 75
quality = 85
@@ -300044,8 +300450,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpwatchdogs : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/RITRedteam/SharpWatchdogs"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L288-L301"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L288-L301"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3b9410d7e502a5fd55e534d8fe79710d48cf65a0e9859bdd0fea6c8d32311df0"
score = 75
quality = 85
@@ -300068,8 +300474,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpcat : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/Cn33liz/SharpCat"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L303-L316"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L303-L316"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b9e5946f8df1649e71abf014aa6579edbbc93a12ddcc56f8d85d97ae087c8711"
score = 75
quality = 85
@@ -300092,8 +300498,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_K8Tools : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/k8gege/K8tools"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L318-L331"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L318-L331"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "370cab83917bbc76f7f3a1b7793773ddf139879880e55efe59c72a07b34120f1"
score = 75
quality = 85
@@ -300116,8 +300522,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Httpsbeaconshell : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L333-L346"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L333-L346"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6a0d7e1f796ae6cefa297978c743916a08b2406c37fa2c1f3f697a17cb032517"
score = 75
quality = 85
@@ -300140,8 +300546,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostpack_Compiledbinaries : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L348-L361"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L348-L361"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a8e90f07b7d1ec309e51e3606169a05c4bb2b2aa7e31ca26b21f927d648c13cd"
score = 75
quality = 85
@@ -300164,8 +300570,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Metasploit_Sharp : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/VolatileMindsLLC/metasploit-sharp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L363-L376"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L363-L376"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7a1c4e077e197a5cdca8cb12713abb3fa86a3f6ea8e8f2f632c9c8e42d829acc"
score = 75
quality = 85
@@ -300188,8 +300594,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Trevorc2 : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/trustedsec/trevorc2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L378-L391"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L378-L391"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c1d56ef865e6619d9d0deff90b154c63cc3036a8521d3952819e45f51fca9fea"
score = 75
quality = 85
@@ -300212,8 +300618,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_DNS2 : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/DamonMohammadbagher/NativePayload_DNS2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L393-L406"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L393-L406"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "765e6117f69fb58e5e71544badc8135b2ec641a74cc0489a7c79308ca2837bd7"
score = 75
quality = 85
@@ -300236,8 +300642,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Aggressiveproxy : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/EncodeGroup/AggressiveProxy"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L408-L421"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L408-L421"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "702b0cc858cb1687962ac403a730e5f778bf51fc91627c50103e4299f4a3ca5f"
score = 75
quality = 85
@@ -300260,8 +300666,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Msbuildapicaller : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/rvrsh3ll/MSBuildAPICaller"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L423-L436"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L423-L436"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3c1f33c759e6331c562dbf76ce7e34ee82d10070e331d0967143d9d7fad077fc"
score = 75
quality = 85
@@ -300284,8 +300690,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Graykeylogger : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/DarkSecDevelopers/GrayKeylogger"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L438-L451"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L438-L451"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b8e12c5ddf0d50d0b3681594c8bc3410a24dab00035a5959e20d20045dacbbbd"
score = 75
quality = 85
@@ -300308,8 +300714,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Weevely3 : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/epinna/weevely3"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L453-L466"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L453-L466"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c57c6ba5276679a2d32e9b0ebb61059c5bed1ba45f9792ecef3d5c7244f38f24"
score = 75
quality = 85
@@ -300332,8 +300738,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Fudgec2 : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/Ziconius/FudgeC2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L468-L481"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L468-L481"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "89f3bf4b81a901e813c3021422c362d7e075dec7fd76240be121f677039f1994"
score = 75
quality = 85
@@ -300356,8 +300762,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverse_Tcp : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/DamonMohammadbagher/NativePayload_Reverse_tcp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L483-L496"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L483-L496"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "055ee105cd46e54b4f49dd92975ecc08a6184fa8508585ee528d19de34914758"
score = 75
quality = 85
@@ -300380,8 +300786,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharphose : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/ustayready/SharpHose"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L498-L511"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L498-L511"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e3af2a156c2451f7ed2fe3e888fdf2ae080298f7eff56801ddc0c612f04902ee"
score = 75
quality = 85
@@ -300404,8 +300810,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_RAT_Njrat_0_7D_Modded_Source_Code : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/AliBawazeEer/RAT-NjRat-0.7d-modded-source-code"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L513-L526"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L513-L526"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f437195348452242adc8b55d6d517a17764c53188fa2de5cd15848fd23827381"
score = 75
quality = 85
@@ -300428,8 +300834,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Rdpthief : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/0x09AL/RdpThief"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L528-L541"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L528-L541"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8e472c8265d517e512eada819627d56ff449fae4d80054946e9ea96f74004f05"
score = 75
quality = 85
@@ -300452,8 +300858,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Runascs : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/antonioCoco/RunasCs"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L543-L556"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L543-L556"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9fd22a3e92222134c101693b944a2ad53055f9cfafe99823fd6f412981f5afa3"
score = 75
quality = 85
@@ -300476,8 +300882,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_IP6DNS : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/DamonMohammadbagher/NativePayload_IP6DNS"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L558-L571"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L558-L571"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "509c396b97524335735107644460eebed3146b2bc5f8dedb909c9754b2121f5f"
score = 75
quality = 85
@@ -300500,8 +300906,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_ARP : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/DamonMohammadbagher/NativePayload_ARP"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L573-L586"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L573-L586"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e8cecfe09f1cb80eb693eb293dfb8c1bc3885a96dfa045b2391216c5f6f6f983"
score = 75
quality = 85
@@ -300524,8 +300930,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_C2Bridge : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/cobbr/C2Bridge"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L588-L601"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L588-L601"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d5f6d6e9d475bf2d8a49d7550bf3b718539753f3494b58462094bfc0a37b813a"
score = 75
quality = 85
@@ -300548,8 +300954,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Infrastructure_Assessment : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/NyaMeeEain/Infrastructure-Assessment"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L603-L616"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L603-L616"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7b2f1481c2880b5b3ee158f2a526ab7fc5e587bbf3847ebe9ddf447742109a78"
score = 75
quality = 85
@@ -300572,8 +300978,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Shellcodetester : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/tophertimzen/shellcodeTester"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L618-L631"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L618-L631"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3101b62428eba5e36572a190bd3a11f59cf9cca10aec3cfe3000028f1b1f0a3f"
score = 50
quality = 85
@@ -300596,8 +301002,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Gray_Hat_Csharp_Code : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/brandonprry/gray_hat_csharp_code"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L633-L646"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L633-L646"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4520528cd6b1832c97fa79442f9d448d54bad4e6944984fa6e71f34246259e28"
score = 75
quality = 85
@@ -300620,8 +301026,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverseshell : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/DamonMohammadbagher/NativePayload_ReverseShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L648-L661"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L648-L661"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "79ebde95674d76e58938b06a97cb6c65e6ac0606398fc9c30d90e517bbdd62a8"
score = 75
quality = 85
@@ -300644,8 +301050,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetavbypass : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/mandreko/DotNetAVBypass"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L663-L676"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L663-L676"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "574a5f1bc1873321042e932ddfd53853e8e06dff3b25f2ad41e6b8aaf150a8b2"
score = 75
quality = 85
@@ -300668,8 +301074,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Hexyrunner : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/bao7uo/HexyRunner"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L678-L691"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L678-L691"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c55be1fe285358378a98fd1027650dd20dd8cd0aad4dc062df7a0d4538c78c3b"
score = 75
quality = 85
@@ -300692,8 +301098,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpoffensiveshell : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/darkr4y/SharpOffensiveShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L693-L706"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L693-L706"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "36bcae7817eed375e48822a49e6875295ea1037217231a7f9ae88a9b8af95530"
score = 75
quality = 85
@@ -300716,8 +301122,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Reconness : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/reconness/reconness"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L708-L721"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L708-L721"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9cb7a3522bada1c724999058ec4ddfde09b22166f8fb3ba184dfe6bec276cfc5"
score = 75
quality = 85
@@ -300740,8 +301146,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Tvasion : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/loadenmb/tvasion"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L723-L736"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L723-L736"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b6262f751cbb85e702d89e7c5b4efdc8eaf3085101cd7685218ab1e8a2599385"
score = 75
quality = 85
@@ -300764,8 +301170,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Ibombshell : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/Telefonica/ibombshell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L738-L751"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L738-L751"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "30de65328e2e2230eca3a30490e20c2c6d8ac9bdc835ee15d44300a00b801921"
score = 75
quality = 85
@@ -300788,8 +301194,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Remoteprocessinjection : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/Mr-Un1k0d3r/RemoteProcessInjection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L753-L766"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L753-L766"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "87d803c361462877f5ebba2a70f611c95b8684fe9f9f747ccf9643fc4e97d9df"
score = 75
quality = 85
@@ -300812,8 +301218,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_CACTUSTORCH : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L768-L781"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L768-L781"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "51a125a44b5d1e73509bcd29865b26f44a5ee53f6907ee9abffa3eef1bbbdea8"
score = 75
quality = 85
@@ -300836,8 +301242,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Pandasniper : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/QAX-A-Team/PandaSniper"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L783-L796"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L783-L796"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c5a32f22a429777186d88f3fcfa79ad4d971e86ebd6117df74aae19728c6addd"
score = 75
quality = 85
@@ -300860,8 +301266,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Xbapappwhitelistbypasspoc : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/jpginc/xbapAppWhitelistBypassPOC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L798-L811"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L798-L811"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3c79b70d3a72084dff391ba297518c4fe748d35b794278c4edf2d1faa4bd216e"
score = 75
quality = 85
@@ -300884,8 +301290,8 @@ rule SIGNATURE_BASE_HKTL_NET_NAME_Stagestrike : FILE
date = "2021-01-22"
modified = "2026-02-23"
reference = "https://github.com/RedXRanger/StageStrike"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_names.yar#L813-L826"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_names.yar#L813-L826"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "99abc2fee732f27ea94c8ce244dc1742ed01a7753adedd7e80226d1e1c8dee4a"
score = 75
quality = 85
@@ -300908,8 +301314,8 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_1 : FILE
date = "2016-10-20"
modified = "2023-12-05"
reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passcv.yar#L10-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passcv.yar#L10-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "24a9bfbff81615a42e42755711c8d04f359f3bf815fb338022edca860ff1908a"
hash = "e61e56b8f2666b9e605127b4fcc7dc23871c1ae25aa0a4ea23b48c9de35d5f55"
logic_hash = "dfa356b4dff12c3de467c74763fc4d233db9ff5bc3e9ac9f052d331fa47a4ded"
@@ -300942,8 +301348,8 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_Signing_Cert : FILE
date = "2016-10-20"
modified = "2023-12-05"
reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passcv.yar#L36-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passcv.yar#L36-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7c32885c258a6d5be37ebe83643f00165da3ebf963471503909781540204752e"
logic_hash = "ead1de262858960a13b375713183f775bc275fbf4beba4c0839cef2baa5e9f00"
score = 50
@@ -300973,8 +301379,8 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_2 : FILE
date = "2016-10-20"
modified = "2023-12-05"
reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passcv.yar#L59-L82"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passcv.yar#L59-L82"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "475d1c2d36b2cf28b28b202ada78168e7482a98b42ff980bbb2f65c6483db5b4"
hash = "009645c628e719fad2e280ef60bbd8e49bf057196ac09b3f70065f1ad2df9b78"
hash = "92479c7503393fc4b8dd7c5cd1d3479a182abca3cda21943279c68a8eef9c64b"
@@ -301006,8 +301412,8 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_Excalibur_1 : FILE
date = "2016-10-20"
modified = "2023-12-05"
reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passcv.yar#L84-L105"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passcv.yar#L84-L105"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "21566f5ff7d46cc9256dae8bc7e4c57f2b9261f95f6ad2ac921558582ea50dfb"
hash = "02922c5d994e81629d650be2a00507ec5ca221a501fe3827b5ed03b4d9f4fb70"
logic_hash = "ffbd971368420460573c4ecc68261088ffacf91ab9ae72405b41393b04aa2b46"
@@ -301035,8 +301441,8 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_3 : FILE
date = "2016-10-20"
modified = "2023-12-05"
reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passcv.yar#L107-L124"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passcv.yar#L107-L124"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "28c7575b2368a9b58d0d1bf22257c4811bd3c212bd606afc7e65904041c29ce1"
logic_hash = "1032f41688e7cb3fe0be33b143c1af43ee705737a70af3b336ba8504ffe169a9"
score = 75
@@ -301062,8 +301468,8 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_4 : FILE
date = "2016-10-20"
modified = "2023-12-05"
reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passcv.yar#L126-L141"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passcv.yar#L126-L141"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "27463bcb4301f0fdd95bc10bf67f9049e161a4e51425dac87949387c54c9167f"
logic_hash = "c445e745ef520438fa7c4ddcae2657b57c80d798640fdd7c85eabf535f158911"
score = 75
@@ -301088,8 +301494,8 @@ rule SIGNATURE_BASE_Passcv_Sabre_Tool_Ntscan : FILE
date = "2016-10-20"
modified = "2023-12-05"
reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passcv.yar#L143-L159"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passcv.yar#L143-L159"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0f290612b26349a551a148304a0bd3b0d0651e9563425d7c362f30bd492d8665"
logic_hash = "f2b41c1e6db8c9288663cccbf5659484ed415b403068cc566b31aa044bf0de9e"
score = 75
@@ -301114,8 +301520,8 @@ rule SIGNATURE_BASE_Passcv_Sabre_Malware_5 : FILE
date = "2016-10-20"
modified = "2023-12-05"
reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passcv.yar#L161-L182"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passcv.yar#L161-L182"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "03aafc5f468a84f7dd7d7d38f91ff17ef1ca044e5f5e8bbdfe589f5509b46ae5"
logic_hash = "30508c6561a2bb908945e9092da1d5cf2257b8b183effcea25a1ba15567f3d20"
score = 75
@@ -301145,8 +301551,8 @@ rule SIGNATURE_BASE_MAL_Driver_Sensecorp_42B2_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_mal_drivers.yar#L312-L329"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_mal_drivers.yar#L312-L329"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25"
logic_hash = "72e213913bf4317fa0751775e6a1a82ba2706e79c52fcd3e2c8ca69050e3a9d7"
score = 70
@@ -301172,8 +301578,8 @@ rule SIGNATURE_BASE_MAL_Driver_Legalcorp_Pciexpressvideocapture_FD22_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_mal_drivers.yar#L332-L351"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_mal_drivers.yar#L332-L351"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8"
logic_hash = "4c47a159595f420c520e6924238bd260f49ccf163208713c72c62638b13756d9"
score = 70
@@ -301201,8 +301607,8 @@ rule SIGNATURE_BASE_MAL_Driver_Gmer_Gmersys_Gmer_0052_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_mal_drivers.yar#L354-L375"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_mal_drivers.yar#L354-L375"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0052aa88e42055a2eed5ddd17c3499c692360155e5e031a211edfcef577acce3"
hash = "18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7"
logic_hash = "1644a972cb9bde33e5e8ec078b0ee67b34b6a298504895f364260b96a453a3ba"
@@ -301232,8 +301638,8 @@ rule SIGNATURE_BASE_MAL_Driver_Mimidrv_Mimidrvmimikatz_2FAF_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_mal_drivers.yar#L378-L395"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_mal_drivers.yar#L378-L395"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2faf95a3405578d0e613c8d88d534aa7233da0a6217ce8475890140ab8fb33c8"
logic_hash = "e7b3f0a8f5a91896f7d487a39c622b12fc7488f9f80c80b6b551e7e5f6a67f18"
score = 70
@@ -301259,8 +301665,8 @@ rule SIGNATURE_BASE_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_3
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_mal_drivers.yar#L497-L518"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_mal_drivers.yar#L497-L518"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "30e083cd7616b1b969a92fd18cf03097735596cce7fcf3254b2ca344e526acc2"
hash = "a906251667a103a484a6888dca3e9c8c81f513b8f037b98dfc11440802b0d640"
logic_hash = "e2c964f7e30da210778e8a2e5bb96d53485a0736cf3ff28bccbefacb6b46765a"
@@ -301290,8 +301696,8 @@ rule SIGNATURE_BASE_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsope
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_mal_drivers.yar#L521-L541"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_mal_drivers.yar#L521-L541"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f"
logic_hash = "9cde0a399b852038979993375be2a6d0f9f9f760381e94df0190256e8810949f"
score = 70
@@ -301320,8 +301726,8 @@ rule SIGNATURE_BASE_MAL_Driver_Microsoftcorporation_Srvnetsys_Microsoftwindowsop
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_mal_drivers.yar#L544-L564"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_mal_drivers.yar#L544-L564"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d"
logic_hash = "ab1aea5cec71668c0e35ea149b9e537c8468738c3b3e70382ebedf51bb8729d0"
score = 70
@@ -301350,8 +301756,8 @@ rule SIGNATURE_BASE_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsope
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_mal_drivers.yar#L567-L587"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_mal_drivers.yar#L567-L587"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1"
logic_hash = "ec9e321bbc89bffb6243e3edde45e60dc06513e88dfb9a262768ef081db60c5b"
score = 70
@@ -301380,8 +301786,8 @@ rule SIGNATURE_BASE_MAL_Driver_773B_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_mal_drivers.yar#L590-L605"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_mal_drivers.yar#L590-L605"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "773b4a1efb9932dd5116c93d06681990759343dfe13c0858d09245bc610d5894"
logic_hash = "5e01850384ac0dc0e9f33e3e217e0e824cfe3c2bb46feff94dffa070f2f7c9a0"
score = 70
@@ -301405,8 +301811,8 @@ rule SIGNATURE_BASE_MAL_Driver_Sensecorp_7F45_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_mal_drivers.yar#L608-L625"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_mal_drivers.yar#L608-L625"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6"
logic_hash = "dbef723d7e44da110675402fc13708c5b077eeb6a66c1772885f5879d795ec4e"
score = 70
@@ -301432,8 +301838,8 @@ rule SIGNATURE_BASE_MAL_Driver_Microsoftcorporation_Ndislansys_Microsoftwindowso
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_mal_drivers.yar#L628-L648"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_mal_drivers.yar#L628-L648"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427"
logic_hash = "4b92b69636dea19a23172def47e9a1bbd4507075ec118b48db30fec377b8fbff"
score = 70
@@ -301462,8 +301868,8 @@ rule SIGNATURE_BASE_Apt_Win32_Dll_Rat_Hizorrat : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hizor_rat.yar#L1-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hizor_rat.yar#L1-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "75d3d1f23628122a64a2f1b7ef33f5cf"
hash = "d9821468315ccd3b9ea03161566ef18e"
hash = "b9af5f5fd434a65d7aa1b55f5441c90a"
@@ -301494,8 +301900,8 @@ rule SIGNATURE_BASE_M_APT_Downloader_BEATDROP : FILE
date = "2022-04-28"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_apr22.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_apr22.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7a766682cc9a057798cc569111bfcb611648c4a052c0dd664d983b80d5891255"
score = 90
quality = 85
@@ -301520,8 +301926,8 @@ rule SIGNATURE_BASE_M_APT_Downloader_BOOMMIC : FILE
date = "2022-04-28"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_apr22.yar#L19-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_apr22.yar#L19-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c561b19464597f896d31307c0383fbc639cf4211600513e1251a3f59405bfed6"
score = 75
quality = 85
@@ -301545,8 +301951,8 @@ rule SIGNATURE_BASE_VULN_PUA_GIGABYTE_Driver_Jul22_1 : FILE
date = "2022-07-25"
modified = "2023-12-05"
reference = "https://twitter.com/malmoeb/status/1551449425842786306"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_gigabyte_driver.yar#L2-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_gigabyte_driver.yar#L2-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
logic_hash = "8aeae559b52b8e01ceab8caba24653b949b3bec694a14b36c819b0a7c9f8b7c6"
score = 65
@@ -301579,8 +301985,8 @@ rule SIGNATURE_BASE_Crunchrat : FILE
date = "2017-11-03"
modified = "2023-12-05"
reference = "https://github.com/t3ntman/CrunchRAT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_crunchrat.yar#L2-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_crunchrat.yar#L2-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58a07e96497745b6fd5075d569f17b0254c3e50b0234744e0487f7c5dddf7161"
logic_hash = "e29cfe6dd2ca69b1a8cd0cb36f7513dd9befd392906225196991dc62fcc80870"
score = 75
@@ -301610,8 +302016,8 @@ rule SIGNATURE_BASE_Aptgroupx_Plugxtrojanloader_Stringdecode
date = "2016-08-17"
modified = "2023-12-05"
reference = "https://t.co/4xQ8G2mNap"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_plugx.yar#L2-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_plugx.yar#L2-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0535e8c300204e257f0fa57630f386e9fcc8e779"
hash = "088ebf9ccde958f32d11f4e7eb14f5332332f97d"
hash = "0c999d0bffa007e9e6b6fe593933b52f40c75b3d"
@@ -301655,8 +302061,8 @@ rule SIGNATURE_BASE_EXT_APT_Bitter_Win32K_0Day_Feb21 : FILE
date = "2021-01-01"
modified = "2023-12-05"
reference = "https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bitter.yar#L2-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bitter.yar#L2-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "84a8d0ae14469eb6431e73295d821609c7a8b313630d645085ffd8faff6e5e43"
score = 75
quality = 85
@@ -301683,8 +302089,8 @@ rule SIGNATURE_BASE_SUSP_Bad_PDF : FILE
date = "2018-05-03"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_bad_pdf.yar#L1-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_bad_pdf.yar#L1-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d8c502da8a2b8d1c67cb5d61428f273e989424f319cfe805541304bdb7b921a8"
logic_hash = "59b159aaccf5c3b64fee17831c1e3a1ca99b60dbb725ad25a4ddad47cdc442d7"
score = 65
@@ -301708,11 +302114,11 @@ rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Core_PDF : FILE
date = "2015-01-22"
modified = "2023-12-05"
reference = "http://t.co/rF35OaAXrl"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbug.yar#L3-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbug.yar#L3-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a854926a4a98eb1d13a582b4ff4504b9740b8bbe7aa6b5192aeb4d2438a58926"
score = 75
- quality = 35
+ quality = 60
tags = "FILE"
strings:
@@ -301731,8 +302137,8 @@ rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Dll
date = "2015-01-22"
modified = "2023-12-05"
reference = "http://t.co/rF35OaAXrl"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbug.yar#L17-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbug.yar#L17-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f29ff81d62bd6bea776aeddc0725b034624f836c234441f63a8b697e959d3f8d"
score = 75
quality = 85
@@ -301756,8 +302162,8 @@ rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Core : FILE
date = "2015-01-22"
modified = "2023-01-27"
reference = "http://t.co/rF35OaAXrl"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbug.yar#L34-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbug.yar#L34-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "59e1363225b1f7765e953e3d6803270b82f4268431d92ef00ed1010df0793e5f"
score = 75
quality = 85
@@ -301781,8 +302187,8 @@ rule SIGNATURE_BASE_Waterbug_Turla_Dropper
date = "2015-01-22"
modified = "2023-12-05"
reference = "http://t.co/rF35OaAXrl"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbug.yar#L50-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbug.yar#L50-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6836b8d28fb41d9459f24d22e3c428b022b26885b7dce1caa5b0d5a7a1b7f82b"
score = 75
quality = 85
@@ -301804,8 +302210,8 @@ rule SIGNATURE_BASE_Waterbug_Fa_Malware : FILE
date = "2015-01-22"
modified = "2023-01-27"
reference = "http://t.co/rF35OaAXrl"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbug.yar#L64-L81"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbug.yar#L64-L81"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b3ac0d69551f27c7f81e24eb00e110639d4b31c8581dfee82715d65528b09632"
score = 75
quality = 85
@@ -301831,8 +302237,8 @@ rule SIGNATURE_BASE_Waterbug_Sav : FILE
date = "2015-01-22"
modified = "2023-01-27"
reference = "http://t.co/rF35OaAXrl"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_waterbug.yar#L114-L129"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_waterbug.yar#L114-L129"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c8622ac6cb1f0b9965fe6ee1a4860f19d8b0dc1c586e2a3771420b8d78648066"
score = 75
quality = 85
@@ -301857,8 +302263,8 @@ rule SIGNATURE_BASE_APT_ME_Bigbang_Gen_Jul18_1 : FILE
date = "2018-07-09"
modified = "2023-12-05"
reference = "https://research.checkpoint.com/apt-attack-middle-east-big-bang/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bigbang.yar#L3-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bigbang.yar#L3-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4db68522600f2d8aabd255e2da999a9d9c9f1f18491cfce9dadf2296269a172b"
hash = "ac6462e9e26362f711783b9874d46fefce198c4c3ca947a5d4df7842a6c51224"
hash = "e1f52ea30d25289f7a4a5c9d15be97c8a4dfe10eb68ac9d031edcc7275c23dbc"
@@ -301891,8 +302297,8 @@ rule SIGNATURE_BASE_APT_ME_Bigbang_Mal_Jul18_1 : FILE
date = "2018-07-09"
modified = "2023-12-05"
reference = "https://research.checkpoint.com/apt-attack-middle-east-big-bang/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bigbang.yar#L31-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bigbang.yar#L31-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ac6462e9e26362f711783b9874d46fefce198c4c3ca947a5d4df7842a6c51224"
hash = "e1f52ea30d25289f7a4a5c9d15be97c8a4dfe10eb68ac9d031edcc7275c23dbc"
logic_hash = "da45482b465549fce0f088c5818dff4a734faa2e4fbcec43b750893d1c3fefad"
@@ -301922,8 +302328,8 @@ rule SIGNATURE_BASE_MAL_Backnet_Nov18_1 : FILE
date = "2018-11-02"
modified = "2023-12-05"
reference = "https://github.com/valsov/BackNet"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_backnet.yar#L2-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_backnet.yar#L2-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc"
logic_hash = "ea809a65a3cd786efe03ff7d831847e658851f76ee9dd084cb6c622b6e44c75f"
score = 75
@@ -301951,8 +302357,8 @@ rule SIGNATURE_BASE_Muddywater_Mal_Doc_Feb18_1 : FILE
date = "2018-02-26"
modified = "2023-12-05"
reference = "Internal Research - TI2T"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_muddywater.yar#L10-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_muddywater.yar#L10-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c"
logic_hash = "b675b004f86695821737b7fc05276c8350e44f5822ec458a74658f895ccf7082"
score = 75
@@ -301976,8 +302382,8 @@ rule SIGNATURE_BASE_Muddywater_Mal_Doc_Feb18_2 : FILE
date = "2018-02-26"
modified = "2023-12-05"
reference = "Internal Research - TI2T"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_muddywater.yar#L28-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_muddywater.yar#L28-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c"
hash = "366d8b84a43a528e6aaf9ecfc38980b148f983967803914471ccf011b9bb0832"
logic_hash = "b198396d27b32f8aa57a25cd6e33deb2bcfb726731e2e07f8b9d50b5f6ff13a0"
@@ -302005,8 +302411,8 @@ rule SIGNATURE_BASE_MAL_Muddywater_Droppedtask_Jun18_1 : FILE
date = "2018-06-12"
modified = "2023-12-05"
reference = "https://app.any.run/tasks/719c94eb-0a00-47cc-b583-ad4f9e25ebdb"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_muddywater.yar#L48-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_muddywater.yar#L48-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7ecc2e1817f655ece2bde39b7d6633f4f586093047ec5697a1fab6adc7e1da54"
logic_hash = "776ae1adab223ae258d1c1c0c501e177dafe196964a2ede31789a7caa8495b2d"
score = 75
@@ -302033,8 +302439,8 @@ rule SIGNATURE_BASE_Plugx_J16_Gen : FILE
date = "2016-06-08"
modified = "2023-12-05"
reference = "VT Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_win_plugx.yar#L10-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_win_plugx.yar#L10-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3e988243663264b2647e098e36b83dd675141fa9765c9bd47c30f29bf176cd8f"
score = 75
quality = 85
@@ -302073,8 +302479,8 @@ rule SIGNATURE_BASE_Plugx_J16_Gen2 : FILE
date = "2016-06-08"
modified = "2023-12-05"
reference = "VT Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_win_plugx.yar#L42-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_win_plugx.yar#L42-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8fbe90cbff5d408d26b0a5ace6833a0e3100d11ff544184d9ccc2f39ee806de9"
score = 75
quality = 85
@@ -302104,8 +302510,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Xsltransform_Aug21 : FILE
date = "2020-02-23"
modified = "2023-12-05"
reference = "https://gist.github.com/JohnHammond/cdae03ca5bc2a14a735ad0334dcb93d6"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/webshell_xsl_transform.yar#L1-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/webshell_xsl_transform.yar#L1-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3ac0b50adc4c56769d0248e213e9426a22e0f5086bf081da57f835ff1c77b716"
score = 75
quality = 85
@@ -302131,8 +302537,8 @@ rule SIGNATURE_BASE_Apt_Sofacy_Xtunnel : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_xtunnel_bundestag.yar#L3-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_xtunnel_bundestag.yar#L3-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2478d9d8996bf4a142e39eac0e2d6af718d364be080a89530812615595777efd"
score = 75
quality = 85
@@ -302168,8 +302574,8 @@ rule SIGNATURE_BASE_Winexe_Remoteexec : FILE
date = "2015-06-19"
modified = "2021-02-11"
reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_xtunnel_bundestag.yar#L26-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_xtunnel_bundestag.yar#L26-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5130f600cd9a9cdc82d4bad938b20cbd2f699aadb76e7f3f1a93602330d9997d"
hash = "d19dfdbe747e090c5aa2a70cc10d081ac1aa88f360c3f378288a3651632c4429"
logic_hash = "9e944f07b43b934346c0e88685014c05ff81561ac2f7c3374b55b9c4523b98c1"
@@ -302196,8 +302602,8 @@ rule SIGNATURE_BASE_Sofacy_Mal2 : FILE
date = "2015-06-19"
modified = "2023-12-05"
reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_xtunnel_bundestag.yar#L50-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_xtunnel_bundestag.yar#L50-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092"
logic_hash = "c325ed815b7de3338363d064f4097edf0596644d4ef8d642fda3664a2a16c2eb"
score = 70
@@ -302222,8 +302628,8 @@ rule SIGNATURE_BASE_Sofacy_Mal3 : FILE
date = "2015-06-19"
modified = "2023-01-06"
reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_xtunnel_bundestag.yar#L69-L99"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_xtunnel_bundestag.yar#L69-L99"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1"
logic_hash = "80c433cf5b3d042e46b5441a1b027c5ecf571f30571064904a33e92677633e66"
score = 70
@@ -302257,8 +302663,8 @@ rule SIGNATURE_BASE_Sofacy_Bundestag_Batch : FILE
date = "2015-06-19"
modified = "2023-12-05"
reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_xtunnel_bundestag.yar#L101-L116"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_xtunnel_bundestag.yar#L101-L116"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "05d6df161042a65f9eeec4be4046001a03fa61747a9ea123f13e6e75d6664ac7"
score = 70
quality = 85
@@ -302282,8 +302688,8 @@ rule SIGNATURE_BASE_SUSP_Scheduled_Task_Java_JAR_Aug25 : FILE
date = "2025-08-07"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_soupdealer_java_aug25.yar#L1-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_soupdealer_java_aug25.yar#L1-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7c5999082d9c5f3dd342ca05191311ddd1e24ba7675d1e9763fb4d962be3a933"
logic_hash = "fc8e72dbc6133ca27cfd35bb952c32be3a75d0485558915f9ea49fc8fd8c5719"
score = 60
@@ -302309,8 +302715,8 @@ rule SIGNATURE_BASE_SUSP_JAVA_Loader_Indicators_Aug25 : FILE
date = "2025-08-07"
modified = "2026-05-15"
reference = "https://www.malwation.com/blog/technical-analysis-of-a-stealth-java-loader-used-in-phishing-campaigns-targeting-turkiye"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_soupdealer_java_aug25.yar#L26-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_soupdealer_java_aug25.yar#L26-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c4cf746fce283878dde567e5457a8ebdbb7ff3414be46569ecdd57338bd96fa1"
logic_hash = "ac610cd6d3030f49058d5e6f059b746cf3da05ca3cdc8f2be2f5f1cfec2ff665"
score = 70
@@ -302334,8 +302740,8 @@ rule SIGNATURE_BASE_MAL_JAVA_Loader_Final_Jar_Aug25
date = "2025-08-07"
modified = "2026-05-15"
reference = "https://www.malwation.com/blog/technical-analysis-of-a-stealth-java-loader-used-in-phishing-campaigns-targeting-turkiye"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_soupdealer_java_aug25.yar#L47-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_soupdealer_java_aug25.yar#L47-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0a7fddd91b332c8daee2c0727b884fc92cfaede02883dbad75f7efc299e884e3"
logic_hash = "743e7e12afd949aacbbfcfc62b13d4e65b7011ca4301b37b71bc8032f96aff20"
score = 85
@@ -302360,8 +302766,8 @@ rule SIGNATURE_BASE_SUSP_JAVA_Class_Allatori_Obfuscator_Aug25 : FILE
date = "2025-08-07"
modified = "2026-05-15"
reference = "https://www.malwation.com/blog/technical-analysis-of-a-stealth-java-loader-used-in-phishing-campaigns-targeting-turkiye"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_soupdealer_java_aug25.yar#L65-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_soupdealer_java_aug25.yar#L65-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0a7fddd91b332c8daee2c0727b884fc92cfaede02883dbad75f7efc299e884e3"
logic_hash = "981ae619526e3f90618884d133d565630320419ad4b9c75737708c864fac8365"
score = 50
@@ -302383,8 +302789,8 @@ rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_1 : FILE
date = "2017-07-08"
modified = "2023-12-05"
reference = "https://blogs.rsa.com/cat-phishing/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_zxshell.yar#L12-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_zxshell.yar#L12-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ef56c2609bc1b90f3e04745890235e6052a4be94e35e38b6f69b64fb17a7064e"
logic_hash = "30195ff91bd62e32784040f9ec2cf72db90ef1c75056abfd9740f35ce1baccd9"
score = 75
@@ -302412,8 +302818,8 @@ rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_2 : FILE
date = "2017-07-08"
modified = "2023-12-05"
reference = "https://blogs.rsa.com/cat-phishing/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_zxshell.yar#L32-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_zxshell.yar#L32-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "204273675526649b7243ee48efbb7e2bc05239f7f9015fbc4fb65f0ada64759e"
logic_hash = "d7c9f2af3842d60cf4b0b64bdb687a32014b449b42b101394e0424c12fc2808e"
score = 75
@@ -302447,8 +302853,8 @@ rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_3 : FILE
date = "2017-07-08"
modified = "2023-12-05"
reference = "https://blogs.rsa.com/cat-phishing/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_zxshell.yar#L60-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_zxshell.yar#L60-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2e5cf8c785dc081e5c2b43a4a785713c0ae032c5f86ccbc7abf5c109b8854ed7"
logic_hash = "1d7dd59cf6ef24ce47431f9f3fbc980019880082b4e6162bae70b64abaa26db7"
score = 75
@@ -302472,8 +302878,8 @@ rule SIGNATURE_BASE_Zxshell_Jul17 : FILE
date = "2017-07-08"
modified = "2023-12-05"
reference = "https://blogs.rsa.com/cat-phishing/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_zxshell.yar#L76-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_zxshell.yar#L76-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16"
logic_hash = "2c7467417ffc8b0ed3037ace9ce4183c9d4a90d1c087a420dd3c7a9c422621b1"
score = 75
@@ -302509,8 +302915,8 @@ rule SIGNATURE_BASE_Zxshell_20171211_Chrsben : FILE
date = "2017-12-11"
modified = "2023-12-05"
reference = "https://goo.gl/snc85M"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_zxshell.yar#L115-L138"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_zxshell.yar#L115-L138"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dd01e7a1c9b20d36ea2d961737780f2c0d56005c370e50247e38c5ca80dcaa4f"
logic_hash = "361441404582b0eaca25954f7fe1a3a3b9fefd15cac78d61408bc50aeb78bb61"
score = 75
@@ -302536,8 +302942,8 @@ rule SIGNATURE_BASE_SUSP_Deviceguard_WDS_Evasion : FILE
date = "2015-01-01"
modified = "2023-01-06"
reference = "http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_deviceguard_evasion.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_deviceguard_evasion.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4be9d7c34f7bafeb53db4fc1262a3692493b2253b0de7dc97480b01b62a9f12c"
score = 70
quality = 85
@@ -302560,8 +302966,8 @@ rule SIGNATURE_BASE_SUSP_BAT2EXE_Bdargo_Converted_BAT : FILE
date = "2018-07-28"
modified = "2022-06-23"
reference = "https://www.majorgeeks.com/files/details/advanced_bat_to_exe_converter.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_bat2exe.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_bat2exe.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d428d79f58425d831c2ee0a73f04749715e8c4dd30ccd81d92fe17485e6dfcda"
hash = "a547a02eb4fcb8f446da9b50838503de0d46f9bb2fd197c9ff63021243ea6d88"
logic_hash = "978aa25f1abd0cbd36e55da2b1ed4478a3a5b8b814988669c70e219cc2dd1afd"
@@ -302591,8 +302997,8 @@ rule SIGNATURE_BASE_FIN7_Dropper_Aug17 : FILE
date = "2017-08-04"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7_backdoor.yar#L12-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7_backdoor.yar#L12-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c91642c0a5a8781fff9fd400bff85b6715c96d8e17e2d2390c1771c683c7ead9"
hash = "cf86c7a92451dca1ebb76ebd3e469f3fa0d9b376487ee6d07ae57ab1b65a86f8"
logic_hash = "610b7288e08d36858de88abac3a86dcb6ebba1c019e17fb716f5c26aa964903b"
@@ -302621,8 +303027,8 @@ rule SIGNATURE_BASE_FIN7_Backdoor_Aug17 : FILE
date = "2017-08-04"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7_backdoor.yar#L34-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7_backdoor.yar#L34-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "76818317c543c1464898463741ddaf8c6368d0f5004c088a323c4323db49060c"
score = 75
quality = 85
@@ -302661,8 +303067,8 @@ rule SIGNATURE_BASE_Furtim_Nativedll : FILE
date = "2016-06-13"
modified = "2023-12-05"
reference = "MISP 3971"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_furtim.yar#L8-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_furtim.yar#L8-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4f39d3e70ed1278d5fa83ed9f148ca92383ec662ac34635f7e56cc42eeaee948"
logic_hash = "f9673cdd1e8e38f98b9625291a03011d5cfce78c689eab491ff189c4e039e1ef"
score = 75
@@ -302688,8 +303094,8 @@ rule SIGNATURE_BASE_Furtim_Parent_1 : FILE
date = "2016-07-16"
modified = "2023-12-05"
reference = "https://sentinelone.com/blogs/sfg-furtims-parent/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_furtim.yar#L34-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_furtim.yar#L34-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "766e49811c0bb7cce217e72e73a6aa866c15de0ba11d7dda3bd7e9ec33ed6963"
logic_hash = "ab4c7ca5c887b2a2f2949a5a6fd0d623dad47d9c1f866fb43f7f8ec38dfa6a02"
score = 75
@@ -302717,8 +303123,8 @@ rule SIGNATURE_BASE_APT_PS1_Sysaid_EXPL_Forensicartifacts_Nov23_1 : SCRIPT CVE_2
date = "2023-11-09"
modified = "2023-12-05"
reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_sysaid_cve_2023_47246.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_sysaid_cve_2023_47246.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "85efeea88961ca99b22004726d88efc46c748273b9a0b3be674f4cbb12cd3dd1"
score = 85
quality = 85
@@ -302740,8 +303146,8 @@ rule SIGNATURE_BASE_MAL_Loader_Turtleloader_Nov23 : CVE_2023_47246 FILE
date = "2023-11-09"
modified = "2023-12-05"
reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_sysaid_cve_2023_47246.yar#L17-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_sysaid_cve_2023_47246.yar#L17-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d"
logic_hash = "14a1636ed4dc3c897fefe53946e67339f91da9e2fbed2c99b9b4119dcc2649c0"
score = 85
@@ -302768,8 +303174,8 @@ rule SIGNATURE_BASE_MAL_Grace_Dec22
date = "2022-12-13"
modified = "2023-12-05"
reference = "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_sysaid_cve_2023_47246.yar#L40-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_sysaid_cve_2023_47246.yar#L40-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a66df3454b8c13f1b92d8b2cf74f5bfcdedfbff41a5e4add62e15277d14dd169"
hash = "e113a8df3c4845365f924bacf10c00bcc5e17587a204b640852dafca6db20404"
logic_hash = "8276662dadfa2f8e07dd7882a60e55bd22ecf1f8f66a09940f16236598646560"
@@ -302798,8 +303204,8 @@ rule SIGNATURE_BASE_SUSP_THOR_Unsigned_Oct23_1 : FILE
date = "2023-10-28"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_unsigned_thor.yar#L4-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_unsigned_thor.yar#L4-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "12303e3549071dd6c8896f7a1222eb5905f6b4d3f320134416a5b6d53857adeb"
score = 75
quality = 85
@@ -302823,8 +303229,8 @@ rule SIGNATURE_BASE_SUSP_Adobepdf_SFX_Bitmap_Combo_Executable : FILE
date = "2020-11-02"
modified = "2023-12-05"
reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_icon_anomalies.yar#L3-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_icon_anomalies.yar#L3-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "13655f536fac31e6c2eaa9e6e113ada2a0b5e2b50a93b6bbfc0aaadd670cde9b"
logic_hash = "ac515d698507be6085684a6ec4622c6f3c26d0c3a0d94cbbeacfab7dfb9fe135"
score = 60
@@ -302864,8 +303270,8 @@ rule SIGNATURE_BASE_SUSP_Adobepdf_Bitmap_Executable : FILE
date = "2020-11-02"
modified = "2023-12-05"
reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_icon_anomalies.yar#L39-L68"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_icon_anomalies.yar#L39-L68"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "13655f536fac31e6c2eaa9e6e113ada2a0b5e2b50a93b6bbfc0aaadd670cde9b"
logic_hash = "a8ef5ce2e876565c7d6367ce555d00bd3535699f1907f867811f2f6749672c67"
score = 60
@@ -302900,8 +303306,8 @@ rule SIGNATURE_BASE_Agent_BTZ_Proxy_DLL_1 : FILE
date = "2017-08-07"
modified = "2023-12-05"
reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_agent_btz.yar#L13-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_agent_btz.yar#L13-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9c163c3f2bd5c5181147c6f4cf2571160197de98f496d16b38c7dc46b5dc1426"
hash = "628d316a983383ed716e3f827720915683a8876b54677878a7d2db376d117a24"
logic_hash = "ea430b2888b487a5c7a91b73e8a7893b53d67e8ac95ae85fe9d15c633b2ee660"
@@ -302926,8 +303332,8 @@ rule SIGNATURE_BASE_Agent_BTZ_Proxy_DLL_2 : FILE
date = "2017-08-07"
modified = "2023-12-05"
reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_agent_btz.yar#L29-L52"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_agent_btz.yar#L29-L52"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "73db4295c5b29958c5d93c20be9482c1efffc89fc4e5c8ba59ac9425a4657a88"
hash = "380b0353ba8cd33da8c5e5b95e3e032e83193019e73c71875b58ec1ed389bdac"
hash = "f27e9bba6a2635731845b4334b807c0e4f57d3b790cecdc77d8fef50629f51a2"
@@ -302961,8 +303367,8 @@ rule SIGNATURE_BASE_Agent_BTZ_Aug17 : FILE
date = "2017-08-07"
modified = "2023-12-05"
reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_agent_btz.yar#L54-L73"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_agent_btz.yar#L54-L73"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6ad78f069c3619d0d18eef8281219679f538cfe0c1b6d40b244beb359762cf96"
hash = "49c5c798689d4a54e5b7099b647b0596fb96b996a437bb8241b5dd76e974c24e"
hash = "e88970fa4892150441c1616028982fe63c875f149cd490c3c910a1c091d3ad49"
@@ -302988,8 +303394,8 @@ rule SIGNATURE_BASE_APT_Turla_Agent_BTZ_Gen_1 : FILE
date = "2018-06-16"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_agent_btz.yar#L75-L106"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_agent_btz.yar#L75-L106"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c905f2dec79ccab115ad32578384008696ebab02276f49f12465dcd026c1a615"
logic_hash = "8616d95e683f213916f06a7bf672ced90b2fa55cb4331176021614b4f0b03aed"
score = 80
@@ -303024,8 +303430,8 @@ rule SIGNATURE_BASE_Hiddencobra_R4_Wiper_1 : FILE
date = "2017-12-12"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hiddencobra_wiper.yar#L8-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hiddencobra_wiper.yar#L8-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0e88b7f8491e87cce0deb5f246ca521bdb556b9c79c697559bdf8b0b332e714e"
score = 75
quality = 85
@@ -303047,8 +303453,8 @@ rule SIGNATURE_BASE_Hiddencobra_R4_Wiper_2 : FILE
date = "2017-12-12"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hiddencobra_wiper.yar#L22-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hiddencobra_wiper.yar#L22-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f537f67be28f854db0d56199d2a43f90cf6c80469a6f9853db0cd550440c7e1f"
score = 75
quality = 85
@@ -303070,8 +303476,8 @@ rule SIGNATURE_BASE_EXPL_LNX_CUPS_CVE_2024_47177_Sep24 : CVE_2024_47177 FILE
date = "2024-09-27"
modified = "2024-12-12"
reference = "https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cups_sep24.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cups_sep24.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "633314dea5e3cbdf3cef6e4f18c2efca261dfc600bb9c11d0834fdae102ac9e6"
score = 75
quality = 85
@@ -303093,8 +303499,8 @@ rule SIGNATURE_BASE_SUSP_EXPL_LNX_CUPS_CVE_2024_47177_Sep24 : CVE_2024_47177
date = "2024-09-27"
modified = "2024-12-12"
reference = "https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cups_sep24.yar#L17-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cups_sep24.yar#L17-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2158ca8a08cb7552e2a437de025e3aad63ddc5417245e6ede7283d3bd0fc159b"
score = 65
quality = 85
@@ -303124,8 +303530,8 @@ rule SIGNATURE_BASE_Sysinternals_Tool_Anomaly : FILE
date = "2016-12-06"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_sysinternals_anomaly.yar#L10-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_sysinternals_anomaly.yar#L10-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "760795a51965197bd101ffbf0f7c8cfbbb16d2f443d0941de4a75c8f33f4cad0"
score = 50
quality = 85
@@ -303153,8 +303559,8 @@ rule SIGNATURE_BASE_HKTL_NFS_Fuse_NFS
date = "2024-10-22"
modified = "2025-03-20"
reference = "https://github.com/hvs-consulting/nfs-security-tooling"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/hktl_HvS_nfs_security_tooling.yar#L1-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_HvS_nfs_security_tooling.yar#L1-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0bd3714b865d77660404e5f3ed1e9c7b55aadc6f58d16761111be57597784686"
score = 75
quality = 85
@@ -303183,8 +303589,8 @@ rule SIGNATURE_BASE_HKTL_NFS_NFS_Analyze
date = "2024-10-22"
modified = "2025-03-20"
reference = "https://github.com/hvs-consulting/nfs-security-tooling"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/hktl_HvS_nfs_security_tooling.yar#L26-L53"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_HvS_nfs_security_tooling.yar#L26-L53"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "83a9e5b5b404bf28b0334611fe4f38227212783cecea3c9996d23cb00cad42ed"
score = 75
quality = 85
@@ -303217,8 +303623,8 @@ rule SIGNATURE_BASE_Bitpaymer_1
date = "2019-10-30"
modified = "2023-12-05"
reference = "http://blog.morphisec.com/bitpaymer-ransomware-with-new-custom-packer-framework"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_crime_bitpaymer.yar#L1-L12"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_crime_bitpaymer.yar#L1-L12"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0c236794c04f0805d4611cfaf43369eeb4d0e65d6c697e6c5e6afd321fbca629"
score = 75
quality = 85
@@ -303241,8 +303647,8 @@ rule SIGNATURE_BASE_MAL_Devilstongue_Hijackdll : FILE
date = "2021-07-15"
modified = "2023-12-05"
reference = "https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_candiru.yar#L3-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_candiru.yar#L3-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4ad58a77f9ab5fa078dc40f3ec1d0b0180f25ff3ea304a3c85889df29739e0f5"
score = 80
quality = 85
@@ -303271,11 +303677,11 @@ rule SIGNATURE_BASE_Office_OLE_DDE : FILE
date = "2017-10-12"
modified = "2023-12-05"
reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_dde_in_office_docs.yar#L48-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_dde_in_office_docs.yar#L48-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2d2f7dce166dc8ef8aba7e8eaafaf4d1bb34cdc1ce97d34125a65147cf5e08ac"
score = 50
- quality = 35
+ quality = 60
tags = "FILE"
strings:
@@ -303295,8 +303701,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_INC_Aug24 : FILE
date = "2024-08-08"
modified = "2024-12-12"
reference = "https://twitter.com/rivitna2/status/1701739812733014313"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_inc_ransomware.yar#L1-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_inc_ransomware.yar#L1-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc"
hash = "1754c9973bac8260412e5ec34bf5156f5bb157aa797f95ff4fc905439b74357a"
logic_hash = "335b92027c551d074015b830d137cf2fdee81d792cd7360f2499c83cc895fbbb"
@@ -303327,8 +303733,8 @@ rule SIGNATURE_BASE_Turla_APT_Srsvc : TURLA FILE
date = "2016-06-09"
modified = "2023-12-05"
reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla.yar#L10-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla.yar#L10-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "65996f266166dbb479a42a15a236e6564f0b322d5d68ee546244d7740a21b8f7"
hash = "25c7ff1eb16984a741948f2ec675ab122869b6edea3691b01d69842a53aa3bac"
logic_hash = "76bd2aacde66114090d1c1767da64728219230964a0bc78a5d830819c46bac3a"
@@ -303357,8 +303763,8 @@ rule SIGNATURE_BASE_Turla_APT_Malware_Gen1 : TURLA FILE
date = "2016-06-09"
modified = "2023-12-05"
reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla.yar#L33-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla.yar#L33-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
hash = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
hash = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
@@ -303404,8 +303810,8 @@ rule SIGNATURE_BASE_RUAG_APT_Malware_Gen2 : FILE
date = "2016-06-09"
modified = "2023-01-06"
reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla.yar#L73-L108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla.yar#L73-L108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
hash = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
hash = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
@@ -303446,8 +303852,8 @@ rule SIGNATURE_BASE_Turla_APT_Malware_Gen3 : TURLA FILE
date = "2016-06-09"
modified = "2023-12-05"
reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla.yar#L110-L150"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla.yar#L110-L150"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
hash = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
hash = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
@@ -303495,8 +303901,8 @@ rule SIGNATURE_BASE_Turla_Mal_Script_Jan18_1 : FILE
date = "2018-01-19"
modified = "2023-12-05"
reference = "https://ghostbin.com/paste/jsph7"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla.yar#L152-L169"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla.yar#L152-L169"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "180b920e9cea712d124ff41cd1060683a14a79285d960e17f0f49b969f15bfcc"
logic_hash = "2386abf8afdf8ed9cfd55cb3dcbb998eb732744c601fd9af701cf64c366a0e62"
score = 75
@@ -303524,8 +303930,8 @@ rule SIGNATURE_BASE_Turla_Kazuarrat : FILE
date = "2018-04-08"
modified = "2023-12-05"
reference = "https://twitter.com/DrunkBinary/status/982969891975319553"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla.yar#L173-L192"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla.yar#L173-L192"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6b5d9fca6f49a044fd94c816e258bf50b1e90305d7dab2e0480349e80ed2a0fa"
hash = "7594fab1aadc4fb08fb9dbb27c418e8bc7f08dadb2acf5533dc8560241ecfc1d"
hash = "4e5a86e33e53931afe25a8cb108f53f9c7e6c6a731b0ef4f72ce638d0ea5c198"
@@ -303552,8 +303958,8 @@ rule SIGNATURE_BASE_MAL_Turla_Agent_BTZ : FILE
date = "2018-04-12"
modified = "2023-01-06"
reference = "https://www.gdatasoftware.com/blog/2014/11/23937-the-uroburos-case-new-sophisticated-rat-identified"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla.yar#L195-L226"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla.yar#L195-L226"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c4a1cd6916646aa502413d42e6e7441c6e7268926484f19d9acbf5113fc52fc8"
logic_hash = "3a091d29ef5981b9ab9c0e4114fef9de70acbcbc8ea8518183a567459e1086fa"
score = 90
@@ -303588,8 +303994,8 @@ rule SIGNATURE_BASE_MAL_Turla_Sample_May18_1 : FILE
date = "2018-05-03"
modified = "2023-12-05"
reference = "https://twitter.com/omri9741/status/991942007701598208"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla.yar#L228-L250"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla.yar#L228-L250"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4c49c9d601ebf16534d24d2dd1cab53fde6e03902758ef6cff86be740b720038"
hash = "77cbd7252a20f2d35db4f330b9c4b8aa7501349bc06bbcc8f40ae13d01ae7f8f"
logic_hash = "f5bb26bc787acb89fe5a337121aabc0cd15ed3fd5cbe64ef4e7031e04dc14fb1"
@@ -303621,8 +304027,8 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr20_1 : FILE
date = "2020-04-05"
modified = "2023-12-05"
reference = "https://twitter.com/Int2e_/status/1246115636331319309"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla.yar#L252-L272"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla.yar#L252-L272"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
hash = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
logic_hash = "d463f5a151bb0c3440d719b4c7c0d1ca34de1e0bed7fb9167ecf396607abd3ff"
@@ -303650,8 +304056,8 @@ rule SIGNATURE_BASE_APT_MAL_Tinyturla_Sep21_1 : FILE
date = "2021-09-21"
modified = "2023-12-05"
reference = "https://blog.talosintelligence.com/2021/09/tinyturla.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla.yar#L275-L295"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla.yar#L275-L295"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "030cbd1a51f8583ccfc3fa38a28a5550dc1c84c05d6c0f5eb887d13dedf1da01"
logic_hash = "ede598374bc4a8a870aa29498be4200b4a3d7b289dfcb680fb3f91108d212bca"
score = 75
@@ -303681,8 +304087,8 @@ rule SIGNATURE_BASE_HKTL_Powersploit
date = "2018-06-23"
modified = "2023-12-05"
reference = "https://www.hybrid-analysis.com/sample/16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75?environmentId=100"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powersploit_dropper.yar#L1-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powersploit_dropper.yar#L1-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75"
logic_hash = "00bc389147926f3b474a7072381bb8b9cddad3ff581a5d2182006a674e0c0163"
score = 75
@@ -303706,8 +304112,8 @@ rule SIGNATURE_BASE_M_APT_VIRTUALPITA_1 : FILE
date = "2023-11-25"
modified = "2025-12-19"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc3886_virtualpita.yar#L1-L13"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc3886_virtualpita.yar#L1-L13"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fe34b7c071d96dac498b72a4a07cb246"
logic_hash = "7641f964cc4a7671a9a3438aad1c653ef3fda3887313846cbe838b275a098190"
score = 60
@@ -303729,8 +304135,8 @@ rule SIGNATURE_BASE_M_APT_VIRTUALPITA_2 : FILE
date = "2022-10-01"
modified = "2025-12-19"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc3886_virtualpita.yar#L15-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc3886_virtualpita.yar#L15-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fe34b7c071d96dac498b72a4a07cb246"
logic_hash = "56a3e1b13f0955a780f882e62003f721e409a1fdf61120dd295941605dbf21a4"
score = 75
@@ -303752,8 +304158,8 @@ rule SIGNATURE_BASE_M_APT_VIRTUALPITA_3 : FILE
date = "2022-10-01"
modified = "2025-12-19"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc3886_virtualpita.yar#L27-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc3886_virtualpita.yar#L27-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fe34b7c071d96dac498b72a4a07cb246"
logic_hash = "6f44d516b3cbe54542ae0991aad49274fc4728570e9498b319fc98840ceb7d7d"
score = 75
@@ -303775,8 +304181,8 @@ rule SIGNATURE_BASE_M_APT_VIRTUALPITA_4 : FILE
date = "2022-10-01"
modified = "2025-12-19"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc3886_virtualpita.yar#L39-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc3886_virtualpita.yar#L39-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fe34b7c071d96dac498b72a4a07cb246"
logic_hash = "aaf2ff682c619d2a254fe069d477654a161658db6315239f1b956141b6a72c01"
score = 75
@@ -303798,12 +304204,12 @@ rule SIGNATURE_BASE_M_Hunting_Python_Backdoor_Commandparser_1 : FILE
date = "2022-10-01"
modified = "2025-12-19"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc3886_virtualpita.yar#L52-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc3886_virtualpita.yar#L52-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61ab3f6401d60ec36cd3ac980a8deb75"
logic_hash = "4c6e65d73543b2ae8e1c0e9a919501a3624fb06d4355a296ae8abb6762d37a1f"
score = 50
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -303826,8 +304232,8 @@ rule SIGNATURE_BASE_SUSP_ZIP_LNK_Phishattachment_Pattern_Jun22_1 : FILE
date = "2022-06-23"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_phish_attachments.yar#L2-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_phish_attachments.yar#L2-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4edb41f4645924d8a73e7ac3e3f39f4db73e38f356bc994ad7d03728cd799a48"
hash = "c4fec375b44efad2d45c49f30133efbf6921ce82dbb2d1a980f69ea6383b0ab4"
hash = "9c70eeac97374213355ea8fa019a0e99e0e57c8efc43daa3509f9f98fa71c8e4"
@@ -303853,8 +304259,8 @@ rule SIGNATURE_BASE_SUSP_ZIP_ISO_Phishattachment_Pattern_Jun22_1 : FILE
date = "2022-06-23"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_phish_attachments.yar#L23-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_phish_attachments.yar#L23-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "21de56d6209050b429c0cce82fd334d1b38a2a3727db5ead06f36fa9d503e193"
score = 65
quality = 85
@@ -303880,8 +304286,8 @@ rule SIGNATURE_BASE_SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 : F
date = "2022-06-29"
modified = "2023-12-05"
reference = "https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_phish_attachments.yar#L43-L141"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_phish_attachments.yar#L43-L141"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "caaa5c5733fca95804fffe70af82ee505a8ca2991e4cc05bc97a022e5f5b331c"
hash = "a746d8c41609a70ce10bc69d459f9abb42957cc9626f2e83810c1af412cb8729"
logic_hash = "647044fa3b5cf6f0e9e738fa7b7d24f8918b7a7fb359342e1314d97b50debf87"
@@ -303988,8 +304394,8 @@ rule SIGNATURE_BASE_Pupy_Backdoor : FILE
date = "2017-08-11"
modified = "2023-12-05"
reference = "https://github.com/n1nj4sec/pupy-binaries"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_pupy_rat.yar#L13-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_pupy_rat.yar#L13-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae93714203c7ab4ab73f2ad8364819d16644c7649ea04f483b46924bd5bc0153"
hash = "83380f351214c3bd2c8e62430f70f8f90d11c831695027f329af04806b9f8ea4"
hash = "90757c1ae9597bea39bb52a38fb3d497358a2499c92c7636d71b95ec973186cc"
@@ -304027,8 +304433,8 @@ rule SIGNATURE_BASE_Whosthere_Alt : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passthehashtoolkit.yar#L10-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passthehashtoolkit.yar#L10-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b4c3691872ca5adf6d312b04190c6e14dd9cbe10e94c0dd3ee874f82db897de"
logic_hash = "ef7bccb8f63034b885cfaec27663c9b038cd9b1811b4f25a9eae28640dac248b"
score = 80
@@ -304058,8 +304464,8 @@ rule SIGNATURE_BASE_Iam_Alt_Iam_Alt : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passthehashtoolkit.yar#L33-L54"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passthehashtoolkit.yar#L33-L54"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2ea662ef58142d9e340553ce50d95c1b7a405672acdfd476403a565bdd0cfb90"
logic_hash = "acd4dae57e8394d4ce2f3dfb44706ea35c3d684ab34fd0c707b6aeedd816280a"
score = 80
@@ -304089,8 +304495,8 @@ rule SIGNATURE_BASE_Genhash_Genhash : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passthehashtoolkit.yar#L56-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passthehashtoolkit.yar#L56-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "113df11063f8634f0d2a28e0b0e3c2b1f952ef95bad217fd46abff189be5373f"
logic_hash = "fe1ebe7ea94351610e0042eab020d155cbab26d790477909467c9b5a827fb6d6"
score = 80
@@ -304117,8 +304523,8 @@ rule SIGNATURE_BASE_Iam_Iamdll : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passthehashtoolkit.yar#L76-L92"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passthehashtoolkit.yar#L76-L92"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "892de92f71941f7b9e550de00a57767beb7abe1171562e29428b84988cee6602"
logic_hash = "ef7c66d2e1204a43921b6701812ea8a7bfa8e39e24d9396c95b725a4a4171010"
score = 80
@@ -304143,8 +304549,8 @@ rule SIGNATURE_BASE_Iam_Iam : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passthehashtoolkit.yar#L94-L114"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passthehashtoolkit.yar#L94-L114"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8a8fcce649259f1b670bb1d996f0d06f6649baa8eed60db79b2c16ad22d14231"
logic_hash = "f170f6f71b81a674a269ddd441c77a43afbbfe2870e1d0c4101abd2e58bff0b0"
score = 80
@@ -304173,8 +304579,8 @@ rule SIGNATURE_BASE_Whosthere_Alt_Pth : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passthehashtoolkit.yar#L116-L134"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passthehashtoolkit.yar#L116-L134"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fbfc8e1bc69348721f06e96ff76ae92f3551f33ed3868808efdb670430ae8bd0"
logic_hash = "137b0dae105f97b5d4352d16e52144e72306e61be57c5d93df77ad3f5808018e"
score = 80
@@ -304201,8 +304607,8 @@ rule SIGNATURE_BASE_Whosthere : FILE
date = "2015-07-10"
modified = "2023-12-05"
reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_passthehashtoolkit.yar#L136-L155"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_passthehashtoolkit.yar#L136-L155"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d7a82204d3e511cf5af58eabdd6e9757c5dd243f9aca3999dc0e5d1603b1fa37"
logic_hash = "a13c8a1fc66381b040d6449fe9655191d7a1762da0dc70789cd497fb68fb2a55"
score = 80
@@ -304230,8 +304636,8 @@ rule SIGNATURE_BASE_Hvs_APT37_Smb_Scanner : FILE
date = "2020-12-15"
modified = "2023-12-05"
reference = "https://www.hybrid-analysis.com/sample/d16163526242508d6961f061aaffe3ae5321bd64d8ceb6b2788f1570757595fc?environmentId=2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_dec20.yar#L2-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_dec20.yar#L2-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0bea71db7052f1c22c01cfbf710d4ed24651cbbd8b0fd29f09dfd49c4e314028"
score = 75
quality = 85
@@ -304267,8 +304673,8 @@ rule SIGNATURE_BASE_Hvs_APT37_Cred_Tool : FILE
date = "2020-12-15"
modified = "2023-12-05"
reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_dec20.yar#L31-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_dec20.yar#L31-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4fb7247b88f2d252e7c9d5034c209945bc9e17f49de3dcdb5bf50b5afb302987"
score = 75
quality = 85
@@ -304298,8 +304704,8 @@ rule SIGNATURE_BASE_Hvs_APT37_RAT_Loader
date = "2020-12-15"
modified = "2023-12-05"
reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_dec20.yar#L52-L65"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_dec20.yar#L52-L65"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b70e66d387e42f5f04b69b9eb15306036702ab8a50b16f5403289b5388292db9"
logic_hash = "241f2683adc29e8aca30ae24278f3703fef0fed6b276dae488fdb32c167af1c9"
score = 75
@@ -304319,8 +304725,8 @@ rule SIGNATURE_BASE_Hvs_APT37_Webshell_Img_Thumbs_Asp : FILE
date = "2020-12-15"
modified = "2023-12-05"
reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_dec20.yar#L68-L95"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_dec20.yar#L68-L95"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "94d2448d3794ae3f29678a7337473d259b5cfd1c7f703fe53ee6c84dd10a48ef"
logic_hash = "58ccee11c08330c8cd4148e623a2e59e024d6d5f3067331dbdd962d0f6a8daa4"
score = 75
@@ -304355,8 +304761,8 @@ rule SIGNATURE_BASE_Hvs_APT37_Webshell_Template_Query_Asp : FILE
date = "2020-12-15"
modified = "2023-12-05"
reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_dec20.yar#L97-L120"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_dec20.yar#L97-L120"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "961a66d01c86fa5982e0538215b17fb9fae2991331dfea812b8c031e2ceb0d90"
logic_hash = "d8bd017e9103bddb0b8a86effa8a4b0617b54bd643bcc36b6f678a3e60f8559f"
score = 75
@@ -304387,8 +304793,8 @@ rule SIGNATURE_BASE_Hvs_APT37_Webshell_Controllers_Asp : FILE
date = "2020-12-15"
modified = "2023-12-05"
reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_dec20.yar#L140-L218"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_dec20.yar#L140-L218"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "829462fc6d84aae04a962dfc919d0a392265fbf255eab399980d2b021e385517"
logic_hash = "a6e53e99f7500683d3b62a7630cecb53ee6c13b335cbf9912366675db964aefe"
score = 75
@@ -304475,8 +304881,8 @@ rule SIGNATURE_BASE_Explosive_EXE : APT FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_volatile_cedar.yar#L1-L12"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_volatile_cedar.yar#L1-L12"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "77eb74586f5ef2878c0d283b925e6e066f704d00525303990cf5ea7988a6637d"
score = 75
quality = 85
@@ -304498,8 +304904,8 @@ rule SIGNATURE_BASE_Explosion_Sample_1 : FILE
date = "2015-04-03"
modified = "2023-12-05"
reference = "http://goo.gl/5vYaNb"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_volatile_cedar.yar#L14-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_volatile_cedar.yar#L14-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c97693ecb36247bdb44ab3f12dfeae8be4d299bb"
logic_hash = "f559880c182cf8061d640f60f18fe607d88a1f22216d93ff1d0ece720bcc94a7"
score = 70
@@ -304531,8 +304937,8 @@ rule SIGNATURE_BASE_Explosion_Sample_2 : FILE
date = "2015-04-03"
modified = "2023-12-05"
reference = "http://goo.gl/5vYaNb"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_volatile_cedar.yar#L40-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_volatile_cedar.yar#L40-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "62fe6e9e395f70dd632c70d5d154a16ff38dcd29"
logic_hash = "db7ead96e0a9b4cf5c5cc885eac421cc11988f60d03f94de5fe828899d115bf0"
score = 70
@@ -304557,8 +304963,8 @@ rule SIGNATURE_BASE_Explosion_Generic_1 : FILE
date = "2015-04-03"
modified = "2023-12-05"
reference = "not set"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_volatile_cedar.yar#L59-L88"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_volatile_cedar.yar#L59-L88"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d0f059ba21f06021579835a55220d1e822d1233f95879ea6f7cb9d301408c821"
hash = "1952fa94b582e9af9dca596b5e51c585a78b8b1610639e3b878bbfa365e8e908"
hash = "d8fdcdaad652c19f4f4676cd2f89ae834dbc19e2759a206044b18601875f2726"
@@ -304595,8 +305001,8 @@ rule SIGNATURE_BASE_Explosive_UA : FILE
date = "2015-04-03"
modified = "2023-12-05"
reference = "http://goo.gl/HQRCdw"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_volatile_cedar.yar#L90-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_volatile_cedar.yar#L90-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9ed7fedcf9cda868803c8ace393e08709a747b909178e19cdbb1b116edbb82f9"
score = 60
quality = 85
@@ -304618,8 +305024,8 @@ rule SIGNATURE_BASE_Webshell_Caterpillar_ASPX
date = "2015-04-03"
modified = "2023-12-05"
reference = "http://goo.gl/emons5"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_volatile_cedar.yar#L106-L126"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_volatile_cedar.yar#L106-L126"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "af4c99208fb92dc42bc98c4f96c3536ec8f3fe56"
logic_hash = "9df2e4a25052136d6e622273f917bd15df410869a8cf3075c773a14ea62a2a55"
score = 75
@@ -304649,11 +305055,11 @@ rule SIGNATURE_BASE_SUSP_Obfuscated_JS_Obfuscatorio : HIGHVOL FILE
date = "2021-08-25"
modified = "2023-12-05"
reference = "https://obfuscator.io"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_js_obfuscatorio.yar#L1-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_js_obfuscatorio.yar#L1-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "813df8459e4a53a084dc1f902713af74747a0c2f4ef535e682de38acba9b0e5e"
score = 50
- quality = 60
+ quality = 85
tags = "HIGHVOL, FILE"
strings:
@@ -304681,8 +305087,8 @@ rule SIGNATURE_BASE_SUSP_LNK_Big_Link_File : FILE
date = "2018-05-15"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_lnk.yar#L2-L12"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_lnk.yar#L2-L12"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6e44483583249939494e76f14b022e698ba59dfe8b58133a69135144ef60c743"
score = 65
quality = 85
@@ -304701,8 +305107,8 @@ rule SIGNATURE_BASE_MAL_XMR_Miner_May19_1 : HIGHVOL FILE
date = "2019-05-31"
modified = "2023-12-05"
reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_nansh0u.yar#L15-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_nansh0u.yar#L15-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc"
logic_hash = "85a65fd2355850b7f5261ad41091e181562938356ba3dae7d867f7ac8922a16e"
score = 85
@@ -304728,8 +305134,8 @@ rule SIGNATURE_BASE_HKTL_CN_Prochook_May19_1 : FILE
date = "2019-05-31"
modified = "2023-12-05"
reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_nansh0u.yar#L38-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_nansh0u.yar#L38-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "02ebdc1ff6075c15a44711ccd88be9d6d1b47607fea17bef7e5e17f8da35293e"
logic_hash = "de55990c130702a05e96ee769707a81ce0ec58a515d75a9a99b20265ce3db682"
score = 75
@@ -304748,8 +305154,8 @@ rule SIGNATURE_BASE_SUSP_PDB_CN_Threat_Actor_May19_1 : FILE
date = "2019-05-31"
modified = "2023-12-05"
reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_nansh0u.yar#L52-L65"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_nansh0u.yar#L52-L65"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "01c3882e8141a25abe37bb826ab115c52fd3d109c4a1b898c0c78cee8dac94b4"
logic_hash = "adcfe3d4bc6fcaf6be4f70c91fb2150bfa2d61f1ba84f96a0bf0c39ed0380b6a"
score = 65
@@ -304772,8 +305178,8 @@ rule SIGNATURE_BASE_MAL_Ramnit_May19_1 : FILE
date = "2019-05-31"
modified = "2023-12-05"
reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_nansh0u.yar#L67-L78"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_nansh0u.yar#L67-L78"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3"
logic_hash = "51d574f457c37eba3c29f869e03244b9471be6f6c8319aa0ddfad34be748eb53"
score = 75
@@ -304792,8 +305198,8 @@ rule SIGNATURE_BASE_MAL_Parite_Malware_May19_1 : FILE
date = "2019-05-31"
modified = "2023-12-05"
reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_nansh0u.yar#L80-L100"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_nansh0u.yar#L80-L100"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c9d8852745e81f3bfc09c0a3570d018ae8298af675e3c6ee81ba5b594ff6abb8"
hash = "8d47b08504dcf694928e12a6aa372e7fa65d0d6744429e808ff8e225aefa5af2"
hash = "285e3f21dd1721af2352196628bada81050e4829fb1bb3f8757a45c221737319"
@@ -304822,8 +305228,8 @@ rule SIGNATURE_BASE_MAL_Parite_Malware_May19_2 : FILE
date = "2019-05-31"
modified = "2023-12-05"
reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_nansh0u.yar#L102-L118"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_nansh0u.yar#L102-L118"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c9d8852745e81f3bfc09c0a3570d018ae8298af675e3c6ee81ba5b594ff6abb8"
hash = "8d47b08504dcf694928e12a6aa372e7fa65d0d6744429e808ff8e225aefa5af2"
hash = "285e3f21dd1721af2352196628bada81050e4829fb1bb3f8757a45c221737319"
@@ -304845,8 +305251,8 @@ rule SIGNATURE_BASE_EXPL_Strings_CVE_POC_May19_1 : FILE
date = "2019-05-31"
modified = "2023-12-05"
reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_nansh0u.yar#L120-L136"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_nansh0u.yar#L120-L136"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "01c3882e8141a25abe37bb826ab115c52fd3d109c4a1b898c0c78cee8dac94b4"
logic_hash = "b470e9f5716130d810e519abb8d4e1058b5a806d59ddae53a40cac5597fbb874"
score = 80
@@ -304871,8 +305277,8 @@ rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_Log_Indicators_Dec24 : SCRIPT
date = "2024-12-10"
modified = "2024-12-12"
reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cleo_dec24.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a7e6713a08d7cce00cffba8daa12b251ccc12dc8d5a5f38d568bd5054e3783a2"
score = 75
quality = 85
@@ -304895,8 +305301,8 @@ rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_1 : FILE
date = "2024-12-10"
modified = "2024-12-12"
reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cleo_dec24.yar#L18-L52"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L18-L52"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "786951478a0fc5db24f6e1d8dcc5eaa8880dbd928da97828a61f1f1f0f21e21d"
logic_hash = "481ddd570d0292036b421223ce0f839ece86cc1a97aa226a8b9fbd1d63905d1b"
score = 75
@@ -304936,8 +305342,8 @@ rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_2 : FILE
date = "2024-12-10"
modified = "2024-12-12"
reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cleo_dec24.yar#L54-L89"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L54-L89"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8debaf2c85ea63501b7a3c2ff8af7a8484f4d6097e073645d808cbd50ef1511a"
score = 70
quality = 85
@@ -304977,8 +305383,8 @@ rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_XML_Indicators_Dec24 : FILE
date = "2024-12-10"
modified = "2024-12-12"
reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cleo_dec24.yar#L91-L109"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L91-L109"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "21c11c3e0c0ffea89e24b9c002b6112a46b4dc7c2c4f1f5dc9803758a68efc36"
score = 70
quality = 85
@@ -305001,8 +305407,8 @@ rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_1 : FILE
date = "2024-12-10"
modified = "2024-12-12"
reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cleo_dec24.yar#L112-L146"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L112-L146"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b103f708e85416fc6d7af9605da4b57b3abe42fb9c6c9ec0f539b4c877580bd2"
logic_hash = "c9be15aec57fdde62815ee04daa5616940ab7949784d382a4825dce9f1e28568"
score = 70
@@ -305042,8 +305448,8 @@ rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_2 : FILE
date = "2024-12-10"
modified = "2024-12-12"
reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cleo_dec24.yar#L148-L183"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L148-L183"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "60e53c8d99fde8c48bff67408605aa69c3c1fe3040ba4f9d2080980df970aa93"
score = 70
quality = 85
@@ -305083,8 +305489,8 @@ rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_PS1_Indicators_Dec24 : SCRIPT
date = "2024-12-10"
modified = "2024-12-12"
reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cleo_dec24.yar#L185-L202"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L185-L202"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "87dcd0aa3c16d8948514b1d8589d38c6cc73bf7e6262f4517659cead16fedd3d"
score = 75
quality = 85
@@ -305109,8 +305515,8 @@ rule SIGNATURE_BASE_SUSP_EXPL_JAR_Indicators_Dec24 : FILE
date = "2024-12-10"
modified = "2024-12-12"
reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cleo_dec24.yar#L204-L222"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L204-L222"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8b87e7000ab5d9759f55660a085bf0f3dddb46ad1ea411cbbabce1000105ee9e"
score = 70
quality = 85
@@ -305135,8 +305541,8 @@ rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_1_1 : FILE
date = "2024-12-10"
modified = "2024-12-12"
reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cleo_dec24.yar#L224-L245"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L224-L245"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0c57b317b572d071afd8ccdb844dd6f117e20f818c6031d7ba8adcbd32be0617"
logic_hash = "85600e9310e502b3b2135f2f3cf698ae54fe362047cdf9d378dcc107e0c2fa18"
score = 75
@@ -305162,8 +305568,8 @@ rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_2 : FILE
date = "2024-12-10"
modified = "2024-12-12"
reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cleo_dec24.yar#L247-L265"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L247-L265"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1ba95af21bac45db43ebf02f87ecedde802c7de4d472f33e74ee0a5b5015a726"
logic_hash = "2bb5eace09b832bf3ce296484f473c9c56f97b881ea17838408be6000cc6fcb1"
score = 75
@@ -305188,8 +305594,8 @@ rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_3 : FILE
date = "2024-12-10"
modified = "2024-12-12"
reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cleo_dec24.yar#L267-L286"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cleo_dec24.yar#L267-L286"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "64a6194110d4eb359cc3f15137cf752d598f2f0a52ac181fcaa358bf40072f54"
score = 75
quality = 85
@@ -305214,8 +305620,8 @@ rule SIGNATURE_BASE_SUSP_LNK_Embedded_Worddoc : FILE
date = "2023-01-02"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_100days_of_yara_2023.yar#L3-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_100days_of_yara_2023.yar#L3-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "120ca851663ef0ebef585d716c9e2ba67bd4870865160fec3b853156be1159c5"
logic_hash = "a53fbfe0ccb5a4ab2320cde10d17f29770d888cf21cda4fdccc3d7ae8d123293"
score = 65
@@ -305240,8 +305646,8 @@ rule SIGNATURE_BASE_SUSP_LNK_Smallscreensize
date = "2023-01-01"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_100days_of_yara_2023.yar#L22-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_100days_of_yara_2023.yar#L22-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "285985c21e34f8412b49dbfe04abad9f93af195801d0a8870ec3795b8a9a3787"
score = 65
quality = 85
@@ -305264,8 +305670,8 @@ rule SIGNATURE_BASE_MAL_Janicab_LNK
date = "2023-01-01"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_100days_of_yara_2023.yar#L46-L68"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_100days_of_yara_2023.yar#L46-L68"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0c7e8427ee61672568983e51bf03e0bcf6f2e9c01d2524d82677b20264b23a3f"
hash = "22ede766fba7551ad0b71ef568d0e5022378eadbdff55c4a02b42e63fcb3b17c"
hash = "4920e6506ca557d486e6785cb5f7e4b0f4505709ffe8c30070909b040d3c3840"
@@ -305297,8 +305703,8 @@ rule SIGNATURE_BASE_SUSP_ELF_Invalid_Version : FILE
date = "2023-01-01"
modified = "2023-12-05"
reference = "https://tmpout.sh/1/1.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_100days_of_yara_2023.yar#L70-L86"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_100days_of_yara_2023.yar#L70-L86"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "05379bbf3f46e05d385bbd853d33a13e7e5d7d50"
logic_hash = "33f096318647867bcd90d7ba77878f43d34477b2b2cbd7410c191e60573d6cd5"
score = 55
@@ -305318,8 +305724,8 @@ rule SIGNATURE_BASE_MAL_ELF_Torchtriton : FILE
date = "2023-01-02"
modified = "2023-12-05"
reference = "https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_100days_of_yara_2023.yar#L88-L117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_100days_of_yara_2023.yar#L88-L117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2385b29489cd9e35f92c072780f903ae2e517ed422eae67246ae50a5cc738a0e"
logic_hash = "12de3c3785aaf3623097db58abfe8ee2cbd9a0e712bf752165952de9a5fdb07d"
score = 75
@@ -305350,8 +305756,8 @@ rule SIGNATURE_BASE_MAL_GOLDBACKDOOR_LNK
date = "2023-01-02"
modified = "2023-12-05"
reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_100days_of_yara_2023.yar#L119-L142"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_100days_of_yara_2023.yar#L119-L142"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "120ca851663ef0ebef585d716c9e2ba67bd4870865160fec3b853156be1159c5"
logic_hash = "043d01758c722964e848e51cf2747c5879f03f0fd43af827e2035abf113daf9d"
score = 75
@@ -305382,8 +305788,8 @@ rule SIGNATURE_BASE_MAL_EXE_Lockbit_V2 : FILE
date = "2023-01-01"
modified = "2023-01-06"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_100days_of_yara_2023.yar#L144-L169"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_100days_of_yara_2023.yar#L144-L169"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8"
logic_hash = "9472727d75e34d8bf87c56b74a6dfc04052e621b5fe31732ea9a10c76a05e0c0"
score = 80
@@ -305414,8 +305820,8 @@ rule SIGNATURE_BASE_MAL_EXE_Prestigeransomware : FILE
date = "2023-01-04"
modified = "2023-01-06"
reference = "https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_100days_of_yara_2023.yar#L171-L195"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_100days_of_yara_2023.yar#L171-L195"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5fc44c7342b84f50f24758e39c8848b2f0991e8817ef5465844f5f2ff6085a57"
logic_hash = "2f51ca71d28c8d0df8de22011e16919672d5f9d3f3d94594c5d0cbf7f1585a1e"
score = 80
@@ -305444,8 +305850,8 @@ rule SIGNATURE_BASE_MAL_EXE_Royalransomware : FILE
date = "2023-01-03"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_100days_of_yara_2023.yar#L197-L222"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_100days_of_yara_2023.yar#L197-L222"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a8384c9e3689eb72fa737b570dbb53b2c3d103c62d46747a96e1e1becf14dfea"
logic_hash = "6f93bade7709945b478cbdc721d85ad9243d56ace19fba25835cec13a6210dfb"
score = 75
@@ -305476,8 +305882,8 @@ rule SIGNATURE_BASE_MAL_PY_Dimorf
date = "2023-01-03"
modified = "2023-12-05"
reference = "https://github.com/Ort0x36/Dimorf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_100days_of_yara_2023.yar#L224-L242"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_100days_of_yara_2023.yar#L224-L242"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7499b21f77d07364983b94134a60f7c99e71a5392386437d459a196bf71852fb"
score = 75
quality = 85
@@ -305504,8 +305910,8 @@ rule SIGNATURE_BASE_MAL_Enfal_Nov22 : FILE
modified = "2023-01-06"
old_rule_name = "Enfal_Malware"
reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enfal"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_enfal.yar#L1-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_enfal.yar#L1-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "42fa6241ab94c73c7ab386d600fae70da505d752daab2e61819a0142b531078a"
hash = "bf433f4264fa3f15f320b35e773e18ebfe94465d864d3f4b2a963c3e5efd39c2"
logic_hash = "bf349ba2b7bd635808b4ee23c6286e7dd403fbc185c6b59f0bb1fbf47ba7d9bb"
@@ -305533,8 +305939,8 @@ rule SIGNATURE_BASE_Enfal_Malware_Backdoor : FILE
date = "2015-02-10"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_enfal.yar#L27-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_enfal.yar#L27-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6d484daba3927fc0744b1bbd7981a56ebef95790"
hash = "d4071272cc1bf944e3867db299b3f5dce126f82b"
hash = "6c7c8b804cc76e2c208c6e3b6453cb134d01fa41"
@@ -305568,8 +305974,8 @@ rule SIGNATURE_BASE_Sofacy_Fybis_ELF_Backdoor_Gen1 : FILE
date = "2016-02-13"
modified = "2023-01-27"
reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_fysbis.yar#L9-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_fysbis.yar#L9-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
hash = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
logic_hash = "fb5239aa75512c8c83b066e64b75469f90fb22cb0918af1e44edb29e7ab38206"
@@ -305601,8 +306007,8 @@ rule SIGNATURE_BASE_Sofacy_Fysbis_ELF_Backdoor_Gen2 : FILE
date = "2016-02-13"
modified = "2023-12-05"
reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_fysbis.yar#L37-L55"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_fysbis.yar#L37-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
hash = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
hash = "fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61"
@@ -305629,8 +306035,8 @@ rule SIGNATURE_BASE_Unspecified_Malware_Jul17_2C : FILE
date = "2017-07-18"
modified = "2023-12-05"
reference = "https://goo.gl/CX3KaY"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_unspecified_malware.yar#L3-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_unspecified_malware.yar#L3-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e8156ec1706716cada6f57b6b8ccc9fb0eb5debe906ac45bdc2b26099695b8f5"
logic_hash = "a078b96ea15b287c8aed960741865aeac356ec8650eac71b8e28f2f1924ec956"
score = 75
@@ -305662,8 +306068,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Venus_Nov22_1 : FILE
date = "2022-11-16"
modified = "2023-12-05"
reference = "https://twitter.com/dyngnosis/status/1592588860168421376"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_venus.yar#L3-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_venus.yar#L3-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "46f9cbc3795d6be0edd49a2c43efe6e610b82741755c5076a89eeccaf98ee834"
hash = "6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05"
hash = "931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224"
@@ -305698,8 +306104,8 @@ rule SIGNATURE_BASE_Quasar_RAT_1 : FILE
date = "2017-04-07"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_quasar_rat.yar#L10-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_quasar_rat.yar#L10-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740"
hash = "1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec"
hash = "515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89"
@@ -305731,8 +306137,8 @@ rule SIGNATURE_BASE_Quasar_RAT_2 : FILE
date = "2017-04-07"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_quasar_rat.yar#L35-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_quasar_rat.yar#L35-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740"
hash = "515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89"
hash = "f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34"
@@ -305765,8 +306171,8 @@ rule SIGNATURE_BASE_MAL_Quasarrat_May19_1 : FILE
date = "2019-05-27"
modified = "2023-01-06"
reference = "https://blog.ensilo.com/uncovering-new-activity-by-apt10"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_quasar_rat.yar#L61-L89"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_quasar_rat.yar#L61-L89"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded"
logic_hash = "a189bce433c71d45fd7f5d7fc284fc5b35c88a7ec616dd392d0e931165263aca"
score = 75
@@ -305802,8 +306208,8 @@ rule SIGNATURE_BASE_APT_Nazar_Svchost_Commands
date = "2020-04-26"
modified = "2023-12-05"
reference = "https://www.epicturla.com/blog/the-lost-nazar"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nazar.yar#L1-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nazar.yar#L1-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
hash = "be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728"
logic_hash = "c71e8a3b2d69c51ed3f822f62b90906fc0a21d32f1f1850cdef71c335964f9b1"
@@ -305830,8 +306236,8 @@ rule SIGNATURE_BASE_Backdoor_Redosdru_Jun17 : HIGHVOL FILE
date = "2017-06-04"
modified = "2023-12-05"
reference = "https://goo.gl/OOB3mH"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eternalblue_non_wannacry.yar#L12-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eternalblue_non_wannacry.yar#L12-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4f49e17b457ef202ab0be905691ef2b2d2b0a086a7caddd1e70dd45e5ed3b309"
logic_hash = "99218c4decf98f02eb75c3c41a56f857a07779c68d30c4d16ca605052c4f9c3e"
score = 75
@@ -305864,8 +306270,8 @@ rule SIGNATURE_BASE_Backdoor_Nitol_Jun17 : FILE
date = "2017-06-04"
modified = "2023-01-07"
reference = "https://goo.gl/OOB3mH"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eternalblue_non_wannacry.yar#L38-L61"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eternalblue_non_wannacry.yar#L38-L61"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946"
logic_hash = "9035b8bd74c284f170f8c9767d96580dba243786abaa3b2e79e05a981f8fa204"
score = 75
@@ -305896,8 +306302,8 @@ rule SIGNATURE_BASE_APT_Area1_SSF_Plugx
date = "2018-12-19"
modified = "2023-12-05"
reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_area1_phishing_diplomacy.yar#L2-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_area1_phishing_diplomacy.yar#L2-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a71f124f0c89c4b020f21d029d0d2997b2bea71526e83bcadffb67acc9cca8f7"
score = 75
quality = 85
@@ -305932,8 +306338,8 @@ rule SIGNATURE_BASE_APT_Area1_SSF_Googlesend_Strings : FILE
date = "2018-12-19"
modified = "2023-12-05"
reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_area1_phishing_diplomacy.yar#L29-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_area1_phishing_diplomacy.yar#L29-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3a373ed63494b67883515c133bf5b0af3ab874397c7cb45c8399f12e35212be4"
score = 75
quality = 85
@@ -305960,8 +306366,8 @@ rule SIGNATURE_BASE_Eternalrocks_Taskhost : FILE
date = "2017-05-18"
modified = "2023-12-05"
reference = "https://twitter.com/stamparm/status/864865144748298242"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_eternalrocks.yar#L12-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_eternalrocks.yar#L12-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30"
logic_hash = "45e5295f34280078c586c4cb643dba65aed63beffb1d6ded05de03403caf273a"
score = 75
@@ -305988,8 +306394,8 @@ rule SIGNATURE_BASE_Eternalrocks_Svchost : FILE
date = "2017-05-18"
modified = "2023-12-05"
reference = "https://twitter.com/stamparm/status/864865144748298242"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_eternalrocks.yar#L32-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_eternalrocks.yar#L32-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "589af04a85dc66ec6b94123142a17cf194decd61f5d79e76183db026010e0d31"
logic_hash = "989df6d582949adbc4e0e2063c99d9ad83c367cedae1030dc23aade091216602"
score = 75
@@ -306014,8 +306420,8 @@ rule SIGNATURE_BASE_SUSP_Certificate_Payload : FILE
date = "2018-08-02"
modified = "2023-12-05"
reference = "https://blog.nviso.be/2018/08/02/powershell-inside-a-certificate-part-3/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cert_payloads.yar#L1-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cert_payloads.yar#L1-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "909cf4209bbb876a042d86e017f65ce3764d2fde7a602406ed8531ba97c9fb9b"
score = 50
quality = 85
@@ -306037,8 +306443,8 @@ rule SIGNATURE_BASE_Keylogger_CN_APT : FILE
date = "2016-03-07"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_keylogger_cn.yar#L8-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_keylogger_cn.yar#L8-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3efb3b5be39489f19d83af869f11a8ef8e9a09c3c7c0ad84da31fc45afcf06e7"
logic_hash = "a5330d15ad7199212cec44ade401c224c40a468650abbc7bf282b26a21cdc22b"
score = 75
@@ -306074,8 +306480,8 @@ rule SIGNATURE_BASE_MAL_Netfilter_Dropper_Jun_2021_1_1 : FILE
date = "2020-06-18"
modified = "2023-12-05"
reference = "https://twitter.com/struppigel/status/1405483373280235520"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_netfilter.yar#L4-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_netfilter.yar#L4-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac"
hash = "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9"
hash = "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540"
@@ -306105,8 +306511,8 @@ rule SIGNATURE_BASE_MAL_Netfilter_May_2021_1_1 : FILE
date = "2020-06-18"
modified = "2023-12-05"
reference = "https://twitter.com/struppigel/status/1405483373280235520"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_netfilter.yar#L28-L52"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_netfilter.yar#L28-L52"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0"
hash = "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870"
hash = "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe"
@@ -306138,8 +306544,8 @@ rule SIGNATURE_BASE_Powershell_Emp_Eval_Jul17_A1 : FILE
date = "2017-07-27"
modified = "2023-12-05"
reference = "PowerShell Empire Eval"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_ps_empire_eval.yar#L11-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_ps_empire_eval.yar#L11-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4d10e80c7c80ef040efc680424a429558c7d76a965685bbc295908cb71137eba"
logic_hash = "e77ff4e216601c62a049569a6ea1aae13fc2612b480f4d7fad4e99dc72155da3"
score = 65
@@ -306163,8 +306569,8 @@ rule SIGNATURE_BASE_Powershell_Emp_Eval_Jul17_A2 : FILE
date = "2017-07-27"
modified = "2023-12-05"
reference = "PowerShell Empire Eval"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_ps_empire_eval.yar#L27-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_ps_empire_eval.yar#L27-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e14c139159c23fdc18969afe57ec062e4d3c28dd42a20bed8ddde37ab4351a51"
logic_hash = "28f320e721a61d7e2db39830652038eb4090429d73162888570a97b0bc1504d8"
score = 65
@@ -306188,12 +306594,12 @@ rule SIGNATURE_BASE_OSX_Backdoor_Evilosx : FILE
date = "2018-02-23"
modified = "2023-12-05"
reference = "https://github.com/Marten4n6/EvilOSX, https://twitter.com/JohnLaTwC/status/966139336436498432"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_osx_evilosx.yar#L1-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_osx_evilosx.yar#L1-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "89e5b8208daf85f549d9b7df8e2a062e47f15a5b08462a4224f73c0a6223972a"
logic_hash = "393abf7cf74f8d079049cf8f0bdb3a79bf16185c80c43b823e19b67a9031aef6"
score = 75
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -306217,8 +306623,8 @@ rule SIGNATURE_BASE_Saudi_Phish_Trojan : FILE
date = "2017-10-12"
modified = "2023-12-05"
reference = "https://goo.gl/Z3JUAA"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_saudi_aramco_phish.yar#L10-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_saudi_aramco_phish.yar#L10-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ad94dc5d59aa1e9962c76fd5ca042e582566049a97aef9f5730ba779e5ebb91"
logic_hash = "f7199d2e408cc057d88234e4041c7d87652d1ed361eaaf75bb37da45900e9f38"
score = 75
@@ -306245,8 +306651,8 @@ rule SIGNATURE_BASE_MAL_Kernel_Regphantom_Mar26 : FILE
date = "2026-03-19"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_kernel_regphantom_mar26.yar#L1-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_kernel_regphantom_mar26.yar#L1-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "006e08f1b8cad821f7849c282dc11d317e76ce66a5bcd84053dd5e7752e0606f"
logic_hash = "53dead8b4cd4f0139249940fbf2767a5411aef73e1919279ef66243fe009bb27"
score = 80
@@ -306283,8 +306689,8 @@ rule SIGNATURE_BASE_TA459_Malware_May17_1 : FILE
date = "2017-05-31"
modified = "2023-12-05"
reference = "https://goo.gl/RLf9qU"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta459.yar#L12-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta459.yar#L12-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5fd61793d498a395861fa263e4438183a3c4e6f1e4f098ac6e97c9d0911327bf"
logic_hash = "2655d4c3a28ad2f77bbf50cd3dface7de49f675f0f974aa44d9b69c3f803da30"
score = 75
@@ -306308,8 +306714,8 @@ rule SIGNATURE_BASE_TA459_Malware_May17_2 : FILE
date = "2017-05-31"
modified = "2023-12-05"
reference = "https://goo.gl/RLf9qU"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta459.yar#L28-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta459.yar#L28-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4601133e94c4bc74916a9d96a5bc27cc3125cdc0be7225b2c7d4047f8506b3aa"
logic_hash = "9904f3905672e5209df037dff1fa2e4d88ee33531096045eb9b9f7460458b6a2"
score = 75
@@ -306335,8 +306741,8 @@ rule SIGNATURE_BASE_Nanocore_RAT_Gen_1 : FILE
date = "2016-04-22"
modified = "2023-12-05"
reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nanocore_rat.yar#L8-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nanocore_rat.yar#L8-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e707a7745e346c5df59b5aa4df084574ae7c204f4fb7f924c0586ae03b79bf06"
logic_hash = "09fab3ef1b4ca9092fd69fb09c4ef759946fcb5b84161441bff797bb4009ed00"
score = 70
@@ -306363,8 +306769,8 @@ rule SIGNATURE_BASE_Nanocore_RAT_Gen_2 : FILE
date = "2016-04-22"
modified = "2023-12-05"
reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nanocore_rat.yar#L28-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nanocore_rat.yar#L28-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050"
logic_hash = "23b3d149012fb8395b7daa2ecaf3ee66fdeac352ac94d632d76e52df2c6e8ea6"
score = 100
@@ -306389,8 +306795,8 @@ rule SIGNATURE_BASE_Nanocore_RAT_Sample_1 : FILE
date = "2016-04-22"
modified = "2023-12-05"
reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nanocore_rat.yar#L46-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nanocore_rat.yar#L46-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b7cfc7e9551b15319c068aae966f8a9ff563b522ed9b1b42d19c122778e018c8"
logic_hash = "c74e5fe7e9d4dd7f032281b0e617f2355bc5844acf04a8ffbfd42165c7d9b8e4"
score = 75
@@ -306415,8 +306821,8 @@ rule SIGNATURE_BASE_Nanocore_RAT_Sample_2 : FILE
date = "2016-04-22"
modified = "2023-12-05"
reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nanocore_rat.yar#L64-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nanocore_rat.yar#L64-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "51142d1fb6c080b3b754a92e8f5826295f5da316ec72b480967cbd68432cede1"
logic_hash = "505176b7320e95c652f0b6fdc6fadc3d16ff30115263862ba61209fa2fb82a2d"
score = 75
@@ -306441,8 +306847,8 @@ rule SIGNATURE_BASE_Nanocore_RAT_Feb18_1 : FILE
date = "2018-02-19"
modified = "2023-12-05"
reference = "Internal Research - T2T"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nanocore_rat.yar#L92-L115"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nanocore_rat.yar#L92-L115"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c"
logic_hash = "824fd7304fb298ced69811078aa2dd23d7116554cffb8b6e4b690fccc93a4caf"
score = 75
@@ -306471,8 +306877,8 @@ rule SIGNATURE_BASE_Nanocore_RAT_Feb18_2 : FILE
date = "2018-02-19"
modified = "2023-12-05"
reference = "Internal Research - T2T"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nanocore_rat.yar#L117-L137"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nanocore_rat.yar#L117-L137"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "377ef8febfd8df1a57a7966043ff0c7b8f3973c2cf666136e6c04080bbf9881a"
logic_hash = "c104e431a4ecc0d18d7eb74e7a55d32bf8978ee922637d48f3f6a9466a0f5b1a"
score = 75
@@ -306503,8 +306909,8 @@ rule SIGNATURE_BASE_Crime_Win32_Dridex_Socks5_Mod
date = "2020-04-06"
modified = "2023-12-05"
reference = "https://twitter.com/VK_Intel/status/1247058432223477760"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_evilcorp_dridex_banker.yar#L8-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_evilcorp_dridex_banker.yar#L8-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5ca09e9c7d94e949e453d1bb69b566c12b253579cbcae700929d4f517df35a0a"
score = 75
quality = 85
@@ -306527,8 +306933,8 @@ rule SIGNATURE_BASE_Crime_Win32_Hvnc_Banker_Gen
date = "2020-04-06"
modified = "2023-12-05"
reference = "https://twitter.com/VK_Intel/status/1247058432223477760"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_evilcorp_dridex_banker.yar#L22-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_evilcorp_dridex_banker.yar#L22-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b01af685c3826834aadaf4eac1f1d8171db288a2efa7b769d8122421f7af8d7e"
score = 75
quality = 85
@@ -306546,8 +306952,8 @@ rule SIGNATURE_BASE_Credentialstealer_Generic_Backdoor : FILE
date = "2017-06-07"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_credstealer_generic.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_credstealer_generic.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "edb2d039a57181acf95bd91b2a20bd9f1d66f3ece18506d4ad870ab65e568f2c"
logic_hash = "aa06291a91ac84f80cd2cbe5a01c2cbcc14cf6914da9d1234af9b3d833990551"
score = 75
@@ -306579,8 +306985,8 @@ rule SIGNATURE_BASE_EXPL_WSUS_Exploitation_Indicators_Oct25 : CVE_2025_59287
date = "2025-10-25"
modified = "2026-05-15"
reference = "https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_wsus_cve_2025_59287.yar#L1-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_wsus_cve_2025_59287.yar#L1-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "04487cca15f4151bfc31279fd58dc6898e59149cabb6dbef08c1df88418ab904"
score = 75
quality = 85
@@ -306609,8 +307015,8 @@ rule SIGNATURE_BASE_HKTL_EXPL_WSUS_Exploitation_POC_Oct25 : CVE_2025_59287 FILE
date = "2025-10-26"
modified = "2026-05-15"
reference = "https://github.com/jiansiting/CVE-2025-59287/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_wsus_cve_2025_59287.yar#L30-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_wsus_cve_2025_59287.yar#L30-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ade02afa7449f0bfcd82065a4246a598bedb46c561bf721b6bf1325fe0fc6239"
score = 75
quality = 85
@@ -306635,8 +307041,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_LNX_Macos_Lockbit_Apr23_1 : FILE
date = "2023-04-15"
modified = "2023-12-05"
reference = "https://twitter.com/malwrhunterteam/status/1647384505550876675?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lockbit_lnx_macos_apr23.yar#L2-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lockbit_lnx_macos_apr23.yar#L2-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0a2bffa0a30ec609d80591eef1d0994d8b37ab1f6a6bad7260d9d435067fb48e"
hash = "9ebcbaf3c9e2bbce6b2331238ab584f95f7ced326ca4aba2ddcc8aa8ee964f66"
hash = "a405d034c01a357a89c9988ffe8a46a165915df18fd297469b2bcaaf97578442"
@@ -306675,8 +307081,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Apr23_1
date = "2023-04-17"
modified = "2023-12-05"
reference = "https://objective-see.org/blog/blog_0x75.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lockbit_lnx_macos_apr23.yar#L43-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lockbit_lnx_macos_apr23.yar#L43-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cd5bffa5571abfd1446b065d26c8c23f00fe1376d505af539c6f37356014a86f"
score = 75
quality = 85
@@ -306703,8 +307109,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Locker_LOG_Apr23_1
date = "2023-04-17"
modified = "2023-12-05"
reference = "https://objective-see.org/blog/blog_0x75.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lockbit_lnx_macos_apr23.yar#L69-L84"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lockbit_lnx_macos_apr23.yar#L69-L84"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d5f96e601150209382d3f6458863bc79768beb99b587aa8d9ba37cb2c11ef634"
score = 75
quality = 85
@@ -306728,8 +307134,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Forensicartifacts_Apr23_1
date = "2023-04-17"
modified = "2023-12-05"
reference = "https://objective-see.org/blog/blog_0x75.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lockbit_lnx_macos_apr23.yar#L86-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lockbit_lnx_macos_apr23.yar#L86-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "81021f8c9aed17c007d7329a598c644a706fa9750818c8974984eefcba8d06c2"
score = 75
quality = 85
@@ -306753,11 +307159,11 @@ rule SIGNATURE_BASE_SUSP_ENV_Folder_Root_File_Jan23_1 : SCRIPT FILE
date = "2023-01-11"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_indicators.yar#L3-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_indicators.yar#L3-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5355ae567e6255e22f566bae9fe50f4995bafba07c261461d37d5b8ba200d33a"
score = 70
- quality = 58
+ quality = 83
tags = "SCRIPT, FILE"
strings:
@@ -306780,8 +307186,8 @@ rule SIGNATURE_BASE_Sofacy_Oct17_1 : FILE
date = "2017-10-23"
modified = "2023-12-05"
reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_oct17_camp.yar#L13-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_oct17_camp.yar#L13-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "522fd9b35323af55113455d823571f71332e53dde988c2eb41395cf6b0c15805"
logic_hash = "c3620d0b347e6cc54af9e046f6b3b6515bfa23dd11225ce2720e09838708a42e"
score = 75
@@ -306817,8 +307223,8 @@ rule SIGNATURE_BASE_Sofacy_Oct17_2 : FILE
date = "2017-10-23"
modified = "2023-12-05"
reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_oct17_camp.yar#L49-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_oct17_camp.yar#L49-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ef027405492bc0719437eb58c3d2774cc87845f30c40040bbebbcc09a4e3dd18"
logic_hash = "c2736cf9efbb022590f4c23986531e645ac412a5b98a950b143f2d75a33e8063"
score = 75
@@ -306845,8 +307251,8 @@ rule SIGNATURE_BASE_Emissary_APT_Malware_1 : FILE
date = "2016-01-02"
modified = "2023-12-05"
reference = "http://goo.gl/V0epcf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_emissary.yar#L8-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_emissary.yar#L8-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9420017390c598ee535c24f7bcbd39f40eca699d6c94dc35bcf59ddf918c59ab"
hash = "70561f58c9e5868f44169854bcc906001947d98d15e9b4d2fbabd1262d938629"
hash = "0e64e68f6f88b25530699a1cd12f6f2790ea98e6e8fa3b4bc279f8e5c09d7290"
@@ -306890,8 +307296,8 @@ rule SIGNATURE_BASE_SUSP_EXPL_LIBCUE_CVE_2023_43641_Oct23_1 : CVE_2023_43641 FIL
date = "2023-10-27"
modified = "2023-12-05"
reference = "https://github.com/github/securitylab/blob/main/SecurityExploits/libcue/track_set_index_CVE-2023-43641/README.md"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_libcue_cve_2023_43641.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_libcue_cve_2023_43641.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a2cd3c1b0b3551ffb24bf7704c37c1be6c1a9655c74447d2f7f94540dd0ab188"
score = 70
quality = 85
@@ -306914,8 +307320,8 @@ rule SIGNATURE_BASE_Reveal_Memorycredentials : FILE
date = "2015-08-31"
modified = "2023-12-05"
reference = "https://github.com/giMini/RWMC/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rwmc_powershell_creddump.yar#L8-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rwmc_powershell_creddump.yar#L8-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "893c26818c424d0ff549c1fbfa11429f36eecd16ee69330c442c59a82ce6adea"
logic_hash = "d740462aacd3b30d0258d018344642683fefd43ef033dd7f5bdde2bdddce4115"
score = 75
@@ -306941,8 +307347,8 @@ rule SIGNATURE_BASE_Minidumptest_Msdsc : FILE
date = "2015-08-31"
modified = "2023-12-05"
reference = "https://github.com/giMini/RWMC/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rwmc_powershell_creddump.yar#L26-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rwmc_powershell_creddump.yar#L26-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "477034933918c433f521ba63d2df6a27cc40a5833a78497c11fb0994d2fd46ba"
logic_hash = "ae8a28df245a8f7a2d62639789c31556b012322fcac09784595fd6f95d6bf195"
score = 50
@@ -306968,8 +307374,8 @@ rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell : FILE
date = "2021-02-15"
modified = "2024-05-25"
reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_centreon.yar#L10-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L10-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "977ee0fdf0e92ccea6b71fea7b2c7aed2965c6966d8af86230ccb0f95b286694"
score = 70
quality = 85
@@ -306995,8 +307401,8 @@ rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Ziparchivefile
date = "2021-02-15"
modified = "2024-05-25"
reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_centreon.yar#L30-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L30-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c15e7022f45ec211ba635d6cd31bab16f4fb0d3038fb19d5765e0f751c14a826"
score = 80
quality = 85
@@ -307017,8 +307423,8 @@ rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Perlnetworkscript : FILE
date = "2021-02-15"
modified = "2024-05-25"
reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_centreon.yar#L44-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L44-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b170c07a005e737c8069f2cc63f869d4d3ff6593b3bfca5bcaf02d7808da6852"
score = 90
quality = 85
@@ -307043,8 +307449,8 @@ rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Sqldumpfile
date = "2021-02-15"
modified = "2024-05-25"
reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_centreon.yar#L64-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L64-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c34abcada22fdf462fd66cc2da18ab9e54215defc6f7a7a95b5a80d1155a2ffe"
score = 90
quality = 85
@@ -307065,8 +307471,8 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_Key
date = "2021-02-15"
modified = "2024-05-25"
reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_centreon.yar#L78-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L78-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "056503a2c240a641cd2292a30ab1090e3a358cb4d57dca83b836ecb1bc62ed6b"
score = 80
quality = 85
@@ -307087,8 +307493,8 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_Name_Encrypted
date = "2021-02-15"
modified = "2024-05-25"
reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_centreon.yar#L92-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L92-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f65d59381403534a2c2f39d66c7c62bf1540eafc9aad1ad73de1809e91c42446"
score = 80
quality = 85
@@ -307109,11 +307515,11 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_File_Plaintext
date = "2021-02-15"
modified = "2024-05-25"
reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_centreon.yar#L106-L118"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L106-L118"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "536327d5216372a3fd2f4dad0a21be2778ce2930212daf0a8628ecbdab49b46e"
score = 80
- quality = 60
+ quality = 85
tags = ""
strings:
@@ -307131,8 +307537,8 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_File_Ciphertext
date = "2021-02-15"
modified = "2024-05-25"
reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_centreon.yar#L120-L132"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L120-L132"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9dc7ee5b0a218a2b5be652e137fa090c944c3ddb0f699f521a72896668210813"
score = 80
quality = 85
@@ -307153,8 +307559,8 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Socket_Path
date = "2021-02-15"
modified = "2024-05-25"
reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_centreon.yar#L134-L146"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L134-L146"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8c049b5a7b508ca0f160d166f3c726e4a23a2c5b3105d075d7bf7a301a1c58f6"
score = 80
quality = 85
@@ -307175,8 +307581,8 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Task_Names
date = "2021-02-15"
modified = "2024-05-25"
reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_centreon.yar#L148-L167"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L148-L167"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "193482da1e2b9509fa9c65d46edc56057f7b5d44b7408d918d4a9cbb60736dab"
score = 80
quality = 85
@@ -307204,8 +307610,8 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Struct
date = "2021-02-15"
modified = "2024-05-25"
reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_centreon.yar#L169-L185"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L169-L185"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "312d0598fa85837f94023036468fcae50e8b2de532430a944befa8090afe79f6"
score = 80
quality = 85
@@ -307230,8 +307636,8 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Strings_Typo
date = "2021-02-15"
modified = "2024-05-25"
reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_centreon.yar#L187-L202"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L187-L202"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "65e6de743eb9fc742674c7e54eef8a376963a6fd4380bacd03fe6f92d4235920"
score = 80
quality = 85
@@ -307255,8 +307661,8 @@ rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Strings
date = "2021-02-15"
modified = "2024-05-25"
reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_centreon.yar#L204-L232"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_centreon.yar#L204-L232"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9d2790e60184ed973b2735263d0a997f32af0beacc9ea8ef65926fe6507011d5"
score = 80
quality = 85
@@ -307289,8 +307695,8 @@ rule SIGNATURE_BASE_Crime_Win64_Backdoor_Bazarbackdoor1 : FILE
date = "2020-04-24"
modified = "2023-12-05"
reference = "https://twitter.com/pancak3lullz/status/1252303608747565057"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_bazarbackdoor.yar#L1-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_bazarbackdoor.yar#L1-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "becb6ebc3a1be061b4f602cc188b172f59bfb6342605af68d8b38009d589f57e"
score = 75
quality = 85
@@ -307314,8 +307720,8 @@ rule SIGNATURE_BASE_Mal_Lockbit4_Packed_Feb24 : FILE
date = "2024-02-16"
modified = "2026-05-15"
reference = "https://0x0d4y.blog/lockbit4-0-evasion-tales/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lockbit4_packed_win_feb24.yar#L1-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lockbit4_packed_win_feb24.yar#L1-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "15796971d60f9d71ad162060f0f76a02"
logic_hash = "07281fd86efbb7167ba1cc0c6f6897418751df1a3697869e51f806c26641e365"
score = 100
@@ -307344,8 +307750,8 @@ rule SIGNATURE_BASE_Win32_Buzus_Softpulse : FILE
date = "2015-05-13"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_buzus_softpulse.yar#L2-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_buzus_softpulse.yar#L2-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f6df200e63a86768471399a74180466d2e99ea9"
logic_hash = "49625594db57e9d629860970c20493b76e554addc2edb41adba64673a820a94b"
score = 75
@@ -307374,8 +307780,8 @@ rule SIGNATURE_BASE_VULN_Keepass_DB_Brute_Forcible : FILE
date = "2023-07-20"
modified = "2023-12-05"
reference = "https://keepass.info/help/base/security.html#secdictprotect"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_keepass_brute_forcible.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_keepass_brute_forcible.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "14460f7d4976a3bbd6de2f7cfccfbfec35eb780ab762396a6490669ddde59ce8"
score = 60
quality = 85
@@ -307397,8 +307803,8 @@ rule SIGNATURE_BASE_Apt28_Win_Zebrocy_Golang_Loader_Modified : FILE
date = "2018-12-25"
modified = "2023-12-05"
reference = "https://www.vkremez.com/2018/12/lets-learn-progression-of-apt28sofacy.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_zebrocy.yar#L1-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_zebrocy.yar#L1-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "799f4457eb2bdeeb7c9383e2b4e9572a41d9adbfe4a1a9c3b0fa1c9fc6077e40"
score = 75
quality = 79
@@ -307428,8 +307834,8 @@ rule SIGNATURE_BASE_EXPL_HKTL_Macos_Switcharoo_CVE_2022_46689_Dec22 : CVE_2022_4
date = "2022-12-19"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_macos_switcharoo_dec22.yar#L2-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_macos_switcharoo_dec22.yar#L2-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "64acd79a37b6f8443250dd33e95bd933ee39fc6d4f35ba6a987dae878d017386"
hash = "6c2ace75000de8a7e8786f28b1b41eed72816991a0961475c6800753bfe9278c"
hash = "6ce080b236ea3aa3b4c992d12af99445ab800abc709c6abbef852a9f0cf219b6"
@@ -307468,8 +307874,8 @@ rule SIGNATURE_BASE_EXPL_Macos_Switcharoo_Indicator_Dec22 : CVE_2022_46689 FILE
date = "2022-12-19"
modified = "2023-12-05"
reference = "https://github.com/zhuowei/MacDirtyCowDemo"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_macos_switcharoo_dec22.yar#L42-L54"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_macos_switcharoo_dec22.yar#L42-L54"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9b9ea134fc4b3a7b15ae585ced2e12cbe1defc54bc6175282d6b7a2a0b65abd1"
score = 65
quality = 85
@@ -307490,8 +307896,8 @@ rule SIGNATURE_BASE_Exploit_MS15_077_078 : FILE
date = "2015-07-21"
modified = "2023-12-05"
reference = "https://code.google.com/p/google-security-research/issues/detail?id=473&can=1&start=200"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2015_2426.yar#L10-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2015_2426.yar#L10-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "18e3e840a5e5b75747d6b961fca66a670e3faef252aaa416a88488967b47ac1c"
hash = "0b5dc030e73074b18b1959d1cf7177ff510dbc2a0ec2b8bb927936f59eb3d14d"
hash = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
@@ -307526,8 +307932,8 @@ rule SIGNATURE_BASE_Exploit_MS15_077_078_Hackingteam : FILE
date = "2015-07-21"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2015_2426.yar#L38-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2015_2426.yar#L38-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ad6bb982a1ecfe080baf0a2b27950f989c107949b1cf02b6e0907f1a568ece15"
hash = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
logic_hash = "c94582629e555c9fd0b29302720078a7eb47d3013d0c1b5edd4e060c2062fa92"
@@ -307557,8 +307963,8 @@ rule SIGNATURE_BASE_SUSP_Microsoft_7Z_SFX_Combo : FILE
date = "2018-09-16"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_sfx_with_microsoft_copyright.yar#L1-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_sfx_with_microsoft_copyright.yar#L1-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cce63f209ee4efb4f0419fb4bbb32326392b5ef85cfba80b5b42b861637f1ff1"
logic_hash = "f48887e0c1031d180e25f2d1b9e016d434f594aef283ab3af8418e86496d2eac"
score = 65
@@ -307589,8 +307995,8 @@ rule SIGNATURE_BASE_SUSP_Microsoft_RAR_SFX_Combo : FILE
date = "2018-09-16"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_sfx_with_microsoft_copyright.yar#L27-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_sfx_with_microsoft_copyright.yar#L27-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a0f29fcf86139a6f95b4ab0095154bd26b555f1576b5a2e263c1939bc30e3431"
score = 65
quality = 85
@@ -307621,8 +308027,8 @@ rule SIGNATURE_BASE_POSHSPY_Malware
date = "2017-07-15"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_poshspy.yar#L11-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_poshspy.yar#L11-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e1f8b502950d2f7600041b5492f529682b9f5f2863c36ad40618b5ed78a94567"
score = 75
quality = 85
@@ -307649,8 +308055,8 @@ rule SIGNATURE_BASE_Indetectables_RAT : FILE
date = "2015-10-01"
modified = "2023-12-05"
reference = "http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_indetectables_rat.yar#L8-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_indetectables_rat.yar#L8-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "081905074c19d5e32fd41a24b4c512d8fd9d2c3a8b7382009e3ab920728c7105"
hash = "66306c2a55a3c17b350afaba76db7e91bfc835c0e90a42aa4cf59e4179b80229"
hash = "1fa810018f6dd169e46a62a4f77ae076f93a853bfc33c7cf96266772535f6801"
@@ -307685,8 +308091,8 @@ rule SIGNATURE_BASE_Bergsilva_Malware : FILE
date = "2015-10-01"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_indetectables_rat.yar#L35-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_indetectables_rat.yar#L35-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "00e175cbad629ee118d01c49c11f3d8b8840350d2dd6d16bd81e47ae926f641e"
hash = "6b4cbbee296e4a0e867302f783d25d276b888b1bf1dcab9170e205d276c22cfc"
logic_hash = "03b823040a057ffbef9bcb3094a672fd75e141f3e82c77548adbe1c465d329fb"
@@ -307717,8 +308123,8 @@ rule SIGNATURE_BASE_MAL_Katz_Stealer_May25 : FILE
date = "2025-05-16"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_katz_stealer.yar#L1-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_katz_stealer.yar#L1-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789"
hash = "d92bb6e47cb0a0bdbb51403528ccfe643a9329476af53b5a729f04a4d2139647"
logic_hash = "73364c2291dc792f46858dda057f08805db55fe1f1e54d6b0dee0a0c8a412259"
@@ -307746,8 +308152,8 @@ rule SIGNATURE_BASE_MAL_DLL_Chrome_App_Bound_Encryption_Decryption_May25 : FILE
date = "2025-05-19"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_katz_stealer.yar#L24-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_katz_stealer.yar#L24-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6dc8e99da68b703e86fa90a8794add87614f254f804a8d5d65927e0676107a9d"
logic_hash = "d5488728a3ee8f2f59ed9798b80d516f7f131e39b3d5099ad5168ffc8ff22718"
score = 80
@@ -307772,8 +308178,8 @@ rule SIGNATURE_BASE_SUSP_Katz_Log_May25 : FILE
date = "2025-05-20"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_katz_stealer.yar#L45-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_katz_stealer.yar#L45-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1ac196ac6393d786618c944a7ab77fb189a6b4ba00af5c0f987c3dc65876c060"
hash = "ad76e2727469525dec7e56977589dd250ca57a29b8b0d42cd5c42e536c285241"
hash = "e1a0d6929662bcbc9e5e0827cb8b6d7818088e996cf971d2a4a1c1ca4208e533"
@@ -307802,8 +308208,8 @@ rule SIGNATURE_BASE_MAL_NET_Katz_Stealer_Loader_May25
date = "2025-05-21"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_katz_stealer.yar#L68-L88"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_katz_stealer.yar#L68-L88"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0df13fd42fb4a4374981474ea87895a3830eddcc7f3bd494e76acd604c4004f7"
logic_hash = "1922520d8c34660a0afff2f552ef0d1c6ec093fb10a00816e0216f574b686221"
score = 80
@@ -307831,8 +308237,8 @@ rule SIGNATURE_BASE_MAL_NET_UAC_Bypass_May25 : FILE
date = "2025-05-21"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_katz_stealer.yar#L90-L108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_katz_stealer.yar#L90-L108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4f12c5dca2099492d0c0cd22edef841cbe8360af9be2d8e9b57c2f83d401c1a7"
hash = "fcad234dc2ad5e2d8215bcf6caac29aef62666c34564e723fa6d2eee8b6468ed"
logic_hash = "4a3f6e90af6f9a8a4dfa8e336eb8c714e5f02625ca2bf5bf8b1bca9cbda6a99e"
@@ -307857,8 +308263,8 @@ rule SIGNATURE_BASE_MAL_Gozicrypter_Dec20_1 : FILE
date = "2020-12-02"
modified = "2023-12-05"
reference = "YaraExchange"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_gozi_crypter.yar#L2-L13"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_gozi_crypter.yar#L2-L13"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "51fdfbb59b8f52cc2ff89d994c0f89d2c2895c346b098879c68b4ccb880783c1"
score = 70
quality = 85
@@ -307879,8 +308285,8 @@ rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_1 : FILE
date = "2018-05-24"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_vpnfilter.yar#L11-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_vpnfilter.yar#L11-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f8286e29faa67ec765ae0244862f6b7914fcdde10423f96595cb84ad5cc6b344"
logic_hash = "aff7b1f3d4afaf883c2702287ef7d6e13e01e80222ba336978d13deb21a93614"
score = 75
@@ -307910,8 +308316,8 @@ rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_2 : FILE
date = "2018-05-24"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_vpnfilter.yar#L33-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_vpnfilter.yar#L33-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "50ac4fcd3fbc8abcaa766449841b3a0a684b3e217fc40935f1ac22c34c58a9ec"
logic_hash = "238ec4575fd8adbfa592e07b601313c71a08be8c776e78469aef8ad02e411798"
score = 75
@@ -307936,8 +308342,8 @@ rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_3 : FILE
date = "2018-05-24"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_vpnfilter.yar#L50-L78"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_vpnfilter.yar#L50-L78"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0e0094d9bd396a6594da8e21911a3982cd737b445f591581560d766755097d92"
hash = "9683b04123d7e9fe4c8c26c69b09c2233f7e1440f828837422ce330040782d17"
hash = "37e29b0ea7a9b97597385a12f525e13c3a7d02ba4161a6946f2a7d978cc045b4"
@@ -307973,8 +308379,8 @@ rule SIGNATURE_BASE_SUSP_ELF_Tor_Client : FILE
date = "2018-05-24"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_vpnfilter.yar#L80-L95"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_vpnfilter.yar#L80-L95"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "afd281639e26a717aead65b1886f98d6d6c258736016023b4e59de30b7348719"
logic_hash = "2b67b32c5b8441c9b38e3bfeefa7f59c2767e29985adcba7d52e858847d37e47"
score = 65
@@ -308000,8 +308406,8 @@ rule SIGNATURE_BASE_Golddragon_Malware_Feb18_1 : FILE
date = "2018-02-03"
modified = "2023-12-05"
reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_golddragon.yar#L13-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_golddragon.yar#L13-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "873cf7aa18027615fe8c44140879811254229a238f7d426144fb7c1a6e07ea74"
score = 90
quality = 85
@@ -308020,8 +308426,8 @@ rule SIGNATURE_BASE_Golddragon_Aux_File : FILE
date = "2018-02-03"
modified = "2023-12-05"
reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_golddragon.yar#L31-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_golddragon.yar#L31-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4c5eb04cdafe3a69e584c64b833d8c6d21890660e92cc050bb29798dbcdf5326"
score = 90
quality = 85
@@ -308044,8 +308450,8 @@ rule SIGNATURE_BASE_Golddragon_Ghost419_RAT : FILE
date = "2018-02-03"
modified = "2023-01-06"
reference = "https://goo.gl/rW1yvZ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_golddragon.yar#L46-L86"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_golddragon.yar#L46-L86"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "45bfa1327c2c0118c152c7192ada429c6d4ae03b8164ebe36ab5ba9a84f5d7aa"
hash = "ee7a9a7589cbbcac8b6bf1a3d9c5d1c1ada98e68ac2f43ff93f768661b7e4a85"
hash = "dee482e5f461a8e531a6a7ea4728535aafdc4941a8939bc3c55f6cb28c46ad3d"
@@ -308090,8 +308496,8 @@ rule SIGNATURE_BASE_Golddragon_Runningrat : FILE
date = "2018-02-03"
modified = "2023-12-05"
reference = "https://goo.gl/rW1yvZ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_golddragon.yar#L88-L128"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_golddragon.yar#L88-L128"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0852f2c5741997d8899a34bb95c349d7a9fb7277cd0910656c3ce37a6f11cb88"
hash = "2981e1a1b3c395cee6e4b9e6c46d062cf6130546b04401d724750e4c8382c863"
hash = "7aa99ebc49a130f07304ed25655862a04cc20cb59d129e1416a7dfa04f7d3e51"
@@ -308133,8 +308539,8 @@ rule SIGNATURE_BASE_Golddragon_Runnignrat : FILE
date = "2018-02-03"
modified = "2023-01-07"
reference = "https://goo.gl/rW1yvZ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_golddragon.yar#L130-L154"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_golddragon.yar#L130-L154"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579"
hash = "5cbc07895d099ce39a3142025c557b7fac41d79914535ab7ffc2094809f12a4b"
hash = "98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a"
@@ -308165,8 +308571,8 @@ rule SIGNATURE_BASE_OSX_Backdoor_Bella : FILE
date = "2018-02-23"
modified = "2023-12-05"
reference = "https://twitter.com/JohnLaTwC/status/911998777182924801"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_osx_backdoor_bella.yar#L2-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_osx_backdoor_bella.yar#L2-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"
logic_hash = "c2fa72072decd850698fbaaa9c2a6687cdf64e6bac068ff52a97963053db4339"
score = 75
@@ -308202,8 +308608,8 @@ rule SIGNATURE_BASE_MAL_Ransomware_Wadhrama : FILE
date = "2019-04-07"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_mal_ransom_wadharma.yar#L3-L13"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_mal_ransom_wadharma.yar#L3-L13"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "557c68e38dce7ea10622763c10a1b9f853c236b3291cd4f9b32723e8714e5576"
logic_hash = "5d78837ed7cb8914be0990859751cf64603ee5a5ad135541c60c6ae145046412"
score = 75
@@ -308223,8 +308629,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Unit78020_Sep15 : FILE
modified = "2023-01-31"
old_rule_name = "Unit78020_Malware_Gen1"
reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unit78020_malware.yar#L8-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unit78020_malware.yar#L8-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b15e614fb54bca7031f64ab6caa1f77b4c07dac186826a6cd2e254090675d72"
hash = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
hash = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
@@ -308271,8 +308677,8 @@ rule SIGNATURE_BASE_Unit78020_Malware_1 : FILE
date = "2015-09-24"
modified = "2023-12-05"
reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unit78020_malware.yar#L60-L78"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unit78020_malware.yar#L60-L78"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a93d01f1cc2d18ced2f3b2b78319aadc112f611ab8911ae9e55e13557c1c791a"
logic_hash = "589dfb39630fd396b1f8c5d9d0ecccfc058edfd8e74e3bd06d1bfb9f91ad1798"
score = 75
@@ -308300,8 +308706,8 @@ rule SIGNATURE_BASE_Unit78020_Malware_Gen2 : FILE
date = "2015-09-24"
modified = "2023-12-05"
reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unit78020_malware.yar#L80-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unit78020_malware.yar#L80-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
hash = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
hash = "981e2fa1ae4145359036b46e8b53cc5da37dd2311204859761bd91572f025e8a"
@@ -308332,8 +308738,8 @@ rule SIGNATURE_BASE_Unit78020_Malware_Gen3 : FILE
date = "2015-09-24"
modified = "2023-12-05"
reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unit78020_malware.yar#L103-L132"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unit78020_malware.yar#L103-L132"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
hash = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
logic_hash = "304b3f429e144f1f4b0f7794e77f3059ec6b3e5c6fdf4c7b820a77db1cf8cfcb"
@@ -308370,8 +308776,8 @@ rule SIGNATURE_BASE_Cobaltstrike_C2_Host_Indicator : FILE
date = "2019-08-16"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cobaltstrike_evasive.yar#L1-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cobaltstrike_evasive.yar#L1-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4761e282e9473ba665a597894ed514d057309703a7d5b4e462ef0e779bbb8c39"
score = 60
quality = 65
@@ -308393,8 +308799,8 @@ rule SIGNATURE_BASE_Cobaltstrike_Sleep_Decoder_Indicator
date = "2021-07-19"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cobaltstrike_evasive.yar#L16-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cobaltstrike_evasive.yar#L16-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f3243c326df18edbd15c2d9120379588e61709efb9295b9584c0565c04ee38a5"
score = 75
quality = 85
@@ -308415,8 +308821,8 @@ rule SIGNATURE_BASE_Cobaltstrike_C2_Encoded_XOR_Config_Indicator
date = "2021-07-08"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cobaltstrike_evasive.yar#L28-L295"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cobaltstrike_evasive.yar#L28-L295"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6b25ee9064e925c183ef7599c95ecffce48c7f96eea714fa5f6441b21716277e"
score = 75
quality = 60
@@ -308693,8 +309099,8 @@ rule SIGNATURE_BASE_Cobaltstrike_MZ_Launcher
date = "2021-07-08"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cobaltstrike_evasive.yar#L297-L307"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cobaltstrike_evasive.yar#L297-L307"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "aa188546db138dffdcdbf6538367b5d5bc37638a2784b24b7fcd913c15e56072"
score = 75
quality = 85
@@ -308715,8 +309121,8 @@ rule SIGNATURE_BASE_Cobaltstrike_Unmodifed_Beacon
date = "2019-08-16"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cobaltstrike_evasive.yar#L309-L320"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cobaltstrike_evasive.yar#L309-L320"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "10114a431fb70be8e18e67b22aa76bf2c0536f07d373f717c1dc51755e0847c9"
score = 75
quality = 85
@@ -308738,8 +309144,8 @@ rule SIGNATURE_BASE_MAL_LNX_PLAGUE_BACKDOOR_Jul25 : FILE
date = "2025-07-25"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lnx_plague.yar#L1-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lnx_plague.yar#L1-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39"
hash = "7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e"
logic_hash = "9ef7d8153c8567f85b8713467bf5b175e0c2af050e1f275fb2441bbca8d20a79"
@@ -308772,8 +309178,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_COVID19_Apr20_1 : FILE
date = "2020-04-15"
modified = "2023-12-05"
reference = "https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_covid_ransom.yar#L2-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_covid_ransom.yar#L2-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2779863a173ff975148cb3156ee593cb5719a0ab238ea7c9e0b0ca3b5a4a9326"
logic_hash = "9b32ce1dff9d27c5f7541de97cd1198b0d837a69ee260b327c66a22ca6f30091"
score = 75
@@ -308798,8 +309204,8 @@ rule SIGNATURE_BASE_Invoke_Mimikatz
date = "2016-08-03"
modified = "2023-12-05"
reference = "https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_invoke_mimikatz.yar#L10-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_invoke_mimikatz.yar#L10-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67"
logic_hash = "b9bfa54a64d6f6b8af97ec62c9102ccf0912a19b65fbd25a4836480e63497a00"
score = 75
@@ -308823,8 +309229,8 @@ rule SIGNATURE_BASE_APT17_Sample_FXSST_DLL : FILE
date = "2015-05-14"
modified = "2023-12-05"
reference = "https://goo.gl/ZiJyQv"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt17_malware.yar#L10-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt17_malware.yar#L10-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "52f1add5ad28dc30f68afda5d41b354533d8bce3"
logic_hash = "51d6da6c3ec46dc9e991a6a36de6d79626f1859296cda65e9027951c13aa4cd5"
score = 75
@@ -308857,8 +309263,8 @@ rule SIGNATURE_BASE_Hiddencobra_Rule_1
date = "2017-06-13"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hidden_cobra.yar#L11-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hidden_cobra.yar#L11-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e8bb844d72b7d7564caec0d0842889000c77611eeb24ac5c5cb35072a92c9d10"
score = 75
quality = 85
@@ -308886,8 +309292,8 @@ rule SIGNATURE_BASE_Hiddencobra_Rule_3
date = "2017-06-13"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hidden_cobra.yar#L52-L82"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hidden_cobra.yar#L52-L82"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6c0e385e46fe9d6cde7d2bc8ef059cfd8c33ef5b17e9fcd7cea97863fb8d2c24"
score = 75
quality = 85
@@ -308927,8 +309333,8 @@ rule SIGNATURE_BASE_APT_Hiddencobra_Ghostsecret_1 : FILE
date = "2018-08-11"
modified = "2023-12-05"
reference = "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hidden_cobra.yar#L87-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hidden_cobra.yar#L87-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "05a567fe3f7c22a0ef78cc39dcf2d9ff283580c82bdbe880af9549e7014becfc"
logic_hash = "b1e72ca66520152b444cc415bdf54921ebba9671519d3b0327316cee2bf0ba1d"
score = 75
@@ -308952,8 +309358,8 @@ rule SIGNATURE_BASE_APT_Hiddencobra_Ghostsecret_2 : FILE
date = "2018-08-11"
modified = "2023-12-05"
reference = "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hidden_cobra.yar#L103-L119"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hidden_cobra.yar#L103-L119"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "45e68dce0f75353c448865b9abafbef5d4ed6492cd7058f65bf6aac182a9176a"
logic_hash = "878711f5e1a8a3cfefdaf13fc08a4778fba9d2f729248784cf72b610c8bc5e17"
score = 75
@@ -308979,8 +309385,8 @@ rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_1 : FILE
date = "2019-04-13"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hidden_cobra.yar#L124-L137"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hidden_cobra.yar#L124-L137"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39"
logic_hash = "6cd036129ea54f4e3a2c52bf9ebd04e2d368e737cf83ca34a8feb79ea477a3af"
score = 75
@@ -309003,8 +309409,8 @@ rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_2 : FILE
date = "2019-04-13"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hidden_cobra.yar#L139-L154"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hidden_cobra.yar#L139-L154"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3"
logic_hash = "741d69b470ac230d502116ebd5f09bbf4bdbbbdd7e70b97a4bd5d3f2c8e148ef"
score = 75
@@ -309029,8 +309435,8 @@ rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_3 : FILE
date = "2019-04-13"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hidden_cobra.yar#L156-L185"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hidden_cobra.yar#L156-L185"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525"
hash = "05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461"
hash = "ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d"
@@ -309066,8 +309472,8 @@ rule SIGNATURE_BASE_Apt_RU_Turla_Kazuar_Debugview_Pefeatures : FILE
date = "2020-05-28"
modified = "2023-12-05"
reference = "https://www.epicturla.com/blog/sysinturla"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_kazuar.yar#L15-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_kazuar.yar#L15-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
hash = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
logic_hash = "10c2e47e5c1885c7dc19d1fb7933c9b15911cbe4c6fba99b7f763738ae934126"
@@ -309088,8 +309494,8 @@ rule SIGNATURE_BASE_APT_MAL_RU_Turla_Kazuar_May20_1 : FILE
date = "2020-05-28"
modified = "2023-12-05"
reference = "https://www.epicturla.com/blog/sysinturla"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_kazuar.yar#L61-L81"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_kazuar.yar#L61-L81"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
hash = "1fca5f41211c800830c5f5c3e355d31a05e4c702401a61f11e25387e25eeb7fa"
hash = "2d8151dabf891cf743e67c6f9765ee79884d024b10d265119873b0967a09b20f"
@@ -309116,8 +309522,8 @@ rule SIGNATURE_BASE_Crime_Win32_Parallax_Loader_1 : FILE
date = "2020-02-24"
modified = "2023-12-05"
reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_parallax_rat.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_parallax_rat.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "829fce14ac8b9ad293076c16a1750502c6b303123c9bd0fb17c1772330577d65"
logic_hash = "1331e7b69fd9b14b5d2dae45b452b385e48018290d91de33a4f4a5ebcce4805b"
score = 75
@@ -309140,8 +309546,8 @@ rule SIGNATURE_BASE_Crime_Win32_Parallax_Payload_1 : FILE
date = "2020-02-24"
modified = "2023-12-05"
reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_parallax_rat.yar#L20-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_parallax_rat.yar#L20-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "20d0be64a0e0c2e96729143d41b334603f5d3af3838a458b0627af390ae33fbc"
logic_hash = "3a1718d7caea5bd6741dd39fc16f955e1d3c73a282d51eda5b63c3352404529e"
score = 75
@@ -309165,8 +309571,8 @@ rule SIGNATURE_BASE_MAL_Crime_Win32_Rat_Parallax_Shell_Bin : FILE
date = "2020-05-05"
modified = "2023-12-05"
reference = "https://twitter.com/VK_Intel/status/1257714191902937088"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_rat_parallax.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_rat_parallax.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6b8c71cc19ca6f066d27a4e58d9ec347ac51d245308f2c41adf2386242581610"
score = 75
quality = 85
@@ -309190,11 +309596,11 @@ rule SIGNATURE_BASE_Rtf_CVE_2018_0802 : CVE_2018_0802 FILE
date = "2018-01-14"
modified = "2023-12-05"
reference = "http://www.freebuf.com/vuls/159789.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2018_0802.yar#L2-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2018_0802.yar#L2-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ac1cd4f2162d2c8415e2ee5167cabb8e8aff08a06afe244f5bfe099f2d3fbeb4"
score = 75
- quality = 58
+ quality = 83
tags = "CVE-2018-0802, FILE"
strings:
@@ -309213,8 +309619,8 @@ rule SIGNATURE_BASE_EXPL_Gitlab_CE_RCE_CVE_2021_22205 : CVE_2021_22205
date = "2021-10-26"
modified = "2023-12-05"
reference = "https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_gitlab_cve_2021_22205.yar#L2-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_gitlab_cve_2021_22205.yar#L2-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "54b841716a6bd56706c1c38fcda9a27ffd7feba2660602b191e8e347983e578d"
score = 70
quality = 85
@@ -309243,11 +309649,11 @@ rule SIGNATURE_BASE_EXPL_Gitlab_CE_RCE_Malformed_JPG_CVE_2021_22204 : CVE_2021_2
date = "2021-10-26"
modified = "2023-12-05"
reference = "https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=blog"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_gitlab_cve_2021_22205.yar#L29-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_gitlab_cve_2021_22205.yar#L29-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0718ad24337acbb746c6e0d7e0b42d2d034ff583ec6fd12b34fda4737d7e78b0"
score = 70
- quality = 58
+ quality = 83
tags = "CVE-2021-22204, CVE-2021-22205, FILE"
strings:
@@ -309266,8 +309672,8 @@ rule SIGNATURE_BASE_APT_SAP_Netweaver_Exploitation_Activity_Apr25_1 : SCRIPT CVE
date = "2025-04-25"
modified = "2026-05-15"
reference = "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_sap_netweaver_apr25.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_sap_netweaver_apr25.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ab6c5e17bba15a3f968bdbe88a8cf4a039c55b6035d91fd3c6b30092be89af5c"
score = 70
quality = 85
@@ -309289,8 +309695,8 @@ rule SIGNATURE_BASE_APT_SAP_Netweaver_Exploitation_Activity_Apr25_2 : SCRIPT CVE
date = "2025-04-25"
modified = "2026-05-15"
reference = "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_sap_netweaver_apr25.yar#L17-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_sap_netweaver_apr25.yar#L17-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dfc24a4f359e2bc899ab3924bd342c2c6bd8c757b7c1d3859a47f61b9e4039a9"
score = 70
quality = 85
@@ -309311,11 +309717,11 @@ rule SIGNATURE_BASE_SUSP_WEBSHELL_Cmd_Indicator_Apr25
date = "2025-04-25"
modified = "2025-05-07"
reference = "https://regex101.com/r/N6oZ2h/2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_sap_netweaver_apr25.yar#L31-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_sap_netweaver_apr25.yar#L31-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b992786a58389749db40fc90363f00c5df374d514374afc2d6fdff4429cb1ec0"
score = 60
- quality = 60
+ quality = 85
tags = ""
strings:
@@ -309333,8 +309739,8 @@ rule SIGNATURE_BASE_LOG_EXPL_Proxytoken_Exploitation_Aug21_1 : CVE_2021_33766
date = "2021-08-30"
modified = "2023-12-05"
reference = "https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2021_33766_proxytoken.yar#L2-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2021_33766_proxytoken.yar#L2-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ff0c3e4f7491f5faec3e2688819ea5ec636a7d4eb57941afff6f53f60b0c0293"
score = 75
quality = 85
@@ -309360,8 +309766,8 @@ rule SIGNATURE_BASE_MAL_Go_Modbus_Jul24_1 : FILE
date = "2024-07-23"
modified = "2024-07-24"
reference = "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_go_modbus.yar#L2-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_go_modbus.yar#L2-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb"
logic_hash = "d992c8159deca0ed2b2a33da3c31fdf0efa9a09ba941d059fa7fc1bad458aed1"
score = 75
@@ -309388,8 +309794,8 @@ rule SIGNATURE_BASE_Trojan_Win32_Adupib_1 : PLATINUM
date = "2016-04-12"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ms_platinum.yara#L101-L122"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ms_platinum.yara#L101-L122"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
logic_hash = "4d93b6a041468b51763d9497acf3d01ee59ac05f1807a6b140c557ef96d26df9"
score = 75
@@ -309418,8 +309824,8 @@ rule SIGNATURE_BASE_B374K_Back_Connect : FILE
date = "2016-08-18"
modified = "2023-12-05"
reference = "Internal Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_b374k_extra.yar#L8-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_b374k_extra.yar#L8-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c8e16f71f90bbaaef27ccaabb226b43762ca6f7e34d7d5585ae0eb2d36a4bae5"
logic_hash = "dd89aefb6c1add44bfe2a706cd161a16f36a649f910ace16b641a7836525aa73"
score = 80
@@ -309444,8 +309850,8 @@ rule SIGNATURE_BASE_HKTL_Bluehammer_Apr26 : FILE
date = "2026-04-07"
modified = "2026-05-15"
reference = "https://github.com/Nightmare-Eclipse/BlueHammer"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/htkl_blue_hammer_tool.yar#L1-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/htkl_blue_hammer_tool.yar#L1-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6514f56223999eb86a19ea9f2abbfb0f407934a1a0694ffb94a8ea37113073f4"
hash = "93008c42764b74b759678fd376abd90696f74af408600727b6649286d8424270"
hash = "b25e903988e530df00658ff3ad6d180e43d6660b705ad6d0def4a29ee1167e52"
@@ -309479,11 +309885,11 @@ rule SIGNATURE_BASE_Groups_Cpassword : FILE
date = "2015-09-08"
modified = "2023-12-05"
reference = "http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_gpp_cpassword.yar#L2-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_gpp_cpassword.yar#L2-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "de37dc77d9a2462f5d54ad5225405c6d95dad39e67a893f5442b26dc641a20f9"
score = 50
- quality = 60
+ quality = 85
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
@@ -309505,8 +309911,8 @@ rule SIGNATURE_BASE_MAL_APT_Operation_Shadowhammer_Malsetup : FILE
date = "2019-03-25"
modified = "2023-12-05"
reference = "https://securelist.com/operation-shadowhammer/89992/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_shadowhammer.yar#L2-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_shadowhammer.yar#L2-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ac0711afee5a157d084251f3443a40965fc63c57955e3a241df866cfc7315223"
hash = "9acd43af36f2d38077258cb2ace42d6737b43be499367e90037f4605318325f8"
hash = "bca9583263f92c55ba191140668d8299ef6b760a1e940bddb0a7580ce68fef82"
@@ -309535,8 +309941,8 @@ rule SIGNATURE_BASE_APT_Artradownloader2_Aug19_1 : FILE
date = "2019-08-27"
modified = "2023-12-05"
reference = "https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_patchwork.yar#L2-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_patchwork.yar#L2-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22"
logic_hash = "c365c3d678c881eeb626b5d26e6164b473990387619337459ccdd8d9f0633b49"
score = 75
@@ -309574,8 +309980,8 @@ rule SIGNATURE_BASE_Teledoor_Backdoor : FILE
date = "2017-07-05"
modified = "2023-12-05"
reference = "https://goo.gl/CpfJQQ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_teledoor.yar#L11-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_teledoor.yar#L11-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d462966166450416d6addd3bfdf48590f8440dd80fc571a389023b7c860ca3ac"
hash = "f9d6fe8bd8aca6528dec7eaa9f1aafbecde15fd61668182f2ba8a7fc2b9a6740"
hash = "2fd2863d711a1f18eeee5c7c82f2349c5d4e00465de9789da837fcdca4d00277"
@@ -309602,8 +310008,8 @@ rule SIGNATURE_BASE_MAL_Wshrat_Dotnet_Packer_Feb21 : FILE
date = "2021-03-09"
modified = "2023-12-05"
reference = "https://yoroi.company/research/threatening-within-budget-how-wsh-rat-is-abused-by-cyber-crooks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_wsh_rat.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_wsh_rat.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "18159b140c314a00111fb9453e60d19c11633628a4fe2ad8299b839165b39424"
score = 75
quality = 85
@@ -309629,8 +310035,8 @@ rule SIGNATURE_BASE_APT_Virtualizor_Compromise_Forensicartifacts_Aug26 : FILE
date = "2026-08-31"
modified = "2026-08-31"
reference = "https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_virtualizor_compromise_aug26.yar#L1-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_virtualizor_compromise_aug26.yar#L1-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2a8821419395a11f1f86ef8324e881a4c8250832e65295dcdfe992b6cc33b363"
score = 75
quality = 85
@@ -309656,8 +310062,8 @@ rule SIGNATURE_BASE_APT_Virtualizor_Compromise_Payload_Aug26 : FILE
date = "2026-08-31"
modified = "2026-08-31"
reference = "https://lowendtalk.com/discussion/220625/urgent-virtualizor-compromised-31st-aug/p1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_virtualizor_compromise_aug26.yar#L24-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_virtualizor_compromise_aug26.yar#L24-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7"
logic_hash = "068e6ed5391205f4b98f227085fb2770952342166ea59cd20e7cd157d88b4df3"
score = 80
@@ -309681,8 +310087,8 @@ rule SIGNATURE_BASE_APT_MAL_Win_Bluelight_B : INKYSQUID
date = "2021-06-21"
modified = "2023-12-05"
reference = "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt37_bluelight.yar#L12-L112"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt37_bluelight.yar#L12-L112"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "837eaf7b736583497afb8bbdb527f70577901eff04cc69d807983b233524bfed"
logic_hash = "a6e83ca2ae15f1a7819f065449f84166da401739d091565605d62ebba3d47a50"
score = 75
@@ -309779,8 +310185,8 @@ rule SIGNATURE_BASE_APT_MAL_Win_Bluelight : INKYSQUID
date = "2021-04-23"
modified = "2023-12-05"
reference = "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt37_bluelight.yar#L114-L144"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt37_bluelight.yar#L114-L144"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7c40019c1d4cef2ffdd1dd8f388aaba537440b1bffee41789c900122d075a86d"
hash = "94b71ee0861cc7cfbbae53ad2e411a76f296fd5684edf6b25ebe79bf6a2a600a"
logic_hash = "52589348f42aadbe453ad8a40ac36b58fcc9e07cd298486f09b6f793823d8cc7"
@@ -309817,8 +310223,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_1 : FILE
date = "2017-04-03"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L10-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L10-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "27876dc5e6f746ff6003450eeea5e98de5d96cbcba9e4694dad94ca3e9fb1ddc"
logic_hash = "1e024767797fb146b92d6e8c549597c0cda7c2f8fb961299a3808b9b2e924666"
score = 75
@@ -309844,8 +310250,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_2 : FILE
date = "2017-04-03"
modified = "2023-01-06"
reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L28-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L28-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c1dbf481b2c3ba596b3542c7dc4e368f322d5c9950a78197a4ddbbaacbd07064"
logic_hash = "dff8623c35c83c20fb525209ec9aa5d77b51fa494eb557845a8320c77746c02f"
score = 90
@@ -309880,8 +310286,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_3 : FILE
date = "2017-04-03"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L59-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L59-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c21eaadf9ffc62ca4673e27e06c16447f103c0cf7acd8db6ac5c8bd17805e39d"
logic_hash = "d15b4c277e2c4dfe300f242e4cc9b217981166191a47939ca437c55391874b5d"
score = 75
@@ -309910,8 +310316,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Dropper_1 : FILE
date = "2017-04-03"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L81-L94"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L81-L94"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "411571368804578826b8f24f323617f51b068809b1c769291b21125860dc3f4e"
logic_hash = "ee0caf8a08db9a2a83f10178e2ee890b6b0bc6e699ebb3d01fa94fa48c6dfdee"
score = 75
@@ -309934,8 +310340,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_4 : FILE
date = "2017-04-03"
modified = "2023-01-06"
reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L96-L112"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L96-L112"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae6b45a92384f6e43672e617c53a44225e2944d66c1ffb074694526386074145"
logic_hash = "7b39531e4af93ab026381a1114efe00fa01fb45860ddb512dbfa436471644e20"
score = 75
@@ -309960,8 +310366,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_5 : FILE
date = "2017-04-03"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L114-L134"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L114-L134"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "beb1bc03bb0fba7b0624f8b2330226f8a7da6344afd68c5bc526f9d43838ef01"
logic_hash = "9b91ac8f450843c7c85e8d056218aff671bb0f345d16a7ba3f4180ac008bf318"
score = 75
@@ -309989,8 +310395,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_6 : FILE
date = "2017-04-03"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L136-L152"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L136-L152"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aabebea87f211d47f72d662e2449009f83eac666d81b8629cf57219d0ce31af6"
logic_hash = "f165912001c5e2eb48cef46df12220f7f7a53e908a6af571bb4932c50e355388"
score = 75
@@ -310016,8 +310422,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_7 : FILE
date = "2017-04-03"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L154-L168"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L154-L168"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "44a7bea8a08f4c2feb74c6a00ff1114ba251f3dc6922ea5ffab9e749c98cbdce"
logic_hash = "01993e785fb7d5de9ea629d31725e86fa169b70dcde9716a5da0b646ac88864a"
score = 75
@@ -310041,8 +310447,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_8 : FILE
date = "2017-04-03"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L170-L189"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L170-L189"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "19aa5019f3c00211182b2a80dd9675721dac7cfb31d174436d3b8ec9f97d898b"
hash = "5cebc133ae3b6afee27beb7d3cdb5f3d675c3f12b7204531f453e99acdaa87b1"
logic_hash = "a27b041a1ff0fae3d06d8050fe3207435cb84f421099dc1cad8f8a503e976860"
@@ -310071,8 +310477,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_9 : FILE
date = "2017-04-03"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L191-L205"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L191-L205"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f0002b912135bcee83f901715002514fdc89b5b8ed7585e07e482331e4a56c06"
logic_hash = "f45159a508ce8ccb5ab57c7347916642f58ab1b6e0a8886ba53e4810ed65c5c1"
score = 75
@@ -310096,8 +310502,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_10 : FILE
date = "2017-04-03"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L207-L222"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L207-L222"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5b4028728d8011a2003b7ce6b9ec663dd6a60b7adcc20e2125da318e2d9e13f4"
logic_hash = "538754e6daadd3efa3e77723dce7143fecad28cf94caa1b29a2d45df44b14ee4"
score = 75
@@ -310122,8 +310528,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Malware_11 : FILE
date = "2017-04-03"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L224-L240"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L224-L240"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a80f6c57f772f20d63021c8971a280c19e8eafe7cc7088344c598d84026dda15"
logic_hash = "7935d3aeef0d4c94a00dd44942a1ba97d0c9fce848914ebc9c59d9f8e9f51599"
score = 75
@@ -310148,8 +310554,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Lockdown : FILE
date = "2017-04-07"
modified = "2023-12-05"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L251-L265"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L251-L265"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ca61cef74573d9c1d19b8191c23cbd2b7a1195a74eaba037377e5ee232b1dc5"
logic_hash = "3f24c08817bc94bb4b7d09d51bed62f43952f2c66338f29c4bc8e9000b3ff78a"
score = 75
@@ -310173,8 +310579,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Windowxarbot : FILE
date = "2017-04-07"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L267-L279"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L267-L279"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5d8a9c25032c5371e843f8e80884e43a64c73b1644605b39b2dff11104c3bbcd"
score = 75
quality = 85
@@ -310196,8 +310602,8 @@ rule SIGNATURE_BASE_Opcloudhopper_Wmidll_Inmemory
date = "2017-04-07"
modified = "2023-12-05"
reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L281-L293"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L281-L293"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6dddda4e519eeaa67eb4c21151cab10553420a23a077751e0fc45fcae0bf6e69"
score = 75
quality = 85
@@ -310219,8 +310625,8 @@ rule SIGNATURE_BASE_VBS_Wmiexec_Tool_Apr17_1 : FILE
date = "2017-04-07"
modified = "2023-12-05"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cloudhopper.yar#L295-L318"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cloudhopper.yar#L295-L318"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "21bc328ed8ae81151e7537c27c0d6df6d47ba8909aebd61333e32155d01f3b11"
logic_hash = "b0aad1c8dfc07ae3df835ae113bd02abfd706a0646ffcac5dd5691822016d31a"
score = 75
@@ -310252,8 +310658,8 @@ rule SIGNATURE_BASE_ACE_Containing_EXE
date = "2015-09-09"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_ace_with_exe.yar#L2-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_ace_with_exe.yar#L2-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "27fba0db7a98fbaf4b3710a9e411ed74860099c133a2e83ddf368ae2fef3c288"
score = 50
quality = 83
@@ -310278,8 +310684,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0E85_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L33-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L33-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0e8595217f4457757bed0e3cdea25ea70429732b173bba999f02dc85c7e06d02"
hash = "73c03b01d5d1eb03ec5cb5a443714b12fa095cc4b09ddc34671a92117ae4bb3a"
hash = "b0f6cd34717d0cea5ab394b39a9de3a479ca472a071540a595117219d9a61a44"
@@ -310317,8 +310723,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_D7E0_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L129-L147"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L129-L147"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0"
logic_hash = "229c98a4e55486cde122edd3a846c6cec6b242ee9e0269bf25e92d1e00e63d67"
score = 40
@@ -310345,8 +310751,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsy
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L212-L232"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L212-L232"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0abca92512fc98fe6c2e7d0a33935686fc3acbd0a4c68b51f4a70ece828c0664"
logic_hash = "5c46f095f8329b4dab225ff3b15eb102ecfa9f25f0f86f1d18ea3a6690e267b8"
score = 40
@@ -310375,8 +310781,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Lgdatacatchersys_Game
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L290-L312"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L290-L312"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "07fb2bb6c852f6a6fe982b2232f047e167be39738bac26806ffe0927ba873756"
hash = "516159871730b18c2bddedb1a9da110577112d4835606ee79bb80e7a58784a13"
hash = "45b07a2f387e047a6bb0e59b7f22fb56182d57b50e84e386a38c2dbb7e773837"
@@ -310407,8 +310813,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Innotekgmbh_Vboxguest_Virtualboxguestadditio
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L315-L335"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L315-L335"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d53f9111a5e6c94b37e3f39c5860897405cb250dd11aa91c3814a98b1759c055"
logic_hash = "06994b6e75aefad03b1346e1bcaf68dca8464526bf182557257c4f5635bb93ce"
score = 40
@@ -310437,8 +310843,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Eldoscorporation_Elrawdsksys_Rawdisk_4744_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L338-L359"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L338-L359"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6"
hash = "5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a"
logic_hash = "01faeb5fe7618ce1135a8532c76357cfea1dfb0932e3d7c4cf9ff7d1c8c1d8fb"
@@ -310468,8 +310874,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoft
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L362-L382"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L362-L382"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0"
logic_hash = "8be18437fb165bab491d1d63b01d744f14df8594288bf0d447b76913de934aa9"
score = 40
@@ -310498,8 +310904,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L385-L405"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L385-L405"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f"
logic_hash = "1f489ec71f92390aeb4137ba72cb88a950ed91f8e67bb82cf176a8c2fb4ef50f"
score = 40
@@ -310528,8 +310934,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternet
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L408-L428"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L408-L428"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2"
logic_hash = "ef0e7b48aaee9dc6251120a879a192993d86043dbfd11e2be1f6e675aaa4d2e4"
score = 40
@@ -310558,8 +310964,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Innotekgmbh_Vboxguest_Virtualboxguestadditio
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L508-L528"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L508-L528"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "983310cdce8397c016bfcfcc9c3a8abbb5c928b235bc3c3ae3a3cc10ef24dfbd"
logic_hash = "8d2323bd83c70339f41fc8f90c67729f57ee1e54dc4f7d05dfded438c7bc419a"
score = 40
@@ -310588,8 +310994,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realixtm_Hwinfoisys_Hwinfoiakerneldriver_33C
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L610-L630"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L610-L630"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "33c6c622464f80a8d8017a03ff3aa196840da8bb03bfb5212b51612b5cf953dc"
logic_hash = "b9ec2a1a569f6972c9713a8e1512b0de974b4536bc92bd5466ee808d7574fada"
score = 40
@@ -310618,8 +311024,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowe
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L633-L653"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L633-L653"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6945077a6846af3e4e2f6a2f533702f57e993c5b156b6965a552d6a5d63b7402"
logic_hash = "06b458c2f8c6eb5dadf2a05c69225fdc4cbd6bd48e4380fa224573139de6a466"
score = 40
@@ -310648,8 +311054,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_42B3_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L680-L701"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L680-L701"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "42b31b850894bf917372ff50fbe1aff3990331e8bd03840d75e29dcc1026c180"
hash = "c0c52425dd90f36d110952c665e5b644bb1092f952942c07bb4da998c9ce6e5b"
logic_hash = "d9437369dd7a913176a1351f991216f3190b608f3a3182e891bdb7778835b815"
@@ -310679,8 +311085,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L704-L724"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L704-L724"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c"
logic_hash = "69948e6d3cc375d78ba95a51c7a78e5a3f17e0ca07cf1e3e53d54f350d9ac0a9"
score = 40
@@ -310709,8 +311115,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Innotekgmbh_Vboxusbsys_Virtualboxusbdriver_C
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L727-L747"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L727-L747"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c509935f3812ad9b363754216561e0a529fc2d5b8e86bfa7302b8d149b7d04aa"
logic_hash = "5bf3a4f5e3f674c4f32de55abd9d1981ad0b1fd48fb460905d017096b30ae10e"
score = 40
@@ -310739,8 +311145,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Netfiltersys_F171_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L750-L770"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L750-L770"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f1718a005232d1261894b798a60c73d971416359b70d0e545d7e7a40ed742b71"
logic_hash = "2879360aef7b25e7d5ea9e4cbdce9f60a33ca4181ef35e18117e69832589cc73"
score = 40
@@ -310769,8 +311175,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L822-L843"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L822-L843"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "16ae28284c09839900b99c0bdf6ce4ffcd7fe666cfd5cfb0d54a3ad9bea9aa9c"
hash = "d54ac69c438ba77cde88c6efd6a423491996d4e8a235666644b1db954eb1da9c"
logic_hash = "4c4359af17cfc03947722c644064fa2e2bacc5adcbd66499bfba4aa483ac56f6"
@@ -310800,8 +311206,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Computerz_Computerzsys_Computerzsystemdriver
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L846-L866"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L846-L866"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61f3b1c026d203ce94fab514e3d15090222c0eedc2a768cc2d073ec658671874"
logic_hash = "73d2e39a2e1d9810f5f0999a8f79a238a36305d36db731a3e84859e6d15bfdd8"
score = 40
@@ -310830,8 +311236,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Cpuzsys_Windowsrwindd
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L902-L933"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L902-L933"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c"
hash = "c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e"
hash = "922d23999a59ce0d84b479170fd265650bc7fae9e7d41bf550d8597f472a3832"
@@ -310871,8 +311277,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Mitactechnologycorporation_Vdbsvsys_Mitacsys
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L936-L956"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L936-L956"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "91afa3de4b70ee26a4be68587d58b154c7b32b50b504ff0dc0babc4eb56578f4"
logic_hash = "e93e2620e452d0d6d834057921ed0de35309098130b47e98da7c1e87b31b86ee"
score = 40
@@ -310901,8 +311307,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_00B3_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L959-L982"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L959-L982"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "00b3ff11585c2527b9e1c140fd57cb70b18fd0b775ec87e9646603056622a1fd"
hash = "3140005ce5cac03985f71c29732859c88017df9d41c3761aa7c57bbcb7ad2928"
hash = "18f306b6edcfacd33b7b244eaecdd0986ef342f0d381158844d1f0ee1ac5c8d7"
@@ -310934,8 +311340,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD_1 : FI
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1011-L1032"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1011-L1032"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5"
hash = "a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062"
logic_hash = "e5777a3a1e71f287c18434a48c2990abd3e202c919378a9473541abe2b8f0ba5"
@@ -310965,8 +311371,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowswinowsdriverkitsprovider_Hwrwdrvsys_H
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1035-L1055"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1035-L1055"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21"
logic_hash = "da6f9de9c0529ef274b989f63d9d6308ea78a0f7f91d81caaafb5478412c33eb"
score = 40
@@ -310995,8 +311401,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_AD8F_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1058-L1078"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1058-L1078"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833"
logic_hash = "fba0440ab68b148f26224cce5d2b8bdb684a2d185502fb3b920fe12288e6d775"
score = 40
@@ -311025,8 +311431,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3124_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1081-L1101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1081-L1101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5"
logic_hash = "4e22250223e272624f9608e7981ba91c1fb0e00eaf6d8388b81ad91fd8dbcc5c"
score = 40
@@ -311055,8 +311461,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1104-L1124"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1104-L1124"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ff55c1f308a5694eb66a3e9ba326266c826c5341c44958831a7a59a23ed5ecc8"
logic_hash = "298b509c736082f651b32be6ff3ba8b2044d48e8d1ac5c411449524750794d4f"
score = 40
@@ -311085,8 +311491,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_DB71_1 : FI
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1151-L1171"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1151-L1171"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "db711ec3f4c96b60e4ed674d60c20ff7212d80e34b7aa171ad626eaa8399e8c7"
logic_hash = "c62675b8ae01311a74bd0b0717219dde73badf621f2b6af1d5d6ff12317048f0"
score = 40
@@ -311115,8 +311521,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Iobit_Monitorsys_Advancedsystemcare_E4A7_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1174-L1194"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1174-L1194"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb"
logic_hash = "798dad45f7ac1267da440c3ca7aba1da1dbd2bdead9b6979379902e009bbd2a2"
score = 40
@@ -311145,8 +311551,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Phoenixtechnologiesltd_Phlashnt_Winphlash_65
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1232-L1252"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1232-L1252"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890"
logic_hash = "52b33a82d9835242e397f693094494508a9a1e17ab7125ad6818130f4b2dc2de"
score = 40
@@ -311175,8 +311581,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7196_1 : F
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1255-L1275"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1255-L1275"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d"
logic_hash = "c69a031ad9d7eff41358cd2ae9404c25c48ca747ac5fc9b806e48be2fe59aee8"
score = 40
@@ -311205,8 +311611,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Anticheatexpertcom_Acebase_Anticheatexpert_7
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1326-L1345"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1326-L1345"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7326aefff9ea3a32286b423a62baebe33b73251348666c1ee569afe62dd60e11"
logic_hash = "c309c294def3fb6601ab76b4b67bdda0d38db398a8a56b0ced0d4ce8cafc8602"
score = 40
@@ -311234,8 +311640,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoft
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1348-L1368"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1348-L1368"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743"
logic_hash = "8294e9a9d7bf9e4471d494ca78db936c69b2b2ee495207cde79aeabff9910463"
score = 40
@@ -311264,8 +311670,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_1072_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1371-L1392"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1371-L1392"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1072beb3ff6b191b3df1a339e3a8c87a8dc5eae727f2b993ea51b448e837636a"
hash = "e8eb1c821dbf56bde05c0c49f6d560021628df89c29192058ce68907e7048994"
logic_hash = "99645f9bf3c3ba88788ad609ee067cdda808effac07990db725b9be5fca32658"
@@ -311295,8 +311701,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0D37_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1428-L1466"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1428-L1466"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f"
hash = "523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba"
hash = "df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15"
@@ -311343,8 +311749,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Proxydrvsys_Nn_C0E7_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1469-L1489"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1469-L1489"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c0e74f565237c32989cb81234f4b5ad85f9dd731c112847c0a143d771021cb99"
logic_hash = "b4248d60006efcf3f489cfad8a68bbf594bd45f75e8b9c8d7b9f727c6ee05042"
score = 40
@@ -311373,8 +311779,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Netfiltersys_26D6_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1516-L1538"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1516-L1538"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "26d67d479dafe6b33c980bd1eed0b6d749f43d05d001c5dcaaf5fcddb9b899fe"
hash = "6a234a2b8eb3844f7b5831ee048f88e8a76e9d38e753cc82f61b234c79fe1660"
hash = "2fa78c2988f9580b0c18822b117d065fb419f9c476f4cfa43925ba6cd2dffac3"
@@ -311405,8 +311811,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylauncha
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1567-L1587"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1567-L1587"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dd628061d6e53f3f0b44f409ad914b3494c5d7b5ff6ff0e8fc3161aacec93e96"
logic_hash = "f0bf2e418bed091c1d9f1d604f284586f27d2d28b277c29f241aeaee9b9bdccf"
score = 40
@@ -311435,8 +311841,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorp_Stdcdrvwssys_Selftestdatacollector
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1590-L1610"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1590-L1610"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70afdc0e11db840d5367afe53c35d9642c1cf616c7832ab283781d085988e505"
logic_hash = "06aae42f1cfaaa5d797ef384786a8cdb54685465240d324216d8832be82c5db0"
score = 40
@@ -311465,8 +311871,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realteksemiconductorcorp_Rtportsys_Realtekpo
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1613-L1633"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1613-L1633"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ff322cd0cc30976f9dbdb7a3681529aeab0de7b7f5c5763362b02c15da9657a1"
logic_hash = "814b2a2bc284623f620341ec841cd080eb04ef9c9f4a11387d0b79c5010e70e8"
score = 40
@@ -311495,8 +311901,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_A6F7_1 : FI
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1636-L1656"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1636-L1656"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a6f7897cd08fe9de5e902bb204ff87215584a008f458357d019a50d6139ca4af"
logic_hash = "e6b52b789ba1f5bf60722a7b4ec2f94e650b186605ea558780018edaa74090b4"
score = 40
@@ -311525,8 +311931,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_834A_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1659-L1679"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1659-L1679"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "834a3d755b5ae798561f8e5fbb18cf28dfcae7a111dc6a03967888e9d10f6d78"
hash = "e89cb7217ec1568b43ad9ca35bf059b17c3e26f093e373ab6ebdeee24272db21"
logic_hash = "54a915ecbb2fb9f77603a19628d8130cf9896bc649618e3448442e1408b1f8a4"
@@ -311555,8 +311961,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F42E_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1707-L1727"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1707-L1727"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f42eb29f5b2bcb2a70d796fd71fd1b259d5380b216ee672cf46dcdd4604b87ad"
logic_hash = "2bbf7257a20468f12ffa8e8dc70c126a41124043acfcae776cda173ed68788c3"
score = 40
@@ -311585,8 +311991,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CF4B_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1730-L1750"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1730-L1750"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b"
logic_hash = "50f8cbf8834910e3560b3d092ae897977db2c9cb26107219e1604b2c26bba2ae"
score = 40
@@ -311615,8 +312021,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_3867_1 : FI
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1753-L1774"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1753-L1774"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "386745d23a841e1c768b5bdf052e0c79bb47245f9713ee64e2a63f330697f0c8"
hash = "5aee1bae73d056960b3a2d2e24ea07c44358dc7bc3f8ac58cc015cccc8f8d89c"
logic_hash = "f911813c40d65c443b01e00635da122cd1969817c6d3842eca7a5a20ff57513e"
@@ -311646,8 +312052,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_D783_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1777-L1797"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1777-L1797"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f"
logic_hash = "f92c013f7c10a9c63b2f630b198d9ef360e944182b9760e8c268dc7145f82e95"
score = 40
@@ -311676,8 +312082,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_4B52_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1800-L1820"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1800-L1820"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1"
logic_hash = "c1df652b20d7bbea94d71bdef159c26b59180b736859bb4a16d03880a99d2841"
score = 40
@@ -311706,8 +312112,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsd
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1823-L1843"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1823-L1843"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38d6d90d543bf6037023c1b1b14212b4fa07731cbbb44bdb17e8faffc12b22e8"
logic_hash = "d1cc4c2d1335784f723849ab37131f3b5384628652594fe8e3a1ab4b0729eacd"
score = 40
@@ -311736,8 +312142,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriverfle_42E
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1846-L1868"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1846-L1868"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb"
hash = "f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65"
hash = "55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a"
@@ -311768,8 +312174,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytes_Elbycdio_Cdrtools_07AF_1 : FI
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1871-L1891"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1871-L1891"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "07af8c5659ad293214364789df270c0e6d03d90f4f4495da76abc2d534c64d88"
logic_hash = "832d90cd437cb6912630943fcae9e103341c0bc6770a4515525cf42f72812faa"
score = 40
@@ -311798,8 +312204,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Mitactechnologycorporation_Mtcbsvsys_Mitacsy
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1894-L1914"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1894-L1914"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8"
logic_hash = "402e0a50c61722ffbbf6778df2483750fae17d6a18d8b247d65df8302d725c14"
score = 40
@@ -311828,8 +312234,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_7125_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1917-L1937"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1917-L1937"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7125c9831a52d89d3d59fb28043b67fbe0068d69732da006fabb95550d1fa730"
logic_hash = "b91987339120b171bf8059bd06c95b25ec8124a902d53c0d05558e95bdfa588b"
score = 40
@@ -311858,8 +312264,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F65_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1940-L1960"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1940-L1960"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0"
logic_hash = "66fa3b5461eb9cf7c9f0eba976ac1546338ac11b937cc9753340042a0dc49066"
score = 40
@@ -311888,8 +312294,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_58A7_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1963-L1983"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1963-L1983"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495"
logic_hash = "f1f16f31db7cd1249b3a76eddf0091a1b89d158da5c3beb1e3ed5ec18a3a7d72"
score = 40
@@ -311918,8 +312324,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panm
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L1986-L2006"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L1986-L2006"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf"
logic_hash = "ad7595823bec8291999096f6249051d51741761c09e5a00ed72b01beeb13389b"
score = 40
@@ -311948,8 +312354,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_0F1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2033-L2053"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2033-L2053"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf"
logic_hash = "3e9d3d998c97ac3491211c231552ee36be1428ca8ec61e89e9c1c1b7ff4ccf22"
score = 40
@@ -311978,8 +312384,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_AF16_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2103-L2123"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2103-L2123"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "af16c36480d806adca881e4073dcd41acb20c35ed0b1a8f9bd4331de655036e1"
logic_hash = "390b48999576261d87a970dee3dd1da4d82f45bdcf4db37be180c464bacfa488"
score = 40
@@ -312008,8 +312414,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Ncrcorporation_Radhwmgrsys_Ncrcorporationhar
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2179-L2199"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2179-L2199"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7c8ad57b3a224fdc2aac9dd2d7c3624f1fcd3542d4db804de25a90155657e2cc"
logic_hash = "cc7c365f36d9c7fc0367b57f9d5b24004c8c4453e0ed227941623c6057fce39a"
score = 40
@@ -312038,8 +312444,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avaluetechnologyinc_Avalueio_Avalueio_A5A4_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2202-L2223"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2202-L2223"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a5a4a3c3d3d5a79f3ed703fc56d45011c21f9913001fcbcc43a3f7572cff44ec"
hash = "defde359045213ae6ae278e2a92c5b4a46a74119902364c7957a38138e9c9bbd"
logic_hash = "ec187ba5aadc7b9395008155d4b6331b099b3ae9e3ab738568a9980b3d0ce448"
@@ -312069,8 +312475,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_965D_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2279-L2299"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2279-L2299"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "965d4f981b54669a96c5ab02d09bf0a9850d13862425b8981f1a9271350f28bb"
logic_hash = "e5ba23bf3914d121647d6b7aef5ec81d9d62af56397e152fb39179349f1f6146"
score = 40
@@ -312099,8 +312505,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Pani
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2329-L2349"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2329-L2349"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74"
logic_hash = "d6d95fe0d738012ca0643f478c59accd2d1e47742a502f5fea65040e59e9f42a"
score = 40
@@ -312129,8 +312535,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_82FB_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2352-L2372"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2352-L2372"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989"
logic_hash = "38df982e74818094d0aa508b6b0ad94b885e6554760b4678de833fcc86e8bb13"
score = 40
@@ -312159,8 +312565,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Entechtaiwan_Seasys_Softenginex_6CB5_1 : FIL
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2375-L2395"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2375-L2395"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc"
logic_hash = "aa425e95a0b920bf68c0221d8fb1cc16f00755b626f496b758cf50d26949c27b"
score = 40
@@ -312189,8 +312595,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2398-L2418"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2398-L2418"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917"
logic_hash = "264c22a6b54b47962561ea3d8400aab606dd2d28f5d288ba4777ff2ca290c38e"
score = 40
@@ -312219,8 +312625,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_127
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2447-L2467"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2447-L2467"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1"
logic_hash = "1bf31b51302ade1b65e6c24a0dfcc6e144a2f0104e687cef4a14e6307c27c9e1"
score = 40
@@ -312249,8 +312655,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3854_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2470-L2491"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2470-L2491"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039"
hash = "b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3"
logic_hash = "0cdfef6284465ea9f5509cb4e0ad6efb531d60150fb355a388f8152b322e3da9"
@@ -312280,8 +312686,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdri
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2494-L2516"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2494-L2516"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3c11dec1571253594d64619d8efc8c0212897be84a75a8646c578e665f58bf5d"
hash = "5a0b10a9e662a0b0eeb951ffd2a82cc71d30939a78daebd26b3f58bb24351ac9"
hash = "7a1105548bfc4b0a1b7b891cde0356d39b6633975cbcd0f2e2d8e31b3646d2ca"
@@ -312312,8 +312718,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2519-L2539"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2519-L2539"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eaa5dae373553024d7294105e4e07d996f3a8bd47c770cdf8df79bf57619a8cd"
logic_hash = "9149c106ff7ea0326b9e010ef7ae32c25f57c3b9b2e738f4915eda205a512888"
score = 40
@@ -312342,8 +312748,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_8FE9_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2542-L2559"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2542-L2559"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a"
logic_hash = "f293cb0a8bbc710428a7a4ae582f9d6ed60954afeb84efe8b74da38ff41732c1"
score = 40
@@ -312369,8 +312775,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3D9E_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2593-L2613"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2593-L2613"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3"
logic_hash = "fdb944988945780b774d73f3d729d2468b0c9006aca100fa8bbf913a9c5402c6"
score = 40
@@ -312399,8 +312805,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Logitech_Lgcoretempsys_Lgcoretemp_E0CB_1 : F
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2616-L2636"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2616-L2636"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e0cb07a0624ddfacaa882af49e3783ae02c9fbd0ab232541a05a95b4a8abd8ef"
logic_hash = "f3162a80eb6ab357766aaafbf62aec608291873980c81c6d21d835bc349cda76"
score = 40
@@ -312429,8 +312835,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Stdcdrvsys_Selftestdatacoll
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2639-L2659"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2639-L2659"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "37022838c4327e2a5805e8479330d8ff6f8cd3495079905e867811906c98ea20"
logic_hash = "dfc77d3461c57240baea160b35e9174aa370fc533d08a9331dd8ce53a0048ad4"
score = 40
@@ -312459,8 +312865,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_2BBE_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2662-L2683"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2662-L2683"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250"
hash = "e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a"
logic_hash = "23365c52fd3ce5d9c113c0779072b82325632c75f27cbfde9037b7ffc543a209"
@@ -312490,8 +312896,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoft
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2686-L2707"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2686-L2707"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0"
hash = "0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c"
logic_hash = "771400b6e3f2d216fd38db681bf78fbc4e764a45ff9e11d2e33b62f93ac4a8e2"
@@ -312521,8 +312927,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkpro
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2710-L2730"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2710-L2730"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3c0a36990f7eef89b2d5f454b6452b6df1304609903f31f475502e4050241dd8"
logic_hash = "0460def7e251adf398560c0f05cac2d161951339eb2bcc2b2f4840edbd0d6991"
score = 40
@@ -312551,8 +312957,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_5FAE_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2733-L2753"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2733-L2753"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5fae7e491b0d919f0b551e15e0942ac7772f2889722684aea32cff369e975879"
logic_hash = "7dfbd2e11b8a37a8b276a2279f19f57064f3d561cf2555680c71679206ec1452"
score = 40
@@ -312581,8 +312987,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Innotekgmbh_Vboxusbmonsys_Virtualboxusbmonit
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2756-L2776"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2756-L2776"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3d055be2671e136c937f361cef905e295ddb6983526341f1d5f80a16b7655b40"
logic_hash = "ca021b6b3c733e75d33996652ca9602541e4c9eb9e74f2a995d1b2c2989ca68b"
score = 40
@@ -312611,8 +313017,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_1A45_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2779-L2799"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2779-L2799"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1a450ae0c9258ab0ae64f126f876b5feed63498db729ec61d06ed280e6c46f67"
logic_hash = "51f72d08bd6f0b0e683a9af729e16e08e8d652d9ea5f43872aa402ec3da65cfe"
score = 40
@@ -312641,8 +313047,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_62F5_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2802-L2823"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2802-L2823"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0"
hash = "ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7"
logic_hash = "13b9c0f468e8ce5a9ff8938879d6d22a56c0d7e01b3a72969ecff55954a07b89"
@@ -312672,8 +313078,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Yyinc_Dianhu_80CB_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2826-L2845"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2826-L2845"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3"
hash = "bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955"
logic_hash = "fb1f5f8687f1673585ee2652b9dde20ae925ee33d527d2052707b2370a5df1fc"
@@ -312701,8 +313107,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_A5A
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2874-L2894"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2874-L2894"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad"
logic_hash = "38048706f3e5bd4248779dc8890d14a31daafa177c51953c31f2e7a81c6871a0"
score = 40
@@ -312731,8 +313137,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Wnbiossys_Windowsrwin
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2897-L2917"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2897-L2917"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "530d9223ec7e4123532a403abef96dfd1af5291eb49497392ff5d14d18fccfbb"
logic_hash = "73e496811ab4097aa8311e510fa913a10691a00e314944d509df05084d373379"
score = 40
@@ -312761,8 +313167,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytes_Elbycdio_Cdrtools_98EC_1 : FI
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2920-L2940"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2920-L2940"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "98ec7cc994d26699f5d26103a0aeb361128cff3c2c4d624fc99126540e23e97e"
logic_hash = "27e4fb74a63ee1fe3b3bcf97e2ed01b02d05339cce2f18c2f010577d80dbb243"
score = 40
@@ -312791,8 +313197,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_591B_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2943-L2963"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2943-L2963"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52"
logic_hash = "471fab20146586dacf37b9bb3f43ee578339c73f204487556987803d12a64f95"
score = 40
@@ -312821,8 +313227,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsd
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L2990-L3010"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L2990-L3010"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd"
logic_hash = "b4f90f50b2e90fd8dc57778ba8f650ed201fe2f11f145e981d13021f87746d1f"
score = 40
@@ -312851,8 +313257,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3013-L3033"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3013-L3033"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880"
logic_hash = "669972137fad6a5cc701ea56cf8ae85e08d2131f026e8cf1bd5c85ca1754d3cb"
score = 40
@@ -312881,8 +313287,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3090-L3110"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3090-L3110"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c"
logic_hash = "b0ef81e3a05326390a7d2f00499cf3aaf0610b03f3df2313d5a1f2dddff3555f"
score = 40
@@ -312911,8 +313317,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_3FA6
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3113-L3133"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3113-L3133"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e"
logic_hash = "c1d75b4073f212403f3e7b50cd8c1ea2a8a979bca7cf2dd4cd05bfca03d49c48"
score = 40
@@ -312941,8 +313347,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3E1D_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3136-L3156"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3136-L3156"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272"
logic_hash = "29f4dbbd8dd749a9ccf94cd59010c8c8b63ce1d33c93f05b1f24b1e6a216aff6"
score = 40
@@ -312971,8 +313377,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternet
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3159-L3179"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3159-L3179"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d"
logic_hash = "108670db45ff60bd5d31187755019cd7530f29da12d36c96be06880c23d5e7f9"
score = 40
@@ -313001,8 +313407,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_3B71_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3182-L3204"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3182-L3204"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3b7177e9a10c1392633c5f605600bb23c8629379f7f42957972374a05d4dc458"
hash = "72b67b6b38f5e5447880447a55fead7f1de51ca37ae4a0c2b2f23a4cb7455f35"
hash = "d04c72fd31e7d36b101ad30e119e14f6df9cbc7a761526da9b77f9e0b9888bc4"
@@ -313033,8 +313439,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_0BD1_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3207-L3227"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3207-L3227"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0bd1523a68900b80ed1bccb967643525cca55d4ff4622d0128913690e6bb619e"
logic_hash = "c5fa94fee1260b2c8f188c996ed4ce2095ad8c72fcf6a03b6985303209f17a3a"
score = 40
@@ -313063,8 +313469,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_1E94_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3230-L3250"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3230-L3250"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1e94d4e6d903e98f60c240dc841dcace5f9e8bbb0802e6648a49ab80c23318cb"
logic_hash = "86cbd2762bb8bf050343f4e738216a33764997046a9b59bbb6a435afa2859f0e"
score = 40
@@ -313093,8 +313499,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Hpdevelopmentcompany_Etdsuppsys_Hpetdidriver
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3253-L3273"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3253-L3273"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
logic_hash = "9fcdfda30bb8fb16c5112c22b34be1c42f9ce1a32d21a7554ba0aff2a7696aa1"
score = 40
@@ -313123,8 +313529,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_4ED2_1 : FI
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3306-L3326"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3306-L3326"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7"
logic_hash = "07981841e989bc762fbce94915e29595b1e6db881ed57064c03b126019538fca"
score = 40
@@ -313153,8 +313559,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Netfiltersys_1265_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3329-L3351"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3329-L3351"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12656fc113b178fa3e6bfffc6473897766c44120082483eb8059ebff29b5d2df"
hash = "7ff8fe4c220cf6416984b70a7e272006a018e5662da3cedc2a88efeb6411b4a4"
hash = "1cd75de5f54b799b60789696587b56a4a793cf60775b81f236f0e65189d863af"
@@ -313185,8 +313591,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_1F81_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3354-L3374"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3354-L3374"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501"
logic_hash = "e5b9e4c1559e91b575933d2dd5574a6c374fe967256f65243122c22efbc666ce"
score = 40
@@ -313215,8 +313621,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Iobit_Iobitunlockersys_Iobitunlocker_C79A_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3377-L3397"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3377-L3397"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c79a2bb050af6436b10b58ef04dbc7082df1513cec5934432004eb56fba05e66"
logic_hash = "b711978610592c579a05d332b72c294a5b960a18033264d6a75b8b482dbe8903"
score = 40
@@ -313245,8 +313651,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_16B5_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3400-L3420"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3400-L3420"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "16b591cf5dc1e7282fdb25e45497fe3efc8095cbe31c05f6d97c5221a9a547e1"
logic_hash = "57f379da59234cd2e83802180faecd15784a28fcd09f2eb0a5944f494972c9fc"
score = 40
@@ -313275,8 +313681,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_D0E2_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3475-L3495"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3475-L3495"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605"
logic_hash = "c265c6c89ea9bf09b9dcf47e1ce60f3531d76521a0ef1bbdc07d401a7b4164ed"
score = 40
@@ -313305,8 +313711,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_F060_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3498-L3518"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3498-L3518"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008"
logic_hash = "c73f19c87d63e9986e5f44a368f4b8305b7bff17ebdeb85f309751f54f76db48"
score = 40
@@ -313335,8 +313741,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_4AC0_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3521-L3541"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3521-L3541"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4ac08a6035cfcafdac712d7c3cf2eef6e10258f14cee6e80e1ef2f71f5045173"
logic_hash = "b3a6dc1e2b7e806eb56133af99e995139dccddb2cba897f54144203ea3558f29"
score = 40
@@ -313365,8 +313771,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5027_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3572-L3592"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3572-L3592"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48"
logic_hash = "f2f0788448e15b372c67c310a411c9533fad7e03b24c24a1a1da7eeb595b6e75"
score = 40
@@ -313395,8 +313801,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3595-L3615"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3595-L3615"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2203bd4731a8fdc2a1c60e975fd79fd5985369e98a117df7ee43c528d3c85958"
logic_hash = "30602a4c8f91277805e82cdcd5ccae77b22e77644baf59d9ab2235e575ed9f25"
score = 40
@@ -313425,8 +313831,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Ludashicom_Computerzsys_468B_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3642-L3663"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3642-L3663"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "468b087a0901d7bd971ab564b03ded48c508840b1f9e5d233a7916d1da6d9bd5"
hash = "f93e0d776481c4ded177d5e4aebb27f30f0d47dcb4a1448aee8b66099ac686e1"
logic_hash = "b286d189f5709b74d0da658841a1a626408db584696c467b07b4c341ec6d6748"
@@ -313456,8 +313862,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3666-L3686"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3666-L3686"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0"
logic_hash = "0d4f44ece27db1def197e6353d59677915f7f58eb5ff4661d2b8e024eb07acb7"
score = 40
@@ -313486,8 +313892,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3689-L3709"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3689-L3709"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194"
logic_hash = "fcef672d2e2c24f4b1323554ca206f3bd67657af96ad774056e5fd0181cc7ac7"
score = 40
@@ -313516,8 +313922,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panm
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3712-L3732"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3712-L3732"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7"
logic_hash = "6f9a951d64947f6930614206f10eb51a5f43566fdc6425821608e0f847818f75"
score = 40
@@ -313546,8 +313952,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Lenovogrouplimitedr_Lenovodiagnosticsdrivers
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3759-L3779"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3759-L3779"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe"
logic_hash = "22098d721c4814786834b3ea781283f53d195ba35f51fc8fd75b45f7781d39d4"
score = 40
@@ -313576,8 +313982,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_3F20_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3782-L3799"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3782-L3799"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3f20ac5dac9171857fc5791865458fdb6eac4fab837d7eabc42cb0a83cb522fc"
logic_hash = "6265acf1ebd52e5efe41774f35b3b01ede27f18c04975ac57afbd62b7d6d7600"
score = 40
@@ -313603,8 +314009,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiosp
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3802-L3822"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3802-L3822"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7d4ca5760b6ad2e4152080e115f040f9d42608d2c7d7f074a579f911d06c8cf8"
logic_hash = "a724598247e27cca91bd76f60ebbad471d199ae290c8ec100bcf1efc02b74963"
score = 40
@@ -313633,8 +314039,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Dell_Dbutil_71FE_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3825-L3842"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3825-L3842"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009"
logic_hash = "dad7c23d78176f31a2a324998e3170a5096a50389ff83af590503fac69791890"
score = 40
@@ -313660,8 +314066,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Cn_Computerzsys_6D2C_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3845-L3866"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3845-L3866"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6d2cc7e1d95bb752d79613d0ea287ea48a63fb643dcb88c12b516055da56a11d"
hash = "8047859a7a886bcf4e666494bd03a6be9ce18e20dc72df0e5b418d180efef250"
logic_hash = "c2c74038259bec413bbacf0957449d1da5291b84c6f6848e5573ca50bbea006f"
@@ -313691,8 +314097,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Asus_Asmmapsys_Atkgenericfunctionservice_025
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3892-L3912"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3892-L3912"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4"
logic_hash = "81100a6b0917bd9d6641c1f3db32353d1fe02b34feb5136c3f316f5deaa32f7d"
score = 40
@@ -313721,8 +314127,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_7133_1 : FI
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3941-L3961"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3941-L3961"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129"
logic_hash = "7abc5f0325fa8552b38499b061dd10f6a4cdb56ba1071446ce6ca91e42b8c9f7"
score = 40
@@ -313751,8 +314157,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Lgelectronicsinc_Lhasys_Microsoftwindowsoper
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3964-L3985"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3964-L3985"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade"
hash = "e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf"
logic_hash = "fcc57907a8653acc1175b486f719f029ba3c982dbc73ab0cd878f08b2fcb0aad"
@@ -313782,8 +314188,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elitegroupcomputersystems_Ecsiodriversys_Ecs
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L3988-L4008"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L3988-L4008"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "270547552060c6f4f5b2ebd57a636d5e71d5f8a9d4305c2b0fe5db0aa2f389cc"
logic_hash = "899c58fe4793270c3e314e2c3f04c1341b6fefedba37d53200e5477f1108a5cf"
score = 40
@@ -313812,8 +314218,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_C586_1 : FI
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4035-L4056"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4035-L4056"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c586befc3fd561fcbf1cf706214ae2adaa43ce9ba760efd548d581f60deafc65"
hash = "dda2a604bb94a274e23f0005f0aa330d45ca1ea25111746fb46fa5ef6d155b1d"
logic_hash = "761661cb4ab100aad58ca83f20dd3eb25173bb6c987a7643ca93b91e90f25409"
@@ -313843,8 +314249,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Logmeininc_Lmiinfosys_Logmein_453B_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4059-L4079"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4059-L4079"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233"
logic_hash = "1940aec392f250b22b8480d7b75f0c1a21c7bad13c0e83a4eb6065b3d045e4cd"
score = 40
@@ -313873,8 +314279,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_76AF_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4082-L4102"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4082-L4102"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "76af3f9fa111d694e37058606f2636430bdd378c85b94f426fbfcd6666ebe6cc"
logic_hash = "d4031de065552af6807677430ee6aa17fb754052f6fdeb147db0105bd235acd8"
score = 40
@@ -313903,8 +314309,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_1284_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4105-L4125"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4105-L4125"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1284a1462a5270833ec7719f768cdb381e7d0a9c475041f9f3c74fa8eea83590"
logic_hash = "2453f457e43fd2dade465a33189f8ae41ca5ebd16d9a9c42d8edaf22ca990916"
score = 40
@@ -313933,8 +314339,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Rweverything_Asrsetupdrvsys_Asrsetupdrvdrive
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4128-L4149"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4128-L4149"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9d9346e6f46f831e263385a9bd32428e01919cca26a035bbb8e9cb00bf410bc3"
hash = "a0728184caead84f2e88777d833765f2d8af6a20aad77b426e07e76ef91f5c3f"
logic_hash = "875be865b5c6a924c48aada4c97ae39552a9944d9efb4e419dd754ce3f7ec217"
@@ -313964,8 +314370,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylauncha
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4177-L4197"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4177-L4197"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d0eb3ba0aff471d19260192784bf9f056d669b779b6eaff84e732b7124ce1d11"
logic_hash = "434964576b56367bc1ef4a198b6d6315c00c3fea0af9f1e0f08da6b7bd2cd0d1"
score = 40
@@ -313994,8 +314400,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2FBB_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4224-L4244"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4224-L4244"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445"
logic_hash = "b25969777810ff75d8cc35ae042a58e35f268c09aaa6f7fd6e10b1a1741898b4"
score = 40
@@ -314024,8 +314430,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Pr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4247-L4267"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4247-L4267"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f"
logic_hash = "21a234179b5f2ae97262100f990587238339777bf919f8a9f04e84e64c77fb1d"
score = 40
@@ -314054,8 +314460,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_082C_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4270-L4290"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4270-L4290"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d"
logic_hash = "805a4da51dd1a85c46b830b747ed15f5cfb7539b42fd598987d3cd879d93cc97"
score = 40
@@ -314084,8 +314490,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_1493_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4293-L4317"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4293-L4317"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "14938f68957ede6e2b742a550042119a8fbc9f14427fb89fa53fff12d243561c"
hash = "28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7"
hash = "41eeeb0472c7e9c3a7146a2133341cd74dd3f8b5064c9dee2c70e5daa060954f"
@@ -314118,8 +314524,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_D1F4_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4351-L4371"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4351-L4371"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f"
logic_hash = "8152947116f7cb31e716db449c855255c30f5034d065e8287cf480157274ba9b"
score = 40
@@ -314148,8 +314554,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_7CB4_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4398-L4418"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4398-L4418"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7"
logic_hash = "bec5e91150c9c0760c91f8a2b4b83867af030ede236c8596c3558e0f8fca1004"
score = 40
@@ -314178,8 +314584,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Safenetinc_Hostnt_Hostnt_07B6_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4421-L4441"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4421-L4441"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357"
logic_hash = "b07f335b6941ef2095903cb8841358bff6b09518a96512d69fdf90bf328888e7"
score = 40
@@ -314208,8 +314614,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficco
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4444-L4464"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4444-L4464"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba"
logic_hash = "29ba3734f177a3ca166a3c02d066da4b9e4cbd146724f037ac82e3ced1d7951e"
score = 40
@@ -314238,8 +314644,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4467-L4487"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4467-L4487"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "848b150ffcf1301b26634a41f28deacb5ccdd3117d79b590d515ed49849b8891"
logic_hash = "e56d5221962e4fe353c0e37cc3bbebf68d785d86f49269d7e6d935ef6cff6f38"
score = 40
@@ -314268,8 +314674,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_7CB5_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4490-L4508"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4490-L4508"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21"
logic_hash = "df3e79bf8db29cb712ac4fe3670954a0793d7d839f3368ad52e5f826afd18b7f"
score = 40
@@ -314296,8 +314702,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Asrockincorporation_Asrautochkupddrvsys_Asra
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4511-L4531"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4511-L4531"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4"
logic_hash = "87c0e6a3d0ff8f88e8f190c6b643adde45dc7d4c2aa73b79ba0f38a13bd86f1c"
score = 40
@@ -314326,8 +314732,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_0EAB_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4558-L4578"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4558-L4578"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0eab16c7f54b61620277977f8c332737081a46bc6bbde50742b6904bdd54f502"
logic_hash = "a4b1e73c5706e29fc31722f82bdf03c705a03821feb22da48c8c5d0d0f7f2dbb"
score = 40
@@ -314356,8 +314762,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_8EF5_1 : FI
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4581-L4601"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4581-L4601"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ef59605ebb2cb259f19aba1a8c122629c224c58e603f270eaa72f516277620c"
logic_hash = "d0b94553fb03576dea69fd13042db119825009c0a90ba111560102fed8bb3154"
score = 40
@@ -314386,8 +314792,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_1F15_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4604-L4624"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4604-L4624"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1f15fd9b81092a98fabcc4ac95e45cec2d9ff3874d2e3faac482f3e86edad441"
logic_hash = "5eebc2d90e6d17134c100e4f04271f4e1f6546a6c74ef4737e60ec76d4fa8227"
score = 40
@@ -314416,8 +314822,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsd
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4627-L4647"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4627-L4647"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0452a6e8f00bae0b79335c1799a26b2b77d603451f2e6cc3b137ad91996d4dec"
logic_hash = "3e5eddf984eb85a304bd19a444238850dc2d153f8e59bb215a08f781efc270c6"
score = 40
@@ -314446,8 +314852,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_818E_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4650-L4670"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4650-L4670"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01"
logic_hash = "de48cb605c339f13f94451361531ea2661d79311aacbb87878b24866766b6e3f"
score = 40
@@ -314476,8 +314882,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_6FFD_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4673-L4693"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4673-L4693"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc"
logic_hash = "f8d629b1c9b785204c61c95ac83dc7516db14aa8abd68dc8cb5250d53408f20d"
score = 40
@@ -314506,8 +314912,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrserverddkprovider_Speedfansys_Window
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4776-L4796"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4776-L4796"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c"
logic_hash = "ce5fb5f559f97130403f8f4c22a2f223892ba46b1df9fd6a99624e879a3fcea3"
score = 40
@@ -314536,8 +314942,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_9131_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4799-L4819"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4799-L4819"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c"
logic_hash = "e61f4452ecae438072b37ae00ca67401541db0e8f6d5b0f1d697190fdff16d23"
score = 40
@@ -314566,8 +314972,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E4EC_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4822-L4842"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4822-L4842"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148"
logic_hash = "08fa3c764599e1f0cb4e76b38b9d577a2fd70fb3f6f3e8e70eea65f0cf16d93a"
score = 40
@@ -314596,8 +315002,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_FB
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4845-L4865"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4845-L4865"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22"
logic_hash = "f62cc8ddd443bf196d36d5a3a2724aff4858fcc78abcdbb3cf7362228fde7a7b"
score = 40
@@ -314626,8 +315032,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Pr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4868-L4889"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4868-L4889"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85"
hash = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
logic_hash = "467c47d2a64332dc3b94a3b55655f0e0c4f10b19e8724718b8f2ccf97ffe6446"
@@ -314657,8 +315063,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpub
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4917-L4937"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4917-L4937"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b"
logic_hash = "6c2a12c5866686cde0e621bd35b73079d7d37d5b5d4b42bb962435a73682c32b"
score = 40
@@ -314687,8 +315093,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2380_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L4940-L4960"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L4940-L4960"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4"
logic_hash = "7ac9c6ae541d6689a986d884e96f2f024a18736a59b02a1103e44538d725bb52"
score = 40
@@ -314717,8 +315123,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolibx_1E8B_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5011-L5032"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5011-L5032"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee"
hash = "5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3"
logic_hash = "673d993f0ad7800551cfc11d73a38aa37b306902f2d28db4d5ec5f33bc51f21f"
@@ -314748,8 +315154,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Featureintegrationtechnologyinc_Fintekpcieco
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5035-L5055"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5035-L5055"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "81fbc9d02ef9e05602ea9c0804d423043d0ea5a06393c7ece3be03459f76a41d"
hash = "ebf0e56a1941e3a6583aab4a735f1b04d4750228c18666925945ed9d7c9007e1"
logic_hash = "24ae9365e55b29c55f83f944154f8fd4643c733f33cfb6542e9159b52acdb9c3"
@@ -314778,8 +315184,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Pr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5083-L5103"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5083-L5103"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf"
logic_hash = "3827cad3f54342cba5e6cfc98b2e30522feb79ea8917d882b95dcc66863e389d"
score = 40
@@ -314808,8 +315214,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_45F4_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5106-L5123"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5106-L5123"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef"
logic_hash = "539d1795ae819c2705e77cb41ec4248c7239ffa8cd805addbb9e5da5e98a83e2"
score = 40
@@ -314835,8 +315241,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4D05_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5126-L5153"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5126-L5153"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee"
hash = "77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9"
hash = "cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c"
@@ -314872,8 +315278,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_86A
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5156-L5176"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5156-L5176"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882"
logic_hash = "ed28688de49b089def60861ffe53f4e3a7f714b255035fdb19122375c83ebac2"
score = 40
@@ -314902,8 +315308,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_61BE_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5179-L5199"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5179-L5199"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf"
logic_hash = "70969db52d4e88e1662902634e0cb21c44ab694928e15e4bdaa9a1b2604146dd"
score = 40
@@ -314932,8 +315338,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Filseclabcorporation_Fildds_Filseclabdynamic
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5228-L5248"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5228-L5248"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f8c07b6e2066a5a22a92d9f521ecdeb8c68698c400e4b83e0501b9f340957c22"
logic_hash = "5eb7f097384c0e4b418611a37d6a03dc7a6ff21814716489bf35e0bd43f390cf"
score = 40
@@ -314962,8 +315368,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_BE8
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5251-L5271"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5251-L5271"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2"
logic_hash = "98be6af9aa551ba153413f75d4038b2840181418e0b8eba2cfcac2aa29a4460e"
score = 40
@@ -314992,8 +315398,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_3E85_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5274-L5294"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5274-L5294"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3e85cf32562a47d51827b21ab1e7f8c26c0dbd1cd86272f3cc64caae61a7e5fb"
logic_hash = "23d11200a9d5ad71d8578e3ec3ac40ad6f7d9971177aa59a1ea6bac3de4f0b04"
score = 40
@@ -315022,8 +315428,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3070_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5297-L5317"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5297-L5317"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab"
logic_hash = "05e9f35f83489d262ffece0c406eebf1b81514ea60278415fbc53adc0bc365fb"
score = 40
@@ -315052,8 +315458,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CC58_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5320-L5340"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5320-L5340"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b"
logic_hash = "8eb46633cce7959cfefbc65ede889c748a077cddc59fb79d87b54ddcd42ca524"
score = 40
@@ -315082,8 +315488,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nmscommunications_Cgkwinksys_Ctaccess_223F_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5368-L5388"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5368-L5388"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "223f61c3f443c5047d1aeb905b0551005a426f084b7a50384905e7e4ecb761a1"
logic_hash = "2ec82ad1a839ff65d3e8288ed161650bd678f8a201bb513bd869d1e9bcfb2a65"
score = 40
@@ -315112,8 +315518,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E4D9_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5391-L5411"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5391-L5411"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036"
logic_hash = "e17c01d291e60fff225ee60e296450ab2d4a293084dc4c07de7347f55566d7ee"
score = 40
@@ -315142,8 +315548,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsd
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5414-L5434"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5414-L5434"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b9ae1d53a464bc9bb86782ab6c55e2da8804c80a361139a82a6c8eef30fddd7c"
logic_hash = "dac574b12f72b99fe66500edb6447802f95ad8d6c787ddbea69b36a1c0dfdab7"
score = 40
@@ -315172,8 +315578,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Cupfixerxsys_Windowsr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5437-L5457"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5437-L5457"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9"
logic_hash = "d0eb0738da64ce1a94278a422e829f01d1514ac4536fc2187aa5f4112b70f6e0"
score = 40
@@ -315202,8 +315608,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowe
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5460-L5481"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5460-L5481"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0cf84400c09582ee2911a5b1582332c992d1cd29fcf811cb1dc00fcd61757db0"
hash = "f190919f1668652249fa23d8c0455acbde9d344089fde96566239b1a18b91da2"
logic_hash = "6497a69a7fd7502a78ec6d373a2b0bdc1da73bca4590a256f7094463e0f0b363"
@@ -315233,8 +315639,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmoded
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5484-L5504"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5484-L5504"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0"
logic_hash = "bfcaa037bc06303a0de6a0372cd9dd49bd9801610989df46ca19fd844b22560e"
score = 40
@@ -315263,8 +315669,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5507-L5527"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5507-L5527"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4d777a9e2c61e8b55b3c34c5265b301454bb080abe7ffb373e7800bd6a498f8d"
logic_hash = "bed34d3bcb856628a688bb189f5bc1a0adf2384698ac28196fc5313e57387a1e"
score = 40
@@ -315293,8 +315699,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_2AFD_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5530-L5550"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5530-L5550"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30"
logic_hash = "a687639311529ca919f90d478ddbb39e441ce24a58be056af7a7108db3f11f25"
score = 40
@@ -315323,8 +315729,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Cn_Computerzsys_00D9_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5553-L5573"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5553-L5573"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "00d9781d0823ab49505ef9c877aa6fa674e19ecc8b02c39ee2728f298bc92b03"
logic_hash = "dd1b181f975ada1e7d1def32be88e41df2f994c698e794dc0fade119b0eabf2d"
score = 40
@@ -315353,8 +315759,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5576-L5596"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5576-L5596"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c35cab244bd88bf0b1e7fc89c587d82763f66cf1108084713f867f72cc6f3633"
logic_hash = "f9010e0f70eb1c94a1e41e5999623f5eeb6aff155c36cb7b17c196eb363a62c4"
score = 40
@@ -315383,8 +315789,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Asustekcomputerinc_Iomapsys_Asuskernelmodedr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5599-L5619"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5599-L5619"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41"
logic_hash = "f9ffedd3761c0cf68d5f862ceb8e22a61a5da73e757cf92317085b714656e139"
score = 40
@@ -315413,8 +315819,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E05E_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5622-L5642"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5622-L5642"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53"
logic_hash = "94ee30a5cbd1ff47cddf35ec2205d9008857e87c457dce025501132231a146e4"
score = 40
@@ -315443,8 +315849,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternet
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5645-L5665"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5645-L5665"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9"
logic_hash = "0a35b3e88bb078e61c2769267fdba624d171492b0e4d1c57ecf7ea770fa2f44d"
score = 40
@@ -315473,8 +315879,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsy
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5692-L5712"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5692-L5712"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e6023b8fd2ce4ad2f3005a53aa160772e43fe58da8e467bd05ab71f3335fb822"
logic_hash = "6e220e39e765c6af5d2e80cce4a4a07b587ccd559e0cb455d56046cf4c2ff447"
score = 40
@@ -315503,8 +315909,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Genitlkiwibenjaminxxxxx_Titidrv_Titidrvtitic
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5715-L5735"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5715-L5735"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "208ea38734979aa2c86332eba1ea5269999227077ff110ac0a0d411073165f85"
logic_hash = "c1a57d6f66fd8818dd72813a3bac78eab44b2b546f65a78864739cb55a258d39"
score = 40
@@ -315533,8 +315939,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowe
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5738-L5758"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5738-L5758"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5df689a62003d26df4aefbaed41ec1205abbf3a2e18e1f1d51b97711e8fcdf00"
logic_hash = "b560682fe9ed95a19df7dcc6ea823545d2303a51aaa06dc14e48c73f2e6fe8b7"
score = 40
@@ -315563,8 +315969,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_B9AD_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5761-L5781"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5761-L5781"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b9ad7199c00d477ebbc15f2dcf78a6ba60c2670dad0ef0994cebccb19111f890"
logic_hash = "c8efd23f9fb60831cede71737c5d1e62d94f3b44a2b3da7f29db06ca4599821d"
score = 40
@@ -315593,8 +315999,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Cn_Computerzsys_348D_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5784-L5805"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5784-L5805"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "348dc502ac57d7362c7f222e656c52e630c90bef92217a3bd20e49193b5a69f1"
hash = "c186967cc4f2a0cb853c9796d3ea416d233e48e735f02b1bb013967964e89778"
logic_hash = "435219f0b49a009eb42ffa096c4acefc48f85d03a8656d5142df20deee19cf08"
@@ -315624,8 +316030,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Mydriverscom_Hwm_Drivergenius_08EB_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5808-L5828"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5808-L5828"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6"
logic_hash = "2371de5547217734226420bbbee12dee897206bd2419387d2c2fc2ae07df7fec"
score = 40
@@ -315654,8 +316060,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_3E27_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5831-L5851"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5831-L5851"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75"
logic_hash = "18affdea7f982e47ca4852d9a4a28797a1ca3175c404c8e5c316ee3a610cf858"
score = 40
@@ -315684,8 +316090,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Evgatechnologyinc_Windowsvistasmartiodevice_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5854-L5874"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5854-L5874"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3c95ebf3f1a87f67d2861dbd1c85dc26c118610af0c9fbf4180428e653ac3e50"
logic_hash = "e0bf6bd64e91baa27e1181223cba6f4975b5b5a9fd9918d4c65180ed584b319b"
score = 40
@@ -315714,8 +316120,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_033C_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5877-L5897"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5877-L5897"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "033c4634ab1a43bc3247384864f3380401d3b4006a383312193799dded0de4c7"
logic_hash = "fea547a999db61dd4c87d648d8e0e1a50f9c677439d514cfdd0a75a5a6da4c8f"
score = 40
@@ -315744,8 +316150,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxusbsys_Virtualboxusbd
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5900-L5920"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5900-L5920"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5b26c4678ecd37d1829513f41ff9e9df9ef1d1d6fea9e3d477353c90cc915291"
logic_hash = "49554df6ecdbfafbb3cf8f78cdece896830dd842cf1cae1129f11eb69a3588c4"
score = 40
@@ -315774,8 +316180,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_3B6E_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5923-L5943"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5923-L5943"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b"
logic_hash = "f3736282399849376632ee9392bf679779cecbb76fa7bd8ccaff0b787a3370f5"
score = 40
@@ -315804,8 +316210,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7C73_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5946-L5967"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5946-L5967"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b"
hash = "fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c"
logic_hash = "9e024ac35be2fe02ecaae96f3cfbbae60b4032986f22710809699049456e979c"
@@ -315835,8 +316241,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Wistroncorporation_Wirwadrvsys_Wistronrwadri
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5970-L5990"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5970-L5990"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d8fc8e3a1348393c5d7c3a84bcbae383d85a4721a751ad7afac5428e5e579b4e"
logic_hash = "e991957205079fb282f9fb248637d4723c940a7e9ab708e68082e99adbed647c"
score = 40
@@ -315865,8 +316271,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1A4
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L5993-L6013"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L5993-L6013"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0"
logic_hash = "bfd4ff6c58d83e8d09d43d75e655993319283d0a41407d20417011d663791fd3"
score = 40
@@ -315895,8 +316301,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_EC5F_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6040-L6060"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6040-L6060"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5"
logic_hash = "74fad50be13de00367a5cecb25f7e3feb53f5e8553fac8cd32edc500a91aad88"
score = 40
@@ -315925,8 +316331,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6063-L6083"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6063-L6083"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf"
logic_hash = "a2f304406595b6cad63dbc83f32f1a35477d022fe5cad1c11ac9746d3775199d"
score = 40
@@ -315955,8 +316361,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_D0BD_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6086-L6106"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6086-L6106"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889"
logic_hash = "c285e87a94025916ed6d3fac65761d1ca4bef13102a0a37b256525bf651bd16c"
score = 40
@@ -315985,8 +316391,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Atlaccesssys_Windowsr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6109-L6129"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6109-L6129"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b57569aaa0f4789d9642dd2189b0a82466b80ad32ff35f88127210ed105fe57"
logic_hash = "93d5121da2037ffcc961550b6859bff4257f56b783d7c49e442dc97a3f9257ae"
score = 40
@@ -316015,8 +316421,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6132-L6152"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6132-L6152"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "909f6c4b8f779df01ef91e549679aa4600223ac75bc7f3a3a79a37cee2326e77"
logic_hash = "4e4a093fcdd97298aa6ead7c4412263837a7403f87b4d8f72e6ea27bc6f4d15f"
score = 40
@@ -316045,8 +316451,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_3C18_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6155-L6172"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6155-L6172"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b"
logic_hash = "4f958ccb21b5cbd28c25a9c2e1a08fcf00e24bfa9e7814b9e68b87814dd04f4c"
score = 40
@@ -316072,8 +316478,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2B4C_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6175-L6195"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6175-L6195"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a"
logic_hash = "3db68ef927d373e7774d52bbf1dccfa2960b4bb1b42a32a181ad9e1f00458f23"
score = 40
@@ -316102,8 +316508,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Innotekgmbh_Iprt_Virtualboxguestadditions_BB
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6198-L6218"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6198-L6218"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bbf564a02784d53b8006333406807c3539ee4a594585b1f3713325904cb730ec"
logic_hash = "7f5480d84195854bdc5c7554495e0ecd9b69b9c527152def1e85fd61084fd22d"
score = 40
@@ -316132,8 +316538,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_9399_1 : F
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6221-L6242"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6221-L6242"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9399f35b90f09b41f9eeda55c8e37f6d1cb22de6e224e54567d1f0865a718727"
hash = "a66b4420fa1df81a517e2bbea1a414b57721c67a4aa1df1967894f77e81d036e"
logic_hash = "92139b7123c13dc80c1671b92ad6d1c6d6f4d02e1a3bc07e95cac27c7d43df66"
@@ -316163,8 +316569,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_3D23_1 : FIL
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6245-L6265"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6245-L6265"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4"
logic_hash = "4f494f3f2367bbc5751a09b79775ea61f62986b82375c8c98bf6a77203174be1"
score = 40
@@ -316193,8 +316599,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_496F_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6268-L6288"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6268-L6288"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b"
logic_hash = "405e7a16f8290d1d5462227ccf7d42e137bc98f084c9d5763b000d101e615c6a"
score = 40
@@ -316223,8 +316629,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Pr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6291-L6312"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6291-L6312"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e"
hash = "51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5"
logic_hash = "191ef735b2fa7cf3c1e0ae1a28e7996580ed2094d214f2ce7b42d856b119eb5e"
@@ -316254,8 +316660,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Multitheftauto_Mtasanandreas_9F4C_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6315-L6333"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6315-L6333"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5"
logic_hash = "b8c423a00732d4e0fb4c45c64a6794a466e604feb9d455bc110cf5169f95ab55"
score = 40
@@ -316282,8 +316688,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_273
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6336-L6356"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6336-L6356"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c"
logic_hash = "17723afb429fe90b2e49d61676c6564ce94547b55be45ea6a66cf8d2edcdc49b"
score = 40
@@ -316312,8 +316718,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_7702_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6407-L6427"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6407-L6427"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7702f240800528d8186e3e6a26e2680486fed65a6fb5a2a000ad12c1fb61a398"
logic_hash = "c2f1170c6fc0353b99f0c0487937d05cba9a79c3b70eafa1895999074c6c4972"
score = 40
@@ -316342,8 +316748,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_EF6D_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6430-L6450"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6430-L6450"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850"
logic_hash = "aff0eae9976189fe89534f7c3f1a35f093627f71d2c65aa446da85185f972bea"
score = 40
@@ -316372,8 +316778,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Microfocus_Microfocusxtier_95D5_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6453-L6472"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6453-L6472"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3"
logic_hash = "070ce1aff2ca552a049602c694e77bd89caa4f6712d86671e21745d9d88f3bc3"
score = 40
@@ -316401,8 +316807,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Z_Computerzsys_Zwuqisystemdriver_61E7_1 : FI
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6475-L6495"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6475-L6495"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61e7f9a91ef25529d85b22c39e830078b96f40b94d00756595dded9d1a8f6629"
logic_hash = "891a11f7f82c6aaa05801bdf0fd82d9786ec1e35c6d699119a801d5cc8e1fe24"
score = 40
@@ -316431,8 +316837,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_8DCE_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6498-L6518"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6498-L6518"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8dcec67a1f4903981c3e0ab938784c2f241e041e26748e1c22059e0e507cfb37"
logic_hash = "4900c684a248338e686b0da0288fe2937cf5d0f5e453419b6f8091c2fc7fc061"
score = 40
@@ -316461,8 +316867,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E3EF_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6521-L6541"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6521-L6541"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918"
logic_hash = "50c225f42f3b7ac785d01cc9ad5542ac2e12d26e707d0ed5b8c5415d981479bc"
score = 40
@@ -316491,8 +316897,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7F37_1 : F
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6544-L6564"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6544-L6564"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa"
logic_hash = "5e796e1ebc587faf2f8255e6229fe4f97f781fd66100398561703320d34728c1"
score = 40
@@ -316521,8 +316927,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Pani
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6567-L6587"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6567-L6587"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960"
logic_hash = "5694c7f1a74ffd5cdaa143bc563939589305450c3ee24c758fb7379b79f73764"
score = 40
@@ -316551,8 +316957,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_6C5A_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6590-L6610"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6590-L6610"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6c5aef14613b8471f5f4fdeb9f25b5907c2335a4bc18b3c2266fb1ffd8f1741d"
hash = "ec1307356828426d60eab78ffb5fc48a06a389dea6e7cc13621f1fa82858a613"
logic_hash = "02155af4ab432fbbec1bf582fa8161eb2e39c258bb0f67fcc7054d2f3c8a46be"
@@ -316581,8 +316987,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_1768_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6613-L6633"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6613-L6633"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca"
logic_hash = "5fb10d691fda963001b9a3c07b22db5e63beef984f26bc7d31ad98a1524ce5ff"
score = 40
@@ -316611,8 +317017,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Cn_Computerzsys_3913_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6636-L6658"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6636-L6658"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "39134750f909987f6ebb46cf37519bb80707be0ca2017f3735018bac795a3f8d"
hash = "a34e45e5bbec861e937aefb3cbb7c8818f72df2082029e43264c2b361424cbb1"
hash = "3e758221506628b116e88c14e71be99940894663013df3cf1a9e0b6fb18852b9"
@@ -316643,8 +317049,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Cn_Computerzsys_767E_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6661-L6682"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6661-L6682"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "767ef5c831f92d92f2bfc3e6ea7fd76d11999eeea24cb464fd62e73132ed564b"
hash = "d9a73df5ac5c68ef5b37a67e5e649332da0f649c3bb6828f70b65c0a2e7d3a23"
logic_hash = "624a88bcb301508151c2afdd1d5f076d04e2941dc2178b931f9dcfe3d63ab47d"
@@ -316674,8 +317080,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternet
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6685-L6705"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6685-L6705"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7"
logic_hash = "a520f2236b800f2dd2b8ac9963b8e9ba3ce782cca2c1b2835540899da65168b5"
score = 40
@@ -316704,8 +317110,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Oti_Otipcibussys_Kernelmodedrivertoaccessphy
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6708-L6727"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6708-L6727"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80"
logic_hash = "ef5cb96dc4f6eaaf24fe9d0a65ccb5efe54cb672a9328b9dc2bbc36af82d96e2"
score = 40
@@ -316733,8 +317139,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_DCB
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6730-L6750"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6730-L6750"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258"
logic_hash = "80b8d0833d2e3675c5a1105725ef61e6914774019d4499c752a25b628a985274"
score = 40
@@ -316763,8 +317169,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriververs
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6753-L6773"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6753-L6773"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab"
logic_hash = "2dd35edfdf8b82b650278186df087c5ae103f3b807faf30c72278521ff56224b"
score = 40
@@ -316793,8 +317199,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6776-L6796"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6776-L6796"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f8d45fa03f56e2ea14920b902856666b8d44f1f1b16644baf8c1ae9a61851fb6"
logic_hash = "522145d0081891d18a0c1e657ca6228962e97325697b556d97a4fe311efa3aee"
score = 40
@@ -316823,8 +317229,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6823-L6844"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6823-L6844"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "77da3e8c5d70978b287d433ae1e1236c895b530a8e1475a9a190cdcc06711d2f"
hash = "837d3b67d3e66ef1674c9f1a47046e1617ed13f73ee08441d95a6de3d73ee9f2"
logic_hash = "a2918e4ffce0affe25aa7b8793c19dfa61da8321b35cb91600d0a5552e14fef6"
@@ -316854,8 +317260,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Ludashicom_Computerzsys_0368_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6847-L6868"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6847-L6868"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "03680068ec41bbe725e1ed2042b63b82391f792e8e21e45dc114618641611d5d"
hash = "66f851b309bada6d3e4b211baa23b534165b29ba16b5cbf5e8f44eaeb3ca86ea"
logic_hash = "67626089334102cf852d0863b58a29562dda673b6601a90b13d97a2380a4295c"
@@ -316885,8 +317291,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6871-L6891"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6871-L6891"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b0dcdbdc62949c981c4fc04ccea64be008676d23506fc05637d9686151a4b77f"
logic_hash = "13f4cfb57115eab4850771248b479f523f3c6d9a25a21b16ce224ab783dd4abc"
score = 40
@@ -316915,8 +317321,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystems
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6894-L6914"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6894-L6914"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7c79e5196c2f51d2ab16e40b9d5725a8bf6ae0aaa70b02377aedc0f4e93ca37f"
logic_hash = "1e60cfe82a13e311e8dc98cb4da82f0f1aecc606aaa5c57cda445228e78acd6b"
score = 40
@@ -316945,8 +317351,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_DD4A_1 : FIL
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6917-L6937"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6917-L6937"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097"
logic_hash = "f04d75e5ff735d30d5bb3959722a5162b1ab7ce4db8d05a2007f98fc901b2179"
score = 40
@@ -316975,8 +317381,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Pchuntersys_Pchunter_1B7F_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6940-L6960"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6940-L6960"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa"
logic_hash = "54232c91f0f6d119ece865269eec9d5ea885c8dd0119a0eecd889a405af828a0"
score = 40
@@ -317005,8 +317411,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_650
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6963-L6983"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6963-L6983"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3"
logic_hash = "a3a2b21c9a58fee77857f3074fe6b69506eecb2627d93f1ea3a51c4cccdd2bab"
score = 40
@@ -317035,8 +317441,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Cn_Computerzsys_0FC3_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L6986-L7007"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L6986-L7007"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0fc3bc6e81b04dcaa349f59f04d6c85c55a2fea5db8fa0ba53d3096a040ce5a7"
hash = "40eef1f52c7b81750cee2b74b5d2f4155d4e58bdde5e18ea612ab09ed0864554"
logic_hash = "56d3b62717fae240ed7c6becfd6523962bb536fe4f7746e7c80f97851fe30501"
@@ -317066,8 +317472,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_E428_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7035-L7052"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7035-L7052"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f"
logic_hash = "8bd47884d13cfc03ececb849688a1c843c4de684a6d32923493f9d0af3d33b7b"
score = 40
@@ -317093,8 +317499,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrse
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7055-L7075"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7055-L7075"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "be683cd38e64280567c59f7dc0a45570abcb8a75f1d894853bbbd25675b4adf7"
logic_hash = "6fc3676bace692d3c83f0ccebe39be7d9dec3965935a8cf8971594fd6c206b90"
score = 40
@@ -317123,8 +317529,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_0909_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7078-L7098"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7078-L7098"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06"
logic_hash = "f224ce42de29a91805c38c230c5b311878339c20d18bcd482b5738f246b12cbc"
score = 40
@@ -317153,8 +317559,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7101-L7122"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7101-L7122"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3cb111fdedc32f2f253aacde4372b710035c8652eb3586553652477a521c9284"
hash = "9bfd24947052bfe9f2979113a7941e40bd7e3a82eaa081a32ad4064159f07c91"
logic_hash = "cb6f7a26f4564d7a60a8dee25f5018fd4f3b4decfef6dfdb0d0b2f1df982adf7"
@@ -317184,8 +317590,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Watchdogdevelopmentcomllc_Wsdkdsys_Wsdkd_627
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7125-L7145"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7125-L7145"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6278bc785113831b2ec3368e2c9c9e89e8aca49085a59d8d38dac651471d6440"
logic_hash = "3df6c8424981c50e765d8730f702b2a541b4e7312eea2ae27518d0958531f3e0"
score = 40
@@ -317214,8 +317620,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Huawei_Hwosec_Huaweimatebook_B179_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7148-L7169"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7148-L7169"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de"
hash = "bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc"
logic_hash = "6c35f9cdd6d48a5804a95bbfd15564e1b9d145b121a72df7fe345ede0c2eed26"
@@ -317245,8 +317651,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_A468_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7172-L7191"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7172-L7191"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9"
logic_hash = "a1e7828c2e39afe4279e6c9b5d34263478919336ed6b7d01bb45b1fdb2032878"
score = 40
@@ -317274,8 +317680,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_7661_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7194-L7211"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7194-L7211"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a"
logic_hash = "8428303996166eb968534f192a1e15cc374ed412b8915b41a323fcf6d8bd238c"
score = 40
@@ -317301,8 +317707,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoft
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7214-L7234"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7214-L7234"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2"
logic_hash = "565bd93231c1cffbb52efc9fedae7c41593ba93a2540dadf199806793359f67d"
score = 40
@@ -317331,8 +317737,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_881B_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7237-L7257"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7237-L7257"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461"
logic_hash = "0d1427a94c21e7055a8d3d1e23e0ee3c513030530c15778eed40283979dba6f9"
score = 40
@@ -317361,8 +317767,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5192_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7260-L7280"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7260-L7280"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b"
logic_hash = "39194a4e7085e17fef079075949360155d6ce279e3bc1a92f1b3a12b70e7f15c"
score = 40
@@ -317391,8 +317797,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystems
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7283-L7304"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7283-L7304"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0f30ecd4faec147a2335a4fc031c8a1ac9310c35339ebeb651eb1429421951a0"
hash = "903d6d71da64566b1d9c32d4fb1a1491e9f91006ad2281bb91d4f1ee9567ef7b"
logic_hash = "09782a4b713c385896e9793c7fe4771ad00b8736e44c2639f94239751cf17222"
@@ -317422,8 +317828,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Insydesoftware_Insydeflash_Insydeflashutilit
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7307-L7327"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7307-L7327"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ce0a4430d090ba2f1b46abeaae0cb5fd176ac39a236888fa363bf6f9fd6036d9"
logic_hash = "ba20c0a151a7e6ef4c2e70426cf4132d9c30f40b6a91e4402e20d15201b6c56e"
score = 40
@@ -317452,8 +317858,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_80A5_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7330-L7350"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7330-L7350"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085"
logic_hash = "f736ac96f1efde446400aaa49fba7cc84a0a10b3425561f67811da86dbee14a8"
score = 40
@@ -317482,8 +317888,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Microfocus_Microfocusxtier_5351_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7353-L7372"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7353-L7372"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c"
logic_hash = "efbf3fd36c3ca5c2b95796cdaefb175ad1957866649e73366a1d6810cbcb5e81"
score = 40
@@ -317511,8 +317917,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7375-L7396"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7375-L7396"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f"
hash = "c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924"
logic_hash = "5e95853e7a2013132a6565b5908475e6369a56ff6c58f0e10c875b72b15b2523"
@@ -317542,8 +317948,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7447-L7468"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7447-L7468"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "060d25126e45309414b380ee29f900840b689eae4217a8e621563f130c1d457f"
hash = "b8321471be85dc8a67ac18a2460cab50e7c41cb47252f9a7278b1e69d6970f25"
logic_hash = "f7a87edc0403a7b8273256805bb8c7aadadde8143db84be9b3968ef67cf3c1c4"
@@ -317573,8 +317979,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Overclockingtool_Atillksys_Overclockingtool_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7495-L7516"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7495-L7516"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "11a9787831ac4f0657aeb5e7019c23acc39d8833faf28f85bd10d7590ea4cc5f"
hash = "d2182b6ef3255c7c1a69223cd3c2d68eb8ba3112ce433cd49cd803dc76412d4b"
logic_hash = "07b8fb1b1b86b58a6fb7f18f3b1b70eee5826fa5c629a8cef1b97afbae7ea7c3"
@@ -317604,8 +318010,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2A62_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7519-L7539"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7519-L7539"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8"
logic_hash = "5fae0a4ba7d11e3714baab3417a1bdd9fff6275fa9347c0389d8627374533bbf"
score = 40
@@ -317634,8 +318040,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_AAA
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7542-L7562"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7542-L7562"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c"
logic_hash = "bb87661658fa874985bbe1050c19eb8ea9136ec62c224d53cd4920866e6a6b1f"
score = 40
@@ -317664,8 +318070,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswvmmsys_Avastantivirus_3650_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7565-L7585"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7565-L7585"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10"
logic_hash = "afe8e12664ee9061c2b2ecdcaaef0c38ece604d050e31b46208f9a22545042ca"
score = 40
@@ -317694,8 +318100,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gdrv_FF67_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7588-L7608"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7588-L7608"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339"
logic_hash = "18c40b7312d0b65d83287e452e8b9429eaed36245d17ef1b82ec04a968303a39"
score = 40
@@ -317724,8 +318130,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Pr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7611-L7631"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7611-L7631"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c"
logic_hash = "b038dcb0a536e16d71035d11537757f529589a435616abacd94aadd5663c2a17"
score = 40
@@ -317754,8 +318160,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficco
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7634-L7654"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7634-L7654"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704"
logic_hash = "d4f37a4c7014694cfcf57c11ee9d41edec1b6fa77a564341663c3411764dbcda"
score = 40
@@ -317784,8 +318190,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7657-L7677"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7657-L7677"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3d008e636e74c846fe7c00f90089ff725561cb3d49ce3253f2bbfbc939bbfcb2"
logic_hash = "d52c104de520b575b404d320a8ec762a146da8cc0567b5f30dc8594b7a1742ef"
score = 40
@@ -317814,8 +318220,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_ED2F
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7680-L7700"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7680-L7700"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39"
logic_hash = "1da8ef4d1877ba9d2c31d994735f6395367de990be6c875c0cba37654ee39ad3"
score = 40
@@ -317844,8 +318250,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolib_09BE_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7703-L7723"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7703-L7723"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1"
logic_hash = "23f5a77bae75d686a980e65dd6efe4ad216a60d75631fed169a83cc88d64675e"
score = 40
@@ -317874,8 +318280,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_A802_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7726-L7746"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7726-L7746"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e"
logic_hash = "8ef06932883bbd5ad62bd5d975fb341277a83271f7a21fc77cdebc6b9f4a05a6"
score = 40
@@ -317904,8 +318310,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternet
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7749-L7769"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7749-L7769"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8"
logic_hash = "014039b9b1b4ea903b4c014ca3d3ff946b1b0f4759d8d78c1fcf825d11318e42"
score = 40
@@ -317934,8 +318340,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7772-L7792"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7772-L7792"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c"
logic_hash = "dd40b144e403136b4359106d2efeb24335b83ffc13a62fdce7c9bd602dc45506"
score = 40
@@ -317964,8 +318370,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxc_1183_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7795-L7815"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7795-L7815"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "11832c345e9898c4f74d3bf8f126cf84b4b1a66ad36135e15d103dbf2ac17359"
logic_hash = "5842fcb278bb2b659760677fea80cbb110347e495e9f1a39fc901f0927753b88"
score = 40
@@ -317994,8 +318400,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_478D_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7818-L7838"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7818-L7838"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0"
logic_hash = "29a09ee10d391b3183052255622f7b96a0e2bf649acc30e10d57e1cb3b17b84f"
score = 40
@@ -318024,8 +318430,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Activeclean_A903_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7841-L7861"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7841-L7861"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e"
logic_hash = "b79d850df65fa7a96642e4a1da2240e001c87d44d64c621c756face489c0eb6b"
score = 40
@@ -318054,8 +318460,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Pr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7864-L7885"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7864-L7885"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa"
hash = "86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675"
logic_hash = "3035342ffaf651efc8de23d2da68540ee7d89b2bf2b5c2925094e7fe2a3f7c28"
@@ -318085,8 +318491,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_1B17_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7888-L7908"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7888-L7908"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b17d12076d047e74d15e6e51e10497ad49419bec7fbe93386c57d3efbaadc0b"
logic_hash = "cd8e28cc91da2da748b449b175c24f7271019fa6e9b475b8689183eb1866c59a"
score = 40
@@ -318115,8 +318521,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_6CF1_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7911-L7930"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7911-L7930"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6cf1cac0e97d30bb445b710fd8513879678a8b07be95d309cbf29e9b328ff259"
logic_hash = "60fcd09b5ad2beef9a28c78590e6a935b5a2818db45175960527285a4a765ea5"
score = 40
@@ -318144,8 +318550,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_EAE5_1 : F
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7933-L7953"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7933-L7953"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eae5c993b250dcc5fee01deeb30045b0e5ee7cf9306ef6edd8c58e4dc743a8ed"
logic_hash = "ea0bb86a2cc5f3349678d9a698e14301207ba1bf6c19f9caf91abd72e7794a8c"
score = 40
@@ -318174,8 +318580,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Pr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7956-L7976"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7956-L7976"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c"
logic_hash = "c4310d622e5861f4c63d9e9c39ee94acbfb35d24a91f50158f1d695d1f0cf254"
score = 40
@@ -318204,8 +318610,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Databaseharborsoftware_Sysinfodetectorxsys_S
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L7979-L7999"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L7979-L7999"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "45e5977b8d5baec776eb2e62a84981a8e46f6ce17947c9a76fa1f955dc547271"
logic_hash = "3c67bbee00427b7f8ed689a5ff83641bad2b62dc685b5155ea81f6dbba4377b0"
score = 40
@@ -318234,8 +318640,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_7048_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8002-L8024"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8002-L8024"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7048d90ed4c83ad52eb9c677f615627b32815066e34230c3b407ebb01279bae6"
hash = "d80714d87529bb0bc7abcc12d768c43a697fbca59741c38fa0b46900da4db30e"
hash = "fed0fe2489ae807913be33827b3b11359652a127e33b64464cc570c05abd0d17"
@@ -318266,8 +318672,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7837_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8027-L8047"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8027-L8047"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408"
logic_hash = "0d0e3e2675e5d6b11369a388a6e7a947e603db2562aefb802c977728419bb667"
score = 40
@@ -318296,8 +318702,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylauncha
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8050-L8070"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8050-L8070"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e505569892551b2ba79d8792badff0a41faea033e8d8f85c3afea33463c70bd9"
logic_hash = "7645c180f10ba31e259cdfa4904c16941ce777412416527c95fa9592ed76da8c"
score = 40
@@ -318326,8 +318732,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Ncrcorporation_Radhwmgrsys_Ncrcorporationhar
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8073-L8093"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8073-L8093"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "df96d844b967d404e58a12fc57487abc24cd3bd1f8417acfe1ce1ee4a0b0b858"
logic_hash = "2194da0b4589893a0884b9a8c0ed5a556b008152b9c03613074892001406fc21"
score = 40
@@ -318356,8 +318762,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternet
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8096-L8116"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8096-L8116"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d"
logic_hash = "e4e6178a894262ed52bd5ee6e0879f54d4cb81ec467f065f0b00d34ac55064b0"
score = 40
@@ -318386,8 +318792,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_BA40_1 : F
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8119-L8139"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8119-L8139"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ba40b1fc798c2f78165e78997b4baf3d99858ee39a372ca6fbc303057793e50d"
logic_hash = "ea4d6b524d8e4229b090890145a02617482c38ae077d5fd9a7fd46fa6e917b1a"
score = 40
@@ -318416,8 +318822,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_828A_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8142-L8162"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8142-L8162"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "828a18b16418c021b6c4aa8c6d54cef4e815efca0d48b9ff14822f9ccb69dff2"
logic_hash = "e5eb524d77c082acac68ea7b24bf10e445dd1afc9be97333980d8a8d580a6e98"
score = 40
@@ -318446,8 +318852,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxusbmonsys_Virtualboxu
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8165-L8185"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8165-L8185"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8a2482e19040d591c7cec5dfc35865596ce0154350b5c4e1c9eecc86e7752145"
logic_hash = "bf3569ba1652fc95c0752a4bf58586ecbe41db63d58ff6326cbd7ef6c2d5b65f"
score = 40
@@ -318476,8 +318882,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Copyright_Advancedmalwareprotection_6F55_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8188-L8207"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8188-L8207"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c"
logic_hash = "4b5b303a3311ec88e1ebad890eb08fe3af13b3c6fdd7cf88421a9f7590661832"
score = 40
@@ -318505,8 +318911,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_0DC4_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8210-L8230"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8210-L8230"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0dc4ff96d7e7db696e0391c5a1dda92a0b0aedbf1b0535bf5d62ebeec5b2311c"
logic_hash = "291aa7d4bd435f112fb6678d8b495d38df94b7a6256d71ac39dd055ab3c94719"
score = 40
@@ -318535,8 +318941,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_EEA5_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8257-L8277"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8257-L8277"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b"
logic_hash = "47bcbc01fc9d12d72613093da34efd44b9d45af700a83450e36aed9fa972ae9b"
score = 40
@@ -318565,8 +318971,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9CA5_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8280-L8300"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8280-L8300"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9ca586b49135166eea00c6f83329a2d134152e0e9423822a51c13394265b6340"
logic_hash = "a666e2b5c53129dc1f82a945d828bb84fc31e54c1c69cc6666222e4b9a45ea39"
score = 40
@@ -318595,8 +319001,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_4E54_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8303-L8323"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8303-L8323"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4e54e98df13110aac41f3207e400cce2a00df29ce18c32186e536c1de25a75ce"
logic_hash = "81a80cb4cdeb79ba7b32cb981c4f6d986fc465a78566aded7d7bf3f06e3e027f"
score = 40
@@ -318625,8 +319031,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_2D2C_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8326-L8346"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8326-L8346"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b"
logic_hash = "991c554b098cc048d925ab989b0ca3950b07fd13e75ddcc0e8d8f4e24f6e58a6"
score = 40
@@ -318655,8 +319061,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_F4EE_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8349-L8369"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8349-L8369"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f4ee803eefdb4eaeedb3024c3516f1f9a202c77f4870d6b74356bbde32b3b560"
logic_hash = "7ad25b1c03c5f7aff57f6ae40fae6232a0649d643a4ccd6ed1eee886bfad7f68"
score = 40
@@ -318685,8 +319091,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5CFA_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8372-L8392"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8372-L8392"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185"
logic_hash = "772f33e1190458ffbe4f6636fc775fea47d4ab242cecc5a77d00ee34de4ecf86"
score = 40
@@ -318715,8 +319121,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8419-L8440"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8419-L8440"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "afda5af5f210336061bff0fab0ed93ee495312bed639ec5db56fbac0ea8247d3"
hash = "b2364c3cf230648dad30952701aef90acfc9891541c7e154e30c9750da213ed1"
logic_hash = "c969121df4f2e873fbff32b00484550a8a80e4fcc0cd093a2c93c566c249977a"
@@ -318746,8 +319152,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxcdiobmpcicp
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8443-L8464"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8443-L8464"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "63865f04c1150655817ed4c9f56ad9f637d41ebd2965b6127fc7c02757a7800e"
hash = "9c8ed1506b3e35f5eea6ac539e286d46ef76ddbfdfc5406390fd2157c762ce91"
logic_hash = "ceae34b4cd1698fc1d779b5860437b1017401c8f954d74804fcdbb13a5603186"
@@ -318777,8 +319183,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_119C_1 : F
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8492-L8512"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8492-L8512"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280"
logic_hash = "1ff636a8954a5f049c582d8436111ffe5a4e89e3f38870c9c8ac9706f0b1acd2"
score = 40
@@ -318807,8 +319213,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_263E_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8515-L8535"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8515-L8535"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24"
logic_hash = "c4a5f4e6908dcf3280adcebb9d8c58fb58be06267b524cb37f15d99091eb4a98"
score = 40
@@ -318837,8 +319243,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_88FB_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8538-L8558"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8538-L8558"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "88fb0a846f52c3b680c695cd349bf56151a53a75a07b8b0b4fe026ab8aa0a9af"
logic_hash = "9c38d3552116177e73a66e56d3f53f8f50ed698a8747cbc59ccbee3cfec0db0d"
score = 40
@@ -318867,8 +319273,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_E839_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8561-L8581"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8561-L8581"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa"
logic_hash = "452a3eeb969ca2a3145b1f525401490911aeec23b29e88395f33dddb693417d0"
score = 40
@@ -318897,8 +319303,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Hilschergesellschaftfrsystemaoutomationmbh_P
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8584-L8604"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8584-L8604"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d"
logic_hash = "64d1a7c9772d6a627bd2cec5c466a2627fa28d4a640ebe7fac5b948a02f1ff2a"
score = 40
@@ -318927,8 +319333,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_4CE8_1 : F
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8607-L8627"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8607-L8627"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4ce8583768720be90fae66eed3b6b4a8c7c64e033be53d4cd98246d6e06086d0"
logic_hash = "65d2d5a1727f55c5a09c2dac5472095b92316eaaabf6356224b175ffe6b7c5a3"
score = 40
@@ -318957,8 +319363,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8630-L8650"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8630-L8650"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a"
logic_hash = "9fc3405f0415b37f348f5a7ea83344a60a9a987acfa844663811e834927f234a"
score = 40
@@ -318987,8 +319393,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_ADA4_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8653-L8673"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8653-L8673"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47"
logic_hash = "d102d9add684a93cec7f05196b3e3ca39ff470df7df1b5fd58001b460c0a2dfc"
score = 40
@@ -319017,8 +319423,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_9B2F_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8676-L8696"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8676-L8696"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285"
logic_hash = "156c30e23f3a22442c635c449290dfcfc5f02fb3b3a0a65f0966306bd1d71f7c"
score = 40
@@ -319047,8 +319453,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Cyreninc_Amp_Cyrenamp_CBB8_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8722-L8742"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8722-L8742"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6"
logic_hash = "79514ed74f7ca8fae3b4a36ae240d325fb70555cb8371e03a498b6fb9992b961"
score = 40
@@ -319077,8 +319483,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Netfiltersdkcom_Lgdcatchersys_Netfiltersdk_0
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8745-L8765"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8745-L8765"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0c42fe45ffa9a9c36c87a7f01510a077da6340ffd86bf8509f02c6939da133c5"
logic_hash = "ca3a99d2b899c907450d0a975db142d391135f70d8f6e42f937e03e2b0c7a9ce"
score = 40
@@ -319107,8 +319513,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Supermicrocomputerinc_Superbmc_Superbmc_F843
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8768-L8788"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8768-L8788"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35"
logic_hash = "a628c561060c20f97c03b11be8c6d475b390d10ee7bf8dff9cc05600d68b8fc8"
score = 40
@@ -319137,8 +319543,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternet
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8791-L8811"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8791-L8811"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4"
logic_hash = "5dd553f7a90a5680d1a250a951e0166a526690dbef5fe431fa37347b3a5f2078"
score = 40
@@ -319167,8 +319573,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8838-L8858"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8838-L8858"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae3a6a0726f667658fc3e3180980609dcb31bdbf833d7cb76ba5d405058d5156"
logic_hash = "7ff6b127fcdbe2a1612d46fccdf23d0fbaa2f6a91a54b718658ebd2d3fea8bce"
score = 40
@@ -319197,8 +319603,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_AD23_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8861-L8881"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8861-L8881"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b"
logic_hash = "8cdd734afe9bdf25157395096e64bfa743e4f17e1bde796269d6b5c875147561"
score = 40
@@ -319227,8 +319633,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkdri
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8884-L8904"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8884-L8904"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6f806a9de79ac2886613c20758546f7e9597db5a20744f7dd82d310b7d6457d0"
logic_hash = "707ec81c9fb679a439f23e97e92c6d08b541cd433bfa4fa4296a664cabb403d0"
score = 40
@@ -319257,8 +319663,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_B205_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8907-L8927"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8907-L8927"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b205835b818d8a50903cf76936fcf8160060762725bd74a523320cfbd091c038"
logic_hash = "8313ea1ab68c635fd99927884741a087ea5d93e3e2d3d3c9171609f17545d3cc"
score = 40
@@ -319287,8 +319693,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Filseclabcorporation_Filnk_Filseclabdynamicd
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8930-L8950"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8930-L8950"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae55a0e93e5ef3948adecf20fa55b0f555dcf40589917a5bfbaa732075f0cc12"
logic_hash = "36e491c2841bb77cfc3c07545a30af7edef940e4f36fffd33f6a35f5d8980c86"
score = 40
@@ -319317,8 +319723,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_CBF7_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8953-L8973"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8953-L8973"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cbf74bed1a4d3d5819b7c50e9d91e5760db1562d8032122edac6f0970f427183"
logic_hash = "4093b8e8e67632b5ee28b0e8843398e3e32c33b6fbb18c68730f4495d4c025ad"
score = 40
@@ -319347,8 +319753,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8976-L8996"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8976-L8996"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a47555d04b375f844073fdcc71e5ccaa1bbb201e24dcdebe2399e055e15c849f"
logic_hash = "212de91b3abdc9948aad64531983df3c75e36ff73e56a6b5e8a488571fc39465"
score = 40
@@ -319377,8 +319783,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_66F8_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L8999-L9019"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L8999-L9019"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "66f8bd2b29763acfbb7423f4c3c9c3af9f3ca4113bd580ab32f6e3ee4a4fc64e"
hash = "7f84f009704bc36f0e97c7be3de90648a5e7c21b4f870e4f210514d4418079a0"
logic_hash = "bb8f360956167a6616fa3449f4dcbc78f938a69c979298d921757c6f1e779601"
@@ -319407,8 +319813,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9022-L9042"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9022-L9042"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "55b5bcbf8fb4e1ce99d201d3903d785888c928aa26e947ce2cdb99eefd0dae03"
logic_hash = "3379ec91998a5850e3181784a43fa669817d2f3930bc790bf7b46857a2393d93"
score = 40
@@ -319437,8 +319843,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Filseclabcorporation_Filwfp_Filseclabfirewal
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9072-L9092"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9072-L9092"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "490cfbb540dcd70b7bff4fdd62e7ed7400bbfebaf5083523d49f7184670f7b9a"
logic_hash = "722b36f80e7c899c75667c989390161a30d1336be397c771174e8753865a6f8c"
score = 40
@@ -319467,8 +319873,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Asrockincorporation_Asrautochkupddrvsys_Asra
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9095-L9115"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9095-L9115"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4ae42c1f11a98dee07a0d7199f611699511f1fb95120fabc4c3c349c485467fe"
logic_hash = "a07a0630526bf3b9d427a83b00269428059e640787a834ff129cdb23b4c4c245"
score = 40
@@ -319497,8 +319903,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_9E34_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9118-L9138"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9118-L9138"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9e3430d5e0e93bc4a5dccc985053912065e65722bfc2eaf431bc1da91410434c"
logic_hash = "d07bb8afe8e9e55d9bbf5c96ab8be6bf1f3b65a08873f8956436b87ad3b826d8"
score = 40
@@ -319527,8 +319933,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_BCFC_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9165-L9185"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9165-L9185"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f"
logic_hash = "10b04a7ca71652632fb836bfb76f6be8b4c1d9e7e6566f623b52a850b3dbebde"
score = 40
@@ -319557,8 +319963,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_DBC6_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9212-L9232"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9212-L9232"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed"
logic_hash = "becd57b696fe37ea0ae1bd83aa1c00258d1a58fd83c80d9772bea625ad0d6afc"
score = 40
@@ -319587,8 +319993,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllac
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9235-L9255"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9235-L9255"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1"
logic_hash = "ae01cd2b9b1c504298c0295fd4f3e54199df371787676f19ba0a3ad9340f0c56"
score = 40
@@ -319617,8 +320023,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_4E37_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9258-L9278"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9258-L9278"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69"
logic_hash = "cd104e4130ef7fcc525a31aacc1180933cd6fe99a7b0c10a54622c512d699364"
score = 40
@@ -319647,8 +320053,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_ECD0_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9281-L9301"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9281-L9301"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566"
logic_hash = "48342828a25e7fdd6dad197bb079d58fc1937b9630f021067a7f197e53c912d9"
score = 40
@@ -319677,8 +320083,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_6701_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9304-L9324"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9304-L9324"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6701433861742c08eb50f1e785962378143ad5b6c374ac29118168599f8a0f1c"
logic_hash = "c6d8f88f83fffed54cd4adf0542a40531765b0cea0e963ed7ad5d646a7901f19"
score = 40
@@ -319707,8 +320113,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystems
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9327-L9347"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9327-L9347"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "00c3e86952eebb113d91d118629077b3370ebc41eeacb419762d2de30a43c09c"
logic_hash = "d5975b9f192b982cb0febc0314e9597f387830e6c1cc4bf0202918ce75c8ca33"
score = 40
@@ -319737,8 +320143,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_36E3_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9374-L9394"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9374-L9394"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289"
logic_hash = "c8c776a3ef3f452b261c7348f0634f9bac7e00f5028eeb56af41461d240a5216"
score = 40
@@ -319767,8 +320173,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_FDA9_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9397-L9417"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9397-L9417"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280"
logic_hash = "2548a054742e55e13e146fa3389c4fb17bdf4e7785bc824e5dd8be7d0cddd75a"
score = 40
@@ -319797,8 +320203,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_6E9E_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9420-L9440"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9420-L9440"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6e9e9e0b9a23deec5f28dc45f0bbe7423565f037f74be2957e82e5f72c886094"
logic_hash = "1a5841556e8589b9fda2167a5ad9c6ac0ec7bb9e9358220ebc18e9675fe6254b"
score = 40
@@ -319827,8 +320233,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_1228_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9443-L9463"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9443-L9463"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1228d0b6b4f907384346f64e918cc28021fe1cd7d4e39687bca34a708998261a"
logic_hash = "6d10896a203562741de37cb97e858a1d70451ad5fc1341ad80d6aa4765b8de9a"
score = 40
@@ -319857,8 +320263,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_D205_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9466-L9486"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9466-L9486"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e"
logic_hash = "8c88f91ab8ff231e4ab6e532b8d71ba810fa62e684dec7fff6b74c4f85a96f65"
score = 40
@@ -319887,8 +320293,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Amifldrvsys_Windowsrw
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9489-L9510"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9489-L9510"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20"
hash = "ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f"
logic_hash = "fb233e5c3cd88ab1450d3371b2f916af9dc8f0b5ffd145e47ad2f0678495b630"
@@ -319918,8 +320324,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Adlicesoftware_Truesight_Truesight_BFC2_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9538-L9558"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9538-L9558"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bfc2ef3b404294fe2fa05a8b71c7f786b58519175b7202a69fe30f45e607ff1c"
logic_hash = "31bf547d77d003653090c31588635255d5983e179146bf53b5624dc3fdcf8422"
score = 40
@@ -319948,8 +320354,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9561-L9581"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9561-L9581"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "87b4c5b7f653b47c9c3bed833f4d65648db22481e9fc54aa4a8c6549fa31712b"
logic_hash = "e1bf0fb9255ba7cd386ac0d51ce1d22ffde535a0064683f2178fac388b6944a0"
score = 40
@@ -319978,8 +320384,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_12ED_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9609-L9629"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9609-L9629"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56"
logic_hash = "9c43c1e37bcc87d616e8d7fa1a610b4d3f28b60d2203d0e466939a41b1a8a7d7"
score = 40
@@ -320008,8 +320414,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_FF1C_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9632-L9652"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9632-L9652"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ff1ccef7374a1a5054a6f4437e3e0504b14ed76e17090cc6b1a4ec0e2da427a5"
logic_hash = "ee97df01a31ceb88274de9890887f6203bee9b173a2034ad4570a9bb92d13dd2"
score = 40
@@ -320038,8 +320444,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_EBE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9655-L9675"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9655-L9675"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3"
logic_hash = "4f671c0023ef9bbb82a3fdd328709bb9c2a579fbef7f0a348b01fd4188ded3d4"
score = 40
@@ -320068,8 +320474,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_CA34_1 : F
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9678-L9697"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9678-L9697"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ca34f945117ec853a713183fa4e8cf85ea0c2c49ca26e73d869fee021f7b491d"
logic_hash = "20276f0c10cef963957e6f868643166567862b89124d96371b80dfe217eab4b6"
score = 40
@@ -320097,8 +320503,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_46D1_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9700-L9723"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9700-L9723"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "46d1dc89cc5fa327e7adf3e3d6d498657240772b85548c17d2e356aac193dd28"
hash = "dafa4459d88a8ab738b003b70953e0780f6b8f09344ce3cd631af70c78310b53"
hash = "4c2d2122ef7a100e1651f2ec50528c0d1a2b8a71c075461f0dc58a1aca36bc61"
@@ -320130,8 +320536,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_1C12_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9750-L9770"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9750-L9770"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687"
logic_hash = "d8f6326a34caddc2c91ac47e57ed022086bea7122203f166cd5e3176c369a3e4"
score = 40
@@ -320160,8 +320566,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_4BC0
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9773-L9793"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9773-L9793"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4"
logic_hash = "1f138a336f979f9a4a75796cdd6cab5716a17f1ded02350db64a6ec618c7a1dd"
score = 40
@@ -320190,8 +320596,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Iobitinformationtechnology_Iobitunlockersys_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9796-L9816"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9796-L9816"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004"
logic_hash = "1a7df58e346f6ae2224163302bbc14815c6d612c1414b59663d3d9f730925499"
score = 40
@@ -320220,8 +320626,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_C190_1 : F
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9819-L9838"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9819-L9838"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c190e4a7f1781ec9fa8c17506b4745a1369dcdf174ce07f85de1a66cf4b5ed8a"
logic_hash = "44017c1fab02aec40335b310646d9760ce4db2da785d08a430442a5afe9d4887"
score = 40
@@ -320249,8 +320655,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Pr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9841-L9861"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9841-L9861"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4"
logic_hash = "beca5e85d2b29d6a37e9d783facf37bb375095ae5d47a8a2eff663afbc22ffc3"
score = 40
@@ -320279,8 +320685,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternet
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9864-L9884"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9864-L9884"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea"
logic_hash = "5c3addc4d27338e1ed76b65327198acef97969b13e6ac8284153fcc1fd992b4d"
score = 40
@@ -320309,8 +320715,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_7337_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9887-L9908"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9887-L9908"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "733789d0a253e8d80cc3240e365b8d4274e510e36007f6e4b5fd13b07b084c3e"
hash = "d1463b7fec911c10a8c96d84eb7c0f9e95fa488d826647a591a38c0593f812a4"
logic_hash = "9f3772548952491a3c20cdecdba491017a7bb7c113360feae778426539e5d9b8"
@@ -320340,8 +320746,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_ADC1_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9911-L9931"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9911-L9931"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee"
logic_hash = "896055705d276e007082616e944be968d90087798e3c4cfcc35c3ecaf3a781b0"
score = 40
@@ -320370,8 +320776,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Sbiosiosys_Samsungrbi
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9934-L9955"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9934-L9955"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1e24c45ce2672ee403db34077c88e8b7d7797d113c6fd161906dce3784da627d"
hash = "39336e2ce105901ab65021d6fdc3932d3d6aab665fe4bd55aa1aa66eb0de32f0"
logic_hash = "d9be90591690481e778ebb8a18c633d7ceccdaafa3989352d94bd1995e3470f4"
@@ -320401,8 +320807,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9958-L9978"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9958-L9978"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5"
logic_hash = "45bd63fd965c9c40b0d687af623f58922c708608a25e58b2c1ad436312e6284d"
score = 40
@@ -320431,8 +320837,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Fujitsulimited_Advdrvsys_Microsoftrwindowsro
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L9981-L10000"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L9981-L10000"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162"
logic_hash = "7b98ca983166c65065b6fe146957ac438426c0ad2566016e0a61ca3be68f163e"
score = 40
@@ -320460,8 +320866,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10003-L10023"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10003-L10023"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5"
logic_hash = "d47eec2132d31ce4f4009456805e7b75e43054edf13c3f056416638cf3928e41"
score = 40
@@ -320490,8 +320896,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxtapsys_Virtualboxhost
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10026-L10046"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10026-L10046"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cfa28e2f624f927d4cbd2952306570d86901d2f24e3d07cc6277e98289d09783"
logic_hash = "1fefb271c505de9c1d08d558a53f8150cb8724b1b97ac2014f30d2c593f05f6b"
score = 40
@@ -320520,8 +320926,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Generalelectriccompany_Gedevicedriver_Profic
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10049-L10070"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10049-L10070"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a369942ce8d4b70ebf664981e12c736ec980dbe5a74585dd826553c4723b1bce"
hash = "ae73dd357e5950face9c956570088f334d18464cd49f00c56420e3d6ff47e8dc"
logic_hash = "e9af30ff414f7c42b656519453924a90be7cf567c5d5ac6c29713d6799a369c1"
@@ -320551,8 +320957,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_85FD_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10073-L10093"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10073-L10093"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "85fdd255c5d7add25fd7cd502221387a5e11f02144753890218dd31a8333a1a3"
logic_hash = "dd2e7c64c1f0139e2c365e8f726e026c66857334dbfd29eda3ebffa483677b5f"
score = 40
@@ -320581,8 +320987,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_7CF7_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10096-L10116"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10096-L10116"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7cf756afcaf2ce4f8fb479fdede152a17eabf4c5c7c329699dab026a4c1d4fd0"
logic_hash = "f6570bb8a690a21b67637f265f36dbe8a3adb63e30c025216c25df73099ad173"
score = 40
@@ -320611,8 +321017,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_77
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10119-L10139"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10119-L10139"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c"
logic_hash = "f59507fdf64c5eca6139f149595b9919704fead73d4e66c93630ca6cf9582a82"
score = 40
@@ -320641,8 +321047,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_B019_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10142-L10162"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10142-L10162"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a"
logic_hash = "1ef6c4c199fad08babe5f4484444c157dfcfea891f392682689cf2df34088179"
score = 40
@@ -320671,8 +321077,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevicesinc_Amdpowerprofilersys_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10165-L10185"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10165-L10185"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05"
logic_hash = "ac1fd75b411624e0f4cd6d455a61e1ac3c08d421182c4f9eb90698ee29eff77a"
score = 40
@@ -320701,8 +321107,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_074A_1 : FI
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10188-L10208"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10188-L10208"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761"
logic_hash = "b76e7a17aa7da3d6a1972a40fbcaa4ca63edb4220b07d807ee54fea649b13a6d"
score = 40
@@ -320731,8 +321137,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_98B7_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10211-L10231"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10211-L10231"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8"
logic_hash = "db97be0a54fc813022a609ffdabe0e0cff306ef894c560f75a43a4aa890590d5"
score = 40
@@ -320761,8 +321167,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_7A2C_1 : F
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10234-L10253"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10234-L10253"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a2cd1dc110d014165c001ce65578da0c0c8d7d41cc1fa44f974e8a82296fc25"
logic_hash = "01badc48c33814577b1a6000b4ff46473b48f85d8f8e8d6071d26b81d3cde22d"
score = 40
@@ -320790,8 +321196,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_9A95_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10256-L10273"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10256-L10273"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c"
logic_hash = "3b699e2afa7e4c4284d725cc159b46a609e4020703bc0efc7ba6563084d67f0e"
score = 40
@@ -320817,8 +321223,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_19BF_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10276-L10296"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10276-L10296"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775"
logic_hash = "b05c520a5816f2dc7a35319f7f5d11001c5d64cdee479e213ac95950acf26bfc"
score = 40
@@ -320847,8 +321253,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_2BBC_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10299-L10316"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10299-L10316"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1"
logic_hash = "d311a2d88741100de1ca65107b08418f0d5a3fc44e4e388faf3434f9fec77dcc"
score = 40
@@ -320874,8 +321280,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Logitechinc_Lvavsys_Logitechwebcamsoftware_E
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10319-L10339"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10319-L10339"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4"
logic_hash = "ffab2936594602db403cd2aa85e7dffdcb10ec199fe857b947ae3214492106d4"
score = 40
@@ -320904,8 +321310,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsy
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10342-L10362"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10342-L10362"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e6d1ee0455068b74cf537388c874acb335382876aa9d74586efb05d6cc362ae5"
logic_hash = "bdd3eb671365ee774f50c3bbffc33aaffb3651f92101a133d1ddcc8b4a495e8f"
score = 40
@@ -320934,8 +321340,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_C505_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10365-L10385"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10365-L10385"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5"
logic_hash = "6174ef1374e0dfd523f7dcdbbdaab1002a95040c1a33f26bf5145d5dcbf87b08"
score = 40
@@ -320964,8 +321370,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_AB8F_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10388-L10408"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10388-L10408"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89"
logic_hash = "9be0907f77c5d4803a1ad7ac79cc42c15807a5b2d43e00a2448c6278ad5ea6c4"
score = 40
@@ -320994,8 +321400,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10411-L10431"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10411-L10431"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1"
logic_hash = "0ac2638aaea5a401222d1451281ba8dba8fe4ef43da24e5eecbdd6d57f7b1dbb"
score = 40
@@ -321024,8 +321430,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Innotekgmbh_Vboxtapsys_Virtualboxhostinterfa
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10434-L10454"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10434-L10454"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "994f322def98c99aec7ea0036ef5f4b802120458782ae3867d116d55215c56e4"
logic_hash = "25e4171bb112adf44101ca24c7d88e8a11a487b3c41d1f9eed29129c5621456b"
score = 40
@@ -321054,8 +321460,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_9254_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10457-L10477"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10457-L10477"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b"
logic_hash = "cfe16d39c54ccb7ceca1e0fc1033a4d67a0bc9c62c27dcefabe07b68b947e688"
score = 40
@@ -321084,8 +321490,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10480-L10500"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10480-L10500"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3af9c376d43321e813057ecd0403e71cafc3302139e2409ab41e254386c33ecb"
logic_hash = "84d9015bf6ddbfcd60052a6ffcf4bfa6a2c2f8748b3b7f21ad65c1c8377dc3cb"
score = 40
@@ -321114,8 +321520,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4429_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10503-L10524"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10503-L10524"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b"
hash = "a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df"
logic_hash = "3dd4326755957e11ca961eb87d0ccae5b63dc7ea4e9dc8e9c67e9c6d52bf894b"
@@ -321145,8 +321551,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_32E1_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10527-L10547"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10527-L10547"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993"
logic_hash = "fd106f69d83d2b1aeb1fdaf16f5809b0fd0d200dec00292efd9bd62422e518a8"
score = 40
@@ -321175,8 +321581,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriververs
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10550-L10570"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10550-L10570"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89"
logic_hash = "910724e7bac9c9c83e703be52e43f4cd88dda344127f2ebc7aee01981467e9e7"
score = 40
@@ -321205,8 +321611,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternet
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10573-L10593"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10573-L10593"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c"
logic_hash = "e565dcf1bdc8ebaf90c1e42bf3e72ce561cb95f5977809fb9082bb430353dd9b"
score = 40
@@ -321235,8 +321641,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoft
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10596-L10616"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10596-L10616"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097"
logic_hash = "2a6f460b66c7e94dfead7bdb3dc46a181ba2e33b40fca1812f0b412daf0a46c4"
score = 40
@@ -321265,8 +321671,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxcdiobmpcicp
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10619-L10640"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10619-L10640"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "05c15a75d183301382a082f6d76bf3ab4c520bf158abca4433d9881134461686"
hash = "4b4ea21da21a1167c00b903c05a4e3af6c514ea3dfe0b5f371f6a06305e1d27f"
logic_hash = "485222f31dbe1e486e86c64b607de6742747b3ab2571adfc8c210205032b380b"
@@ -321296,8 +321702,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_CC68_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10643-L10663"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10643-L10663"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64"
logic_hash = "26f1740a069d238aadb1922512e23184cb3cf34d9ef1ff1b942755a49fbd48b0"
score = 40
@@ -321326,8 +321732,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_A209_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10666-L10686"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10666-L10686"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a2096b460e31451659b0dde752264c362f47254c8191930bc921ff16a4311641"
logic_hash = "33238c8b189c5aabe45b238a44fde02b6f9436329c8700ff5b64505784438e69"
score = 40
@@ -321356,8 +321762,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpudrive
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10689-L10709"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10689-L10709"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980"
logic_hash = "e4bcd8644bcc82c63d9d963aeb9a0a4250d8b3be3fb1122156148f4582fe6d48"
score = 40
@@ -321386,8 +321792,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Proxydrvsys_Nn_0B20_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10712-L10732"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10712-L10732"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b205838a8271daea89656b1ec7c5bb7244c42a8b8000d7697e92095da6b9b94"
logic_hash = "04460d4fa04b60519b0479baab3e07b389dfe255f43b3dcea3d13ca33dc84ded"
score = 40
@@ -321416,8 +321822,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_1DDF_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10735-L10755"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10735-L10755"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219"
logic_hash = "23a5fb0826068df015769d604ff393d7d649b919efabd237a004c6946a358448"
score = 40
@@ -321446,8 +321852,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_654C_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10758-L10778"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10758-L10778"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad"
logic_hash = "f494a64914971b82f191becf020023de1139e5f466e5c1db9912d1d1edbdd0f2"
score = 40
@@ -321476,8 +321882,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternet
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10805-L10825"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10805-L10825"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf"
logic_hash = "79370b21c6049790a259feebf590222ef8c57bb1564401d68a960ae2c547639a"
score = 40
@@ -321506,8 +321912,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternet
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10828-L10848"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10828-L10848"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1"
logic_hash = "7fc1a629395b0558eecf2744dcb121a5b2cdbd51f4291a679f9526f21c4f21c0"
score = 40
@@ -321536,8 +321942,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdri
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10851-L10871"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10851-L10871"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "81d54ebef1716e195955046ffded498a5a7e325bf83e7847893aa3b0b3776d05"
logic_hash = "fc91d46473eecbc49e074df0c05a1dfee352d3607f9393a6836e37a1c071bdf6"
score = 40
@@ -321566,8 +321972,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_EC9B_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10874-L10894"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10874-L10894"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ec9bd7fb90c3a2aa4605bd73fe1f74399e2cda75fd4c5fff84660ad4f797c4fe"
logic_hash = "e16906686623895cf9d6e3c58701f32d44b50b1fe85b95dcf3a8978a62f06a3c"
score = 40
@@ -321596,8 +322002,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_D7C7_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10897-L10917"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10897-L10917"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d7c79238f862b471740aff4cc3982658d1339795e9ec884a8921efe2e547d7c3"
logic_hash = "146b74a7750951a07d2e8b64d25e0c0371fc6295b2ee843cf6a7d67c272555a7"
score = 40
@@ -321626,8 +322032,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorporation_Nvflash_Nvidiaflashdriver_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10920-L10940"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10920-L10940"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508"
logic_hash = "f23537a1efc5e13efb9e145d6c04bb21c3dc7cd49d1913755528f08b94c316ac"
score = 40
@@ -321656,8 +322062,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F85E_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10943-L10963"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10943-L10963"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439"
logic_hash = "71bef9b60efad8f7bc149d93b94c37e59fd42f01ee01d7964c39ef0d79b997e0"
score = 40
@@ -321686,8 +322092,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpub
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10966-L10986"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10966-L10986"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712"
logic_hash = "913dc412be3eaa31903d3fac94e07174789bb746bb382a5f1c08fea50541f6c6"
score = 40
@@ -321716,8 +322122,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3C42_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L10989-L11009"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L10989-L11009"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f"
logic_hash = "b3e67939d8f6e6121c3d36dfe5ccb01c9cd2a2d5488053a9834c7cb147ac250e"
score = 40
@@ -321746,8 +322152,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_55
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11012-L11033"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11012-L11033"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9"
hash = "c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc"
logic_hash = "a6c5fd6c88e08f663479840ae853a0dd22427d0059f0c6aa961dcc1a395dacce"
@@ -321777,8 +322183,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_1AAF_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11060-L11080"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11060-L11080"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b"
logic_hash = "e441204be274ce4379526096008b545e2a53b11c26c270c2df0c1f70b98d1e57"
score = 40
@@ -321807,8 +322213,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11083-L11103"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11083-L11103"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1698ba7eeee6ff9272cc25b242af89190ff23fd9530f21aa8f0f3792412594f3"
logic_hash = "be362e0f19f3565a77b1dbd78ea04f85b7f56fd6889d8fa48ed9ded25134bc2e"
score = 40
@@ -321837,8 +322243,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_C901_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11106-L11126"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11106-L11126"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c"
logic_hash = "2320a0cc02aa28c6495f553b2c7c9c0486599e510d8378dfb3f15b988ff90983"
score = 40
@@ -321867,8 +322273,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Symanteccorporation_Vproeventmonitorsys_Syma
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11129-L11149"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11129-L11149"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca"
logic_hash = "693ace66d01afcdd61fe23a3baa8b950153d38bdc386a43861005654c269cd3d"
score = 40
@@ -321897,8 +322303,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Wj_Kprocesshacker_C725_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11152-L11171"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11152-L11171"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c"
logic_hash = "78c3a92f79cbbc31d9191da527bf834e366454f1b5109600aca7954ca4e77226"
score = 40
@@ -321926,8 +322332,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_7AD0_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11174-L11194"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11174-L11194"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed"
logic_hash = "2cfb950364b5259679e0dcc7ebe34fd6703ae376b5e1717428a88f0c2ba823f5"
score = 40
@@ -321956,8 +322362,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_83A1_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11197-L11217"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11197-L11217"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "83a1fabf782d5f041132d7c7281525f6610207b38f33ff3c5e44eb9444dd0cbc"
logic_hash = "16b76760cc8831b7e53cb5f12625cd1dcd059253aa195d763011ccc1cf48a2c5"
score = 40
@@ -321986,8 +322392,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_C082_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11220-L11240"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11220-L11240"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd"
logic_hash = "de63522d95ff422588d388c3533e268bd09fcf895d60277b7f7470ca7b1e9a33"
score = 40
@@ -322016,8 +322422,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Creativetechnologyinnovationcoltd_Ctiiosys_C
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11243-L11263"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11243-L11263"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109"
logic_hash = "58b715cbea724f7d8f946f613ec35fc3bf29cc34c1e32ebc2910d73092f96d83"
score = 40
@@ -322046,8 +322452,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Ssmartsoftwaresolutionsgmbh_Sysdrvs_Sysdrvs_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11266-L11286"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11266-L11286"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b"
logic_hash = "4d165a6f340f31b18e62ae9f35dd1c5e278217b949e6162119f0e512a262dc38"
score = 40
@@ -322076,8 +322482,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_14A
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11289-L11309"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11289-L11309"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8"
logic_hash = "157a559b87310d33a96c77208afd4ae9ceea23df99417408e413dee0be507dd3"
score = 40
@@ -322106,8 +322512,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrse
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11336-L11356"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11336-L11356"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3"
logic_hash = "5613c77f79128bc7ac3bbe698dcd8be2fca2f59cb60a40ed97f0c80ba9aff690"
score = 40
@@ -322136,8 +322542,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Lowleveldriver_F941_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11359-L11376"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11359-L11376"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f9418b5e90a235339a4a1a889490faca39cd117a51ba4446daa1011da06c7ecd"
logic_hash = "fdc81fdc11ac6db386f4c41c2c34ab9dbd8dd93836a6a91b9412288eca7f0411"
score = 40
@@ -322163,8 +322569,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_37C6_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11379-L11399"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11379-L11399"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9"
logic_hash = "7ab6c3fe4c9cd61c171a71d631a8efc34121bac85e1abf5f281b150f4b6a77a5"
score = 40
@@ -322193,8 +322599,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiosp
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11402-L11422"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11402-L11422"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073"
logic_hash = "ce2da14c74299d4ad3ab5b882de8bfe810444f21711f2417291bd0298a480e71"
score = 40
@@ -322223,8 +322629,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_5439_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11425-L11443"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11425-L11443"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91"
hash = "ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd"
logic_hash = "d43a364d3f39951140fa3b3395f1d74c306558a6c6946f665873e72377345949"
@@ -322251,8 +322657,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Pr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11446-L11466"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11446-L11466"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb"
logic_hash = "7e1f69495559ca298a05ef6fb3817799b09d66013bae574ec585d27ef89b4dcc"
score = 40
@@ -322281,8 +322687,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_DE8F_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11469-L11486"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11469-L11486"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c"
logic_hash = "0cb5b26dd0cd26c77df642ea6bfffdcede293cdb1ecc15430241ab538f835162"
score = 40
@@ -322308,8 +322714,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11489-L11509"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11489-L11509"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0fc0644085f956706ea892563309ba72f0986b7a3d4aa9ae81c1fa1c35e3e2d3"
logic_hash = "be5fef829971251225d9cbb72d173affd394c8cce6116b0b705c4b02409b6096"
score = 40
@@ -322338,8 +322744,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Supermicrocomputerinc_Phymem_Phymem_1963_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11512-L11532"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11512-L11532"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52"
logic_hash = "8f4cdca4c4bc91f216ee3d89093d482d6e56623a159c3eae6debc388cb9d108f"
score = 40
@@ -322368,8 +322774,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Pr
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11535-L11556"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11535-L11556"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1"
hash = "98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb"
logic_hash = "ee91ed74d1577bc881a029a6790de6d41e0b9494bfeeceec4511b3d8b7c5cff2"
@@ -322399,8 +322805,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpub
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11559-L11579"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11559-L11579"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40"
logic_hash = "8611a572b8366722e237d622b3701072f564f13a73dd71899dbde6faeab73ef8"
score = 40
@@ -322429,8 +322835,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11582-L11602"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11582-L11602"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada"
logic_hash = "4f0a6ffa08a2c219e47c6ae13f6cc6914fe7d0dccb0273bf0905dd9a71eb439f"
score = 40
@@ -322459,8 +322865,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Pinduoduoltdcorp_Vboxdrv_Pinduoduosecurevdi_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11605-L11625"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11605-L11625"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4"
logic_hash = "894060011b20c84849499127305d8f1d45621c5893f74d59c9278067a329a4d2"
score = 40
@@ -322489,8 +322895,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_18DE_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11628-L11648"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11628-L11648"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506"
logic_hash = "d01aeb1783377e6067976e6955e63495706c96c8d6c113b393a47e6fe17992f0"
score = 40
@@ -322519,8 +322925,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternet
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11651-L11671"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11651-L11671"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9"
logic_hash = "5bc5d8a6cd02e9a684515ea333084c788353641cb29ff08f18a1066d533cf0ed"
score = 40
@@ -322549,8 +322955,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_D5C
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11674-L11694"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11674-L11694"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9"
logic_hash = "d6ad094f2e26ff574917770a94af31110f2ed68e47ee082ad4adfcd7376679a5"
score = 40
@@ -322579,8 +322985,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Wj_Kprocesshacker_7021_1 : FILE
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11697-L11716"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11697-L11716"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4"
logic_hash = "e5d17a5b57183c3a27815b5b64014e9d95f49129cd451c62380ba8e1b4d25be6"
score = 40
@@ -322608,8 +323014,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_76E8_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11719-L11739"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11719-L11739"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524"
logic_hash = "0a9822cd471bb7fdaab454e824e31e1dcd685f9226c4fa34af4f13dd228dc97b"
score = 40
@@ -322638,8 +323044,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5148_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11742-L11762"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11742-L11762"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "51480eebbbfb684149842c3e19a8ffbd3f71183c017e0c4bc6cf06aacf9c0292"
logic_hash = "b36414a71e9bd69512ef0c702bf4f7b4bfdb812326a67a0e50f6f75f5c89c152"
score = 40
@@ -322668,8 +323074,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_1D03_1
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11765-L11785"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11765-L11785"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8"
logic_hash = "26e886b28b40a920558a652197a0d7a31fc5f7b239d3886fdf0f44da4590dabb"
score = 40
@@ -322698,8 +323104,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternet
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11788-L11808"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11788-L11808"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6"
logic_hash = "9f77c427b54f1a940547cfc206b8d1aed0288d0664a5a124785c7fcec7b90507"
score = 40
@@ -322728,8 +323134,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11811-L11831"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11811-L11831"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b2247e68386c1bdfd48687105c3728ebbad672daffa91b57845b4e49693ffd71"
logic_hash = "e1d35eb3ea6012cf8b742e97f08d797b4fd64bcc72bd7ebccb8ca33f11afad67"
score = 40
@@ -322758,8 +323164,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F69_
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11834-L11854"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11834-L11854"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683"
logic_hash = "0242a0398f90468dfc41eb04570a70d5072fe089b270feb1f5ab7fbd2c7a1ffc"
score = 40
@@ -322788,8 +323194,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_5E3B_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11857-L11877"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11857-L11877"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5e3bc2d7bc56971457d642458563435c7e5c9c3c7c079ef5abeb6a61fb4d52ea"
logic_hash = "893fe9de3a164fd33483d139e76db4c213c402f276bd285c9acefd76da1d2f38"
score = 40
@@ -322818,8 +323224,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotec
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11880-L11900"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11880-L11900"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9dee9c925f7ea84f56d4a2ad4cf9a88c4dac27380887bf9ac73e7c8108066504"
logic_hash = "e7f65896009629498b16fdacd7dcdaafae8336365e621f791e880c108bbab75b"
score = 40
@@ -322848,8 +323254,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9679_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11903-L11923"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11903-L11923"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d"
logic_hash = "fa486cd644c20c827abc8568933d8537c254cff445f2aef520775e119b6db067"
score = 40
@@ -322878,8 +323284,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8137_1 :
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11926-L11946"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11926-L11946"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60"
logic_hash = "cd4ace0ee1000ec8367bdca57423f311d0993d54359e4b3ca6a503738ba07b3b"
score = 40
@@ -322908,8 +323314,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Asmediatechnologyinc_Asmiosys_Asmediapcidriv
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11949-L11969"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11949-L11969"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e4658d93544f69f5cb9aa6d9fec420fecc8750cb57e1e9798da38c139d44f2eb"
logic_hash = "93c9c472f0664eabf5aeba70babe66f974fd79eaf37b65987c396e35faea4d4b"
score = 40
@@ -322938,8 +323344,8 @@ rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_4DA
date = "2024-08-07"
modified = "2024-12-12"
reference = "https://github.com/magicsword-io/LOLDrivers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara-rules_vuln_drivers_strict.yar#L11972-L11992"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara-rules_vuln_drivers_strict.yar#L11972-L11992"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba"
logic_hash = "c8f2c5a171d1a7192a2eaeae0ab70ce97956b93e68db7a41265e54480bd582f1"
score = 40
@@ -322968,8 +323374,8 @@ rule SIGNATURE_BASE_Sedll_Javascript_Decryptor : FILE
date = "2017-10-18"
modified = "2023-01-07"
reference = "https://goo.gl/MZ7dRg"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_leviathan.yar#L11-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_leviathan.yar#L11-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "146aa9a0ec013aa5bdba9ea9d29f59d48d43bc17c6a20b74bb8c521dbb5bc6f4"
logic_hash = "26ef61d8bb1764dddd951526902fb510fbacc8b808fe99ddee1956dc8b59bd1d"
score = 75
@@ -322997,8 +323403,8 @@ rule SIGNATURE_BASE_Leviathan_Cobaltstrike_Sample_1 : FILE
date = "2017-10-18"
modified = "2023-12-05"
reference = "https://goo.gl/MZ7dRg"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_leviathan.yar#L33-L55"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_leviathan.yar#L33-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362"
logic_hash = "9ebc8c2f8ddba302e0fbde69e27986236053a3d31c50cf3a2f979a9ebb90907f"
score = 75
@@ -323029,8 +323435,8 @@ rule SIGNATURE_BASE_Mockdll_Gen : FILE
date = "2017-10-18"
modified = "2023-12-05"
reference = "https://goo.gl/MZ7dRg"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_leviathan.yar#L57-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_leviathan.yar#L57-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bfc5c6817ff2cc4f3cd40f649e10cc9ae1e52139f35fdddbd32cb4d221368922"
hash = "80b931ab1798d7d8a8d63411861cee07e31bb9a68f595f579e11d3817cfc4aca"
logic_hash = "cbe7b816199d251bfdc751f46bd95da6f0447ebd56f564619d24eb08bbd4a2c7"
@@ -323057,8 +323463,8 @@ rule SIGNATURE_BASE_Vbscript_Favicon_File : FILE
date = "2017-10-18"
modified = "2023-01-06"
reference = "https://goo.gl/MZ7dRg"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_leviathan.yar#L77-L96"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_leviathan.yar#L77-L96"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "39c952c7e14b6be5a9cb1be3f05eafa22e1115806e927f4e2dc85d609bc0eb36"
logic_hash = "5b89ea916adf6864c8b1cb7cd7ee6d74ea47bf17a0b03cc513046f8d260ae376"
score = 75
@@ -323084,8 +323490,8 @@ rule SIGNATURE_BASE_MAL_DNSPIONAGE_Malware_Nov18 : FILE
date = "2018-11-30"
modified = "2023-01-06"
reference = "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dnspionage.yar#L2-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dnspionage.yar#L2-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec"
hash = "45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff"
logic_hash = "c7f148b790c391283ac833236ad7fd3af7af517098adeaf88b8ee8d95df11487"
@@ -323112,8 +323518,8 @@ rule SIGNATURE_BASE_APT_Dnspionage_Karkoff_Malware_Apr19_1 : FILE
date = "2019-04-24"
modified = "2023-12-05"
reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dnspionage.yar#L23-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dnspionage.yar#L23-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11"
hash = "b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04"
hash = "5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c"
@@ -323144,8 +323550,8 @@ rule SIGNATURE_BASE_APT_UNC1151_Windowsinstaller_Silent_Installproduct_Macrometh
date = "2021-07-28"
modified = "2023-12-05"
reference = "Thttps://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc1151_ua.yar#L1-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc1151_ua.yar#L1-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1561ece482c78a2d587b66c8eaf211e806ff438e506fcef8f14ae367db82d9b3"
hash = "a8fd0a5de66fa39056c0ddf2ec74ccd38b2ede147afa602aba00a3f0b55a88e0"
logic_hash = "aec1bb992061fdf1abf5c1a61cf9ec9e54c1f13be36ceb84890b058ade273b70"
@@ -323171,8 +323577,8 @@ rule SIGNATURE_BASE_SUSP_Doc_Windowsinstaller_Call_Feb22_1 : FILE
date = "2022-02-26"
modified = "2023-12-05"
reference = "https://twitter.com/threatinsight/status/1497355737844133895"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_maldoc.yar#L1-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_maldoc.yar#L1-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "279182487ab7d35264adfbd0d122ee7634cd92ae1711de78ec7f20928df34f49"
score = 65
quality = 85
@@ -323196,8 +323602,8 @@ rule SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1 : FILE
date = "2022-09-17"
modified = "2023-12-05"
reference = "https://twitter.com/cglyer/status/1570965878480719873"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_stealer_exfil_zip.yar#L2-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_stealer_exfil_zip.yar#L2-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ce14c6b720281f43c75ce52e23ec13d08e7b2be1c5fbc2d704238f1fdd1a07f"
hash = "011c19d18fa446a2619b3a2512dacb2694e1da99a2c2ea7828769f1373ecd8fe"
hash = "418530bc7210f74ada8e7f16b41ea2033054e99f0c4423ce1d3ebf973c89e3a3"
@@ -323231,8 +323637,8 @@ rule SIGNATURE_BASE_LNK_Malicious_Nov1 : FILE
date = "2017-11-06"
modified = "2023-12-05"
reference = "https://www.virustotal.com/en/file/ee069edc46a18698fa99b6d2204895e6a516af1a306ea986a798b178f289ecd6/analysis/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mal_link.yar#L2-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mal_link.yar#L2-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a1aa29497a0e4741807e3d74d54be69061aed21524c5f901615bd21e2ef13c67"
score = 60
quality = 81
@@ -323262,8 +323668,8 @@ rule SIGNATURE_BASE_Seaduke_Sample : FILE
date = "2015-07-14"
modified = "2023-12-05"
reference = "http://goo.gl/MJ0c2M"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_seaduke_unit42.yar#L10-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_seaduke_unit42.yar#L10-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d2e570129a12a47231a1ecb8176fa88a1bf415c51dabd885c513d98b15f75d4e"
logic_hash = "3bec2bedaafddd17ee65747f8be773287eda784bdfa8fc11e8378737139ef94e"
score = 70
@@ -323290,8 +323696,8 @@ rule SIGNATURE_BASE_MAL_RTF_Embedded_OLE_PE : FILE
date = "2018-01-22"
modified = "2023-11-25"
reference = "https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_strings_in_ole.yar#L2-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_strings_in_ole.yar#L2-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "054abb34ae84e02469d726809a6d8aa582ebad65dd8385de7800d3f5db7ee31c"
score = 65
quality = 85
@@ -323318,8 +323724,8 @@ rule SIGNATURE_BASE_Flash_CVE_2015_5119_APT3_Leg : CVE_2015_5119 FILE
date = "2015-08-01"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2015_5119.yar#L2-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2015_5119.yar#L2-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "99af6b9ecc18b87b14968eb8fffefac7be10dd727d8af2d0488fae4a96196e85"
score = 70
quality = 85
@@ -323348,8 +323754,8 @@ rule SIGNATURE_BASE_Stuxnet_Malware_1
date = "2016-07-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stuxnet.yar#L10-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stuxnet.yar#L10-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9c891edb5da763398969b6aaa86a5d46971bd28a455b20c2067cb512c9f9a0f8"
logic_hash = "8caa6bddef3c05e572ef342513190832900dcb1a7a56589ed7df48b3c6992ed1"
score = 75
@@ -323374,8 +323780,8 @@ rule SIGNATURE_BASE_Stuxnet_Malware_2 : FILE
date = "2016-07-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stuxnet.yar#L43-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stuxnet.yar#L43-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802"
logic_hash = "ecf992f8fd38b1ab3e05bfe05f260bcaf617f168484477aa81acb9b517b9f3e7"
score = 75
@@ -323399,8 +323805,8 @@ rule SIGNATURE_BASE_Stuxnet_Dll : FILE
date = "2016-07-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stuxnet.yar#L59-L72"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stuxnet.yar#L59-L72"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9e392277f62206098cf794ddebafd2817483cfd57ec03c2e05e7c3c81e72f562"
logic_hash = "0c192153c268fdd330d3b9e2eb0d8383bd50ce6d036409f0cc0c9273ba8201b3"
score = 75
@@ -323423,8 +323829,8 @@ rule SIGNATURE_BASE_Stuxnet_Shortcut_To : FILE
date = "2016-07-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stuxnet.yar#L74-L87"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stuxnet.yar#L74-L87"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "801e3b6d84862163a735502f93b9663be53ccbdd7f12b0707336fecba3a829a2"
logic_hash = "a8119500d38bcfc60620265386f31899e586f62e1ceeeff365fd0018ab39c30e"
score = 75
@@ -323447,8 +323853,8 @@ rule SIGNATURE_BASE_Stuxnet_Malware_3 : FILE
date = "2016-07-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stuxnet.yar#L89-L110"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stuxnet.yar#L89-L110"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6bcf88251c876ef00b2f32cf97456a3e306c2a263d487b0a50216c6e3cc07c6a"
hash = "70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b"
logic_hash = "d8c546fb74b419d46bab855fa07a55833ab0a23eb4081ce24a5d4ab0e4bf09dc"
@@ -323478,8 +323884,8 @@ rule SIGNATURE_BASE_Stuxnet_Malware_4 : FILE
date = "2016-07-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stuxnet.yar#L112-L128"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stuxnet.yar#L112-L128"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198"
hash = "1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c"
logic_hash = "a4ad77490d17cf897c4639f0b9f9473267886e99a94b4f506670207497117764"
@@ -323505,8 +323911,8 @@ rule SIGNATURE_BASE_Stuxnet_Maindll_Decrypted_Unpacked
date = "2016-07-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stuxnet.yar#L130-L150"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stuxnet.yar#L130-L150"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4c3d7b38339d7b8adf73eaf85f0eb9fab4420585c6ab6950ebd360428af11712"
logic_hash = "bec740cdb4c1748d0fb546691cf8feb38c0e61adad60c069c5866f5034cb7ed9"
score = 75
@@ -323536,8 +323942,8 @@ rule SIGNATURE_BASE_Stuxnet_S7Hkimdb : FILE
date = "2016-07-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stuxnet.yar#L152-L188"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stuxnet.yar#L152-L188"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4071ec265a44d1f0d42ff92b2fa0b30aafa7f6bb2160ed1d0d5372d70ac654bd"
logic_hash = "a44063b6a542eca17f46802e9f644540f1d6b6cb9777c20ef9ea14e44c341a1c"
score = 75
@@ -323563,8 +323969,8 @@ rule SIGNATURE_BASE_Bytes_Used_In_AES_Key_Generation : FILE
date = "2018-04-06"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ncsc_report_04_2018.yar#L9-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ncsc_report_04_2018.yar#L9-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
logic_hash = "221f5ea0a0224a96588912e7ddfbafd20b0b10c119395ca14d1138c284d7b79e"
score = 75
@@ -323586,8 +323992,8 @@ rule SIGNATURE_BASE_Partial_Implant_ID : FILE
date = "2018-04-06"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ncsc_report_04_2018.yar#L24-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ncsc_report_04_2018.yar#L24-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
logic_hash = "d0a29bed3c19007cb08427769918b0a02d5d247211a1ceaff31aed5839c78966"
score = 75
@@ -323609,8 +324015,8 @@ rule SIGNATURE_BASE_Sleep_Timer_Choice : FILE
date = "2018-04-06"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ncsc_report_04_2018.yar#L39-L52"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ncsc_report_04_2018.yar#L39-L52"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
logic_hash = "5d2b656aabb113c50805d4af0faa62f579547dd4ec328ff2778fab64d778b8b9"
score = 75
@@ -323632,8 +324038,8 @@ rule SIGNATURE_BASE_User_Function_String
date = "2018-04-06"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ncsc_report_04_2018.yar#L54-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ncsc_report_04_2018.yar#L54-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
logic_hash = "04821d1d5c12b5a9aca3c5b4be9f7a7d35320ad1503ccbdadebc7710c613a976"
score = 75
@@ -323659,8 +324065,8 @@ rule SIGNATURE_BASE_Generic_Shellcode_Downloader_Specific : FILE
date = "2018-04-06"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ncsc_report_04_2018.yar#L73-L89"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ncsc_report_04_2018.yar#L73-L89"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b8bc0611a7fd321d2483a0a9a505251e15c22402e0cfdc62c0258af53ed3658a"
logic_hash = "9315ad03b5a28030c32fea5547db3ae421a1ebdae0b96a8a4c2f92660c41bc40"
score = 75
@@ -323686,8 +324092,8 @@ rule SIGNATURE_BASE_Batch_Script_To_Run_Psexec
date = "2018-04-06"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ncsc_report_04_2018.yar#L91-L107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ncsc_report_04_2018.yar#L91-L107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b7d7c4bc8f9fd0e461425747122a431f93062358ed36ce281147998575ee1a18"
logic_hash = "9bdaa14aa535c178914f83c12b23484162f085c6fc6041d379268546ee99f462"
score = 75
@@ -323713,8 +324119,8 @@ rule SIGNATURE_BASE_Batch_Powershell_Invoke_Inveigh
date = "2018-04-06"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ncsc_report_04_2018.yar#L109-L124"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ncsc_report_04_2018.yar#L109-L124"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0a6b1b29496d4514f6485e78680ec4cd0296ef4d21862d8bf363900a4f8e3fd2"
logic_hash = "5048a180df301707622e9ad0b949da9e39d2f55f16fc43e7344a8181596a836c"
score = 75
@@ -323739,8 +324145,8 @@ rule SIGNATURE_BASE_Lnk_Detect : FILE
date = "2018-04-06"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ncsc_report_04_2018.yar#L126-L149"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ncsc_report_04_2018.yar#L126-L149"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ae8796877d70f8ddd56bac8ed474231f26d9bc8e73625e65d5d927ab804996b3"
score = 75
quality = 85
@@ -323771,8 +324177,8 @@ rule SIGNATURE_BASE_RDP_Brute_Strings
date = "2018-04-06"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ncsc_report_04_2018.yar#L151-L174"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ncsc_report_04_2018.yar#L151-L174"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8234bf8a1b53efd2a452780a69666d1aedcec9eb1bb714769283ccc2c2bdcc65"
logic_hash = "80c51d82a57271409d298b5175505c4234a6c3ec8a8763c93b669d1f0a8d59ba"
score = 75
@@ -323806,8 +324212,8 @@ rule SIGNATURE_BASE_WEBSHELL_Z_Webshell_1
modified = "2023-12-05"
old_rule_name = "Z_WebShell"
reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ncsc_report_04_2018.yar#L176-L192"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ncsc_report_04_2018.yar#L176-L192"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ace12552f3a980f1eed4cadb02afe1bfb851cafc8e58fb130e1329719a07dbf0"
logic_hash = "1dfc546a7493c1443527ebe74ed8cd2b06ee032b9a3f736b830e16288e616d43"
score = 75
@@ -323833,8 +324239,8 @@ rule SIGNATURE_BASE_Sofacy_Campaign_Mal_Feb18_Cdnver : FILE
date = "2018-02-07"
modified = "2023-12-05"
reference = "https://twitter.com/ClearskySec/status/960924755355369472"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy.yar#L4-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy.yar#L4-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8"
logic_hash = "cd3fa21710054a96cc85da13d98e0882deaa574708c833349638b57b6088131c"
score = 75
@@ -323864,8 +324270,8 @@ rule SIGNATURE_BASE_Sofacy_Trojan_Loader_Feb18_1 : FILE
date = "2018-03-01"
modified = "2023-12-05"
reference = "https://www.reverse.it/sample/e3399d4802f9e6d6d539e3ae57e7ea9a54610a7c4155a6541df8e94d67af086e?environmentId=100"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy.yar#L29-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy.yar#L29-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "335565711db93cd02d948f472c51598be4d62d60f70f25a20449c07eae36c8c5"
logic_hash = "b1946af23fa0de69f5631a66fa211dab5d8731b5afdb23898428842232752e77"
score = 75
@@ -323892,8 +324298,8 @@ rule SIGNATURE_BASE_APT_ATP28_Sofacy_Indicators_May19_1 : FILE
date = "2019-05-18"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1129647994603790338"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy.yar#L53-L78"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy.yar#L53-L78"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "80548416ffb3d156d3ad332718ed322ef54b8e7b2cc77a7c5457af57f51d987a"
hash = "b40909ac0b70b7bd82465dfc7761a6b4e0df55b894dd42290e3f72cb4280fa44"
logic_hash = "4e3530f540cc66e99b82bd88887943c8e524d4d750734058d9a7b27f76bc6871"
@@ -323922,8 +324328,8 @@ rule SIGNATURE_BASE_Monsoon_APT_Malware_1 : FILE
date = "2017-09-08"
modified = "2023-01-06"
reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_monsoon.yar#L14-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_monsoon.yar#L14-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c9642f44d33e4c990066ce6fa0b0956ff5ace6534b64160004df31b9b690c9cd"
logic_hash = "76580f999d445f4baace5287a3038e294f8be3783289d6c7c5b2c0c92c39db86"
score = 75
@@ -323947,8 +324353,8 @@ rule SIGNATURE_BASE_Monsoon_APT_Malware_2 : FILE
date = "2017-09-08"
modified = "2023-12-05"
reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_monsoon.yar#L37-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_monsoon.yar#L37-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17c3d0fe08e1184c9737144fa065f4530def30d6591e5414a36463609f9aa53a"
hash = "8e0574ebf3dc640ac82987ab6ee2a02fc3dd5eaf4f6b5275272ba887acd15ac0"
hash = "bf93ca5f497fc7f38533d37fd4c083523ececc34aa2d3660d81014c0d9091ae3"
@@ -323982,8 +324388,8 @@ rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1 : FILE
date = "2022-02-24"
modified = "2023-12-05"
reference = "https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ua_hermetic_wiper.yar#L2-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ua_hermetic_wiper.yar#L2-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da"
hash = "3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767"
hash = "2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf"
@@ -324025,8 +324431,8 @@ rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
date = "2022-02-25"
modified = "2023-12-05"
reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ua_hermetic_wiper.yar#L40-L70"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ua_hermetic_wiper.yar#L40-L70"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5e917618a5172c68b4b32ba9e63402c2a98ccb027276b317ec169a4fef219de1"
score = 75
quality = 85
@@ -324059,8 +324465,8 @@ rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
date = "2022-02-25"
modified = "2023-12-05"
reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ua_hermetic_wiper.yar#L72-L88"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ua_hermetic_wiper.yar#L72-L88"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "56368ba1c97fe3455312b6ee86dcd1a21677f7dfa3836e76ada4b236a5b2c171"
score = 85
quality = 85
@@ -324084,8 +324490,8 @@ rule SIGNATURE_BASE_APT_Equation_Group_Op_Triangulation_Triangledb_Implant_Jun23
date = "2023-06-21"
modified = "2023-12-05"
reference = "https://securelist.com/triangledb-triangulation-implant/110050/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_triangulation_jun23.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_triangulation_jun23.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "486b19ddb8b182dbba882359f7eb416735e76f9cda5aea1b290fb5c6b44960c5"
score = 80
quality = 85
@@ -324109,12 +324515,12 @@ rule SIGNATURE_BASE_Persistence_Agent_Macos : FILE
date = "2018-02-24"
modified = "2023-12-05"
reference = "https://ghostbin.com/paste/mz5nf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_osx_pyagent_persistence.yar#L1-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_osx_pyagent_persistence.yar#L1-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"
logic_hash = "2613fcb32cbdbb24df6c48fcb5d16549783e50246d2cdb8c473375644dd88254"
score = 75
- quality = 58
+ quality = 83
tags = "FILE"
strings:
@@ -324142,8 +324548,8 @@ rule SIGNATURE_BASE_Invoke_Mimikittenz : FILE
date = "2016-07-19"
modified = "2023-12-05"
reference = "https://github.com/putterpanda/mimikittenz"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimikittenz.yar#L10-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimikittenz.yar#L10-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "14e2f70470396a18c27debb419a4f4063c2ad5b6976f429d47f55e31066a5e6a"
logic_hash = "f0410a0290d09d3574854b55ffe578f6f799368e14677b581cd65d18700a8656"
score = 90
@@ -324170,8 +324576,8 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Pipe_Backdoor : FILE
date = "2016-08-08"
modified = "2023-12-05"
reference = "https://securelist.com/blog/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron.yara#L4-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron.yara#L4-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "72f6c6fa65f15e4bab18a0f9d5b5b2f571b21d70c7ff306020784ce604a2e0a5"
score = 75
quality = 85
@@ -324198,8 +324604,8 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_LSA : FILE
date = "2016-08-08"
modified = "2023-12-05"
reference = "https://securelist.com/blog/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron.yara#L23-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron.yara#L23-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "aaeee77b596e304836e23241fdc602d0ffed3379b386724210859c84033ac2b5"
score = 75
quality = 60
@@ -324228,8 +324634,8 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_SSPI : FILE
date = "2016-08-08"
modified = "2023-12-05"
reference = "https://securelist.com/blog/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron.yara#L49-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron.yara#L49-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "99d7444ffc45076e97ac3f5c9909ae26a927bbdcfef274d12d162c59e8113d65"
score = 75
quality = 60
@@ -324248,8 +324654,8 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Mytrampoline : FILE
date = "2016-08-08"
modified = "2023-12-05"
reference = "https://securelist.com/blog/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron.yara#L65-L83"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron.yara#L65-L83"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0bd98815fbf6e82cf477e4f4f98360a4c132b2b21e2e5991f6c10903bd4df52b"
score = 75
quality = 85
@@ -324276,8 +324682,8 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_Container : FILE
date = "2016-08-08"
modified = "2023-12-05"
reference = "https://securelist.com/blog/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron.yara#L85-L103"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron.yara#L85-L103"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9b36f2f1161fd2ff856db520efca8648892656b7a2587dce1a7445af4fbba013"
score = 75
quality = 60
@@ -324300,8 +324706,8 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Encryption : FILE
date = "2016-08-08"
modified = "2023-12-05"
reference = "https://securelist.com/blog/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron.yara#L105-L123"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron.yara#L105-L123"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ae3a681b0cf9ed93d25fa35982daab48c460ba9737eb643ba28a972ea3a7b401"
score = 75
quality = 85
@@ -324325,8 +324731,8 @@ rule SIGNATURE_BASE_Apt_Projectsauron_Generic_Pipe_Backdoor : FILE
date = "2016-08-08"
modified = "2023-12-05"
reference = "https://securelist.com/blog/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_sauron.yara#L125-L144"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_sauron.yara#L125-L144"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ec8a311ec1bd98532c278f72c77e58edb5890db940046dfcd14adf1495e9de1e"
score = 75
quality = 83
@@ -324352,8 +324758,8 @@ rule SIGNATURE_BASE_SUSP_Qakbot_Uninstaller_Shellcode_Aug23
date = "2023-08-30"
modified = "2023-12-05"
reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_qakbot_uninstaller.yar#L2-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_qakbot_uninstaller.yar#L2-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "91d26c50bf29517aa68e709ca3b6f32f4ca390f4c2f48e48cd251bfdd5dbcc71"
score = 60
quality = 85
@@ -324374,8 +324780,8 @@ rule SIGNATURE_BASE_SUSP_Qakbot_Uninstaller_FBI_Aug23
date = "2023-08-31"
modified = "2023-12-05"
reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_qakbot_uninstaller.yar#L16-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_qakbot_uninstaller.yar#L16-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "559cae635f0d870652b9482ef436b31d4bb1a5a0f51750836f328d749291d0b6"
hash = "855eb5481f77dde5ad8fa6e9d953d4aebc280dddf9461144b16ed62817cc5071"
hash = "fab408536aa37c4abc8be97ab9c1f86cb33b63923d423fdc2859eb9d63fa8ea0"
@@ -324402,8 +324808,8 @@ rule SIGNATURE_BASE_EXPL_Manageengine_CVE_2022_47966_Jan23_1
date = "2023-01-13"
modified = "2023-12-05"
reference = "https://www.horizon3.ai/manageengine-cve-2022-47966-iocs/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_manageengine_jan23.yar#L2-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_manageengine_jan23.yar#L2-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a62064e4f12632ba6c14cbbd9369ee919536334f19021a177c126b5dff7e568c"
score = 75
quality = 85
@@ -324424,8 +324830,8 @@ rule SIGNATURE_BASE_CVE_2015_1701_Taihou : CVE_2015_1701 FILE
date = "2015-05-13"
modified = "2023-12-05"
reference = "http://goo.gl/W4nU0q"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2015_1701.yar#L2-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2015_1701.yar#L2-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "90d17ebd75ce7ff4f15b2df951572653efe2ea17"
hash = "acf181d6c2c43356e92d4ee7592700fa01e30ffb"
hash = "b8aabe12502f7d55ae332905acee80a10e3bc399"
@@ -324459,8 +324865,8 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Rel : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_putterpanda.yar#L1-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_putterpanda.yar#L1-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5367e183df155e3133d916f7080ef973f7741d34"
logic_hash = "f2ffab73993c578f47e17babc2e65301b3720e438b33e57f2af31b7183bfd20f"
score = 70
@@ -324494,8 +324900,8 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Rel_2 : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_putterpanda.yar#L30-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_putterpanda.yar#L30-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f97e01ee04970d1fc4d988a9e9f0f223ef2a6381"
logic_hash = "60a48288cb106135728fb676ecad2b9be5254d5dc5094da158ea9dc07704c9ab"
score = 70
@@ -324533,8 +324939,8 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_PSAPI : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_putterpanda.yar#L61-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_putterpanda.yar#L61-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f93a7945a33145bb6c106a51f08d8f44eab1cdf5"
logic_hash = "b73f1db2ca8a3164562314ebd9903c864eb2690c95731959df0e99656544ed40"
score = 70
@@ -324561,8 +324967,8 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_WUAUCLT
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_putterpanda.yar#L81-L108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_putterpanda.yar#L81-L108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fd5ca5a2d444865fa8320337467313e4026b9f78"
logic_hash = "49cae3b727d6b2673dc9a6497d59c9abdd78d486e1eaf6f036f6eb1aef9a8fcb"
score = 70
@@ -324596,8 +325002,8 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Gen1 : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "not set"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_putterpanda.yar#L110-L131"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_putterpanda.yar#L110-L131"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bf1d385e637326a63c4d2f253dc211e6a5436b6a"
hash = "76459bcbe072f9c29bb9703bc72c7cd46a692796"
hash = "e105a7a3a011275002aec4b930c722e6a7ef52ad"
@@ -324628,8 +325034,8 @@ rule SIGNATURE_BASE_Malware_Msupdater_String_In_EXE : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_putterpanda.yar#L133-L156"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_putterpanda.yar#L133-L156"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b1a2043b7658af4d4c9395fa77fde18ccaf549bb"
logic_hash = "2b7a43aee6dbac1bfa7d9e0331cb078394ae78a1ec44c1a4a70a63b38595abe0"
score = 50
@@ -324659,8 +325065,8 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_3 : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_putterpanda.yar#L158-L175"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_putterpanda.yar#L158-L175"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "464149ff23f9c7f4ab2f5cadb76a4f41f969bed0"
logic_hash = "09e7da7f2bfbae9252502ea1ea61b612c1af2e4c70508b34e685b46429d4613c"
score = 70
@@ -324686,8 +325092,8 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_1 : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_putterpanda.yar#L177-L200"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_putterpanda.yar#L177-L200"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b55072b67543f58c096571c841a560c53d72f01a"
logic_hash = "038be28609df0187cbbce0d16fee7c902b742458f1201ff3c0d5fde19acd2c56"
score = 70
@@ -324717,8 +325123,8 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_2 : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_putterpanda.yar#L202-L236"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_putterpanda.yar#L202-L236"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "365b5537e3495f8ecfabe2597399b1f1226879b1"
logic_hash = "47d75e589d47a39d5a9c9e0047a143074d3d74b5541adf8cb3be968da732a96d"
score = 70
@@ -324761,8 +325167,8 @@ rule SIGNATURE_BASE_APT_Malware_Putterpanda_Gen4 : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_putterpanda.yar#L238-L276"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_putterpanda.yar#L238-L276"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "71a8378fa8e06bcf8ee9f019c807c6bfc58dca0c"
hash = "8fdd6e5ed9d69d560b6fdd5910f80e0914893552"
hash = "3c4a762175326b37035a9192a981f7f4cc2aa5f0"
@@ -324803,8 +325209,8 @@ rule SIGNATURE_BASE_Uboatrat : FILE
date = "2017-11-29"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_uboat_rat.yar#L9-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_uboat_rat.yar#L9-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "04873dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e232c9b"
hash = "7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd8add1"
hash = "42d8a84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b0edac"
@@ -324842,8 +325248,8 @@ rule SIGNATURE_BASE_Uboatrat_Dropper : FILE
date = "2017-11-29"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_uboat_rat.yar#L52-L69"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_uboat_rat.yar#L52-L69"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3"
logic_hash = "6f8dcc8559fa0ab1644ef6bab9bc875f3d62391c157b373e0355ad03d35e5601"
score = 75
@@ -324870,8 +325276,8 @@ rule SIGNATURE_BASE_MAL_Avemaria_RAT_Jul19 : FILE
date = "2019-07-01"
modified = "2023-12-05"
reference = "https://twitter.com/abuse_ch/status/1145697917161934856"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_avemaria_rat.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_avemaria_rat.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5a927db1566468f23803746ba0ccc9235c79ca8672b1444822631ddbf2651a59"
logic_hash = "a848ec579db6a07faeab5c855a56889b4bfeaa2958d0388f7fe8c6dcdea7e457"
score = 75
@@ -324895,8 +325301,8 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_1 : FILE
date = "2019-10-02"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_trickbot.yar#L3-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_trickbot.yar#L3-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
hash = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
hash = "9d6e4ad7f84d025bbe9f95e74542e7d9f79e054f6dcd7b37296f01e7edd2abae"
@@ -324924,8 +325330,8 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_2 : FILE
date = "2019-10-02"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_trickbot.yar#L24-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_trickbot.yar#L24-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
hash = "d75561a744e3ed45dfbf25fe7c120bd24c38138ac469fd02e383dd455a540334"
logic_hash = "185e59c156218b418bec0c94144b19639c17e3a9595d993e3761eae15379f9fb"
@@ -324950,8 +325356,8 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_3 : FILE
date = "2019-10-02"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_trickbot.yar#L40-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_trickbot.yar#L40-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "25a4ae2a1ce6dbe7da4ba1e2559caa7ed080762cf52dba6c8b55450852135504"
hash = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
hash = "d75561a744e3ed45dfbf25fe7c120bd24c38138ac469fd02e383dd455a540334"
@@ -324977,8 +325383,8 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_4 : FILE
date = "2019-10-02"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_trickbot.yar#L58-L77"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_trickbot.yar#L58-L77"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "25a4ae2a1ce6dbe7da4ba1e2559caa7ed080762cf52dba6c8b55450852135504"
hash = "e92dd00b092b435420f0996e4f557023fe1436110a11f0f61fbb628b959aac99"
hash = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
@@ -325007,8 +325413,8 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_5 : FILE
date = "2019-10-02"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_trickbot.yar#L79-L96"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_trickbot.yar#L79-L96"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
hash = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
hash = "9ecc794ec77ce937e8c835d837ca7f0548ef695090543ed83a7adbc07da9f536"
@@ -325035,8 +325441,8 @@ rule SIGNATURE_BASE_MAL_Trickbot_Oct19_6 : FILE
date = "2019-10-02"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_trickbot.yar#L98-L115"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_trickbot.yar#L98-L115"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
hash = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
logic_hash = "599b1f56483f4ea267595b90dd4ef93b7e2147e4a0d8449cdd9d2539a96c3f79"
@@ -325062,8 +325468,8 @@ rule SIGNATURE_BASE_EXP_Libre_Office_CVE_2018_16858 : CVE_2018_16858 FILE
date = "2019-02-01"
modified = "2023-12-05"
reference = "https://insert-script.blogspot.com/2019/02/libreoffice-cve-2018-16858-remote-code.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2018_16858.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2018_16858.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "95a02b70c117947ff989e3e00868c2185142df9be751a3fefe21f18fa16a1a6f"
logic_hash = "6dd34350f24945ba5a594acae96dc00bb200841a645443a70a59006cea1db949"
score = 75
@@ -325087,8 +325493,8 @@ rule SIGNATURE_BASE_HKTL_Keyword_Injectdll : FILE
date = "2019-04-04"
modified = "2023-12-05"
reference = "https://github.com/zerosum0x0/koadic"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_hacktool.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_hacktool.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2e7b4141e1872857904a0ef2d87535fd913cbdd9f964421f521b5a228a492a29"
logic_hash = "51c54026672e9ad36d2d68ae8dba61437f8808fbf2ad3c3c7bb086d8abb63987"
score = 60
@@ -325111,8 +325517,8 @@ rule SIGNATURE_BASE_HKTL_Python_Sectools
date = "2023-01-27"
modified = "2023-12-05"
reference = "https://github.com/p0dalirius/sectools"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_hacktool.yar#L18-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_hacktool.yar#L18-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "814ba1aa62bbb7aba886edae0f4ac5370818de15ca22a52a6ab667b4e93abf84"
hash = "b3328ac397d311e6eb79f0a5b9da155c4d1987e0d67487ea681ea59d93641d9e"
hash = "8cd205d5380278cff6673520439057e78fb8bf3d2b1c3c9be8463e949e5be4a1"
@@ -325138,8 +325544,8 @@ rule SIGNATURE_BASE_MAL_UNC2891_Slapstick : FILE
date = "2022-03-30"
modified = "2023-01-05"
reference = "https://github.com/fboldewin/YARA-rules/tree/master"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc2891_mal_jan23.yar#L19-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2891_mal_jan23.yar#L19-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9d0165e0484c31bd4ea467650b2ae2f359f67ae1016af49326bb374cead5f789"
logic_hash = "4bc51a47a1b620c3bb950c287c38a37e528e79f9720fb4d9fa9ebecbeca82036"
score = 75
@@ -325167,8 +325573,8 @@ rule SIGNATURE_BASE_MAL_Cryprat_Jan19_1 : FILE
date = "2019-01-07"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_cryp_rat.yar#L3-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_cryp_rat.yar#L3-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "69f8a581bae1a2c411e09e8fe01a979645ef897038af868d8e9f2a2ce9188080"
score = 90
quality = 85
@@ -325190,8 +325596,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Conticrypter
date = "2021-03-17"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_conti.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_conti.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "256fbd028a91da45049e2e861e16e97201f09cb92ab049eda373c80e6a796726"
score = 75
quality = 85
@@ -325216,8 +325622,8 @@ rule SIGNATURE_BASE_Cobaltstrike_Resources_Beacon_Dll_V3_8_1
date = "2022-11-18"
modified = "2023-12-05"
reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_gcti_cobaltstrike.yar#L1020-L1061"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_gcti_cobaltstrike.yar#L1020-L1061"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "67b6557f614af118a4c409c992c0d9a0cc800025f77861ecf1f3bbc7c293d603"
logic_hash = "cde078a6ae7d0d835900e85498cf5ae20663ba8d5d3f912810e157261561e16a"
score = 75
@@ -325244,8 +325650,8 @@ rule SIGNATURE_BASE_SUSP_LNK_Lnkfileoverrfc : FILE
date = "2018-09-18"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_lnk_files.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_lnk_files.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "52ff949a17039c1fa5707ff503aa1a96b3925bdfef01867c9b59a8d72493a84e"
score = 65
quality = 85
@@ -325269,8 +325675,8 @@ rule SIGNATURE_BASE_SUSP_LNK_Suspiciouscommands : FILE
date = "2018-09-18"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_lnk_files.yar#L20-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_lnk_files.yar#L20-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a0380927ebc89e46f9138e01f154113c5e23680cea9b117b47406003ea565c1e"
score = 60
quality = 81
@@ -325310,8 +325716,8 @@ rule SIGNATURE_BASE_SUSP_DOC_LNK_In_ZIP : FILE
date = "2019-07-02"
modified = "2023-12-05"
reference = "https://twitter.com/RedDrip7/status/1145877272945025029"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_lnk_files.yar#L53-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_lnk_files.yar#L53-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7ea4f77cac557044e72a8e280372a2abe072f2ad98b5a4fbed4e2229e780173a"
logic_hash = "ef4cdaad05af12f210aa6324a1e34a42843f814c59fb0085ac18370917ad4866"
score = 50
@@ -325333,8 +325739,8 @@ rule SIGNATURE_BASE_Dropper_Deploysmalwareviasideloading
date = "2017-04-28"
modified = "2024-04-17"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_uscert_ta17-1117a.yar#L9-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_uscert_ta17-1117a.yar#L9-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "51d8a0785bc25cf02460b9b7490ccba3d67806c953e6aa3d3882341ce11857fa"
score = 75
quality = 85
@@ -325357,8 +325763,8 @@ rule SIGNATURE_BASE_REDLEAVES_Droppedfile_Implantloader_Starburn
date = "2017-04-28"
modified = "2024-04-17"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_uscert_ta17-1117a.yar#L23-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_uscert_ta17-1117a.yar#L23-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2ebfdaf363ac80bc9bace3056ff86efd9c1b246c6f60373a82df4a0db901a6e3"
score = 75
quality = 85
@@ -325380,8 +325786,8 @@ rule SIGNATURE_BASE_REDLEAVES_Droppedfile_Obfuscatedshellcodeandrat_Handkerchief
date = "2017-04-28"
modified = "2024-04-17"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_uscert_ta17-1117a.yar#L36-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_uscert_ta17-1117a.yar#L36-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f91bd1ddd6691a0a5b6ebc6a28d35bb5b2e6c00754f07e58ffb01e06ad590ae3"
score = 75
quality = 83
@@ -325403,8 +325809,8 @@ rule SIGNATURE_BASE_REDLEAVES_Coreimplant_Uniquestrings : FILE
date = "2018-12-20"
modified = "2024-04-17"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_uscert_ta17-1117a.yar#L49-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_uscert_ta17-1117a.yar#L49-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ce6ab0f4007f3ea3c31442cab702ad3579faa6835d5ee9b4c03516ce0499bf3e"
score = 75
quality = 81
@@ -325428,8 +325834,8 @@ rule SIGNATURE_BASE_PLUGX_Redleaves
date = "2017-04-03"
modified = "2024-04-17"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_uscert_ta17-1117a.yar#L66-L93"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_uscert_ta17-1117a.yar#L66-L93"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "598ff82ea4fb52717acafb227c83d474"
hash = "7d10708a518b26cc8c3cbfbaa224e032"
hash = "af406d35c77b1e0df17f839e36bce630"
@@ -325465,8 +325871,8 @@ rule SIGNATURE_BASE_APT_SH_Codecov_Hack_Apr21_1 : FILE
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://about.codecov.io/security-update/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_codecov_hack.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_codecov_hack.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1aa7723982a1b675ba6694f1af0eb28e5926b974874580bd727cf33a3f8d893a"
score = 75
quality = 85
@@ -325488,8 +325894,8 @@ rule SIGNATURE_BASE_MAL_WIN_Ralordv1_Apr25 : FILE
date = "2025-04-01"
modified = "2026-05-15"
reference = "https://ish.com.br/wp-content/uploads/2025/04/RALord-Novo-grupo-de-Ransomware-as-a-Service-1.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_ralordv1_win_ap25.yar#L1-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_ralordv1_win_ap25.yar#L1-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "be15f62d14d1cbe2aecce8396f4c6289"
logic_hash = "75d20cca5eb48109bbb3b0ab0ce2efb4f2d89bc1984df8c4fddf1f859d069750"
score = 80
@@ -325522,8 +325928,8 @@ rule SIGNATURE_BASE_Apt3_Bemstour_Strings : FILE
date = "2019-06-25"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt3_bemstour.yar#L1-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt3_bemstour.yar#L1-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
logic_hash = "8aa7491b1dc3595f67ae1229d33f79261616b0f27485b7a27705db63a6111c07"
score = 75
@@ -325590,8 +325996,8 @@ rule SIGNATURE_BASE_Apt3_Bemstour_Implant_Byte_Patch
date = "2019-06-25"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt3_bemstour.yar#L69-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt3_bemstour.yar#L69-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
logic_hash = "08de2c885ccb24cb247efdcc06bbcbea144d652744b2d38aaa2aabfd341e4f91"
score = 75
@@ -325622,8 +326028,8 @@ rule SIGNATURE_BASE_Apt3_Bemstour_Implant_Command_Stack_Variable
date = "2019-06-25"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt3_bemstour.yar#L107-L275"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt3_bemstour.yar#L107-L275"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
logic_hash = "36710db313a52db2a0c0af356e701d3a36e5597203e87fd7f8586d202738be33"
score = 75
@@ -325715,8 +326121,8 @@ rule SIGNATURE_BASE_MAL_Envrial_Jan18_1 : FILE
date = "2018-01-21"
modified = "2023-12-05"
reference = "https://twitter.com/malwrhunterteam/status/953313514629853184"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_envrial.yar#L11-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_envrial.yar#L11-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85"
hash = "9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d"
logic_hash = "f047bedaac4dd934657b282a2587c55f3087a7cceb1a80becf14e7db3c365e8b"
@@ -325749,8 +326155,8 @@ rule SIGNATURE_BASE_MAL_PHISH_Shellcode_Enc_Payload_Feb25 : FILE
date = "2025-02-14"
modified = "2025-03-20"
reference = "https://x.com/dtcert/status/1890384162818802135"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_phish_feb25.yar#L1-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_phish_feb25.yar#L1-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "247e6a648bb22d35095ba02ef4af8cfe0a4cdfa25271117414ff2e3a21021886"
logic_hash = "144323294a8353956adf7a9b2a316e1e7606e882f85b8187c016d5acdcc254cc"
score = 80
@@ -325772,8 +326178,8 @@ rule SIGNATURE_BASE_MAL_PHISH_Final_Payload_Feb25
date = "2025-02-14"
modified = "2025-03-20"
reference = "https://x.com/dtcert/status/1890384162818802135"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_phish_feb25.yar#L16-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_phish_feb25.yar#L16-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "de384aba6b0c6800095eb530954aa718d4ed96cccfc0b1e5e4d01404f3518a77"
logic_hash = "3251d68a019d873987966d46c9e474e5a1ebbca4a33a8bf1e3c3ce119db8ab8c"
score = 80
@@ -325801,8 +326207,8 @@ rule SIGNATURE_BASE_SUSP_Sysinternals_Desktops_Anomaly_Feb25 : FILE
date = "2025-02-14"
modified = "2025-03-20"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_phish_feb25.yar#L37-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_phish_feb25.yar#L37-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5b8f64e090c7c9012e656c222682dfae7910669c7b7afaca35829cd1cc2eac17"
hash = "d0f7f3f58e0dfcfd81235379bb5a236f40be490207d3bf45f190a264879090db"
hash = "a83dc4d69a3de72aed4d1933db2ca120657f06adc6683346afbd267b8b7d27d0"
@@ -325832,8 +326238,8 @@ rule SIGNATURE_BASE_SUSP_PE_Compromised_Certificate_Feb25 : FILE
date = "2025-02-14"
modified = "2025-03-20"
reference = "https://x.com/DTCERT/status/1890384162818802135"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_phish_feb25.yar#L62-L85"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_phish_feb25.yar#L62-L85"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5b8f64e090c7c9012e656c222682dfae7910669c7b7afaca35829cd1cc2eac17"
hash = "d0f7f3f58e0dfcfd81235379bb5a236f40be490207d3bf45f190a264879090db"
hash = "a83dc4d69a3de72aed4d1933db2ca120657f06adc6683346afbd267b8b7d27d0"
@@ -325863,8 +326269,8 @@ rule SIGNATURE_BASE_APT_Webshell_Tiny_1 : FILE
date = "2019-02-18"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_aus_parl_compromise.yar#L12-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_aus_parl_compromise.yar#L12-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "277162f720195c94d36fd3350d0dda785007e8cc6ed2ab2aa1a6a6262f2993fa"
score = 75
quality = 85
@@ -325885,8 +326291,8 @@ rule SIGNATURE_BASE_APT_Webshell_AUS_Tiny_2 : FILE
date = "2019-02-18"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_aus_parl_compromise.yar#L25-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_aus_parl_compromise.yar#L25-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0d6209d86f77a0a69451b0f27b476580c14e0cda15fa6a5003aab57a93e7e5a5"
logic_hash = "e26c265d2b1606257d8c843921601f14cae2beaf246f8e37daeeb6c5ff12f289"
score = 75
@@ -325909,8 +326315,8 @@ rule SIGNATURE_BASE_APT_Webshell_AUS_Jscript_3 : FILE
date = "2019-02-18"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_aus_parl_compromise.yar#L40-L53"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_aus_parl_compromise.yar#L40-L53"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7ac6f973f7fccf8c3d58d766dec4ab7eb6867a487aa71bc11d5f05da9322582d"
logic_hash = "e144e555dd80e15ac9072a645e629a86ca1a6b52949d236ec3daedbf06bd6718"
score = 75
@@ -325933,8 +326339,8 @@ rule SIGNATURE_BASE_APT_Webshell_AUS_4 : FILE
date = "2019-02-18"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_aus_parl_compromise.yar#L56-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_aus_parl_compromise.yar#L56-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "83321c02339bb51735fbcd9a80c056bd3b89655f3dc41e5fef07ca46af09bb71"
logic_hash = "4a4f26b50631021979e4a8246a1e1c10150f4fb03eb7d77a1042e41ef57b3961"
score = 75
@@ -325959,8 +326365,8 @@ rule SIGNATURE_BASE_APT_Script_AUS_4 : FILE
date = "2019-02-18"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_aus_parl_compromise.yar#L73-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_aus_parl_compromise.yar#L73-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fdf15f388a511a63fbad223e6edb259abdd4009ec81fcc87ce84f0f2024c8057"
logic_hash = "3a81365572380964abe07a1ec16a9ea299bf16a4e624285faaa6f72c44f762d2"
score = 75
@@ -325987,8 +326393,8 @@ rule SIGNATURE_BASE_APT_Webshell_AUS_5 : FILE
date = "2019-02-18"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_aus_parl_compromise.yar#L92-L111"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_aus_parl_compromise.yar#L92-L111"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "54a17fb257db2d09d61af510753fd5aa00537638a81d0a8762a5645b4ef977e4"
logic_hash = "fb0e53e5561f7f14f2ad6afcda2798d353cf4d54d12ae3354b03d62ed0c00bf3"
score = 75
@@ -326016,8 +326422,8 @@ rule SIGNATURE_BASE_HKTL_Lazycat_Logeraser
date = "2019-02-18"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_aus_parl_compromise.yar#L113-L135"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_aus_parl_compromise.yar#L113-L135"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1c113dce265e4d744245a7c55dadc80199ae972a9e0ecbd0c5ced57067cf755b"
hash = "510375f8142b3651df67d42c3eff8d2d880987c0e057fc75a5583f36de34bf0e"
logic_hash = "2b4b69dd675172b9b0c08fac674b6daa107535694b4073750501627fb48d12c2"
@@ -326048,8 +326454,8 @@ rule SIGNATURE_BASE_HKTL_Powerkatz_Feb19_1
date = "2019-02-18"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_aus_parl_compromise.yar#L137-L152"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_aus_parl_compromise.yar#L137-L152"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d1d39d68c5c5a3f6142a966925e2a136e937bc09abddd4080862346683886455"
score = 75
quality = 85
@@ -326073,8 +326479,8 @@ rule SIGNATURE_BASE_HKTL_Unknown_Feb19_1
date = "2019-02-18"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_aus_parl_compromise.yar#L154-L172"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_aus_parl_compromise.yar#L154-L172"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "231c771ed24106a8daf352a0df1bc2db43ebd8d1108d7fa1162d03d40e738d46"
score = 75
quality = 85
@@ -326101,8 +326507,8 @@ rule SIGNATURE_BASE_EXT_WEBSHELL_PHP_Generic : FILE
date = "2021-01-14"
modified = "2026-03-09"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L83-L406"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L83-L406"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bee1b76b1455105d4bfe2f45191071cf05e83a309ae9defcf759248ca9bceddd"
hash = "6bf351900a408120bee3fc6ea39905c6a35fe6efcf35d0a783ee92062e63a854"
hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
@@ -326132,7 +326538,7 @@ rule SIGNATURE_BASE_EXT_WEBSHELL_PHP_Generic : FILE
hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
logic_hash = "48d0e0402afaaff6bb0a6c8b2505c2438980b42406ab6f0c0ba46b3cc8f0eea8"
score = 70
- quality = -132
+ quality = -107
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -326324,8 +326730,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Callback : FILE
date = "2021-01-14"
modified = "2023-09-18"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L409-L714"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L409-L714"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e98889690101b59260e871c49263314526f2093f"
hash = "63297f8c1d4e88415bc094bc5546124c9ed8d57aca3a09e36ae18f5f054ad172"
hash = "81388c8cc99353cdb42572bb88df7d3bd70eefc748c2fa4224b6074aa8d7e6a2"
@@ -326541,8 +326947,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Base64_Encoded_Payloads : FILE
date = "2021-01-07"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L716-L866"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L716-L866"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "88d0d4696c9cb2d37d16e330e236cb37cfaec4cd"
hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
hash = "e726cd071915534761822805724c6c6bfe0fcac604a86f09437f03f301512dc5"
@@ -326560,7 +326966,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Base64_Encoded_Payloads : FILE
hash = "e2b1dfcfaa61e92526a3a444be6c65330a8db4e692543a421e19711760f6ffe2"
logic_hash = "8f606dc3e1e688cca144fe769af50980b4c25fa69b08c67aca8c676a6a060010"
score = 75
- quality = -8
+ quality = 17
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -326658,8 +327064,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Unknown_1 : FILE
date = "2021-01-07"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L868-L890"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L868-L890"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12ce6c7167b33cc4e8bdec29fb1cfc44ac9487d1"
hash = "cf4abbd568ce0c0dfce1f2e4af669ad2"
logic_hash = "ce2d4c87c001a45febf7eac5474aa0d24ea73067f9154203ef5653bf77e7028f"
@@ -326687,8 +327093,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Eval : FILE
date = "2021-01-07"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L892-L951"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L892-L951"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a61437a427062756e2221bfb6d58cd62439d09d9"
hash = "90c5cc724ec9cf838e4229e5e08955eec4d7bf95"
hash = "2b41abc43c5b6c791d4031005bf7c5104a98e98a00ee24620ce3e8e09a78e78f"
@@ -326710,7 +327116,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Eval : FILE
hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
logic_hash = "4b7759e4761f5897bfb5e576df645a2e99cec4e703fb28d0fc275cf8f8848263"
score = 75
- quality = 60
+ quality = 85
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -326744,8 +327150,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Double_Eval_Tiny : FILE
date = "2021-01-11"
modified = "2026-02-23"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L953-L1005"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L953-L1005"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f66fb918751acc7b88a17272a044b5242797976c73a6e54ac6b04b02f61e9761"
hash = "6b2f0a3bd80019dea536ddbf92df36ab897dd295840cb15bb7b159d0ee2106ff"
hash = "aabfd179aaf716929c8b820eefa3c1f613f8dcac"
@@ -326753,7 +327159,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Double_Eval_Tiny : FILE
hash = "006620d2a701de73d995fc950691665c0692af11"
logic_hash = "ca7c0a7c8e58dbc15dffb4e388408f904fe56b51481ae976e2aa9fe7d32bd58d"
score = 70
- quality = 17
+ quality = 42
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -326786,8 +327192,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC : FILE
date = "2021-01-12"
modified = "2025-09-22"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L1007-L1136"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L1007-L1136"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eec9ac58a1e763f5ea0f7fa249f1fe752047fa60"
hash = "181a71c99a4ae13ebd5c94bfc41f9ec534acf61cd33ef5bce5fb2a6f48b65bf4"
hash = "76d4e67e13c21662c4b30aab701ce9cdecc8698696979e504c288f20de92aee7"
@@ -326864,8 +327270,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded : FILE
date = "2021-04-18"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L1138-L1189"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L1138-L1189"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "119fc058c9c5285498a47aa271ac9a27f6ada1bf4d854ccd4b01db993d61fc52"
hash = "d5ca3e4505ea122019ea263d6433221030b3f64460d3ce2c7d0d63ed91162175"
hash = "8a1e2d72c82f6a846ec066d249bfa0aaf392c65149d39b7b15ba19f9adc3b339"
@@ -326903,8 +327309,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex : FILE
date = "2021-04-18"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L1191-L1247"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L1191-L1247"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0e21931b16f30b1db90a27eafabccc91abd757fa63594ba8a6ad3f477de1ab1c"
hash = "929975272f0f42bf76469ed89ebf37efcbd91c6f8dac1129c7ab061e2564dd06"
hash = "88fce6c1b589d600b4295528d3fcac161b581f739095b99cd6c768b7e16e89ff"
@@ -326919,7 +327325,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex : FILE
hash = "0ff05e6695074f98b0dee6200697a997c509a652f746d2c1c92c0b0a0552ca47"
logic_hash = "d9b4d224d43915cf08050c173627b314c3e41a30ecfffe28038281eadc114e51"
score = 75
- quality = -8
+ quality = 17
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -326948,8 +327354,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Tiny : FILE
date = "2021-01-12"
modified = "2024-03-11"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L1249-L1344"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L1249-L1344"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b7b7aabd518a2f8578d4b1bc9a3af60d155972f1"
hash = "694ec6e1c4f34632a9bd7065f73be473"
hash = "5c871183444dbb5c8766df6b126bd80c624a63a16cc39e20a0f7b002216b2ba5"
@@ -327015,8 +327421,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Str_Replace : FILE
date = "2021-01-12"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L1346-L1401"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L1346-L1401"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "691305753e26884d0f930cda0fe5231c6437de94"
hash = "7efd463aeb5bf0120dc5f963b62463211bd9e678"
hash = "fb655ddb90892e522ae1aaaf6cd8bde27a7f49ef"
@@ -327025,7 +327431,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Str_Replace : FILE
hash = "e1a2af3477d62a58f9e6431f5a4a123fb897ea80"
logic_hash = "74fb86a7ee7342ede9f49ef004a92fb7bdf06ca62f8e8f0ea1c6adcff96bcb2d"
score = 75
- quality = 21
+ quality = 46
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -327059,14 +327465,14 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Fopo : FILE
date = "2021-01-12"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L1403-L1463"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L1403-L1463"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fbcff8ea5ce04fc91c05384e847f2c316e013207"
hash = "6da57ad8be1c587bb5cc8a1413f07d10fb314b72"
hash = "a698441f817a9a72908a0d93a34133469f33a7b34972af3e351bdccae0737d99"
logic_hash = "076c0c256e5951cdcb2b7bc55030f55bec48c1bea953b8bd85559a3230e387ae"
score = 75
- quality = 15
+ quality = 40
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -327107,8 +327513,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Gzinflated : FILE
date = "2021-01-12"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L1465-L1538"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L1465-L1538"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "49e5bc75a1ec36beeff4fbaeb16b322b08cf192d"
hash = "6f36d201cd32296bad9d5864c7357e8634f365cc"
hash = "ab10a1e69f3dfe7c2ad12b2e6c0e66db819c2301"
@@ -327116,7 +327522,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Gzinflated : FILE
hash = "07eb6634f28549ebf26583e8b154c6a579b8a733"
logic_hash = "d2edb7050c986a00889fd01b709ec0aa1409ce2e40a15b7942562d12596b190e"
score = 75
- quality = 7
+ quality = 32
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -327162,15 +327568,15 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_3 : FILE
date = "2021-04-17"
modified = "2024-12-09"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L1540-L1846"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L1540-L1846"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "11bb1fa3478ec16c00da2a1531906c05e9c982ea"
hash = "d6b851cae249ea6744078393f622ace15f9880bc"
hash = "14e02b61905cf373ba9234a13958310652a91ece"
hash = "6f97f607a3db798128288e32de851c6f56e91c1d"
logic_hash = "aba86f6d8458bb119b9e495e6e77c1b89855bde31b12395a4d656878c5152932"
score = 70
- quality = -223
+ quality = -198
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -327370,15 +327776,15 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Includer_Eval : FILE
date = "2021-01-13"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L1848-L1897"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L1848-L1897"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3a07e9188028efa32872ba5b6e5363920a6b2489"
hash = "ab771bb715710892b9513b1d075b4e2c0931afb6"
hash = "202dbcdc2896873631e1a0448098c820c82bcc8385a9f7579a0dc9702d76f580"
hash = "b51a6d208ec3a44a67cce16dcc1e93cdb06fe150acf16222815333ddf52d4db8"
logic_hash = "a7e9632c495e5d4cc883e2593c8ebe41cdf6a18b54bd6dfd3aec85352f19321c"
score = 75
- quality = 21
+ quality = 46
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -327410,14 +327816,14 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Includer_Tiny : FILE
date = "2021-04-17"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L1899-L1944"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L1899-L1944"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0687585025f99596508783b891e26d6989eec2ba"
hash = "9e856f5cb7cb901b5003e57c528a6298341d04dc"
hash = "b3b0274cda28292813096a5a7a3f5f77378b8905205bda7bb7e1a679a7845004"
logic_hash = "e1efb6384009def30d845650fd0dd77319c3c7b4402cca074ca5c2a06372ab58"
score = 75
- quality = 17
+ quality = 42
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -327446,15 +327852,15 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Dynamic : FILE
date = "2021-01-13"
modified = "2024-12-09"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L1946-L2019"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L1946-L2019"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "65dca1e652d09514e9c9b2e0004629d03ab3c3ef"
hash = "b8ab38dc75cec26ce3d3a91cb2951d7cdd004838"
hash = "c4765e81550b476976604d01c20e3dbd415366df"
hash = "2e11ba2d06ebe0aa818e38e24a8a83eebbaae8877c10b704af01bf2977701e73"
logic_hash = "c49434662defad4945639887f4a6537c44a5559f83646f378f848b4aa4ba3c3f"
score = 60
- quality = -181
+ quality = -156
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -327503,8 +327909,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Dynamic_Big : FILE
date = "2021-02-07"
modified = "2025-08-18"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L2021-L2342"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L2021-L2342"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6559bfc4be43a55c6bb2bd867b4c9b929713d3f7f6de8111a3c330f87a9b302c"
hash = "9e82c9c2fa64e26fd55aa18f74759454d89f968068d46b255bd4f41eb556112e"
hash = "6def5296f95e191a9c7f64f7d8ac5c529d4a4347ae484775965442162345dc93"
@@ -327516,7 +327922,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Dynamic_Big : FILE
hash = "ee34d62e136a04e2eaf84b8daa12c9f2233a366af83081a38c3c973ab5e2c40f"
logic_hash = "1a29df7465b475e74d0f21f1705405e9663699a6e3c7b7107988ee3e202c3a25"
score = 50
- quality = -361
+ quality = -336
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -327689,8 +328095,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Encoded_Big : FILE
date = "2021-02-07"
modified = "2024-12-16"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L2344-L2430"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L2344-L2430"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1d4b374d284c12db881ba42ee63ebce2759e0b14"
hash = "fc0086caee0a2cd20609a05a6253e23b5e3245b8"
hash = "b15b073801067429a93e116af1147a21b928b215"
@@ -327698,7 +328104,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Encoded_Big : FILE
hash = "042245ee0c54996608ff8f442c8bafb8"
logic_hash = "9c995f9c1c5e3a70dbb8170f6d1a2fba51c0f29184a5d3647016b520f4bfc0e3"
score = 50
- quality = -100
+ quality = -75
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -327737,8 +328143,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Backticks : FILE
date = "2021-01-07"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L2432-L2480"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L2432-L2480"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "339f32c883f6175233f0d1a30510caa52fdcaa37"
hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
hash = "af987b0eade03672c30c095cee0c7c00b663e4b3c6782615fb7e430e4a7d1d75"
@@ -327747,7 +328153,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Backticks : FILE
hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
logic_hash = "faa064686a5632788497d0300ba017c3e564f3b70f07a01f2e49bf7c934feb28"
score = 75
- quality = 19
+ quality = 44
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -327776,15 +328182,15 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Backticks_OBFUSC : FILE
date = "2021-01-07"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L2482-L2528"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L2482-L2528"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "23dc299f941d98c72bd48659cdb4673f5ba93697"
hash = "e3f393a1530a2824125ecdd6ac79d80cfb18fffb89f470d687323fb5dff0eec1"
hash = "1e75914336b1013cc30b24d76569542447833416516af0d237c599f95b593f9b"
hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
logic_hash = "34354283762d6f62a4537e914d969f84546339da9be533e209d8738605b7e3ac"
score = 75
- quality = -6
+ quality = 44
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -327813,8 +328219,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_By_String_Known_Webshell : FILE
date = "2021-01-09"
modified = "2025-08-18"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L2530-L2666"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L2530-L2666"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d889da22893536d5965541c30896f4ed4fdf461d"
hash = "10f4988a191774a2c6b85604344535ee610b844c1708602a355cf7e9c12c3605"
hash = "7b6471774d14510cf6fa312a496eed72b614f6fc"
@@ -327836,7 +328242,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_By_String_Known_Webshell : FILE
hash = "d52128bcfff5e9a121eab3d76382420c3eebbdb33cd0879fbef7c3426e819695"
logic_hash = "8909bf77b7bacdae092fd7a94099224bf1660a6d341e113412e93f864298851b"
score = 70
- quality = -8
+ quality = 17
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -327923,8 +328329,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Strings_SUSP : FILE
date = "2021-01-12"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L2668-L2754"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L2668-L2754"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0dd568dbe946b5aa4e1d33eab1decbd71903ea04"
hash = "dde2bdcde95730510b22ae8d52e4344997cb1e74"
hash = "499db4d70955f7d40cf5cbaf2ecaf7a2"
@@ -327932,7 +328338,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Strings_SUSP : FILE
hash = "1ab3ae4d613b120f9681f6aa8933d66fa38e4886"
logic_hash = "5c3837ab761ee2209fab5fc333b050a56d80addb03b088ae28040c7393429bb3"
score = 50
- quality = 15
+ quality = 40
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -327985,8 +328391,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_In_Htaccess : FILE
date = "2021-01-07"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L2756-L2778"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L2756-L2778"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c026d4512a32d93899d486c6f11d1e13b058a713"
hash = "d79e9b13a32a9e9f3fa36aa1a4baf444bfd2599a"
hash = "e1d1091fee6026829e037b2c70c228344955c263"
@@ -328014,14 +328420,14 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Function_Via_Get : FILE
date = "2021-01-09"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L2780-L2824"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L2780-L2824"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ce739d65c31b3c7ea94357a38f7bd0dc264da052d4fd93a1eabb257f6e3a97a6"
hash = "d870e971511ea3e082662f8e6ec22e8a8443ca79"
hash = "73fa97372b3bb829835270a5e20259163ecc3fdbf73ef2a99cb80709ea4572be"
logic_hash = "309203db8e7374531d359e3a723418d47bead45034c4a7bd726fb714622dc039"
score = 75
- quality = 58
+ quality = 83
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -328058,8 +328464,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Writer : FILE
date = "2021-04-17"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L2826-L2916"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L2826-L2916"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ec83d69512aa0cc85584973f5f0850932fb1949fb5fb2b7e6e5bbfb121193637"
hash = "407c15f94a33232c64ddf45f194917fabcd2e83cf93f38ee82f9720e2635fa64"
hash = "988b125b6727b94ce9a27ea42edc0ce282c5dfeb"
@@ -328067,7 +328473,7 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_Writer : FILE
hash = "20281d16838f707c86b1ff1428a293ed6aec0e97"
logic_hash = "34bae0c02156d1c9fd24d674443322409eba0a43e094fc6c05df94bbbe15aa64"
score = 50
- quality = 17
+ quality = 42
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -328118,8 +328524,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Writer : FILE
date = "2021-03-07"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L2918-L3088"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L2918-L3088"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "df6eaba8d643c49c6f38016531c88332e80af33c"
hash = "83642a926291a499916e8c915dacadd0d5a8b91f"
hash = "5417fad68a6f7320d227f558bf64657fe3aa9153"
@@ -328127,7 +328533,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Writer : FILE
hash = "fc44fd7475ee6c0758ace2b17dd41ed7ea75cc73"
logic_hash = "7c9f4c9a5005efad02760cf9ba3ea946068ae281cda10215bf8c88f209b582a5"
score = 60
- quality = -100
+ quality = -75
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -328207,8 +328613,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_OBFUSC : FILE
date = "2021-01-12"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L3090-L3365"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L3090-L3365"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ad597eee256de51ffb36518cd5f0f4aa0f254f27517d28fb7543ae313b15e112"
hash = "e0d21fdc16e0010b88d0197ebf619faa4aeca65243f545c18e10859469c1805a"
hash = "54a5620d4ea42e41beac08d8b1240b642dd6fd7c"
@@ -328219,7 +328625,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_OBFUSC : FILE
hash = "cafc4ede15270ab3f53f007c66e82627a39f4d0f"
logic_hash = "96369062f963c3604c05808755fdfca922e5a6da960cb0ee05dee2df72d5d69b"
score = 75
- quality = -142
+ quality = -117
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -328320,15 +328726,15 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Eval_On_Input : FILE
date = "2021-01-07"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L3367-L3471"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L3367-L3471"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d6b96d844ac395358ee38d4524105d331af42ede"
hash = "9be2088d5c3bfad9e8dfa2d7d7ba7834030c7407"
hash = "a1df4cfb978567c4d1c353e988915c25c19a0e4a"
hash = "069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6"
logic_hash = "f7b9f43cf2fd6d08b7438f003242e9a19dcea282959c7a1fdff3a35e261a031e"
score = 75
- quality = -24
+ quality = 1
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -328375,8 +328781,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Nano : FILE
date = "2021-01-13"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L3473-L3664"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L3473-L3664"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3b7910a499c603715b083ddb6f881c1a0a3a924d"
hash = "990e3f129b8ba409a819705276f8fa845b95dad0"
hash = "22345e956bce23304f5e8e356c423cee60b0912c"
@@ -328394,7 +328800,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Nano : FILE
hash = "28cfcfe28419a399c606bf96505bc68d6fe05624dba18306993f9fe0d398fbe1"
logic_hash = "1b969e098a0b2c86ceba9cbb7f31770ba04f1a4c225716ea27d7e4e4177c90c4"
score = 75
- quality = -142
+ quality = -117
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -328486,8 +328892,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Encoded : FILE
date = "2021-03-14"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L3666-L3776"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L3666-L3776"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1bc7327f9d3dbff488e5b0b69a1b39dcb99b3399"
hash = "9885ee1952b5ad9f84176c9570ad4f0e32461c92"
hash = "27a020c5bc0dbabe889f436271df129627b02196"
@@ -328495,7 +328901,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Encoded : FILE
hash = "af40f4c36e3723236c59dc02f28a3efb047d67dd"
logic_hash = "dc33423874a49edfe9994db50959e6a55e2d475f4cd7d0b1b0a288c4ee1f7961"
score = 75
- quality = -49
+ quality = -24
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -328545,13 +328951,13 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Encoded_Aspcoding : FILE
date = "2021-03-14"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L3778-L3884"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L3778-L3884"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7cfd184ab099c4d60b13457140493b49c8ba61ee"
hash = "f5095345ee085318235c11ae5869ae564d636a5342868d0935de7582ba3c7d7a"
logic_hash = "a0f0b8585b28b13a90c5d112997cacea00af8c89c81eda5edf05508ad41459ab"
score = 60
- quality = -30
+ quality = -5
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -328599,8 +329005,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_By_String : FILE
date = "2021-01-13"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L3886-L4064"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L3886-L4064"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f72252b13d7ded46f0a206f63a1c19a66449f216"
hash = "bd75ac9a1d1f6bcb9a2c82b13ea28c0238360b3a7be909b2ed19d3c96e519d3d"
hash = "56a54fe1f8023455800fd0740037d806709ffb9ece1eb9e7486ad3c3e3608d45"
@@ -328615,7 +329021,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_By_String : FILE
hash = "de173ea8dcef777368089504a4af0804864295b75e51794038a6d70f2bcfc6f5"
logic_hash = "b6ff83bc501753b893a0f5e60c6aafa292617279c0855ce3ba2d0b9b73325e8a"
score = 75
- quality = -66
+ quality = -41
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -328719,15 +329125,15 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Sniffer : FILE
date = "2021-03-14"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L4066-L4201"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L4066-L4201"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1206c22de8d51055a5e3841b4542fb13aa0f97dd"
hash = "60d131af1ed23810dbc78f85ee32ffd863f8f0f4"
hash = "c3bc4ab8076ef184c526eb7f16e08d41b4cec97e"
hash = "ed5938c04f61795834751d44a383f8ca0ceac833"
logic_hash = "874ec4c5dff024a899976e46cd553b52c361779a5507cf08ff0de596fd460d41"
score = 75
- quality = -49
+ quality = -24
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -328788,15 +329194,15 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Tiny : FILE
date = "2021-01-07"
modified = "2025-08-18"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L4203-L4412"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L4203-L4412"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "990e3f129b8ba409a819705276f8fa845b95dad0"
hash = "52ce724580e533da983856c4ebe634336f5fd13a"
hash = "0864f040a37c3e1cef0213df273870ed6a61e4bc"
hash = "b184dc97b19485f734e3057e67007a16d47b2a62"
logic_hash = "e1b4e9fa88bb4260a83a22ec73c9fbec4d4f4928965cba9dfdd6fdba1307e8e4"
score = 75
- quality = -127
+ quality = -102
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -328891,15 +329297,15 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Generic : FILE
date = "2021-03-07"
modified = "2025-08-18"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L4414-L4715"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L4414-L4715"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75"
hash = "4cf6fbad0411b7d33e38075f5e00d4c8ae9ce2f6f53967729974d004a183b25c"
hash = "a91320483df0178eb3cafea830c1bd94585fc896"
hash = "f3398832f697e3db91c3da71a8e775ebf66c7e73"
logic_hash = "c1807922c71cb591ce63ea2d4531d85c5b45ad0f03db07381f8160aec18264ed"
score = 60
- quality = -151
+ quality = -126
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329058,14 +329464,14 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Registry_Reader : FILE
date = "2021-03-14"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L4717-L4864"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L4717-L4864"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4d53416398a89aef3a39f63338a7c1bf2d3fcda4"
hash = "f85cf490d7eb4484b415bea08b7e24742704bdda"
hash = "898ebfa1757dcbbecb2afcdab1560d72ae6940de"
logic_hash = "515bff52bebaad45481202ff934f8d1cbb79c27ccf47ca811077acacb7a47f13"
score = 50
- quality = -53
+ quality = -28
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329134,8 +329540,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Regeorg_CSHARP : FILE
date = "2021-01-11"
modified = "2023-07-05"
reference = "https://github.com/sensepost/reGeorg"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L4866-L4976"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L4866-L4976"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c1f43b7cf46ba12cfc1357b17e4f5af408740af7ae70572c9cf988ac50260ce1"
hash = "479c1e1f1c263abe339de8be99806c733da4e8c1"
hash = "38a1f1fc4e30c0b4ad6e7f0e1df5a92a7d05020b"
@@ -329143,7 +329549,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Regeorg_CSHARP : FILE
hash = "aea0999c6e5952ec04bf9ee717469250cddf8a6f"
logic_hash = "0c68f5955df2e75c3b5b4f1c6398fd57add1f64bfb3d46ccebf1c6767f5d2eb1"
score = 75
- quality = -32
+ quality = -7
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329194,8 +329600,8 @@ rule SIGNATURE_BASE_WEBSHELL_CSHARP_Generic : FILE
date = "2021-01-11"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L4978-L5086"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L4978-L5086"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b6721683aadc4b4eba4f081f2bc6bc57adfc0e378f6d80e2bfa0b1e3e57c85c7"
hash = "4b365fc9ddc8b247a12f4648cd5c91ee65e33fae"
hash = "019eb61a6b5046502808fb5ab2925be65c0539b4"
@@ -329203,7 +329609,7 @@ rule SIGNATURE_BASE_WEBSHELL_CSHARP_Generic : FILE
hash = "a91320483df0178eb3cafea830c1bd94585fc896"
logic_hash = "fb367b79c8ed4a61618594db903cf3d70524685d7710d243163958ecb47634aa"
score = 75
- quality = -30
+ quality = -5
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329253,8 +329659,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Runtime_Compile : FILE
date = "2021-01-11"
modified = "2023-04-05"
reference = "https://github.com/antonioCoco/SharPyShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L5088-L5186"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L5088-L5186"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e826c4139282818d38dcccd35c7ae6857b1d1d01"
hash = "e20e078d9fcbb209e3733a06ad21847c5c5f0e52"
hash = "57f758137aa3a125e4af809789f3681d1b08ee5b"
@@ -329266,7 +329672,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Runtime_Compile : FILE
hash = "8ce4eaf111c66c2e6c08a271d849204832713f8b66aceb5dadc293b818ccca9e"
logic_hash = "6699a44e396eedebb3bafa0e89c3b6d080586a158ed056ec7220bdf2ad764444"
score = 75
- quality = -6
+ quality = 19
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329319,8 +329725,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_SQL : FILE
date = "2021-03-14"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L5188-L5369"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L5188-L5369"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "216c1dd950e0718e35bc4834c5abdc2229de3612"
hash = "ffe44e9985d381261a6e80f55770833e4b78424bn"
hash = "3d7cd32d53abc7f39faed133e0a8f95a09932b64"
@@ -329328,7 +329734,7 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_SQL : FILE
hash = "cafc4ede15270ab3f53f007c66e82627a39f4d0f"
logic_hash = "c59250065c4be267746f716f922007b638706a76579af6509c8e97d0cee03f33"
score = 75
- quality = -59
+ quality = -34
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329423,13 +329829,13 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Scan_Writable : FILE
date = "2021-03-14"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L5371-L5514"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L5371-L5514"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2409eda9047085baf12e0f1b9d0b357672f7a152"
hash = "af1c00696243f8b062a53dad9fb8b773fa1f0395631ffe6c7decc42c47eedee7"
logic_hash = "80969fd0c27903dabf08a250a47971725ac5762fd2f9afd96167b8f88f277348"
score = 75
- quality = -89
+ quality = -64
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329496,8 +329902,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Regeorg : FILE
date = "2021-01-24"
modified = "2024-12-09"
reference = "https://github.com/sensepost/reGeorg"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L5516-L5566"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L5516-L5566"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6db49e43722080b5cd5f07e058a073ba5248b584"
hash = "650eaa21f4031d7da591ebb68e9fc5ce5c860689"
hash = "00c86bf6ce026ccfaac955840d18391fbff5c933"
@@ -329505,7 +329911,7 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Regeorg : FILE
hash = "9108a33058aa9a2fb6118b719c5b1318f33f0989"
logic_hash = "9d4c60a4daaadf6cefe8bf1d84b1e4af491cd23136332db4a022715b265c8f4e"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329539,14 +329945,14 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_HTTP_Proxy : FILE
date = "2021-01-24"
modified = "2024-12-09"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L5568-L5616"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L5568-L5616"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f9b647660923c5262636a5344e2665512a947a4"
hash = "97c1e2bf7e769d3fc94ae2fc74ac895f669102c6"
hash = "2f9b647660923c5262636a5344e2665512a947a4"
logic_hash = "7183902d43fc633db06a41b4a6bc02d2eb5662b7ee08080b57563783b8b67568"
score = 75
- quality = 25
+ quality = 50
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329580,15 +329986,15 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Writer_Nano : FILE
date = "2021-01-24"
modified = "2024-12-09"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L5618-L5699"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L5618-L5699"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ac91e5b9b9dcd373eaa9360a51aa661481ab9429"
hash = "c718c885b5d6e29161ee8ea0acadb6e53c556513"
hash = "9f1df0249a6a491cdd5df598d83307338daa4c43"
hash = "5e241d9d3a045d3ade7b6ff6af6c57b149fa356e"
logic_hash = "44c11570c610b849ba9c7506fd9ef3575d270e79d7aaf5c26d54ab3f64cfc94f"
score = 75
- quality = 23
+ quality = 48
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329632,14 +330038,14 @@ rule SIGNATURE_BASE_EXT_WEBSHELL_JSP_Generic_Tiny : FILE
date = "2021-01-07"
modified = "2024-12-16"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L5701-L5786"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L5701-L5786"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8fd343db0442136e693e745d7af1018a99b042af"
hash = "87c3ac9b75a72187e8bc6c61f50659435dbdc4fde6ed720cebb93881ba5989d8"
hash = "1aa6af726137bf261849c05d18d0a630d95530588832aadd5101af28acc034b5"
logic_hash = "a6bf86961bc07b312fc24362d70d22ce826a2e918e1e0e8679bd415783d8500a"
score = 75
- quality = 23
+ quality = 48
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329685,14 +330091,14 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic : FILE
date = "2021-01-07"
modified = "2025-08-18"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L5788-L5882"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L5788-L5882"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4762f36ca01fb9cda2ab559623d2206f401fc0b1"
hash = "bdaf9279b3d9e07e955d0ce706d9c42e4bdf9aa1"
hash = "ee9408eb923f2d16f606a5aaac7e16b009797a07"
logic_hash = "1a464e222704cfc947ed2f1c027c7871db8ab73e5130a309738afd25c8e614ab"
score = 75
- quality = -49
+ quality = -24
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329746,13 +330152,13 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Base64 : FILE
date = "2021-01-24"
modified = "2025-08-18"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L5884-L5961"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L5884-L5961"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8b5fe53f8833df3657ae2eeafb4fd101c05f0db0"
hash = "1b916afdd415dfa4e77cecf47321fd676ba2184d"
logic_hash = "1787b7c6e587e1745930faaac5d28338a86baf6abc19be7c0ffe875029ff6ca1"
score = 75
- quality = -2
+ quality = 48
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329801,8 +330207,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Processbuilder : FILE
date = "2021-01-07"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L5963-L6000"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L5963-L6000"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "82198670ac2072cd5c2853d59dcd0f8dfcc28923"
hash = "c05a520d96e4ebf9eb5c73fc0fa446ceb5caf343"
hash = "347a55c174ee39ec912d9107e971d740f3208d53af43ea480f502d177106bbe8"
@@ -329838,13 +330244,13 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Reflection : FILE
date = "2021-01-07"
modified = "2024-12-09"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L6002-L6084"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L6002-L6084"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"
hash = "bf0ff88cbb72c719a291c722ae3115b91748d5c4920afe7a00a0d921d562e188"
logic_hash = "386aeb3745c5dd815f00bbc941450a2c3f1ddfc2956c67ecd5bee9318b1756ef"
score = 75
- quality = -25
+ quality = 0
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329885,8 +330291,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Classloader : FILE
date = "2021-01-07"
modified = "2024-12-09"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L6086-L6163"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L6086-L6163"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6b546e78cc7821b63192bb8e087c133e8702a377d17baaeb64b13f0dd61e2347"
hash = "f3a7e28e1c38fa5d37811bdda1d6b0893ab876023d3bd696747a35c04141dcf0"
hash = "8ea2a25344e6094fa82dfc097bbec5f1675f6058f2b7560deb4390bcbce5a0e7"
@@ -329895,7 +330301,7 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Classloader : FILE
hash = "8e544a5f0c242d1f7be503e045738369405d39731fcd553a38b568e0889af1f2"
logic_hash = "109c0063f4e8db6172fd872b3b93d4f069234f28bbf033fbd2c5f135051df77e"
score = 75
- quality = -25
+ quality = 0
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329932,14 +330338,14 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Encoded_Shell : FILE
date = "2021-01-07"
modified = "2023-07-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L6165-L6191"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L6165-L6191"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3eecc354390d60878afaa67a20b0802ce5805f3a9bb34e74dd8c363e3ca0ea5c"
hash = "f6c2112e3a25ec610b517ff481675b2ce893cb9f"
hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"
logic_hash = "74f45478e5bd7bb300e4ec493c2d3ef9a26340a141c3512a722618b3a3731500"
score = 75
- quality = 58
+ quality = 83
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -329965,13 +330371,13 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Netspy : FILE
date = "2021-01-24"
modified = "2024-12-09"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L6193-L6259"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L6193-L6259"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "94d1aaabde8ff9b4b8f394dc68caebf981c86587"
hash = "3870b31f26975a7cb424eab6521fc9bffc2af580"
logic_hash = "65432e42ad2626b62b1d1a6298c301513c2fb03d89193a77b053069cebcb45e9"
score = 75
- quality = -24
+ quality = 1
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -330016,8 +330422,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_By_String : FILE
date = "2021-01-09"
modified = "2025-08-18"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L6261-L6360"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L6261-L6360"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e9060aa2caf96be49e3b6f490d08b8a996c4b084"
hash = "4c2464503237beba54f66f4a099e7e75028707aa"
hash = "06b42d4707e7326aff402ecbb585884863c6351a"
@@ -330028,7 +330434,7 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_By_String : FILE
hash = "850f998753fde301d7c688b4eca784a045130039512cf51292fcb678187c560b"
logic_hash = "ab8d8df32ab745d8dd02d63d89264df2fbc0087daf6b4f91900ad03ab6e7949e"
score = 75
- quality = -6
+ quality = 19
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -330083,8 +330489,8 @@ rule SIGNATURE_BASE_WEBSHELL_JSP_Input_Upload_Write : FILE
date = "2021-01-24"
modified = "2024-12-09"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L6362-L6422"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L6362-L6422"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ef98ca135dfb9dcdd2f730b18e883adf50c4ab82"
hash = "583231786bc1d0ecca7d8d2b083804736a3f0a32"
hash = "19eca79163259d80375ebebbc440b9545163e6a3"
@@ -330128,8 +330534,8 @@ rule SIGNATURE_BASE_WEBSHELL_Generic_OS_Strings : FILE
date = "2021-01-12"
modified = "2024-12-09"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L6424-L6593"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L6424-L6593"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d5bfe40283a28917fcda0cefd2af301f9a7ecdad"
hash = "fd45a72bda0a38d5ad81371d68d206035cb71a14"
hash = "b4544b119f919d8cbf40ca2c4a7ab5c1a4da73a3"
@@ -330138,7 +330544,7 @@ rule SIGNATURE_BASE_WEBSHELL_Generic_OS_Strings : FILE
hash = "0353ae68b12b8f6b74794d3273967b530d0d526f"
logic_hash = "10b956cac601c97d1483d35a7730d7178c4175800b4e4c9ed62ad583d3cac3d7"
score = 50
- quality = -123
+ quality = -98
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -330209,14 +330615,14 @@ rule SIGNATURE_BASE_WEBSHELL_In_Image : FILE
date = "2021-02-27"
modified = "2024-03-11"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L6595-L6855"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L6595-L6855"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d4fde4e691db3e70a6320e78657480e563a9f87935af873a99db72d6a9a83c78"
hash = "84938133ee6e139a2816ab1afc1c83f27243c8ae76746ceb2e7f20649b5b16a4"
hash = "52b918a64afc55d28cd491de451bb89c57bce424f8696d6a94ec31fb99b17c11"
logic_hash = "e7e78107c661aa5124a37b8e492986e5a3da63c79c97c4dc3199e648a5aa4aa8"
score = 55
- quality = -192
+ quality = -167
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
importance = 70
@@ -330338,8 +330744,8 @@ rule SIGNATURE_BASE_WEBSHELL_Mixed_OBFUSC : FILE
date = "2023-01-28"
modified = "2023-04-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L6857-L6881"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L6857-L6881"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8c4e5c6bdfcc86fa27bdfb075a7c9a769423ec6d53b73c80cbc71a6f8dd5aace"
hash = "78f2086b6308315f5f0795aeaa75544128f14889a794205f5fc97d7ca639335b"
hash = "3bca764d44074820618e1c831449168f220121698a7c82e9909f8eab2e297cbd"
@@ -330372,8 +330778,8 @@ rule SIGNATURE_BASE_WEBSHELL_Cookie_Post_Obfuscation : FILE
date = "2023-01-28"
modified = "2023-04-05"
reference = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshells.yar#L6883-L6909"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshells.yar#L6883-L6909"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d08a00e56feb78b7f6599bad6b9b1d8626ce9a6ea1dfdc038358f4c74e6f65c9"
hash = "2ce5c4d31682a5a59b665905a6f698c280451117e4aa3aee11523472688edb31"
hash = "ff732d91a93dfd1612aed24bbb4d13edb0ab224d874f622943aaeeed4356c662"
@@ -330406,8 +330812,8 @@ rule SIGNATURE_BASE_Telebots_Intercepterng : FILE
date = "2016-12-14"
modified = "2023-12-05"
reference = "https://goo.gl/4if3HG"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_telebots.yar#L10-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_telebots.yar#L10-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5f9fef7974d37922ac91365588fbe7b544e13abbbde7c262fe30bade7026e118"
logic_hash = "cbf0d44d871ec471e891fb909612f58263ec0b0c702f87875f6e027362409318"
score = 75
@@ -330437,8 +330843,8 @@ rule SIGNATURE_BASE_Telebots_Killdisk_1 : FILE
date = "2016-12-14"
modified = "2023-12-05"
reference = "https://goo.gl/4if3HG"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_telebots.yar#L32-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_telebots.yar#L32-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8246f709efa922a485e1ca32d8b0d10dc752618e8b3fce4d3dd58d10e4a6a16d"
logic_hash = "e70d324c408bae1bb42b16f19cd0e6b87e8228c7480d571fef5266eee5695fd2"
score = 75
@@ -330467,8 +330873,8 @@ rule SIGNATURE_BASE_Telebots_Killdisk_2 : FILE
date = "2016-12-14"
modified = "2023-12-05"
reference = "https://goo.gl/4if3HG"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_telebots.yar#L53-L68"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_telebots.yar#L53-L68"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "26173c9ec8fd1c4f9f18f89683b23267f6f9d116196ed15655e9cb453af2890e"
logic_hash = "e4ae09a226c4eecae18e685423ef30b3776be518609f89a078c647fe8ee00f19"
score = 75
@@ -330493,8 +330899,8 @@ rule SIGNATURE_BASE_Telebots_Credraptor_Password_Stealer : FILE
date = "2016-12-14"
modified = "2023-01-06"
reference = "https://goo.gl/4if3HG"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_telebots.yar#L70-L88"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_telebots.yar#L70-L88"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "50b990f6555055a265fde98324759dbc74619d6a7c49b9fd786775299bf77d26"
logic_hash = "ed884cb7643a61109f87e2887bed7ddb838c73bce28812b76c35bb807629e116"
score = 75
@@ -330521,8 +330927,8 @@ rule SIGNATURE_BASE_Telebots_VBS_Backdoor_1 : FILE
date = "2016-12-14"
modified = "2023-12-05"
reference = "https://goo.gl/4if3HG"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_telebots.yar#L90-L106"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_telebots.yar#L90-L106"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eb31a918ccc1643d069cf08b7958e2760e8551ba3b88ea9e5d496e07437273b2"
logic_hash = "4ff4963058674cf71c123af74c0947da2edf3b5e2622261d14200f406dbe2992"
score = 75
@@ -330548,8 +330954,8 @@ rule SIGNATURE_BASE_Telebots_VBS_Backdoor_2 : FILE
date = "2016-12-14"
modified = "2023-12-05"
reference = "https://goo.gl/4if3HG"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_telebots.yar#L108-L123"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_telebots.yar#L108-L123"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b2a5922b58c8060844b43e14dfa5b0c8b119f281f54a46f0f1c34accde71ddb"
logic_hash = "299a2ca6eacc29b4a7697a8502a56cffda4f6bc6b3354d3cc133712c1755c476"
score = 75
@@ -330574,8 +330980,8 @@ rule SIGNATURE_BASE_Telebots_Win64_Spy_Keylogger_G : FILE
date = "2016-12-14"
modified = "2023-12-05"
reference = "https://goo.gl/4if3HG"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_telebots.yar#L125-L144"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_telebots.yar#L125-L144"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e3f134ae88f05463c4707a80f956a689fba7066bb5357f6d45cba312ad0db68e"
logic_hash = "1b4db8f290bd4f943a90669afd5bff6b766d0723fb3ee9c69d7097e737beadc8"
score = 75
@@ -330604,8 +331010,8 @@ rule SIGNATURE_BASE_Blackenergy3_Installer
date = "2015-05-29"
modified = "2023-12-05"
reference = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_blackenergy_installer.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_blackenergy_installer.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "78387651dd9608fcdf6bfb9df8b84db4"
hash = "78636f7bbd52ea80d79b4e2a7882403092bbb02d"
logic_hash = "c4c562124427fd394b56e48f16f2d262c8a717fc750b955b2b2a35acb478d5e7"
@@ -330628,8 +331034,8 @@ rule SIGNATURE_BASE_Asp_File : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L8-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L8-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ff5b1a9598735440bdbaa768b524c639e22f53c5"
logic_hash = "9ec19a994571f4d1b40b6d6af3fb6eb4c5004a6439b99863b50dae0262677263"
score = 75
@@ -330657,8 +331063,8 @@ rule SIGNATURE_BASE_Php_Killnc : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L28-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L28-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
logic_hash = "431a9a66f5d0e42856ca5716c2994c018f77cc338300abd71d94ffe7e75da3bf"
score = 75
@@ -330685,8 +331091,8 @@ rule SIGNATURE_BASE_Asp_Shell : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L47-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L47-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8bf1ff6f8edd45e3102be5f8a1fe030752f45613"
logic_hash = "af9c5cf7125e1210761e720c5f30527ac6345b5029b087807309000a29b67f6e"
score = 75
@@ -330715,8 +331121,8 @@ rule SIGNATURE_BASE_Settings : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L68-L83"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L68-L83"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
logic_hash = "b02e293e659fa77257d0642c57e51d6ae712d9221ae295cf69bb845f68c650ee"
score = 75
@@ -330741,8 +331147,8 @@ rule SIGNATURE_BASE_Asp_Proxy : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L85-L103"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L85-L103"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "51e97040d1737618b1775578a772fa6c5a31afd8"
logic_hash = "f53c97a2bf31f411b3220dc741b85d0edf96e9b92474f1abd5ac443be6b92897"
score = 75
@@ -330770,8 +331176,8 @@ rule SIGNATURE_BASE_Cfm_Shell : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L105-L120"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L105-L120"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "885e1783b07c73e7d47d3283be303c9719419b92"
logic_hash = "961eb398422e3c528b886c150f11dcb8a6832f0ea48e20ddc381e1f2740bd0c6"
score = 75
@@ -330796,8 +331202,8 @@ rule SIGNATURE_BASE_Aspx_Shell : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L122-L138"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L122-L138"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
logic_hash = "b31c36f53d46e17b6d97e582e46c540928a386e2075b841f5c11b959a0c68462"
score = 75
@@ -330823,8 +331229,8 @@ rule SIGNATURE_BASE_Php_Shell : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L140-L156"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L140-L156"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
logic_hash = "dc798508434686bbcb4fa0bb47381252bfa0491b0987956fd4c5aa13b7f57810"
score = 75
@@ -330850,8 +331256,8 @@ rule SIGNATURE_BASE_Php_Reverse_Shell : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L158-L173"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L158-L173"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3ef03bbe3649535a03315dcfc1a1208a09cea49d"
logic_hash = "ea8e320abb57e0467db92271f7d36f144f85e04ce15cd9fa8d3f53dfa8d43929"
score = 75
@@ -330876,8 +331282,8 @@ rule SIGNATURE_BASE_Php_Dns : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L175-L191"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L175-L191"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
logic_hash = "650eecc06f215ae6a15078c87d8a8c1597ca9e3d735eacd17b046a9d9deb6aa8"
score = 75
@@ -330903,8 +331309,8 @@ rule SIGNATURE_BASE_WEB_INF_Web : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L193-L207"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L193-L207"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0251baed0a16c451f9d67dddce04a45dc26cb4a3"
logic_hash = "b58bb63a5268812ed6a5d18c8da96b0fdae33e4802a2fba4964ab69e92517a16"
score = 75
@@ -330928,8 +331334,8 @@ rule SIGNATURE_BASE_Jsp_Cmd : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L209-L226"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L209-L226"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "55e4c3dc00cfab7ac16e7cfb53c11b0c01c16d3d"
logic_hash = "ab5b013a385549322bcb2811fa1a2d14b5633e2c41b9486b1e1c50c02437b8e6"
score = 75
@@ -330956,8 +331362,8 @@ rule SIGNATURE_BASE_Laudanum : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L228-L242"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L228-L242"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
logic_hash = "53caad87d22b5f13e5b7be8720baa1d436cc57d8062ec5d557df8524a2ccfb68"
score = 75
@@ -330981,8 +331387,8 @@ rule SIGNATURE_BASE_Php_File : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L244-L260"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L244-L260"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7421d33e8007c92c8642a36cba7351c7f95a4335"
logic_hash = "85c14a9c8a6aece231b1cb6dcdd7ed39fdc6aced868c34557ee2e2204ce7007b"
score = 75
@@ -331008,8 +331414,8 @@ rule SIGNATURE_BASE_Warfiles_Cmd : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L262-L278"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L262-L278"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3ae3d837e7b362de738cf7fad78eded0dccf601f"
logic_hash = "64724b24d9f5b5d78e231ea8196abb609237cc430c49f6ceeb99c9684a904568"
score = 75
@@ -331035,8 +331441,8 @@ rule SIGNATURE_BASE_Asp_Dns : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L280-L296"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L280-L296"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5532154dd67800d33dace01103e9b2c4f3d01d51"
logic_hash = "808e879238a0c24e975c260fc95c05c91bdc0f73553a241bd00f5bf7e6622639"
score = 75
@@ -331062,8 +331468,8 @@ rule SIGNATURE_BASE_Php_Reverse_Shell_2 : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L298-L312"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L298-L312"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "025db3c3473413064f0606d93d155c7eb5049c42"
logic_hash = "695dc565c273ed358f7d56526fa4956ba13b216d8897d0707e1660a82b745081"
score = 75
@@ -331087,8 +331493,8 @@ rule SIGNATURE_BASE_Laudanum_Tools_Generic : FILE
date = "2015-06-22"
modified = "2023-12-05"
reference = "http://laudanum.inguardians.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_laudanum_webshells.yar#L314-L345"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_laudanum_webshells.yar#L314-L345"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
hash = "885e1783b07c73e7d47d3283be303c9719419b92"
hash = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
@@ -331129,8 +331535,8 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Customlokitools : FILE
date = "2017-03-15"
modified = "2017-03-22"
reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_moonlightmaze.yar#L11-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_moonlightmaze.yar#L11-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "14cce7e641d308c3a177a8abb5457019"
hash = "a3164d2bbc45fb1eef5fde7eb8b245ea"
hash = "dabee9a7ea0ddaf900ef1e3e166ffe8a"
@@ -331167,8 +331573,8 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Customsniffer
date = "2017-03-15"
modified = "2023-12-05"
reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_moonlightmaze.yar#L50-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_moonlightmaze.yar#L50-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7b86f40e861705d59f5206c482e1f2a5"
hash = "927426b558888ad680829bd34b0ad0e7"
logic_hash = "5ccf9035adc16393db4b3d461f7a20f86f538275d7806280a15508c15d9c805c"
@@ -331198,8 +331604,8 @@ rule SIGNATURE_BASE_Loki2Crypto
date = "2017-03-21"
modified = "2023-12-05"
reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_moonlightmaze.yar#L82-L106"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_moonlightmaze.yar#L82-L106"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "19fbd8cbfb12482e8020a887d6427315"
hash = "ea06b213d5924de65407e8931b1e4326"
hash = "14ecd5e6fc8e501037b54ca263896a11"
@@ -331226,8 +331632,8 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_De_Tool
date = "2017-03-27"
modified = "2017-03-27"
reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_moonlightmaze.yar#L111-L137"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_moonlightmaze.yar#L111-L137"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4bc7ed168fb78f0dc688ee2be20c9703"
hash = "8b56e8552a74133da4bc5939b5f74243"
logic_hash = "f658e1aa2ddb84fe3c1de7c7c00f2148d232cf2b3381c298420abfc382c02986"
@@ -331253,8 +331659,8 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Cle_Tool
date = "2017-03-27"
modified = "2017-03-27"
reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_moonlightmaze.yar#L140-L167"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_moonlightmaze.yar#L140-L167"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "647d7b711f7b4434145ea30d0ef207b0"
logic_hash = "a4bbd7be617b944a656fa58ca9ec6384f624c95250de6b8a6ba63e7c3387484c"
score = 75
@@ -331282,8 +331688,8 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Xk_Keylogger
date = "2017-03-27"
modified = "2017-03-27"
reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_moonlightmaze.yar#L170-L202"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_moonlightmaze.yar#L170-L202"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b2acdef9c8e545f4ab217f529a7e4a3e74723b27ec89896f98639fd40792bcc8"
score = 75
quality = 35
@@ -331316,8 +331722,8 @@ rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Encrypted_Keylog : FILE
date = "2017-03-27"
modified = "2017-03-27"
reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_moonlightmaze.yar#L204-L222"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_moonlightmaze.yar#L204-L222"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "593f6f2148ddb52e2beee72a48135cd83f126edfdb263b471432d17273e536db"
score = 75
quality = 85
@@ -331339,8 +331745,8 @@ rule SIGNATURE_BASE_Winagent_Badpatch_1 : FILE
date = "2017-10-20"
modified = "2023-12-05"
reference = "https://goo.gl/RvDwwA"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_bad_patch.yar#L11-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_bad_patch.yar#L11-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "285998bce9692e46652529685775aa05e3a5cb93ee4e65d021d2231256e92813"
logic_hash = "568086edb8884877f9dcb0cffa1e4c05164e6884bf80ce50692cedfa3e8d5750"
score = 75
@@ -331377,8 +331783,8 @@ rule SIGNATURE_BASE_Winagent_Badpatch_2 : FILE
date = "2017-10-20"
modified = "2023-12-05"
reference = "https://goo.gl/RvDwwA"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_bad_patch.yar#L41-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_bad_patch.yar#L41-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "106deff16a93c4a4624fe96e3274e1432921c56d5a430834775e5b98861c00ea"
hash = "ece76fdf7e33d05a757ef5ed020140d9367c7319022a889923bbfacccb58f4d7"
hash = "cf53fc8c9ce4e5797cc5ac6f71d4cbc0f2b15f2ed43f38048a5273f40bc09876"
@@ -331421,8 +331827,8 @@ rule SIGNATURE_BASE_ATM_Malware_Javadispcash_1 : FILE
date = "2019-03-28"
modified = "2023-12-05"
reference = "https://twitter.com/r3c0nst/status/1111254169623674882"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_atm_javadipcash.yar#L1-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_atm_javadipcash.yar#L1-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0149667c0f8cbfc216ef9d1f3154643cbbf6940e6f24a09c92a82dd7370a5027"
hash = "ef407db8c79033027858364fd7a04eeb70cf37b7c3a10069a92bae96da88dfaa"
logic_hash = "9a714571281844cfe7193b7c183b86b797ef5de5d1922eacaf45dad8d41cfc52"
@@ -331450,8 +331856,8 @@ rule SIGNATURE_BASE_NTLM_Dump_Output
date = "2015-10-01"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/generic_dumps.yar#L17-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/generic_dumps.yar#L17-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "154de926d27d38b38a4ed2c14b9122213fd1deb4115ef3bb77366db0818c7572"
score = 75
quality = 85
@@ -331474,8 +331880,8 @@ rule SIGNATURE_BASE_Gsecdump_Password_Dump_File : FILE
date = "2018-03-06"
modified = "2023-12-05"
reference = "https://t.co/OLIj1yVJ4m"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/generic_dumps.yar#L32-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/generic_dumps.yar#L32-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "483ad5217cbc065bd2f791c473b9a2455fddc4e0123268a8d37c64d92dd78c43"
score = 65
quality = 85
@@ -331497,8 +331903,8 @@ rule SIGNATURE_BASE_SUSP_ZIP_Ntdsdit : T1003_003 FILE
date = "2020-08-10"
modified = "2023-12-05"
reference = "https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/generic_dumps.yar#L47-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/generic_dumps.yar#L47-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "371e30f50d96c884bd55ffc10d049d0ada881304746564a99dec0e8efad87602"
score = 50
quality = 85
@@ -331520,8 +331926,8 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_1 : FILE
date = "2018-02-07"
modified = "2023-12-05"
reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_middle_east_talosreport.yar#L13-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_middle_east_talosreport.yar#L13-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1176642841762b3bc1f401a5987dc55ae4b007367e98740188468642ffbd474e"
logic_hash = "e5ea689de4be64a02aed31c85a4bd56561ba932587998bc276ddba248d73fa2d"
score = 75
@@ -331542,8 +331948,8 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_2 : FILE
date = "2018-02-07"
modified = "2023-12-05"
reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_middle_east_talosreport.yar#L28-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_middle_east_talosreport.yar#L28-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "76a9b603f1f901020f65358f1cbf94c1a427d9019f004a99aa8bff1dea01a881"
logic_hash = "414e7760c56d2a1713258bb5c5f65e4fb561523ae037f8715d7fba5914ef9211"
score = 75
@@ -331570,8 +331976,8 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_3 : FILE
date = "2018-02-07"
modified = "2023-12-05"
reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_middle_east_talosreport.yar#L50-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_middle_east_talosreport.yar#L50-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b"
logic_hash = "7d45f9f624285ed13a16901335585490459f22ef8af157c38b720118735ed432"
score = 75
@@ -331598,8 +332004,8 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_4 : FILE
date = "2018-02-07"
modified = "2023-12-05"
reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_middle_east_talosreport.yar#L68-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_middle_east_talosreport.yar#L68-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c5bfb5118a999d21e9f445ad6ccb08eb71bc7bd4de9e88a41be9cf732156c525"
logic_hash = "83340b2d8f5f58f886eb318b80d7fbb0b9a4f5ad634db857edc405932f3ea5bc"
score = 75
@@ -331619,8 +332025,8 @@ rule SIGNATURE_BASE_ME_Campaign_Malware_5 : FILE
date = "2018-02-07"
modified = "2022-08-18"
reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_middle_east_talosreport.yar#L81-L100"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_middle_east_talosreport.yar#L81-L100"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d49e9fdfdce1e93615c406ae13ac5f6f68fb7e321ed4f275f328ac8146dd0fc1"
hash = "e66af059f37bdd35056d1bb6a1ba3695fc5ce333dc96b5a7d7cc9167e32571c5"
logic_hash = "b958a09be09de03e702a0653cf51148698b35c29bed90edbc3a65e485f0c3aa6"
@@ -331648,8 +332054,8 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Local_URL : FILE
date = "2019-09-27"
modified = "2023-12-05"
reference = "https://twitter.com/cglyer/status/1176184798248919044"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_url_persitence.yar#L2-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_url_persitence.yar#L2-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e95e5e97760d9b565184c588fdafe8408cdab61959aee5221485df53ef5f51d6"
score = 50
quality = 85
@@ -331672,12 +332078,12 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_SMB_URL : FILE
date = "2019-09-27"
modified = "2023-12-05"
reference = "https://twitter.com/cglyer/status/1176184798248919044"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_url_persitence.yar#L21-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_url_persitence.yar#L21-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e0bef7497fcb284edb0c65b59d511830"
logic_hash = "4903c8f4bb08e799f6787ad29cf7688f354f97a065bcd24c58d3ccd3778a6a15"
score = 50
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -331697,8 +332103,8 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Iconremote_Smborlocal : FILE
date = "2019-09-27"
modified = "2023-12-05"
reference = "https://twitter.com/ItsReallyNick/status/1176241449148588032"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_url_persitence.yar#L61-L78"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_url_persitence.yar#L61-L78"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8c49908c7f52ebcd512ff2dc8c40392767769130b9d39abb9d5fc9e130edb65c"
score = 50
quality = 85
@@ -331721,11 +332127,11 @@ rule SIGNATURE_BASE_Methodology_Shortcut_Hotkey : FILE
date = "2019-09-27"
modified = "2023-12-05"
reference = "https://twitter.com/cglyer/status/1176184798248919044"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_url_persitence.yar#L80-L97"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_url_persitence.yar#L80-L97"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a48f7c1125218ee89f58f1517e81150038a5d71889d847e7690b13c818b32fb5"
score = 50
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -331745,8 +332151,8 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Baseurlsyntax : FILE
date = "2019-09-27"
modified = "2023-12-05"
reference = "https://twitter.com/cglyer/status/1176184798248919044"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_url_persitence.yar#L99-L117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_url_persitence.yar#L99-L117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4aa29bedb5689fe16c067f5ea933e56804085712c7469b138d8b658a30a7eb67"
score = 50
quality = 85
@@ -331770,11 +332176,11 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Iconnotfromexeordllorico : F
date = "2019-09-27"
modified = "2023-12-05"
reference = "https://twitter.com/ItsReallyNick/status/1176229087196696577"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_url_persitence.yar#L161-L179"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_url_persitence.yar#L161-L179"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "957fe9f24d08033cf6e29d7e202e04bfb579577d3850a99e97da6b70924ae88e"
score = 50
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -331795,11 +332201,11 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Evasion : FILE
date = "2019-09-27"
modified = "2023-12-05"
reference = "https://twitter.com/DissectMalware/status/1176736510856634368"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_url_persitence.yar#L181-L198"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_url_persitence.yar#L181-L198"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c4fafae6af3ed5cc2e83e30427107d1c42cc4bc86d5c6a60e26953a11847029f"
score = 50
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -331819,11 +332225,11 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Lolcommand : FILE
date = "2019-09-27"
modified = "2021-02-14"
reference = "https://twitter.com/ItsReallyNick/status/1176601500069576704"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_url_persitence.yar#L201-L219"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_url_persitence.yar#L201-L219"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4ac9a555e61303a173443de2a189536c8ea0fc32ee73c589dd104275c7967c57"
score = 50
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -331843,11 +332249,11 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Webdav : FILE
date = "2019-09-27"
modified = "2023-12-05"
reference = "https://twitter.com/cglyer/status/1176243536754282497"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_url_persitence.yar#L222-L239"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_url_persitence.yar#L222-L239"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4fec084392140245eeb25bb512f3a4631ec6be08c197ec130a907fc118161197"
score = 50
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -331867,11 +332273,11 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Scripturl : FILE
date = "2019-09-27"
modified = "2023-12-05"
reference = "https://twitter.com/cglyer/status/1176184798248919044"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_url_persitence.yar#L241-L259"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_url_persitence.yar#L241-L259"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ece0013dbc9836fa800f99a10ab46c1eb081e1c04fe45fe17be26ffac1d464e9"
score = 50
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -331891,8 +332297,8 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Workingdirremote_HTTP : FILE
date = "2019-09-27"
modified = "2023-12-05"
reference = "https://twitter.com/cglyer/status/1176184798248919044"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_url_persitence.yar#L261-L278"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_url_persitence.yar#L261-L278"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c7c23c1253bf089519dec5f141f486425c6804640d9bffac9ce4c986ce25d323"
score = 50
quality = 85
@@ -331915,8 +332321,8 @@ rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Workingdirremote_SMB : FILE
date = "2019-09-27"
modified = "2023-12-05"
reference = "https://twitter.com/cglyer/status/1176184798248919044"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_url_persitence.yar#L280-L297"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_url_persitence.yar#L280-L297"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5d9caa64ac730d34a2dcfb3368f8302849275b6ee16fe31f20978d72382b0d73"
score = 50
quality = 85
@@ -331940,8 +332346,8 @@ rule SIGNATURE_BASE_APT12_Malware_Aug17 : FILE
date = "2017-08-30"
modified = "2023-12-05"
reference = "http://blog.macnica.net/blog/2017/08/post-fb81.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt12_malware.yar#L13-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt12_malware.yar#L13-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc7521c00ec2534cf494c0263ddf67ea4ba9915eb17bdc0b3ebe9e840ec63643"
hash = "42da51b69bd6625244921a4eef9a2a10153e012a3213e8e9877cf831aea3eced"
logic_hash = "0766376689540680f8db699f64aa89fc32ddef619a74864eb816c598b8d08c8a"
@@ -331962,8 +332368,8 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Dropper_Gen1 : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "http://snip.ly/giNB"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_threatgroup_3390.yar#L8-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_threatgroup_3390.yar#L8-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "808de72f1eae29e3c1b2c32be1b84c5064865a235866edf5e790d2a7ba709907"
hash = "f6f966d605c5e79de462a65df437ddfca0ad4eb5faba94fc875aba51a4b894a7"
hash = "f424965a35477d822bbadb821125995616dc980d3d4f94a68c87d0cd9b291df9"
@@ -332001,8 +332407,8 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Sample1 : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "http://snip.ly/giNB"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_threatgroup_3390.yar#L50-L65"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_threatgroup_3390.yar#L50-L65"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "be334d1f8fa65a723af65200a166c2bbdb06690c8b30fafe772600e4662fc68b"
hash = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
logic_hash = "746df577e952e0354342a48fe9f1650e63e3470902e7c5bba36d36fa34ea2bff"
@@ -332026,8 +332432,8 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Sample2 : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "http://snip.ly/giNB"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_threatgroup_3390.yar#L67-L84"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_threatgroup_3390.yar#L67-L84"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
logic_hash = "c7e945131a867bf46a467784d7119c95342733cc723cdeeb76d69c8fdb326749"
score = 80
@@ -332053,8 +332459,8 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Gen : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "http://snip.ly/giNB"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_threatgroup_3390.yar#L86-L124"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_threatgroup_3390.yar#L86-L124"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0299493ccb175d452866f5e21d023d3e92cd8d28452517d1d19c0f05f2c5ca27"
hash = "065d055a90da59b4bdc88b97e537d6489602cb5dc894c5c16aff94d05c09abc7"
hash = "05c7291db880f94c675eea336ecd66338bd0b1d49ad239cc17f9df08106e6684"
@@ -332101,8 +332507,8 @@ rule SIGNATURE_BASE_Plugx_Nvsmartmax_Gen : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "http://snip.ly/giNB"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_threatgroup_3390.yar#L126-L154"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_threatgroup_3390.yar#L126-L154"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "718fc72942b9b706488575c0296017971170463f6f40fa19b08fc84b79bf0cef"
hash = "1c0379481d17fc80b3330f148f1b87ff613cfd2a6601d97920a0bcd808c718d0"
hash = "555952aa5bcca4fa5ad5a7269fece99b1a04816d104ecd8aefabaa1435f65fa5"
@@ -332138,8 +332544,8 @@ rule SIGNATURE_BASE_Httpbrowser_RAT_Dropper_Gen2 : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "http://snip.ly/giNB"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_threatgroup_3390.yar#L156-L183"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_threatgroup_3390.yar#L156-L183"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
hash = "dfa984174268a9f364d856fd47cfaca75804640f849624d69d81fcaca2b57166"
logic_hash = "bf274053fe7729471716a710e3bd5ed027d6ab2c45f7af9a1103bfa1ada9cbf4"
@@ -332174,8 +332580,8 @@ rule SIGNATURE_BASE_Threatgroup3390_Strings : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "http://snip.ly/giNB"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_threatgroup_3390.yar#L185-L202"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_threatgroup_3390.yar#L185-L202"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d1e4889a48f4f9bfcc12237dd44cd8ad9db9918c6a5859de086d1ddc051ff937"
score = 60
quality = 85
@@ -332201,8 +332607,8 @@ rule SIGNATURE_BASE_Threatgroup3390_C2 : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "http://snip.ly/giNB"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_threatgroup_3390.yar#L204-L323"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_threatgroup_3390.yar#L204-L323"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "be411bb8e301eb4ba611bc9d6c8f0e3b8c27b87c2dd3f8405d0eba0296117697"
score = 60
quality = 60
@@ -332330,8 +332736,8 @@ rule SIGNATURE_BASE_Xrat_1 : FILE
date = "2017-12-11"
modified = "2023-12-05"
reference = "https://goo.gl/Pg3P4W"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_xrat.yar#L12-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_xrat.yar#L12-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b"
hash = "f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a"
logic_hash = "032c5af4f34959783102977543d2caf6199b8d1880a64797882f591e36c64d69"
@@ -332366,8 +332772,8 @@ rule SIGNATURE_BASE_APT_FIN7_Strings_Aug18_1
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L13-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L13-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b6354e46af0d69b6998dbed2fceae60a3b207584e08179748e65511d45849b00"
logic_hash = "89d2f8f28a7ab0e78c53d8c41b45efa60cfa9ff72306c49197f52342d9a3c546"
score = 75
@@ -332394,8 +332800,8 @@ rule SIGNATURE_BASE_APT_FIN7_Sample_Aug18_2 : FILE
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L32-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L32-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1513c7630c981e4b1d0d5a55809166721df4f87bb0fac2d2b8ff6afae187f01d"
logic_hash = "a46492383db5af8f60984b42c53a792632f836f1668fca2d564e0f1f1ed313f2"
score = 75
@@ -332422,8 +332828,8 @@ rule SIGNATURE_BASE_APT_FIN7_Maldoc_Aug18_1 : FILE
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L51-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L51-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9c12591c850a2d5355be0ed9b3891ccb3f42e37eaf979ae545f2f008b5d124d6"
logic_hash = "f3ecf77a5f909361f4a6af5ca0f25ec85721570587500a8ce2ef203158472e47"
score = 75
@@ -332446,8 +332852,8 @@ rule SIGNATURE_BASE_APT_FIN7_Sample_Aug18_1 : FILE
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L66-L93"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L66-L93"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a1e95ac1bb684186e9fb5c67f75c7c26ddc8b18ebfdaf061742ddf1675e17d55"
hash = "dc645aae5d283fa175cf463a19615ed4d16b1d5238686245574d8a6a8b0fc8fa"
hash = "eebbce171dab636c5ac0bf0fd14da0e216758b19c0ce2e5c572d7e6642d36d3d"
@@ -332483,8 +332889,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_1 : FILE
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L95-L108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L95-L108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7f16cbe7aa1fbc5b8a95f9d123f45b7e3da144cb88db6e1da3eca38cf88660cb"
logic_hash = "7144d4c7651e3fb288ef608fdff07af6cb223c90c34fb780d65184760386d5c7"
score = 75
@@ -332507,8 +332913,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_2 : FILE
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L110-L124"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L110-L124"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "60cd98fc4cb2ae474e9eab81cd34fd3c3f638ad77e4f5d5c82ca46f3471c3020"
logic_hash = "8e62c9488f211635ae30633a0d894b00e0ba2a7e7d4cb628117a166d4f0f9697"
score = 75
@@ -332532,8 +332938,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_3 : FILE
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L126-L140"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L126-L140"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "995b90281774798a376db67f906a126257d314efc21b03768941f2f819cf61a6"
logic_hash = "3f757bc4a6d46be85732fe33dd0a323c5774cbc1f0da2b984c5db14c1362745a"
score = 75
@@ -332557,8 +332963,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_4 : FILE
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L142-L157"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L142-L157"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4b5405fc253ed3a89c770096a13d90648eac10a7fb12980e587f73483a07aa4c"
logic_hash = "cd8a33c4e4f626d744e03f48e093f6a45223c74088b03185833ece8034614ca4"
score = 75
@@ -332583,8 +332989,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_5 : FILE
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L159-L173"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L159-L173"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7789a3d7d05c30b4efaf3f2f5811804daa56d78a9a660968a4f1f9a78a9108a0"
logic_hash = "893e144d86025db750b32ae69964578ec92862face706339a5bafb393e3c7091"
score = 75
@@ -332609,8 +333015,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_6 : FILE
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L175-L198"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L175-L198"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1439d301d931c8c4b00717b9057b23f0eb50049916a48773b17397135194424a"
logic_hash = "33db8e61b6220d9e16191228573d3d375cce9528241dcf1ad74d641f0959f03b"
score = 75
@@ -332640,8 +333046,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_7 : FILE
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L200-L214"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L200-L214"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ce8ce35f85406cd7241c6cc402431445fa1b5a55c548cca2ea30eeb4a423b6f0"
logic_hash = "212bc13d22d7bc6b0ef10ae034ea09c7ea0d0e66afd212fb55c09cf43344c2ec"
score = 75
@@ -332665,8 +333071,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_8 : FILE
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L216-L229"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L216-L229"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d8bda53d7f2f1e4e442a0e1c30a20d6b0ac9c6880947f5dd36f78e4378b20c5c"
logic_hash = "f15a8dfd3efb094ab73caebe9bffb5735762960445ca421cd49eaa091ecea300"
score = 75
@@ -332689,8 +333095,8 @@ rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_10 : FILE
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L231-L248"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L231-L248"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8cc02b721683f8b880c8d086ed055006dcf6155a6cd19435f74dd9296b74f5fc"
logic_hash = "1d6dba0c858eacea5bd67682a588105a2ff09d10bb60d9888ace07609c9b33de"
score = 75
@@ -332716,8 +333122,8 @@ rule SIGNATURE_BASE_APT_FIN7_Sample_EXE_Aug18_1 : FILE
date = "2018-08-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L250-L275"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L250-L275"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "608003c2165b0954f396d835882479f2504648892d0393f567e4a4aa90659bf9"
hash = "deb62514704852ccd9171d40877c59031f268db917c23d00a2f0113dab79aa3b"
hash = "16de81428a034c7b2636c4a875809ab62c9eefcd326b50c3e629df3b141cc32b"
@@ -332749,8 +333155,8 @@ rule SIGNATURE_BASE_APT_FIN7_Msdoc_Sep21_1 : FILE
date = "2021-09-07"
modified = "2023-12-05"
reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L277-L301"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L277-L301"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d60b6a8310373c9b84e6760c24185535"
logic_hash = "ffc91cdad91b8ab24840c6ef1a6c39aad081d986c21a88b3f2ea3ec1bcd3b52b"
score = 85
@@ -332777,8 +333183,8 @@ rule SIGNATURE_BASE_SUSP_OBFUSC_JS_Sept21_2 : FILE
date = "2021-09-07"
modified = "2023-12-05"
reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin7.yar#L303-L323"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L303-L323"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "235ff8fe5c033fd90d77ecf9ce80b59be7bf6ae5a2863a1c9365d8b125a7ff3f"
score = 65
quality = 85
@@ -332805,8 +333211,8 @@ rule SIGNATURE_BASE_Oilrig_Rgdoor_Gen1 : FILE
date = "2018-01-27"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig_rgdoor.yar#L13-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig_rgdoor.yar#L13-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a9c92b29ee05c1522715c7a2f9c543740b60e36373cb47b5620b1f3d8ad96bfa"
logic_hash = "896900f788337327d444495ba0cd4c7c327bb4f9166bc2a981a348cf2c34cbdb"
score = 80
@@ -332836,8 +333242,8 @@ rule SIGNATURE_BASE_Wmimplant
date = "2017-03-24"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_wmi_implant.yar#L10-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_wmi_implant.yar#L10-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "860d7c237c2395b4f51b8c9bd0ee6cab06af38fff60ce3563d160d50c11d2f78"
logic_hash = "6422514d25b723e7ab92c1af1301e51d9a93aa41da98791d96c4754a91b5a18e"
score = 75
@@ -332865,8 +333271,8 @@ rule SIGNATURE_BASE_Darkeyev3_Cryptor : FILE
date = "2015-05-24"
modified = "2023-12-05"
reference = "http://darkeyev3.blogspot.fi/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/generic_cryptors.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/generic_cryptors.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6b854b967397f7de0da2326bdd5d39e710e2bb12"
hash = "d53149968eca654fc0e803f925e7526fdac2786c"
hash = "7e3a8940d446c57504d6a7edb6445681cca31c65"
@@ -332897,8 +333303,8 @@ rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_1 : FILE
date = "2020-10-14"
modified = "2023-12-05"
reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_reddelta.yar#L2-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_reddelta.yar#L2-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "30b2bbce0ca4cb066721c94a64e2c37b7825dd72fc19c20eb0ab156bea0f8efc"
hash = "42ed73b1d5cc49e09136ec05befabe0860002c97eb94e9bad145e4ea5b8be2e2"
hash = "480a8c883006232361c5812af85de9799b1182f1b52145ccfced4fa21b6daafa"
@@ -332931,8 +333337,8 @@ rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_2 : FILE
date = "2020-10-14"
modified = "2023-12-05"
reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_reddelta.yar#L31-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_reddelta.yar#L31-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "260ebbf392498d00d767a5c5ba695e1a124057c1c01fff2ae76db7853fe4255b"
hash = "9ccb4ed133be5c9c554027347ad8b722f0b4c3f14bfd947edfe75a015bf085e5"
hash = "b3fd750484fca838813e814db7d6491fea36abe889787fb7cf3fb29d9d9f5429"
@@ -332964,8 +333370,8 @@ rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_3 : FILE
date = "2020-10-14"
modified = "2022-12-21"
reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_reddelta.yar#L59-L78"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_reddelta.yar#L59-L78"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "740992d40b84b10aa9640214a4a490e989ea7b869cea27dbbdef544bb33b1048"
logic_hash = "64402f6265f23abf7d6a711aa888c89386c1a754f12286b0efe5fd5d81f15b01"
score = 75
@@ -332991,8 +333397,8 @@ rule SIGNATURE_BASE_Neuron_Common_Strings : FILE
date = "2017-11-23"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_neuron.yar#L9-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_neuron.yar#L9-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
logic_hash = "5f7a704fa0b6892b40868689c876e2f8252bb7319424212454408cbdf66f0b9f"
score = 75
@@ -333024,8 +333430,8 @@ rule SIGNATURE_BASE_Nautilus_Forensic_Artificats
date = "2017-11-23"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_neuron.yar#L98-L125"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_neuron.yar#L98-L125"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "17ae559a4640636f1285c7078a4366954d5a41c098419db32315e354f0ae619d"
score = 60
quality = 85
@@ -333062,8 +333468,8 @@ rule SIGNATURE_BASE_APT_Donotteam_Ytyframework : APT DONOTTEAM WINDOWS FILE
date = "2018-08-03"
modified = "2023-12-05"
reference = "https://labs.bitdefender.com/2017/09/ehdevel-the-story-of-a-continuously-improving-advanced-threat-creation-toolkit/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_donotteam_ytyframework.yar#L3-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_donotteam_ytyframework.yar#L3-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1e0c1b97925e1ed90562d2c68971e038d8506b354dd6c1d2bcc252d2a48bc31c"
logic_hash = "8e2841fd4550f12d88fb451a893f1ba41f0d3c123d9c195fe97366202376ef61"
score = 75
@@ -333107,8 +333513,8 @@ rule SIGNATURE_BASE_SUSP_Unsigned_Googleupdate : FILE
date = "2019-08-05"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_google_anomaly.yar#L3-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_google_anomaly.yar#L3-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354"
logic_hash = "5e333ac773927e2ed1f6aa4d6bbcb63d67bcc8d18d732a84bb68cb503469b247"
score = 60
@@ -333134,8 +333540,8 @@ rule SIGNATURE_BASE_SUSP_VEST_Encryption_Core_Accumulator_Jan21 : FILE
date = "2021-01-28"
modified = "2023-12-05"
reference = "https://twitter.com/ochsenmeier/status/1354737155495649280"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_jan21.yar#L2-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_jan21.yar#L2-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7cd3ca8bdfb44e98a4b9d0c6ad77546e03d169bda9bdf3d1bcf339f68137af23"
logic_hash = "41fe42b2f2b5fb54b7ff19b74a35aadd928be9a3c7280ee9feffc4a142924b07"
score = 70
@@ -333166,8 +333572,8 @@ rule SIGNATURE_BASE_Hiddencobra_BANKSHOT_Gen : FILE
date = "2017-12-26"
modified = "2022-06-10"
reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hiddencobra_bankshot.yar#L11-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hiddencobra_bankshot.yar#L11-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486"
hash = "8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247"
hash = "b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24"
@@ -333221,8 +333627,8 @@ rule SIGNATURE_BASE_Unauthorized_Proxy_Server_RAT
date = "2017-12-26"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hiddencobra_bankshot.yar#L67-L92"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hiddencobra_bankshot.yar#L67-L92"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c74e289ad927e81d2a1a56bc73e394ab"
hash = "2950e3741d7af69e0ca0c5013abc4209"
logic_hash = "7ede26272ddcb25dca2b44ff08b232f358078872f6cf76491b0fd8d65772c60d"
@@ -333258,8 +333664,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Metasploitpayload : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L10-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L10-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a85ca27537ebeb79601b885b35ddff6431860b5852c6a664d32a321782808c54"
logic_hash = "1399818f71544245a7b689a7eb4da794b10814590e4c5f545fc28237ffa3d0f6"
score = 75
@@ -333283,8 +333689,8 @@ rule SIGNATURE_BASE_Empire_Exploit_Jenkins : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L26-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L26-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a5182cccd82bb9984b804b365e07baba78344108f225b94bd12a59081f680729"
logic_hash = "caf65814a1aeb0e14ec6430f7d5692b9c090bdc0d453566f0b0abd703f74bac7"
score = 75
@@ -333309,8 +333715,8 @@ rule SIGNATURE_BASE_Empire_Get_Securitypackages : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L43-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L43-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5d06e99121cff9b0fce74b71a137501452eebbcd1e901b26bde858313ee5a9c1"
logic_hash = "2d63fdcc6713d2f7645b16cf3e79a6e951c7751a10bfa0e2853def47ea9547d2"
score = 75
@@ -333334,8 +333740,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Powerdump : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L59-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L59-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "095c5cf5c0c8a9f9b1083302e2ba1d4e112a410e186670f9b089081113f5e0e1"
logic_hash = "e460d015be54a88d0eb5741a9c32cf6d7a410e0beb5356402af0dd19d1b4c6f2"
score = 75
@@ -333360,8 +333766,8 @@ rule SIGNATURE_BASE_Empire_Install_SSP : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L76-L89"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L76-L89"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7fd921a23950334257dda57b99e03c1e1594d736aab2dbfe9583f99cd9b1d165"
logic_hash = "bf0966d0141d4606983f267face635ef5fddbc73282f02f0a0ae6fcf89f2e6dc"
score = 75
@@ -333384,8 +333790,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Shellcodemsil : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L91-L107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L91-L107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9a9c6c9eb67bde4a8ce2c0858e353e19627b17ee2a7215fa04a19010d3ef153f"
logic_hash = "eb556fb8b558145e7e981ab3c3ccfb2656512498b917c705e53bc5b9f3650155"
score = 75
@@ -333411,8 +333817,8 @@ rule SIGNATURE_BASE_HKTL_Empire_Powerup : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L109-L122"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L109-L122"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ad9a5dff257828ba5f15331d59dd4def3989537b3b6375495d0c08394460268c"
logic_hash = "d55674866a1a14d4f4c2b5529e47e005ca4b433383bf112af6da41d7f84afdb7"
score = 75
@@ -333435,8 +333841,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Mimikatz_Gen : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L124-L138"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L124-L138"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
logic_hash = "a28297025b9b0178ab437996ffd3e0c28526f1edaf61db659093fe41a356cf40"
score = 75
@@ -333460,8 +333866,8 @@ rule SIGNATURE_BASE_Empire_Get_Gpppassword : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L140-L155"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L140-L155"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "55a4519c4f243148a971e4860225532a7ce730b3045bde3928303983ebcc38b0"
logic_hash = "3c879e50805e8b89fc8f3a7c7da2c8e906c89f210ab74194daca6b0ba2d312ba"
score = 75
@@ -333486,8 +333892,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Smbscanner : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L157-L171"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L157-L171"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9a705f30766279d1e91273cfb1ce7156699177a109908e9a986cc2d38a7ab1dd"
logic_hash = "5feb32dd0fc5271256dc4a088b9b02b591dbe584759db7ee4f5a6c99f42c3c0c"
score = 75
@@ -333511,8 +333917,8 @@ rule SIGNATURE_BASE_Empire_Exploit_Jboss : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L173-L190"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L173-L190"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9ea3e00b299e644551d90bbee0ce3e4e82445aa15dab7adb7fcc0b7f1fe4e653"
logic_hash = "a0eef14c3966745a0f2b7eb404eed122a11eea2fb82884ebd2087b3ab90bff93"
score = 75
@@ -333539,8 +333945,8 @@ rule SIGNATURE_BASE_Empire_Dumpcredstore : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L192-L207"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L192-L207"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c1e91a5f9cc23f3626326dab2dcdf4904e6f8a332e2bce8b9a0854b371c2b350"
logic_hash = "7136920e531d7ab621e743c5c89c0d817fe453108878e3c808814ca48ad57fb3"
score = 75
@@ -333565,8 +333971,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Egresscheck : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L209-L222"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L209-L222"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e2d270266abe03cfdac66e6fc0598c715e48d6d335adf09a9ed2626445636534"
logic_hash = "693564e0bd98ebd03cd433d8ba1003051a5cf6b1f0c05d3c5a4682e6d667327e"
score = 75
@@ -333589,8 +333995,8 @@ rule SIGNATURE_BASE_Empire_Reflectivepick_X64_Orig : FILE
date = "2016-11-05"
modified = "2022-12-21"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L224-L240"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L224-L240"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a8c1b108a67e7fc09f81bd160c3bafb526caf3dbbaf008efb9a96f4151756ff2"
logic_hash = "a87c5f1da9c490887cba5e9837ca40ac92b63d8c36b682f4be770ac061b5acdf"
score = 75
@@ -333614,8 +334020,8 @@ rule SIGNATURE_BASE_Empire_Out_Minidump : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L242-L256"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L242-L256"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7803ae7ba5d4e7d38e73745b3f321c2ca714f3141699d984322fa92e0ff037a1"
logic_hash = "7ce4ac95ac942a2ad758b1d9034e6ec50d25d195ba1c2ae95a90a7490708e485"
score = 75
@@ -333639,8 +334045,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Psexec : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L258-L273"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L258-L273"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0218be4323959fc6379489a6a5e030bb9f1de672326e5e5b8844ab5cedfdcf88"
logic_hash = "86af63a3be5b4940966932b129edbe4cca5ac1a31d120ba44fdca739e9c97ad4"
score = 75
@@ -333665,8 +334071,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Postexfil : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L275-L289"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L275-L289"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "00c0479f83c3dbbeff42f4ab9b71ca5fe8cd5061cb37b7b6861c73c54fd96d3e"
logic_hash = "74602d1c4986e6392df8845e0ed713499aa3b93c64e9d68e95f9dbaf60fe4299"
score = 75
@@ -333690,8 +334096,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Smbautobrute : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L291-L305"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L291-L305"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7950f8abdd8ee09ed168137ef5380047d9d767a7172316070acc33b662f812b2"
logic_hash = "dd87a5d3a710017953c8c19862e4daee25de0e57175cab8246eea6d067fcb4d1"
score = 75
@@ -333715,8 +334121,8 @@ rule SIGNATURE_BASE_Empire_Get_Keystrokes : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L307-L320"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L307-L320"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c36e71db39f6852f78df1fa3f67e8c8a188bf951e96500911e9907ee895bf8ad"
logic_hash = "710e1bbf517c6683bd3082786e605cb8e6a52460f9c96609610e5ab38800dc79"
score = 75
@@ -333739,8 +334145,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Dllinjection : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L322-L335"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L322-L335"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "304031aa9eca5a83bdf1f654285d86df79cb3bba4aa8fe1eb680bd5b2878ebf0"
logic_hash = "450ca96dd7c80275d7e4eaf07a7229e27530c373b8d79af5be8f4a741daef448"
score = 75
@@ -333763,8 +334169,8 @@ rule SIGNATURE_BASE_Empire_Keepassconfig : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L337-L350"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L337-L350"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5a76e642357792bb4270114d7cd76ce45ba24b0d741f5c6b916aeebd45cff2b3"
logic_hash = "044c8a326ee6cc74a918e6c28100032bfd2fb396ddab8683ab11e00f9370ab2a"
score = 75
@@ -333787,8 +334193,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Sshcommand : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L352-L367"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L352-L367"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cbaf086b14d5bb6a756cbda42943d4d7ef97f8277164ce1f7dd0a1843e9aa242"
logic_hash = "3749c3d58335cb08bff66fe3126fc4977261576a9fbedbd7da673e3921364850"
score = 75
@@ -333813,8 +334219,8 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen1 : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L371-L390"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L371-L390"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
hash = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
hash = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
@@ -333843,8 +334249,8 @@ rule SIGNATURE_BASE_Empire_Powerup_Gen : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L392-L407"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L392-L407"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ad9a5dff257828ba5f15331d59dd4def3989537b3b6375495d0c08394460268c"
logic_hash = "4086b057b46cac85bb871d2d4363d4ae4c99a160e5c9625e4d41e3df55fece2d"
score = 75
@@ -333869,8 +334275,8 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen2 : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L409-L428"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L409-L428"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
hash = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
hash = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
@@ -333899,8 +334305,8 @@ rule SIGNATURE_BASE_Empire_Agent_Gen : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L430-L447"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L430-L447"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "380fd09bfbe47d5c8c870c1c97ff6f44982b699b55b61e7c803d3423eb4768db"
hash = "380fd09bfbe47d5c8c870c1c97ff6f44982b699b55b61e7c803d3423eb4768db"
logic_hash = "ed8aee7ac6c1d93b21cc1aa5c3c18df1566692c63a010715a3aae65e18fffa60"
@@ -333927,8 +334333,8 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen3 : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L449-L467"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L449-L467"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
hash = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
hash = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
@@ -333956,8 +334362,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Inveighrelay_Gen : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L469-L484"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L469-L484"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "21b90762150f804485219ad36fa509aeda210d46453307a9761c816040312f41"
logic_hash = "183a0afa9233e380471ddfa8f85e6c6555d69c785c9a4e8791e19432b6849558"
score = 75
@@ -333982,8 +334388,8 @@ rule SIGNATURE_BASE_Empire_Keepassconfig_Gen : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L486-L500"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L486-L500"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5a76e642357792bb4270114d7cd76ce45ba24b0d741f5c6b916aeebd45cff2b3"
logic_hash = "986f299d2b6e2ec47acae09d8a25b6c45caf83c964208c594433308cd11ad264"
score = 75
@@ -334007,8 +334413,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Portscan_Gen : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L502-L517"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L502-L517"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cf7030be01fab47e79e4afc9e0d4857479b06a5f68654717f3bc1bc67a0f38d3"
logic_hash = "05e786dc42ee5ec56197803577d104595ad6554e028b7633b2f7fdf55a63e27c"
score = 75
@@ -334033,8 +334439,8 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen4 : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L519-L545"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L519-L545"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "743c51334f17751cfd881be84b56f648edbdaf31f8186de88d094892edc644a9"
hash = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
hash = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
@@ -334070,8 +334476,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Credentialinjection_Invoke_Mimikatz_Gen : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L547-L563"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L547-L563"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
hash = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
logic_hash = "3210b4407c3209a20d74c8c5af66077cc9b902912ae49253883b7acd87eef1f9"
@@ -334097,8 +334503,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Gen : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L565-L582"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L565-L582"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
hash = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
hash = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
@@ -334125,8 +334531,8 @@ rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen5 : FILE
date = "2016-11-05"
modified = "2023-12-05"
reference = "https://github.com/adaptivethreat/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_empire.yar#L584-L601"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_empire.yar#L584-L601"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
hash = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
hash = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
@@ -334153,8 +334559,8 @@ rule SIGNATURE_BASE_Bronzebutler_Daserf_Delphi_1 : FILE
date = "2017-10-14"
modified = "2023-12-05"
reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bronze_butler.yar#L13-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bronze_butler.yar#L13-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "89a80ca92600af64eb9c32cab4e936c7d675cf815424d72438973e2d6788ef64"
hash = "b1bd03cd12638f44d9ace271f65645e7f9b707f86e9bcf790e0e5a96b755556b"
hash = "22e1965154bdb91dd281f0e86c8be96bf1f9a1e5fe93c60a1d30b79c0c0f0d43"
@@ -334188,8 +334594,8 @@ rule SIGNATURE_BASE_Bronzebutler_Daserf_C_1 : FILE
date = "2017-10-14"
modified = "2023-12-05"
reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bronze_butler.yar#L38-L78"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bronze_butler.yar#L38-L78"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a4afd9df1b4cc014c3a89d7b4a560fa3e368b02286c42841762714b23e68cc05"
hash = "90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2"
hash = "331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b"
@@ -334233,8 +334639,8 @@ rule SIGNATURE_BASE_Bronzebutler_Dget_1 : FILE
date = "2017-10-14"
modified = "2023-12-05"
reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bronze_butler.yar#L80-L93"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bronze_butler.yar#L80-L93"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bd81521445639aaa5e3bcb5ece94f73feda3a91880a34a01f92639f8640251d6"
logic_hash = "2d5537f581039fa4561950402a34cbd9abd54c167d659fbbe74f1cb83217e3fb"
score = 75
@@ -334257,8 +334663,8 @@ rule SIGNATURE_BASE_Bronzebutler_Uacbypass_1 : FILE
date = "2017-10-14"
modified = "2023-12-05"
reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bronze_butler.yar#L95-L113"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bronze_butler.yar#L95-L113"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fe06b99a0287e2b2d9f7faffbda3a4b328ecc05eab56a3e730cfc99de803b192"
logic_hash = "64b70b9f5963be9009025c14a6e98be9642599af5226f77946b6255116fc22d8"
score = 75
@@ -334286,8 +334692,8 @@ rule SIGNATURE_BASE_Bronzebutler_Xxmm_1 : FILE
date = "2017-10-14"
modified = "2023-12-05"
reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bronze_butler.yar#L115-L140"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bronze_butler.yar#L115-L140"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7197de18bc5a4c854334ff979f3e4dafa16f43d7bf91edfe46f03e6cc88f7b73"
logic_hash = "eb9c12cbe2fe132a9588b744d10caee12716f622c31da8a1cee4c0f88d693e8e"
score = 75
@@ -334318,8 +334724,8 @@ rule SIGNATURE_BASE_Bronzebutler_Rarstar_1 : FILE
date = "2017-10-14"
modified = "2023-12-05"
reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bronze_butler.yar#L142-L158"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bronze_butler.yar#L142-L158"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0fc1b4fdf0dc5373f98de8817da9380479606f775f5aa0b9b0e1a78d4b49e5f4"
logic_hash = "0e418e595020d91c575051c3b1639b09efad150c625b62eec3d1331f9792641b"
score = 75
@@ -334345,8 +334751,8 @@ rule SIGNATURE_BASE_Daserf_Nov1_Bronzebutler : FILE
date = "2017-11-08"
modified = "2023-12-05"
reference = "https://goo.gl/ffeCfd"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bronze_butler.yar#L170-L196"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bronze_butler.yar#L170-L196"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5ede6f93f26ccd6de2f93c9bd0f834279df5f5cfe3457915fae24a3aec46961b"
logic_hash = "75edc17c51f4ea82ff7722df2f5825721ff64445fb8c78b450f1333bd32b5829"
score = 75
@@ -334379,8 +334785,8 @@ rule SIGNATURE_BASE_RAT_AAR
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/AAR"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L1-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L1-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a206b3f5cf6cc870135bc267b5baab8333422dc917efce6c66ee907690592d09"
score = 75
quality = 85
@@ -334408,8 +334814,8 @@ rule SIGNATURE_BASE_RAT_Adzok
date = "2015-01-05"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Adzok"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L24-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L24-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ee3291a4396ba6cb3c5e22229de4f5e45714b29bfeac1c56bde6d038a9d25458"
score = 75
quality = 85
@@ -334440,8 +334846,8 @@ rule SIGNATURE_BASE_RAT_Ap0Calypse
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Ap0calypse"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L50-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L50-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1ce90a5b1b3f643d4e530d6e00741f5d5918d3199cfbc4126cf8421a9e42023e"
score = 75
quality = 85
@@ -334469,8 +334875,8 @@ rule SIGNATURE_BASE_RAT_Arcom
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Arcom"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L72-L93"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L72-L93"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dbccd9885ba0ec5741e3c74908d2e76b15836bc75373c100f344abf9bdf3a0b4"
score = 75
quality = 85
@@ -334498,8 +334904,8 @@ rule SIGNATURE_BASE_RAT_Bandook
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/bandook"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L95-L120"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L95-L120"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fe658e0990f0d456b1a8f5acea62a3b80bdd4a9bc0eedfe2e1092ea60b4fca2e"
score = 75
quality = 85
@@ -334531,8 +334937,8 @@ rule SIGNATURE_BASE_RAT_Blacknix
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/BlackNix"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L122-L142"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L122-L142"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "de8787fd35e6313c061b8759361698b1acd54b215d226839a8702b1a5d189ccb"
score = 75
quality = 85
@@ -334559,8 +334965,8 @@ rule SIGNATURE_BASE_RAT_Blackshades : BLACKSHADES
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L144-L161"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L144-L161"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "23f8d52cf92b594f9302d549cf54f37dc0a01b5686da74b72120a8072435abfe"
score = 75
quality = 85
@@ -334584,8 +334990,8 @@ rule SIGNATURE_BASE_RAT_Bluebanana
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/BlueBanana"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L163-L184"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L163-L184"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0d84bb63d56d876c8b2e7c8c8afeaba839fee41d2d38f16ac9a13e802008179e"
score = 75
quality = 85
@@ -334613,8 +335019,8 @@ rule SIGNATURE_BASE_RAT_Bozok
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Bozok"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L186-L206"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L186-L206"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9a2fcd11573654f0c91c0c0dec8938ca8319a23953a5043135cb0032562f9f53"
score = 75
quality = 75
@@ -334641,8 +335047,8 @@ rule SIGNATURE_BASE_RAT_Clientmesh : TORCT
date = "2014-01-06"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/ClientMesh"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L208-L228"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L208-L228"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "671da9586110726b1646d4365ccaa87982ec7c86b7d4d80b99dbb444496b936c"
score = 75
quality = 85
@@ -334669,8 +335075,8 @@ rule SIGNATURE_BASE_RAT_Cybergate
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/CyberGate"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L230-L254"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L230-L254"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6b3861ae5e6bd6478e9d8024b0e67a3ac1dbf31083b77477364c55b51d0ed9b5"
score = 75
quality = 85
@@ -334700,8 +335106,8 @@ rule SIGNATURE_BASE_RAT_Darkcomet
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/DarkComet"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L256-L282"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L256-L282"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "db139f754f89affc706e090a41bfcd30cf49f9d4e16ade89993ee170f92cf68b"
score = 75
quality = 85
@@ -334732,8 +335138,8 @@ rule SIGNATURE_BASE_RAT_Darkrat
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/DarkRAT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L284-L306"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L284-L306"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dccb473a3cf4478dd1dbf8b35ad564f59740676ecde90266a0dc15cbad89bfe7"
score = 75
quality = 85
@@ -334762,8 +335168,8 @@ rule SIGNATURE_BASE_RAT_Greame
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Greame"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L308-L331"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L308-L331"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4a1ce5f5847bdc01d286c1d9cd1e16ba2fd6b5bc56e6094cb1492882708e8e59"
score = 75
quality = 85
@@ -334793,8 +335199,8 @@ rule SIGNATURE_BASE_RAT_Hawkeye
date = "2015-01-06"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/HawkEye"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L333-L357"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L333-L357"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "db3a0fe5774f0d137e092a4eb9672a4518d0ef943a1a4619cb646a9ac9f74ee0"
score = 75
quality = 85
@@ -334825,8 +335231,8 @@ rule SIGNATURE_BASE_RAT_Imminent
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Imminent"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L359-L389"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L359-L389"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "aebae753c119950b0b3f315c7279866caf15f4d482c0a47912c90885adcf6db2"
score = 75
quality = 85
@@ -334862,8 +335268,8 @@ rule SIGNATURE_BASE_RAT_Infinity
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Infinity"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L391-L414"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L391-L414"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c1f5381755af6cfbb10a4769757cdeffb9651bddc76bc4c8e9765ed44bf37fe6"
score = 75
quality = 85
@@ -334893,8 +335299,8 @@ rule SIGNATURE_BASE_RAT_Lostdoor
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/LostDoor"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L440-L465"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L440-L465"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7ffa6f5cbeacca5a1e750e35d8296658d4e280078a61f94fd5f2d4b7c800bb44"
score = 75
quality = 85
@@ -334926,8 +335332,8 @@ rule SIGNATURE_BASE_RAT_Luminositylink
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/LuminosityLink"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L467-L493"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L467-L493"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5e70e3e0885d098f1ac2bcc324cd8ad2682fbfc395f189cabc4a4f97a0109682"
score = 75
quality = 60
@@ -334960,8 +335366,8 @@ rule SIGNATURE_BASE_RAT_Luxnet
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/LuxNet"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L495-L516"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L495-L516"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "55d872e2e30f6d55a6f91750bbb52675042e4673d712a4f2417af43b0f2c4fb9"
score = 75
quality = 85
@@ -334989,8 +335395,8 @@ rule SIGNATURE_BASE_RAT_Netwire
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/NetWire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L547-L569"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L547-L569"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6a4e757262c02dfe46ac28940b53a5695df2d242ccd4c16b42fbfdcf96072e91"
score = 75
quality = 60
@@ -335019,8 +335425,8 @@ rule SIGNATURE_BASE_RAT_Pandora
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Pandora"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L571-L599"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L571-L599"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d33598d0699bfb7e996047318099302c2c326e45d993a259c2bc145acf8cf54b"
score = 75
quality = 85
@@ -335055,8 +335461,8 @@ rule SIGNATURE_BASE_RAT_Paradox
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Paradox"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L601-L623"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L601-L623"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fef41262b78a497c65c7548c58d78ba8912725b28606fd9e99d1dbc19bdf7393"
score = 75
quality = 85
@@ -335085,8 +335491,8 @@ rule SIGNATURE_BASE_RAT_Plasma
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Plasma"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L625-L649"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L625-L649"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e73348d379c483a7917cf765a457739aed6940f180272fa8d0c0dd1eb8e5f562"
score = 75
quality = 85
@@ -335117,8 +335523,8 @@ rule SIGNATURE_BASE_RAT_Poisonivy
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/PoisonIvy"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L651-L672"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L651-L672"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "874e0dfb22a03abc0f7fdc7209ff13b55dfa5dcc17db944903ca37a549eb331d"
score = 75
quality = 85
@@ -335146,8 +335552,8 @@ rule SIGNATURE_BASE_RAT_Predatorpain
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/PredatorPain"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L674-L702"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L674-L702"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "917234f83f891ad00bd83908c244818f517ea89cf7d8c81cfc3618b8386c1804"
score = 75
quality = 85
@@ -335182,8 +335588,8 @@ rule SIGNATURE_BASE_RAT_Punisher
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Punisher"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L704-L726"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L704-L726"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9347b8053393c3537693273c44a2a2f095928b8bc0cdcf9365a6f060d66efeb5"
score = 75
quality = 60
@@ -335212,8 +335618,8 @@ rule SIGNATURE_BASE_RAT_Pythorat
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/PythoRAT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L728-L751"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L728-L751"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8edcfb8f234ff225537d19343c75788ec2a25940e80042751eea3280a967e166"
score = 75
quality = 85
@@ -335243,8 +335649,8 @@ rule SIGNATURE_BASE_RAT_Qrat
date = "2015-01-08"
modified = "2023-12-05"
reference = "http://malwareconfig.com"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L753-L773"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L753-L773"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6d404153ca64b547885e4e4581205f5fc20faf86e8ab18002c5deedca2487225"
score = 75
quality = 85
@@ -335271,8 +335677,8 @@ rule SIGNATURE_BASE_RAT_Sakula : FILE
date = "2015-10-13"
modified = "2023-12-05"
reference = "http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L775-L817"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L775-L817"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ec4e16deb6f4a671ee665c81568e87dc9a1023328e1be242eae015c1e04cfcef"
score = 75
quality = 85
@@ -335313,8 +335719,8 @@ rule SIGNATURE_BASE_RAT_Shadowtech : FILE
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/ShadowTech"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L819-L839"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L819-L839"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8ab024ae5ca62de30daf4392db5241220fcdb9b419bad555a996729aed9fa45d"
score = 75
quality = 83
@@ -335343,8 +335749,8 @@ rule SIGNATURE_BASE_RAT_Smallnet
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/SmallNet"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L841-L861"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L841-L861"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "17a6be371ce0c616cfea0b42a30e6d9118376912002d59790b133c73fd5436a3"
score = 75
quality = 85
@@ -335371,8 +335777,8 @@ rule SIGNATURE_BASE_RAT_Spygate
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/SpyGate"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L863-L890"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L863-L890"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5b891212f3a669c6066cfddef418faafd75c92bb2f1e8e1f48403422a73bc9fa"
score = 75
quality = 83
@@ -335406,8 +335812,8 @@ rule SIGNATURE_BASE_RAT_Sub7Nation
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Sub7Nation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L892-L913"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L892-L913"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "bd6c423cd5cb5a86b20e5e65ab460904548b8814c92ac65e497757bb79a27681"
score = 75
quality = 85
@@ -335435,8 +335841,8 @@ rule SIGNATURE_BASE_RAT_Vertex
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Vertex"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L915-L938"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L915-L938"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c9fb0dedd97240ad29924865118ba34f5d79dbefbb13729d96d41336ec4de39e"
score = 75
quality = 85
@@ -335466,8 +335872,8 @@ rule SIGNATURE_BASE_RAT_Virusrat
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/VirusRat"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L940-L967"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L940-L967"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8540296fe1341a793377494cec9ba6ee0313203bee9997f0da0b692959727c59"
score = 75
quality = 85
@@ -335501,8 +335907,8 @@ rule SIGNATURE_BASE_RAT_Xtreme
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/Xtreme"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L969-L990"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L969-L990"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4dec8de6609f8229444291a78e920ac48b9b5751dd0cad7c95bc6529d6f8c16c"
score = 75
quality = 85
@@ -335530,8 +335936,8 @@ rule SIGNATURE_BASE_RAT_Adwind
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/adWind"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L992-L1011"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L992-L1011"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "11167b927fa06324950753c6ec8f28058f2aa66fb4ecdf66a21de11a8db190b8"
score = 75
quality = 85
@@ -335557,8 +335963,8 @@ rule SIGNATURE_BASE_RAT_Njrat
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/njRat"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L1013-L1036"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L1013-L1036"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "47e8cc71caaefd70a170eb8fc845cb7ddb8df04b90163fe35f1ccb9a3f614c57"
score = 75
quality = 85
@@ -335587,8 +335993,8 @@ rule SIGNATURE_BASE_RAT_Unrecom
date = "2014-01-04"
modified = "2023-12-05"
reference = "http://malwareconfig.com/stats/unrecom"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L1038-L1058"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L1038-L1058"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "15ab9ee2f3fd825e91813a185bc5c7d7e790de39cd3e88c375b801d1412a08f4"
score = 75
quality = 85
@@ -335615,8 +336021,8 @@ rule SIGNATURE_BASE_MAL_JRAT_Oct18_1 : FILE
date = "2018-10-11"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rats_malwareconfig.yar#L1060-L1072"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rats_malwareconfig.yar#L1060-L1072"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ce190c37a6fdb2632f4bc5ea0bb613b3fbe697d04e68e126b41910a6831d3411"
logic_hash = "7c652f3943ae7639633b82663f639adb7dea1bae9e617a14710fb6e448cfdbee"
score = 75
@@ -335638,8 +336044,8 @@ rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Zlib_Zerodium_Mar21_1 : FILE
date = "2021-03-29"
modified = "2023-12-05"
reference = "https://www.bleepingcomputer.com/news/security/phps-git-server-hacked-to-add-backdoors-to-php-source-code/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vul_php_zlib_backdoor.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vul_php_zlib_backdoor.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "74bfd9e12cb7671cde953d361a2adeb9388edd9b2aab0f9ce04dce0d433561dc"
score = 75
quality = 85
@@ -335661,8 +336067,8 @@ rule SIGNATURE_BASE_APT17_Malware_Oct17_1 : FILE
date = "2017-10-03"
modified = "2023-12-05"
reference = "https://goo.gl/puVc9q"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt17_mal_sep17.yar#L13-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt17_mal_sep17.yar#L13-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc9b5e8aa6ec86db8af0a7aa897ca61db3e5f3d2e0942e319074db1aaccfdc83"
logic_hash = "0c4391b47df0c40dbd605515992e5eaa758d0e509e9ad24b517d104b8e7d504c"
score = 75
@@ -335689,8 +336095,8 @@ rule SIGNATURE_BASE_APT17_Malware_Oct17_2 : FILE
date = "2017-10-03"
modified = "2023-12-05"
reference = "https://goo.gl/puVc9q"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt17_mal_sep17.yar#L31-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt17_mal_sep17.yar#L31-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "20cd49fd0f244944a8f5ba1d7656af3026e67d170133c1b3546c8b2de38d4f27"
logic_hash = "378a21edeaf36267986bd5158fe736b0970b0b9f0ad824f09dc6434a9ba1d7e2"
score = 75
@@ -335724,8 +336130,8 @@ rule SIGNATURE_BASE_APT17_Unsigned_Symantec_Binary_EFA : FILE
date = "2017-10-03"
modified = "2023-12-05"
reference = "https://goo.gl/puVc9q"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt17_mal_sep17.yar#L61-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt17_mal_sep17.yar#L61-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "128aca58be325174f0220bd7ca6030e4e206b4378796e82da460055733bb6f4f"
logic_hash = "7306c8ae2be4dbf56957e11d78ba85bcfa1c8570ba41f749ea5b0e2a05e9df7b"
score = 75
@@ -335750,8 +336156,8 @@ rule SIGNATURE_BASE_APT17_Malware_Oct17_Gen : FILE
date = "2017-10-03"
modified = "2023-12-05"
reference = "https://goo.gl/puVc9q"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt17_mal_sep17.yar#L77-L107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt17_mal_sep17.yar#L77-L107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0375b4216334c85a4b29441a3d37e61d7797c2e1cb94b14cf6292449fb25c7b2"
hash = "07f93e49c7015b68e2542fc591ad2b4a1bc01349f79d48db67c53938ad4b525d"
hash = "ee362a8161bd442073775363bf5fa1305abac2ce39b903d63df0d7121ba60550"
@@ -335785,8 +336191,8 @@ rule SIGNATURE_BASE_MAL_WIPER_Caddywiper_Mar22_1 : FILE
date = "2022-03-15"
modified = "2023-12-05"
reference = "https://twitter.com/ESETresearch/status/1503436420886712321?s=20&t=xh8JK6fEmRIrnqO7Ih_PNg"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ua_caddywiper.yar#L2-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ua_caddywiper.yar#L2-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176"
hash = "a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea"
hash = "ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72"
@@ -335814,8 +336220,8 @@ rule SIGNATURE_BASE_CACTUSTORCH : FILE
date = "2017-07-31"
modified = "2023-12-05"
reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_gen_cactustorch.yar#L11-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_gen_cactustorch.yar#L11-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "314e6d7d863878b6dca46af165e7f08fedd42c054d7dc3828dc80b86a3a9b98c"
hash = "0305aa32d5f8484ca115bb4888880729af7f33ac99594ec1aa3c65644e544aea"
hash = "a52d802e34ac9d7d3539019d284b04ded3b8e197d5e3b38ed61f523c3d68baa7"
@@ -335852,8 +336258,8 @@ rule SIGNATURE_BASE_Powershdll
date = "2017-08-03"
modified = "2023-12-05"
reference = "https://github.com/p3nt4/PowerShdll"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershdll.yar#L9-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershdll.yar#L9-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4d33bc7cfa79d7eefc5f7a99f1b052afdb84895a411d7c30045498fd4303898a"
hash = "f999db9cc3a0719c19f35f0e760f4ce3377b31b756d8cd91bb8270acecd7be7d"
logic_hash = "6c93eca642cc29e6ce661e6ea975bc1a88fff4e6a4825c1da3f82b3a6701392a"
@@ -335879,8 +336285,8 @@ rule SIGNATURE_BASE_HKTL_Natbypass_Dec22_1 : T1090 FILE
date = "2022-12-27"
modified = "2023-12-05"
reference = "https://github.com/cw1997/NATBypass"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/hktl_natbypass.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_natbypass.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4550635143c9997d5499d1d4a4c860126ee9299311fed0f85df9bb304dca81ff"
logic_hash = "8af76d7d9d4500dc219090fbd8ca8cd9fd17bfc224f14a411febfd6f75b92206"
score = 80
@@ -335906,13 +336312,13 @@ rule SIGNATURE_BASE_Gen_Python_Reverse_Shell : FILE
date = "2018-02-24"
modified = "2023-12-05"
reference = "https://www.virustotal.com/en/file/9ec5102bcbabc45f2aa7775464f33019cfbe9d766b1332ee675957c923a17efd/analysis/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_python_reverse_shell.yara#L1-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_python_reverse_shell.yara#L1-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9ec5102bcbabc45f2aa7775464f33019cfbe9d766b1332ee675957c923a17efd"
hash = "bfb5c622a3352bb71b86df81c45ccefaa68b9f7cc0a3577e8013aad951308f12"
logic_hash = "12b1424265cd0ea62b8dd5c08933f1285a156d906df6c31ca9a94fbc303f248e"
score = 75
- quality = 58
+ quality = 83
tags = "FILE"
strings:
@@ -335937,8 +336343,8 @@ rule SIGNATURE_BASE_Dubseven_File_Set : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_between-hk-and-burma.yar#L1-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_between-hk-and-burma.yar#L1-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "af98ab901ca97a350aa837779d74208a780b1099e113cfa59bee2eb33690918e"
score = 75
quality = 85
@@ -335966,8 +336372,8 @@ rule SIGNATURE_BASE_Dubseven_Dropper_Registry_Checks : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_between-hk-and-burma.yar#L31-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_between-hk-and-burma.yar#L31-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "813ff641a4213cf9d56013768e284e7f622a223c6c4f585c3bbbcf69fc03723c"
score = 75
quality = 85
@@ -335994,8 +336400,8 @@ rule SIGNATURE_BASE_Dubseven_Dropper_Dialog_Remains : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_between-hk-and-burma.yar#L59-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_between-hk-and-burma.yar#L59-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "322ddc1210b6bde393970c61113e6efcb87a3529db386323dfd08973e5d2703e"
score = 75
quality = 85
@@ -336017,8 +336423,8 @@ rule SIGNATURE_BASE_Maindll_Mutex : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_between-hk-and-burma.yar#L83-L103"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_between-hk-and-burma.yar#L83-L103"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8d3311164104198e02e700c2e9a5293e55d75d63b39c75c4e375b7f35eb5fde4"
score = 75
quality = 85
@@ -336039,8 +336445,8 @@ rule SIGNATURE_BASE_Slserver_Dialog_Remains : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_between-hk-and-burma.yar#L106-L136"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_between-hk-and-burma.yar#L106-L136"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5b18f4a6c54b456ae697e9639e8c3041fd4f3141d89850c3e1d3d4e220c3cea3"
score = 75
quality = 85
@@ -336065,8 +336471,8 @@ rule SIGNATURE_BASE_Slserver_Mutex : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_between-hk-and-burma.yar#L138-L158"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_between-hk-and-burma.yar#L138-L158"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9bf3c6c93e77424463e3fb6f9f4d58e80254866462fe1287293b0a357737da20"
score = 75
quality = 85
@@ -336087,8 +336493,8 @@ rule SIGNATURE_BASE_Slserver_Command_And_Control : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_between-hk-and-burma.yar#L160-L180"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_between-hk-and-burma.yar#L160-L180"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "48a13d27b7dc9a7f3a65752142b2a291e7c3ee93ef67b36aa4202d065e74d80e"
score = 75
quality = 85
@@ -336109,8 +336515,8 @@ rule SIGNATURE_BASE_Slserver_Campaign_Code : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_between-hk-and-burma.yar#L182-L202"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_between-hk-and-burma.yar#L182-L202"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fbf53678399b0e14eae6f1bb6594b2aa665f76f10388e492bec2f9101a4dd4b1"
score = 75
quality = 85
@@ -336131,8 +336537,8 @@ rule SIGNATURE_BASE_Slserver_Unknown_String : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_between-hk-and-burma.yar#L204-L224"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_between-hk-and-burma.yar#L204-L224"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "18d3bb236282c506c161949883722da1cb0af6dd87bf5cb3d4a5b3d90f4a7db0"
score = 75
quality = 85
@@ -336153,8 +336559,8 @@ rule SIGNATURE_BASE_Casper_Backdoor_X86 : FILE
date = "2015-03-05"
modified = "2023-01-27"
reference = "http://goo.gl/VRJNLo"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_casper.yar#L4-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_casper.yar#L4-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f4c39eddef1c7d99283c7303c1835e99d8e498b0"
logic_hash = "027457a3d86c0a7924fd6eb09c4a753cc846ba45f0b04257d9eec396bbc27f75"
score = 80
@@ -336189,8 +336595,8 @@ rule SIGNATURE_BASE_Casper_EXE_Dropper
date = "2015-03-05"
modified = "2023-12-05"
reference = "http://goo.gl/VRJNLo"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_casper.yar#L37-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_casper.yar#L37-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e4cc35792a48123e71a2c7b6aa904006343a157a"
logic_hash = "8ffba5598078fdadf2d9e8ee7fe0fef8b3b89517490a379d46cab33cd0036d6e"
score = 80
@@ -336220,8 +336626,8 @@ rule SIGNATURE_BASE_Casper_Included_Strings : FILE
date = "2015-03-06"
modified = "2023-12-05"
reference = "http://goo.gl/VRJNLo"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_casper.yar#L60-L83"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_casper.yar#L60-L83"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8796f45e459747db6bc08f362db7b152242f9f5bda3b72ddfc739cc9dcdfc55f"
score = 50
quality = 85
@@ -336251,8 +336657,8 @@ rule SIGNATURE_BASE_Casper_Systeminformation_Output
date = "2015-03-06"
modified = "2023-12-05"
reference = "http://goo.gl/VRJNLo"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_casper.yar#L85-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_casper.yar#L85-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "83c6216bc3e7fadfe81b9bbaca7b14e3398e972f8298c99a8eb576a40e4b4e1b"
score = 70
quality = 85
@@ -336280,8 +336686,8 @@ rule SIGNATURE_BASE_Shamoon2_Wiper : FILE
date = "2016-12-01"
modified = "2023-12-05"
reference = "https://goo.gl/jKIfGB"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_shamoon2.yar#L10-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_shamoon2.yar#L10-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a"
hash = "128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd"
logic_hash = "245b03d9606f2e391f53a60aa333c6b037aa1f013794d83b761813d54782b885"
@@ -336308,8 +336714,8 @@ rule SIGNATURE_BASE_Shamoon2_Comcomp : FILE
date = "2016-12-01"
modified = "2023-12-05"
reference = "https://goo.gl/jKIfGB"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_shamoon2.yar#L30-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_shamoon2.yar#L30-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61c1c8fc8b268127751ac565ed4abd6bdab8d2d0f2ff6074291b2d54b0228842"
logic_hash = "edebdbcf17bd9fadc67c7d76839cf569f0ea20127d4e0d216411c35e9ba54208"
score = 70
@@ -336335,8 +336741,8 @@ rule SIGNATURE_BASE_Eldos_Rawdisk : FILE
date = "2016-12-01"
modified = "2023-01-27"
reference = "https://goo.gl/jKIfGB"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_shamoon2.yar#L50-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_shamoon2.yar#L50-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34"
hash = "394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b"
logic_hash = "ab09371b91ab6889f342c7992108ad374b5ecf67b6c2144a6282670f177d0f15"
@@ -336368,8 +336774,8 @@ rule SIGNATURE_BASE_Blackenergy_BE_2 : FILE
date = "2015-02-19"
modified = "2023-12-05"
reference = "http://goo.gl/DThzLz"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_blackenergy.yar#L8-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_blackenergy.yar#L8-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
logic_hash = "77ecab353063bf8be5ec70294f8497234af8ddd944e0b207d8d633f59f76dbb6"
score = 75
@@ -336396,8 +336802,8 @@ rule SIGNATURE_BASE_Blackenergy_VBS_Agent : FILE
date = "2016-01-03"
modified = "2023-12-05"
reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_blackenergy.yar#L34-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_blackenergy.yar#L34-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f"
logic_hash = "2a0037a76f1031117fe41b2e41691511eb626ffc0c738547eda24f771505bc67"
score = 75
@@ -336422,8 +336828,8 @@ rule SIGNATURE_BASE_Dropbear_SSH_Server : FILE
date = "2016-01-03"
modified = "2023-12-05"
reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_blackenergy.yar#L51-L69"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_blackenergy.yar#L51-L69"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
logic_hash = "6b8acaaa64329d09d3d22d74f4f40288fba3f5faaff63e1ee6b2e6153f14d730"
score = 50
@@ -336450,8 +336856,8 @@ rule SIGNATURE_BASE_Blackenergy_Backdoorpass_Dropbear_SSH : FILE
date = "2016-01-03"
modified = "2023-12-05"
reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_blackenergy.yar#L71-L84"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_blackenergy.yar#L71-L84"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
logic_hash = "3af58d155691d9323458280ad1b933e8e784acafb0974f5f267b93d9b02e825e"
score = 75
@@ -336474,8 +336880,8 @@ rule SIGNATURE_BASE_Blackenergy_Killdisk_1 : FILE
date = "2016-01-03"
modified = "2023-12-05"
reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_blackenergy.yar#L88-L115"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_blackenergy.yar#L88-L115"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
hash = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
hash = "c7536ab90621311b526aefd56003ef8e1166168f038307ae960346ce8f75203d"
@@ -336511,8 +336917,8 @@ rule SIGNATURE_BASE_Blackenergy_Killdisk_2 : FILE
date = "2016-01-03"
modified = "2023-01-06"
reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_blackenergy.yar#L117-L138"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_blackenergy.yar#L117-L138"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
hash = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
hash = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
@@ -336541,8 +336947,8 @@ rule SIGNATURE_BASE_Blackenergy_Driver_USBMDM : FILE
date = "2016-01-04"
modified = "2023-12-05"
reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_blackenergy.yar#L140-L163"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_blackenergy.yar#L140-L163"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094"
hash = "b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a"
hash = "edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281"
@@ -336575,8 +336981,8 @@ rule SIGNATURE_BASE_Blackenergy_Driver_AMDIDE : FILE
date = "2016-01-04"
modified = "2023-12-05"
reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_blackenergy.yar#L165-L188"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_blackenergy.yar#L165-L188"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614"
hash = "3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2"
hash = "90ba78b6710462c2d97815e8745679942b3b296135490f0095bdc0cd97a34d9c"
@@ -336609,8 +337015,8 @@ rule SIGNATURE_BASE_MAL_Payload_F5_BIG_IP_Exploitations_Jul20_1 : CVE_2020_5902
date = "2020-06-07"
modified = "2023-12-05"
reference = "https://research.nccgroup.com/2020/07/05/rift-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902-intelligence/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_f5_bigip_expl_payloads.yar#L2-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_f5_bigip_expl_payloads.yar#L2-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a3651081bb09452d80cba9f673a7b61c8ee2f47a12fb64d975eb63867688ee3b"
score = 75
quality = 85
@@ -336638,8 +337044,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Robinhood_May19_1 : FILE
date = "2019-05-15"
modified = "2023-12-05"
reference = "https://twitter.com/BThurstonCPTECH/status/1128489465327030277"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_robinhood.yar#L2-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_robinhood.yar#L2-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "21cb84fc7b33e8e31364ff0e58b078db8f47494a239dc3ccbea8017ff60807e3"
logic_hash = "5eef71b94f2488dceff80ec2daba689c12d13b2742ba9ae5ead58711339d6026"
score = 75
@@ -336668,8 +337074,8 @@ rule SIGNATURE_BASE_Invoke_Psimage : FILE
date = "2017-12-16"
modified = "2023-12-05"
reference = "https://github.com/peewpw/Invoke-PSImage"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_invoke_psimage.yar#L2-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_invoke_psimage.yar#L2-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ce4bc73fcba3b82e4d11203aa2c3f0b2f85c6eb9e1784ad76a7b20500b4053f8"
score = 75
quality = 85
@@ -336703,8 +337109,8 @@ rule SIGNATURE_BASE_Windivert_Driver : FILE
date = "2017-10-02"
modified = "2023-12-05"
reference = "https://www.reqrypt.org/windivert.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_pua.yar#L1-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_pua.yar#L1-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "33c657fa27b92cfcced66b331cfea7a880460a98cf037e4277faa1420fe59d1c"
hash = "9b834e8f9d117bf2c564a37434973dc0717270ebfac8d8251711905d18da3858"
hash = "5ef707ea68a9bd3a3e568793a0f7d66d166694801ada067d9ebac1d13e53153e"
@@ -336732,8 +337138,8 @@ rule SIGNATURE_BASE_APT_APT41_POISONPLUG_3 : FILE
date = "2019-08-07"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt41.yar#L14-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt41.yar#L14-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70c03ce5c80aca2d35a5555b0532eedede24d4cc6bdb32a2c8f7e630bba5f26e"
logic_hash = "b74b89ac382b2b839c169cd1388d86888172f133091afd079ec42c9380935fdc"
score = 80
@@ -336760,8 +337166,8 @@ rule SIGNATURE_BASE_APT_APT41_POISONPLUG_SHADOW : FILE
date = "2019-08-07"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt41.yar#L33-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt41.yar#L33-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
logic_hash = "fc923c7e85f3870e08a077b344e575d3c349fa02f3d218a9a7ec31992f14866b"
score = 85
@@ -336780,8 +337186,8 @@ rule SIGNATURE_BASE_APT_APT41_CRACKSHOT : FILE
date = "2019-08-07"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt41.yar#L46-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt41.yar#L46-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "993d14d00b1463519fea78ca65d8529663f487cd76b67b3fd35440bcdf7a8e31"
logic_hash = "70dd9edfc7f9ace7b00a35eb2ef664aa4fbaab8e2d268922d1593074897e769c"
score = 85
@@ -336807,8 +337213,8 @@ rule SIGNATURE_BASE_APT_APT41_POISONPLUG_2 : FILE
date = "2019-08-07"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt41.yar#L66-L82"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt41.yar#L66-L82"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0055dfaccc952c99b1171ce431a02abfce5c6f8fb5dc39e4019b624a7d03bfcb"
logic_hash = "f2ec2e91edaaf976169b1fa6645aeae75135e5d5f522e0fda2438f84d674f383"
score = 70
@@ -336834,8 +337240,8 @@ rule SIGNATURE_BASE_APT_APT41_POISONPLUG : FILE
date = "2019-08-07"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt41.yar#L84-L106"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt41.yar#L84-L106"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2eea29d83f485897e2bac9501ef000cc266ffe10019d8c529555a3435ac4aabd"
hash = "5d971ed3947597fbb7e51d806647b37d64d9fe915b35c7c9eaf79a37b82dab90"
hash = "f4d57acde4bc546a10cd199c70cdad09f576fdfe66a36b08a00c19ff6ae19661"
@@ -336863,8 +337269,8 @@ rule SIGNATURE_BASE_APT_APT41_HIGHNOON : FILE
date = "2019-08-07"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt41.yar#L108-L135"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt41.yar#L108-L135"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "63e8ed9692810d562adb80f27bb1aeaf48849e468bf5fd157bc83ca83139b6d7"
hash = "4aa6970cac04ace4a930de67d4c18106cf4004ba66670cfcdaa77a4c4821a213"
logic_hash = "c8afa91f90157c3ac0f7954cd2d42022392c4e6f039d88d1dd4bace19028c2b1"
@@ -336900,8 +337306,8 @@ rule SIGNATURE_BASE_APT_APT41_HIGHNOON_2 : FILE
date = "2019-08-07"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt41.yar#L137-L157"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt41.yar#L137-L157"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "79190925bd1c3fae65b0d11db40ac8e61fb9326ccfed9b7e09084b891089602d"
logic_hash = "dc35b78df1631b1c9650de2bac625a7bc629225f36fe5e32fbff829cb77dc9ac"
score = 75
@@ -336927,8 +337333,8 @@ rule SIGNATURE_BASE_APT_APT41_HIGHNOON_BIN : FILE
date = "2019-08-07"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt41.yar#L159-L180"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt41.yar#L159-L180"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "490c3e4af829e85751a44d21b25de1781cfe4961afdef6bb5759d9451f530994"
hash = "79190925bd1c3fae65b0d11db40ac8e61fb9326ccfed9b7e09084b891089602d"
logic_hash = "c6557bff952454482271d1b52fb37b2dd0471abd237449fd9c94b293ea5218b3"
@@ -336955,8 +337361,8 @@ rule SIGNATURE_BASE_APT_APT41_HIGHNOON_BIN_2 : FILE
date = "2019-08-07"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt41.yar#L182-L200"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt41.yar#L182-L200"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "63e8ed9692810d562adb80f27bb1aeaf48849e468bf5fd157bc83ca83139b6d7"
hash = "c51c5bbc6f59407286276ce07f0f7ea994e76216e0abe34cbf20f1b1cbd9446d"
logic_hash = "1e3d622b4719962f59d95dbf1374c526c22461dd1d9313504f28e8e5c9184272"
@@ -336984,8 +337390,8 @@ rule SIGNATURE_BASE_APT_APT41_Revokedcert_Aug19_1 : FILE
date = "2019-08-07"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt41.yar#L202-L231"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt41.yar#L202-L231"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f78c1310f99ac1993b01f3469f2f8e0765b79b2ea17fc6e7cff4e99949ca1139"
score = 60
quality = 85
@@ -337003,8 +337409,8 @@ rule SIGNATURE_BASE_APT_APT41_CN_ELF_Speculoos_Backdoor : FILE
date = "2020-04-14"
modified = "2023-12-05"
reference = "https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt41.yar#L233-L267"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt41.yar#L233-L267"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6943fbb194317d344ca9911b7abb11b684d3dca4c29adcbcff39291822902167"
hash = "99c5dbeb545af3ef1f0f9643449015988c4e02bf8a7164b5d6c86f67e6dc2d28"
logic_hash = "ee4cbbc5fc51fb24cbf6017dfb4763ac72a0b23a3b6e794b909e678ebfbabc03"
@@ -337043,8 +337449,8 @@ rule SIGNATURE_BASE_Suspicious_Autoit_By_Microsoft : FILE
date = "2017-12-14"
modified = "2026-04-17"
reference = "Internal Research - VT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/generic_anomalies.yar#L382-L397"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/generic_anomalies.yar#L382-L397"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c0cbcc598d4e8b501aa0bd92115b4c68ccda0993ca0c6ce19edd2e04416b6213"
logic_hash = "7dfbaf7d136bd9e151c533b49394a9a596450d9cc2643dc144cb693290004591"
score = 60
@@ -337068,8 +337474,8 @@ rule SIGNATURE_BASE_SUSP_Size_Of_ASUS_Tuningtool : FILE
date = "2018-10-17"
modified = "2022-12-21"
reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/generic_anomalies.yar#L399-L414"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/generic_anomalies.yar#L399-L414"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d4e97a18be820a1a3af639c9bca21c5f85a3f49a37275b37fd012faeffcb7c4a"
logic_hash = "5aadb48f61947ff0362bde5f80830b835ca9e3cb7e1c632d153d0ea5f8bbad6c"
score = 60
@@ -337092,8 +337498,8 @@ rule SIGNATURE_BASE_SUSP_Piratedoffice_2007 : FILE
date = "2018-12-04"
modified = "2026-04-17"
reference = "https://twitter.com/pwnallthethings/status/743230570440826886?lang=en"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/generic_anomalies.yar#L416-L429"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/generic_anomalies.yar#L416-L429"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "210448e58a50da22c0031f016ed1554856ed8abe79ea07193dc8f5599343f633"
logic_hash = "ff94483944a4a4e4bc3cba26fc08fc2a5239f27b301b2ca7cca5edc092c2fc73"
score = 40
@@ -337115,8 +337521,8 @@ rule SIGNATURE_BASE_SUSP_Scheduled_Task_Bigsize : FILE
date = "2018-12-06"
modified = "2026-04-17"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/generic_anomalies.yar#L431-L447"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/generic_anomalies.yar#L431-L447"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dcc06261b1ea39c587d8bcefbb8e85e6b9016da01bf66c2eefe5bd7bbdfc6968"
score = 65
quality = 85
@@ -337141,8 +337547,8 @@ rule SIGNATURE_BASE_SUSP_Putty_Unnormal_Size : FILE
date = "2019-01-07"
modified = "2022-06-30"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/generic_anomalies.yar#L449-L499"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/generic_anomalies.yar#L449-L499"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e5e89bdff733d6db1cffe8b3527e823c32a78076f8eadc2f9fd486b74a0e9d88"
hash = "ce4c1b718b54973291aefdd63d1cca4e4d8d4f5353a2be7f139a290206d0c170"
hash = "adb72ea4eab7b2efc2da6e72256b5a3bb388e9cdd4da4d3ff42a9fec080aa96f"
@@ -337170,8 +337576,8 @@ rule SIGNATURE_BASE_SUSP_RTF_Header_Anomaly : FILE
date = "2019-01-20"
modified = "2022-09-15"
reference = "https://twitter.com/ItsReallyNick/status/975705759618158593"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/generic_anomalies.yar#L501-L513"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/generic_anomalies.yar#L501-L513"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c0be95894edc861cf322309f2c86a8ab986bb111dfdeea1990b4a074d5ab9ea3"
score = 50
quality = 85
@@ -337189,8 +337595,8 @@ rule SIGNATURE_BASE_EXPL_Exploit_TLB_Scripts : FILE
date = "2021-01-26"
modified = "2023-12-05"
reference = "https://github.com/outflanknl/Presentations/blob/master/Nullcon2020_COM-promise_-_Attacking_Windows_development_environments.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_tlb_scripts.yar#L2-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_tlb_scripts.yar#L2-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "39bf626d60a867d054762043f74e86998d6848439655f84be72003c112db9953"
score = 75
quality = 85
@@ -337215,8 +337621,8 @@ rule SIGNATURE_BASE_SUSP_SVG_JS_Payload_Mar25 : FILE
date = "2025-03-20"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_svg_js_phish_mar25.yar#L3-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_svg_js_phish_mar25.yar#L3-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7b4b8e42d4df56412969cd1c38dcb750d21b10a54d257a9b918bd6ae0e0f8d11"
hash = "4ae2ebc103f5de7ccfd75603b543d602b5c793e1ef7db19fbb60ff2e42611f75"
hash = "b92e9d6f8a516e78b3e848c4b5b2815b406c9478e6be3777f3e784ceedc66f4a"
@@ -337251,8 +337657,8 @@ rule SIGNATURE_BASE_Tempracer : FILE
date = "2016-03-30"
modified = "2023-12-05"
reference = "http://www.darknet.org.uk/2016/03/tempracer-windows-privilege-escalation-tool/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_tempracer.yar#L10-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_tempracer.yar#L10-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e17d80c4822d16371d75e1440b6ac44af490b71fbee1010a3e8a5eca94d22bb3"
logic_hash = "37355456e13ea9fa6429b68970e0450f4ddbd8da81c070a0383b1e048a05e35a"
score = 75
@@ -337279,8 +337685,8 @@ rule SIGNATURE_BASE_Poisonivy_Generic_3 : FILE
date = "2015-05-14"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_poisonivy_gen3.yar#L2-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_poisonivy_gen3.yar#L2-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e1cbdf740785f97c93a0a7a01ef2614be792afcd"
logic_hash = "8116b07c00218a0e9784447f322455ff24ae754770b85db760b1c397e10e5695"
score = 75
@@ -337316,8 +337722,8 @@ rule SIGNATURE_BASE_Turla_Png_Dropper : FILE
date = "2018-11-23"
modified = "2023-12-05"
reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_png_dropper_nov18.yar#L3-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_png_dropper_nov18.yar#L3-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6ed939f59476fd31dc4d99e96136e928fbd88aec0d9c59846092c0e93a3c0e27"
logic_hash = "c859310660603d0748cf17daea0799af7684f2a9f77f729871eb57338fbfcca6"
score = 75
@@ -337371,8 +337777,8 @@ rule SIGNATURE_BASE_Turla_Png_Reg_Enum_Payload : FILE
date = "2018-11-23"
modified = "2023-12-05"
reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_png_dropper_nov18.yar#L51-L77"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_png_dropper_nov18.yar#L51-L77"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fea27eb2e939e930c8617dcf64366d1649988f30555f6ee9cd09fe54e4bc22b3"
logic_hash = "b01d0c3a26ce955570ed5607514906bd8860f36637957e39a15f74a7dbb1a1e6"
score = 75
@@ -337395,8 +337801,8 @@ rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_1
date = "2021-03-02"
modified = "2023-12-05"
reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium_log_sigs.yar#L2-L13"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium_log_sigs.yar#L2-L13"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9306cf177928266ea921461e9da80ad5bb37e1e0848559898a414956cfbc2b49"
score = 75
quality = 85
@@ -337417,11 +337823,11 @@ rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_26858_Exchange_Forensic_Artefacts_Mar21_1
date = "2021-03-02"
modified = "2021-03-04"
reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium_log_sigs.yar#L15-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium_log_sigs.yar#L15-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0a8296b7e990e52330412288e9ff71e08a5258fc63c4754e6d0e6d64302f55e6"
score = 65
- quality = 60
+ quality = 85
tags = "LOG, CVE-2021-26858"
strings:
@@ -337439,8 +337845,8 @@ rule SIGNATURE_BASE_LOG_Exchange_Forensic_Artefacts_Cleanup_Activity_Mar21_1 : L
date = "2021-03-08"
modified = "2023-12-05"
reference = "https://twitter.com/jdferrell3/status/1368626281970024448"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium_log_sigs.yar#L48-L65"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium_log_sigs.yar#L48-L65"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "12e5b76dafcae13f1eb21913ae0bde233152fd8b9d29f073893418ac9f742de3"
score = 70
quality = 85
@@ -337465,11 +337871,11 @@ rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_27055_Exchange_Forensic_Artefacts : LOG
date = "2021-03-10"
modified = "2021-03-15"
reference = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium_log_sigs.yar#L67-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium_log_sigs.yar#L67-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "131ff0ce189dfeace0922000b0d15dfb5a1270bee8fba8e4d66aa75b1d3f864f"
score = 65
- quality = 35
+ quality = 60
tags = "LOG"
strings:
@@ -337494,11 +337900,11 @@ rule SIGNATURE_BASE_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_2 : LOG
date = "2021-03-10"
modified = "2023-12-05"
reference = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium_log_sigs.yar#L92-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium_log_sigs.yar#L92-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "13e2e46689bc0e87c3cf13dc2ce213c384afe6c03c21e62a467974a0518c12da"
score = 65
- quality = 60
+ quality = 85
tags = "LOG"
strings:
@@ -337517,8 +337923,8 @@ rule SIGNATURE_BASE_Tophat_Malware_Jan18_1 : FILE
date = "2018-01-29"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_tophat.yar#L13-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_tophat.yar#L13-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5c0b253966befd57f4d22548f01116ffa367d027f162514c1b043a747bead596"
hash = "1f9bca1d5ce5d14d478d32f105b3ab5d15e1c520bde5dfca22324262e84d4eaf"
logic_hash = "69a1e1105b28d66203f74e68038efacc926e501e28a73865485adf2fd7fc0ac0"
@@ -337549,8 +337955,8 @@ rule SIGNATURE_BASE_Tophat_Malware_Jan18_2 : FILE
date = "2018-01-29"
modified = "2023-01-06"
reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_tophat.yar#L38-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_tophat.yar#L38-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9580d15a06cd59c01c59bca81fa0ca8229f410b264a38538453f7d97bfb315e7"
logic_hash = "2321e89559363c04ef0e92a9c9e03d11ff27410103b3aaba954b544e33961b2f"
score = 75
@@ -337578,8 +337984,8 @@ rule SIGNATURE_BASE_Tophat_BAT : FILE
date = "2018-01-29"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_tophat.yar#L62-L78"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_tophat.yar#L62-L78"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f998271c4140caad13f0674a192093092e2a9f7794a7fbbdaa73ae8f2496c387"
hash = "0fbc6fd653b971c8677aa17ecd2749200a4a563f9dd5409cfb26d320618db3e2"
logic_hash = "5dc58fa39d8b2aed95b39da575191fe5d10d5dd95b57c320cde8983505e7184f"
@@ -337605,8 +338011,8 @@ rule SIGNATURE_BASE_Gen_Trojan_Mikey : FILE
date = "2015-05-07"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_mikey_trojan.yar#L2-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_mikey_trojan.yar#L2-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a8e6c3ca056b3ff2495d7728654b780735b3a4cb"
logic_hash = "5454953bba09d6fc866bcb23ef81a0b6763d8f82b8b606597548cbb5cf6053ed"
score = 70
@@ -337634,8 +338040,8 @@ rule SIGNATURE_BASE_Fidelis_Advisory_Purchase_Order_Pps
date = "2015-06-09"
modified = "2023-12-05"
reference = "http://goo.gl/ZjJyti"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fidelis_phishing_plain_sight.yar#L2-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fidelis_phishing_plain_sight.yar#L2-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "45cfee6413accff36a39ced861a29c611d6efe24e1ca87f17467106f8565642b"
score = 75
quality = 85
@@ -337657,8 +338063,8 @@ rule SIGNATURE_BASE_Fidelis_Advisory_Cedt370
date = "2015-06-09"
modified = "2023-12-05"
reference = "http://goo.gl/ZjJyti"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fidelis_phishing_plain_sight.yar#L16-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fidelis_phishing_plain_sight.yar#L16-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1070d3c63a7091c0982e67134f9dc3cd790bb0b5c2ac08f3a00e3b97ef53d64b"
score = 75
quality = 85
@@ -337682,8 +338088,8 @@ rule SIGNATURE_BASE_HKTL_Redsun_Privilege_Escalation_Apr26 : FILE
date = "2026-04-16"
modified = "2026-05-15"
reference = "https://github.com/Nightmare-Eclipse/RedSun"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/hktl_redsun_apr26.yar#L1-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_redsun_apr26.yar#L1-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "57a70c383feb9af60b64ab6768a1ca1b3f7394b8c5ffdbfafc8e988d63935120"
logic_hash = "fb756b0ec61e141fecaf8fc795d10818f4016955dda68772310f8249282f2438"
score = 80
@@ -337711,8 +338117,8 @@ rule SIGNATURE_BASE_Sliver_Implant_32Bit_1
date = "2022-11-18"
modified = "2025-03-21"
reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_gcti_sliver.yar#L26-L94"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_gcti_sliver.yar#L26-L94"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "911f4106350871ddb1396410d36f2d2eadac1166397e28a553b28678543a9357"
logic_hash = "3fec6fbba86a24b395e58f02fb35a60b1b9a4b941b4d85c060cc6159c6aa8265"
score = 75
@@ -337742,8 +338148,8 @@ rule SIGNATURE_BASE_Sliver_Implant_64Bit_1
date = "2022-11-18"
modified = "2025-03-21"
reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_gcti_sliver.yar#L112-L183"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_gcti_sliver.yar#L112-L183"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2d1c9de42942a16c88a042f307f0ace215cdc67241432e1152080870fe95ea87"
logic_hash = "ccfd944a5bc6521c89d44572910e2998e2404d472a593f9d97224d606d247bcd"
score = 75
@@ -337772,8 +338178,8 @@ rule SIGNATURE_BASE_Destructive_Ransomware_Gen1 : FILE
date = "2018-02-12"
modified = "2023-12-05"
reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_olympic_destroyer.yar#L13-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_olympic_destroyer.yar#L13-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85"
logic_hash = "1f7a41c5a7e812e0e26b346cc6465290b17aff31620cbcf6e01c569d8eea2dbd"
score = 75
@@ -337799,8 +338205,8 @@ rule SIGNATURE_BASE_Olympicdestroyer_Gen2 : FILE
date = "2018-02-12"
modified = "2023-12-05"
reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_olympic_destroyer.yar#L30-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_olympic_destroyer.yar#L30-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d934cb8d0eadb93f8a57a9b8853c5db218d5db78c16a35f374e413884d915016"
hash = "3e27b6b287f0b9f7e85bfe18901d961110ae969d58b44af15b1d75be749022c2"
hash = "edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9"
@@ -337833,8 +338239,8 @@ rule SIGNATURE_BASE_HKTL_Venom_LIB_Dec22 : FILE
date = "2022-12-17"
modified = "2023-12-05"
reference = "https://github.com/Idov31/Venom"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_hktl_venom_lib.yar#L2-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_hktl_venom_lib.yar#L2-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fa143946479a45b272d507c3aa2b17026bfdcbb4abefd833f95ff78537568ec1"
score = 75
quality = 85
@@ -337866,8 +338272,8 @@ rule SIGNATURE_BASE_Hkdoor_Backdoor_Dll : FILE
date = "2017-10-18"
modified = "2023-12-05"
reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hkdoor.yar#L11-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hkdoor.yar#L11-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "77901d1f2d6c53161c79b50ef20eeb424bf1b8b32906302ca10f3c4b82a58e2a"
score = 75
quality = 85
@@ -337892,8 +338298,8 @@ rule SIGNATURE_BASE_Hkdoor_Backdoor : FILE
date = "2017-10-18"
modified = "2023-12-05"
reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hkdoor.yar#L32-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hkdoor.yar#L32-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3fc71c971bf0908e044e3e0ec3f266b8dfaae33bcfbf1b10619375fc7b5e7f5e"
score = 75
quality = 85
@@ -337922,8 +338328,8 @@ rule SIGNATURE_BASE_Hkdoor_Dropper : FILE
date = "2018-01-01"
modified = "2023-01-07"
reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hkdoor.yar#L53-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hkdoor.yar#L53-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "521836ff95142d276152687f7c36e8f503f168f101976022431efd13a6adf7e4"
score = 75
quality = 85
@@ -337951,8 +338357,8 @@ rule SIGNATURE_BASE_Hkdoor_Driver : FILE
date = "2018-01-01"
modified = "2023-01-07"
reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hkdoor.yar#L81-L99"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hkdoor.yar#L81-L99"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "68ac505d67af5361f096529697e621c83a4628f21c213fcea6652905f87ebe00"
score = 75
quality = 83
@@ -337977,8 +338383,8 @@ rule SIGNATURE_BASE_REGEORG_Tuneller_Generic : FILE
date = "2021-12-20"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/unc3524-eye-spy-email"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/webshell_regeorg.yar#L1-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/webshell_regeorg.yar#L1-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ba22992ce835dadcd06bff4ab7b162f9"
logic_hash = "1657928875c3cd2d5bf774929b0497d78f0211b321f8a4138cc9b8c80b9f99d6"
score = 75
@@ -338008,8 +338414,8 @@ rule SIGNATURE_BASE_MAL_Qakbotloader_Export_Section_Feb23 : FILE
date = "2023-02-17"
modified = "2023-12-05"
reference = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_qbot_feb23.yar#L22-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_qbot_feb23.yar#L22-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6f99171c95a8ed5d056eeb9234dbbee123a6f95f481ad0e0a966abd2844f0e1a"
logic_hash = "0e40cd6acdbfb17670b414bd6f2ecdf1ae26ddd6a5d85931973b98963a43aba8"
score = 75
@@ -338033,8 +338439,8 @@ rule SIGNATURE_BASE_Woolengoldfish_Sample_1
date = "2015-03-25"
modified = "2023-12-05"
reference = "http://goo.gl/NpJpVZ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_woolengoldfish.yar#L13-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_woolengoldfish.yar#L13-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7ad0eb113bc575363a058f4bf21dbab8c8f7073a"
logic_hash = "9490715a2fc7d3c742771a8211bcfb4c0a0bafba4d5de8eee5825fdabaded6af"
score = 60
@@ -338058,8 +338464,8 @@ rule SIGNATURE_BASE_Woolengoldfish_Generic_1
date = "2015-03-25"
modified = "2023-12-05"
reference = "http://goo.gl/NpJpVZ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_woolengoldfish.yar#L30-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_woolengoldfish.yar#L30-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5d334e0cb4ff58859e91f9e7f1c451ffdc7544c3"
hash = "d5b2b30fe2d4759c199e3659d561a50f88a7fb2e"
hash = "a42f1ad2360833baedd2d5f59354c4fc3820c475"
@@ -338096,8 +338502,8 @@ rule SIGNATURE_BASE_Woolengoldfish_Generic_2
date = "2015-03-25"
modified = "2023-12-05"
reference = "http://goo.gl/NpJpVZ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_woolengoldfish.yar#L62-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_woolengoldfish.yar#L62-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "47b1c9caabe3ae681934a33cd6f3a1b311fd7f9f"
hash = "62172eee1a4591bde2658175dd5b8652d5aead2a"
hash = "7fef48e1303e40110798dfec929ad88f1ad4fbd8"
@@ -338123,8 +338529,8 @@ rule SIGNATURE_BASE_Woolengoldfish_Generic_3
date = "2015-03-25"
modified = "2023-12-05"
reference = "http://goo.gl/NpJpVZ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_woolengoldfish.yar#L81-L111"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_woolengoldfish.yar#L81-L111"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "86222ef166474e53f1eb6d7e6701713834e6fee7"
hash = "e8dbcde49c7f760165ebb0cb3452e4f1c24981f5"
logic_hash = "ac51c25ad6ef6668238fef1de50517d48e6509f57cd6dd723595777ae16d8a6c"
@@ -338162,8 +338568,8 @@ rule SIGNATURE_BASE_VULN_Printerdriver_Privesc_CVE_2021_3438_Jul21 : FILE
date = "2021-07-20"
modified = "2023-12-05"
reference = "https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vul_cve_2021_3438_printdriver.yar#L4-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vul_cve_2021_3438_printdriver.yar#L4-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4"
logic_hash = "b58c2623c8fb84162c1c9390d0398639061ed5b1d4a8e007685e6fabe42bde54"
score = 70
@@ -338186,8 +338592,8 @@ rule SIGNATURE_BASE_Invoke_Osiris : FILE
date = "2017-03-27"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_ps_osiris.yar#L10-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_ps_osiris.yar#L10-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "19e4a8b07f85c3d4c396d0c4e839495c9fba9405c06a631d57af588032d2416e"
logic_hash = "9a93308d6595de647a96716df0799ec690d91b2fb87e0b4a2f47e6b8b52eed97"
score = 70
@@ -338211,8 +338617,8 @@ rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1 : FILE
date = "2022-01-16"
modified = "2023-12-05"
reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ua_wiper_whispergate.yar#L2-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ua_wiper_whispergate.yar#L2-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
logic_hash = "72eb50a70b3f2fbb232134ef4706dbb15bdb5893fe06d899bff3b7aacdfadd30"
score = 85
@@ -338239,8 +338645,8 @@ rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2 : FILE
date = "2022-01-16"
modified = "2023-12-05"
reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ua_wiper_whispergate.yar#L25-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ua_wiper_whispergate.yar#L25-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
logic_hash = "87a03e95bc1c33d1b3343ec7369c516bb15791943fbb122de11867ad4bddd565"
score = 90
@@ -338275,8 +338681,8 @@ rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Stage3_Jan22 : FILE
date = "2022-01-16"
modified = "2023-12-05"
reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ua_wiper_whispergate.yar#L59-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ua_wiper_whispergate.yar#L59-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
logic_hash = "b06536b6a6eebd5fb398ba2617bf68a5b2c4b0035766b3cd0fc03d95019891ec"
score = 75
@@ -338299,8 +338705,8 @@ rule SIGNATURE_BASE_MAL_OBFUSC_Unknown_Jan22_1 : FILE
date = "2022-01-16"
modified = "2023-12-05"
reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ua_wiper_whispergate.yar#L76-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ua_wiper_whispergate.yar#L76-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
logic_hash = "26a295d3b78c3a33d776a648aa0f410ac7cb5021ad9d3b294ff9629d6ba7132a"
score = 75
@@ -338332,8 +338738,8 @@ rule SIGNATURE_BASE_MAL_Unknown_Discord_Characteristics_Jan22_1 : FILE
date = "2022-01-16"
modified = "2023-12-05"
reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ua_wiper_whispergate.yar#L103-L119"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ua_wiper_whispergate.yar#L103-L119"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
logic_hash = "f9cf4a15be0ab35a0d0f0c9b1a191f623f905c8fc9da651872de7c025a27a806"
score = 75
@@ -338356,8 +338762,8 @@ rule SIGNATURE_BASE_Minirat_Gen_1 : FILE
date = "2018-01-22"
modified = "2023-12-05"
reference = "https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_darkcaracal.yar#L12-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_darkcaracal.yar#L12-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b"
hash = "b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d"
hash = "ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2"
@@ -338385,8 +338791,8 @@ rule SIGNATURE_BASE_MAL_Backdoor_DLL_Nov23_1 : CVE_2023_4966 FILE
date = "2023-11-23"
modified = "2023-12-05"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L1-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L1-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cc21c77e1ee7e916c9c48194fad083b2d4b2023df703e544ffb2d6a0bfc90a63"
hash = "0eb66eebb9b4d671f759fb2e8b239e8a6ab193a732da8583e6e8721a2670a96d"
logic_hash = "6788d37301bb82bd4d9584e192e2fb14d4f6c77801b70299097d8ba139219394"
@@ -338414,8 +338820,8 @@ rule SIGNATURE_BASE_MAL_Trojan_DLL_Nov23 : CVE_2023_4966 FILE
date = "2023-11-23"
modified = "2023-12-05"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L24-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L24-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e557e1440e394537cca71ed3d61372106c3c70eb6ef9f07521768f23a0974068"
logic_hash = "9be42742711b4d0440244b507945e074b61c456588580b3263f899a7eb84d8aa"
score = 80
@@ -338439,8 +338845,8 @@ rule SIGNATURE_BASE_MAL_DLL_Stealer_Nov23 : CVE_2023_4966 FILE
date = "2023-11-23"
modified = "2023-12-05"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L41-L54"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L41-L54"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17a27b1759f10d1f6f1f51a11c0efea550e2075c2c394259af4d3f855bbcc994"
logic_hash = "7d0c46d855973cb2c0636aed9c67cfbe47ca260ab1bc842fef1d532725c26910"
score = 80
@@ -338462,8 +338868,8 @@ rule SIGNATURE_BASE_MAL_Python_Backdoor_Script_Nov23 : CVE_2023_4966 FILE
date = "2023-11-23"
modified = "2023-12-05"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L56-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L56-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "906602ea3c887af67bcb4531bbbb459d7c24a2efcb866bcb1e3b028a51f12ae6"
logic_hash = "b336f6438a420af49b1b0144039f1051f12c0c54f77a94e2f947f71d1f6230b3"
score = 80
@@ -338487,8 +338893,8 @@ rule SIGNATURE_BASE_APT_RANSOM_Lockbit_Forensicartifacts_Nov23
date = "2023-11-22"
modified = "2023-12-05"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L73-L86"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L73-L86"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6ba1d47e2cac72143c4612c420777024f114afc007c7b15251a58819654aeff1"
score = 75
quality = 85
@@ -338511,8 +338917,8 @@ rule SIGNATURE_BASE_MAL_Exilerat_Feb19_1 : FILE
date = "2019-02-04"
modified = "2023-12-05"
reference = "https://creativecommons.org/licenses/by-nc/4.0/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_exile_rat.yar#L4-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_exile_rat.yar#L4-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3eb026d8b778716231a07b3dbbdc99e2d3a635b1956de8a1e6efc659330e52de"
logic_hash = "0556bc0dbd33502d5bf823cf265a4e133d9af43076abe35a86cf5e20ab314e35"
score = 75
@@ -338539,8 +338945,8 @@ rule SIGNATURE_BASE_Octowave_Installer_03_2025 : FILE
date = "2025-03-28"
modified = "2025-04-08"
reference = "https://x.com/CyberRaiju/status/1893450184224362946?t=u0X6ST2Qgnrf-ujjphGOSg&s=19"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_octowave_installer_mar25.yar#L1-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_octowave_installer_mar25.yar#L1-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "05b025b8475c0acbc9a5d2cd13c15088a2fb452aa514d0636f145e1c4c93e6ee"
hash = "500462c4fb6e4d0545f04d63ef981d9611b578948e5cfd61d840ff8e2f206587"
hash = "5ee9e74605b0c26b39b111a89139d95423e54f7a54decf60c7552f45b8b60407"
@@ -338580,8 +338986,8 @@ rule SIGNATURE_BASE_Corkowdll : FILE
date = "2016-01-02"
modified = "2023-12-05"
reference = "https://www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_corkow_dll.yar#L3-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_corkow_dll.yar#L3-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "072112c79f20ba08b7ef71d3dacff7eb947b4a27bf6381ce788e229f2f791cdf"
score = 75
quality = 85
@@ -338603,8 +339009,8 @@ rule SIGNATURE_BASE_Oilrig_Strings_Oct17 : FILE
date = "2017-10-18"
modified = "2022-12-21"
reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig_oct17.yar#L11-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig_oct17.yar#L11-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3987fa1ccb215edeb0d36c947fd6d7a24847ea854d3f355d1aef4b000f55e710"
score = 75
quality = 85
@@ -338630,8 +339036,8 @@ rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples1 : FILE
date = "2017-10-18"
modified = "2023-12-05"
reference = "https://goo.gl/JQVfFP"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig_oct17.yar#L42-L61"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig_oct17.yar#L42-L61"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "119c64a8b35bd626b3ea5f630d533b2e0e7852a4c59694125ff08f9965b5f9cc"
hash = "0ccb2117c34e3045a4d2c0d193f1963c8c0e8566617ed0a561546c932d1a5c0c"
logic_hash = "d7e659440e3abc7355f2e21ea8f63cfb7b17b5715e4575bdccf9d646ed47db20"
@@ -338660,8 +339066,8 @@ rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples2 : FILE
date = "2017-10-18"
modified = "2023-12-05"
reference = "https://goo.gl/JQVfFP"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig_oct17.yar#L63-L82"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig_oct17.yar#L63-L82"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fcad263d0fe2b418db05f47d4036f0b42aaf201c9b91281dfdcb3201b298e4f4"
hash = "33c187cfd9e3b68c3089c27ac64a519ccc951ccb3c74d75179c520f54f11f647"
logic_hash = "ad00c7293f61f1b5528c3eea0dc32c10d40aeacc194be84a7f64d19b069f1add"
@@ -338690,8 +339096,8 @@ rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples3 : FILE
date = "2017-10-18"
modified = "2023-12-05"
reference = "https://goo.gl/JQVfFP"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig_oct17.yar#L84-L116"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig_oct17.yar#L84-L116"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a9f1375da973b229eb649dc3c07484ae7513032b79665efe78c0e55a6e716821"
logic_hash = "a4984cf33e7b0e0dae264ed11caae6cfab9db2a6047a46ec41c28b5637b4589b"
score = 75
@@ -338728,8 +339134,8 @@ rule SIGNATURE_BASE_Ghostdragon_Gh0Strat : FILE
date = "2016-04-23"
modified = "2023-12-05"
reference = "https://blog.cylance.com/the-ghost-dragon"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ghostdragon_gh0st_rat.yar#L8-L52"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ghostdragon_gh0st_rat.yar#L8-L52"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197"
hash = "99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2"
hash = "6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df"
@@ -338777,8 +339183,8 @@ rule SIGNATURE_BASE_Ghostdragon_Gh0Strat_Sample2 : FILE
date = "2016-04-23"
modified = "2023-12-05"
reference = "https://blog.cylance.com/the-ghost-dragon"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ghostdragon_gh0st_rat.yar#L54-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ghostdragon_gh0st_rat.yar#L54-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "71a52058f6b5cef66302c19169f67cf304507b4454cca83e2c36151da8da1d97"
logic_hash = "f41776a033be766844c9867902d2ef9b79bf59bdf212f0158eccf79db0810460"
score = 75
@@ -338804,8 +339210,8 @@ rule SIGNATURE_BASE_Ghostdragon_Gh0Strat_Sample3
date = "2016-04-23"
modified = "2023-12-05"
reference = "https://blog.cylance.com/the-ghost-dragon"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ghostdragon_gh0st_rat.yar#L77-L92"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ghostdragon_gh0st_rat.yar#L77-L92"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1be9c68b31247357328596a388010c9cfffadcb6e9841fb22de8b0dc2d161c42"
logic_hash = "39ddb94ac14032f88e54e413ed650277e95f6dcf66219fcf43a01aff1f10a058"
score = 75
@@ -338830,8 +339236,8 @@ rule SIGNATURE_BASE_Crowdstrike_Shamoon_Droppedfile
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://www.rsaconference.com/writable/presentations/file_upload/exp-w01-hacking-exposed-day-of-destruction.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_shamoon.yar#L1-L13"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_shamoon.yar#L1-L13"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ed550832b217f7edceea2edf7c4453925ed1759d97db7728f7face6ff10ee361"
score = 75
quality = 85
@@ -338856,8 +339262,8 @@ rule SIGNATURE_BASE_CVE_2014_4076_Exploitcode : CVE_2014_4076 FILE
date = "2018-04-04"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/yarGen"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2014_4076.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2014_4076.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "44690af85efef2db04c7e8cba7ca0d0e53be1a1432a339570a7d26eec860b8ee"
logic_hash = "96b8743de8b3968d64b74af93f5e61574a3b31d33df6d51e944b4f02c7b9723e"
score = 75
@@ -338883,8 +339289,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Wmiexec : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L32-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L32-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "19544863758341fe7276c59d85f4aa17094045621ca9c98f8a9e7307c290bad4"
logic_hash = "1ac78768ae230aa00f392f7a7886589b14814e9c7379528d2ecd218852086ee4"
score = 75
@@ -338909,8 +339315,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Sniffer : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L49-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L49-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "efff15e1815fb3c156678417d6037ddf4b711a3122c9b5bc2ca8dc97165d3769"
logic_hash = "77f4a7cdfced27ea342fe0fe6debebb720b7494b3f352465ab2fd92f2b7178ab"
score = 75
@@ -338934,8 +339340,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Mmcexec : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L65-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L65-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "263a1655a94b7920531e123a8c9737428f2988bf58156c62408e192d4b2a63fc"
logic_hash = "1aee75155ed3d868f576d7d650f0791ac54e351851f7bfb65390b4ae5c4c83b9"
score = 75
@@ -338959,8 +339365,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Ifmap : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L81-L95"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L81-L95"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "20a1f11788e6cc98a76dca2db4691963c054fc12a4d608ac41739b98f84b3613"
logic_hash = "bbe875e03434c040da914e81ec5ef691ba8fd02607631e118d958819d0e94ff5"
score = 75
@@ -338984,8 +339390,8 @@ rule SIGNATURE_BASE_Karmasmb : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L97-L110"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L97-L110"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d256d1e05695d62a86d9e76830fcbb856ba7bd578165a561edd43b9f7fdb18a3"
logic_hash = "94322dda799bcb25caeb7f9e526bcc14c6dfd9247080b4bb79dcd7b340fcb36c"
score = 75
@@ -339008,8 +339414,8 @@ rule SIGNATURE_BASE_Samrdump : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L112-L126"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L112-L126"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4c2921702d18e0874b57638433474e54719ee6dfa39d323839d216952c5c834a"
logic_hash = "6bc0a4d9f9bd0d72e7f2ce4b0f8608296e6f2db14fd3a1740e0eebfe35629018"
score = 75
@@ -339033,8 +339439,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Rpcdump : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L128-L142"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L128-L142"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "21d85b36197db47b94b0f4995d07b040a0455ebbe6d413bc33d926ee4e0315d9"
logic_hash = "cf0a64391ef0a5d3f87996fb3e4f152a3ff4938356b96f840aa3f4f4f30aaa97"
score = 75
@@ -339058,8 +339464,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Secretsdump : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L144-L158"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L144-L158"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "47afa5fd954190df825924c55112e65fd8ed0f7e1d6fd403ede5209623534d7d"
logic_hash = "462748d60764c6fbaeede48b5a98cb68f61cf695f976bf6db94cb497be48fcb2"
score = 75
@@ -339083,8 +339489,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Esentutl : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L160-L174"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L160-L174"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70d854953d3ebb2c252783a4a103ba0e596d6ab447f238af777fb37d2b64c0cd"
logic_hash = "e972ad610df65309f4e5996ad0b537670b944f43b810fda5a890ea995193a97a"
score = 75
@@ -339108,8 +339514,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Opdump : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L176-L190"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L176-L190"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e2205539f29972d4e2a83eabf92af18dd406c9be97f70661c336ddf5eb496742"
logic_hash = "18b772e19fd61d77f3a671ee097e0f032738a73a360f4cfe79df4eb6377e12b1"
score = 75
@@ -339133,8 +339539,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Sniff : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L192-L206"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L192-L206"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ab2b60aadf97e921e3a9df5cf1c135fbc851cb66d09b1043eaaa1dc01b9a699"
logic_hash = "b317e23d1f76cec4d5b14cb95d463ec410551052b30f1d2d5f52a441104108c0"
score = 75
@@ -339158,8 +339564,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Smbexec : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L208-L222"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L208-L222"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7d715217e23a471d42d95c624179fe7de085af5670171d212b7b798ed9bf07c2"
logic_hash = "0f424dd5cc525ef0bd9671c4c1b8da0a1ff9eb79056cc081c1ebe7c9bf75fee6"
score = 75
@@ -339183,8 +339589,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Goldenpac : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L224-L239"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L224-L239"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4f7fad0676d3c3d2d89e8d4e74b6ec40af731b1ddf5499a0b81fc3b1cd797ee3"
logic_hash = "0c764083a699204819f9ff6e2664a50d467447d0fff040ef32a8e28cc678b3cd"
score = 75
@@ -339209,8 +339615,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Netview : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L241-L256"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L241-L256"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ab909f8082c2d04f73d8be8f4c2640a5582294306dffdcc85e83a39d20c49ed6"
logic_hash = "e0beb6235838b4e8a1312ba53c539c6c3d732ba13a0190c654dcf7ec4389e364"
score = 75
@@ -339235,8 +339641,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Smbtorture : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L258-L272"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L258-L272"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d2856e98011541883e5b335cb46b713b1a6b2c414966a9de122ee7fb226aa7f7"
logic_hash = "63cbd6511c5498b39fa5efadb8fe0caeeaa8d4c2afe534a0169ea38f205a9cba"
score = 75
@@ -339260,8 +339666,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Mimikatz : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L274-L289"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L274-L289"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2d8d500bcb3ffd22ddd8bd68b5b2ce935c958304f03729442a20a28b2c0328c1"
logic_hash = "0dce4086887877aa77063dfa3c69d7a17cfa0815c4ca417144d3bbb6ebe68650"
score = 75
@@ -339286,8 +339692,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Smbrelayx : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L291-L307"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L291-L307"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9706eb99e48e445ac4240b5acb2efd49468a800913e70e40b25c2bf80d6be35f"
logic_hash = "2afcede9d9f5af102c68e705f29242bc3a56485e79c0acfc347a4ea7f823dfda"
score = 75
@@ -339313,8 +339719,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Wmipersist : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L309-L323"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L309-L323"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2527fff1a3c780f6a757f13a8912278a417aea84295af1abfa4666572bbbf086"
logic_hash = "df0dfaed264e0acc57f74e40addcaf52f6d8e832524eb638b682a358c81da83f"
score = 75
@@ -339338,8 +339744,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Lookupsid : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L325-L339"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L325-L339"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "47756725d7a752d3d3cfccfb02e7df4fa0769b72e008ae5c85c018be4cf35cc1"
logic_hash = "629ddd49377017d6ea2aac9665b21dfdf9a50c917bf915ea892faafd841bf817"
score = 75
@@ -339363,8 +339769,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Wmiquery : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L341-L355"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L341-L355"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "202a1d149be35d96e491b0b65516f631f3486215f78526160cf262d8ae179094"
logic_hash = "fa237b5c1b4881804c33152a1ce9f3a571b506178fde455a8dd9f92af68c5610"
score = 75
@@ -339388,8 +339794,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Atexec : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L357-L373"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L357-L373"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "337bd5858aba0380e16ee9a9d8f0b3f5bfc10056ced4e75901207166689fbedc"
logic_hash = "e9537a67e17fb980505aead84b15c7dc8a2f3f1e9a4088edd8b313f1b7a9675d"
score = 75
@@ -339415,8 +339821,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Psexec : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L375-L390"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L375-L390"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "27bb10569a872367ba1cfca3cf1c9b428422c82af7ab4c2728f501406461c364"
logic_hash = "922b2adec9c73d36343c0182f72f5a325c93c051a22e3f80236f942287d0738b"
score = 75
@@ -339441,8 +339847,8 @@ rule SIGNATURE_BASE_Impacket_Tools_Generic_1 : FILE
date = "2017-04-07"
modified = "2025-03-29"
reference = "https://github.com/maaaaz/impacket-examples-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L392-L427"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L392-L427"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4f7fad0676d3c3d2d89e8d4e74b6ec40af731b1ddf5499a0b81fc3b1cd797ee3"
hash = "d256d1e05695d62a86d9e76830fcbb856ba7bd578165a561edd43b9f7fdb18a3"
hash = "2d8d500bcb3ffd22ddd8bd68b5b2ce935c958304f03729442a20a28b2c0328c1"
@@ -339487,8 +339893,8 @@ rule SIGNATURE_BASE_Impacket_Lateral_Movement : FILE
date = "2018-03-22"
modified = "2025-03-29"
reference = "https://github.com/CoreSecurity/impacket"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_impacket_tools.yar#L429-L447"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_impacket_tools.yar#L429-L447"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6628c27474d5235d5b510a55215762980a5b526b353b740344cb669e8e023e3c"
score = 60
quality = 85
@@ -339515,8 +339921,8 @@ rule SIGNATURE_BASE_Apolmy_Privesc_Trojan : FILE
date = "2015-08-04"
modified = "2023-12-05"
reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_terracotta.yar#L11-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_terracotta.yar#L11-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d7bd289e6cee228eb46a1be1fcdc3a2bd5251bc1eafb59f8111756777d8f373d"
logic_hash = "8cce828806d5829735d6ac8d28a48c9b016b96b4370b2f3ac139799a9fe13c4a"
score = 80
@@ -339541,8 +339947,8 @@ rule SIGNATURE_BASE_Mithozhan_Trojan : FILE
date = "2015-08-04"
modified = "2023-12-05"
reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_terracotta.yar#L29-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_terracotta.yar#L29-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a"
logic_hash = "a7beb030368cc6e1119617991b68e6fa1bf2d1f6eee28e83fef7862313f19d30"
score = 70
@@ -339567,8 +339973,8 @@ rule SIGNATURE_BASE_Remoteexec_Tool : FILE
date = "2015-08-04"
modified = "2023-12-05"
reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_terracotta.yar#L47-L65"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_terracotta.yar#L47-L65"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a550131e106ff3c703666f15d55d9bc8c816d1cb9ac1b73c2e29f8aa01e53b78"
logic_hash = "951cc65e14c2ff035ccc06d080730b1c25208caa1d30129074a6150557a5cebe"
score = 75
@@ -339596,8 +340002,8 @@ rule SIGNATURE_BASE_Liudoor_Malware_1 : FILE
date = "2015-08-04"
modified = "2023-12-05"
reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_terracotta.yar#L69-L89"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_terracotta.yar#L69-L89"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "deed6e2a31349253143d4069613905e1dfc3ad4589f6987388de13e33ac187fc"
hash = "4575e7fc8f156d1d499aab5064a4832953cd43795574b4c7b9165cdc92993ce5"
hash = "ad1a507709c75fe93708ce9ca1227c5fefa812997ed9104ff9adfec62a3ec2bb"
@@ -339626,8 +340032,8 @@ rule SIGNATURE_BASE_Liudoor_Malware_2 : FILE
date = "2015-08-04"
modified = "2023-12-05"
reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_terracotta.yar#L91-L108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_terracotta.yar#L91-L108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f3fb68b21490ded2ae7327271d3412fbbf9d705c8003a195a705c47c98b43800"
hash = "e42b8385e1aecd89a94a740a2c7cd5ef157b091fabd52cd6f86e47534ca2863e"
logic_hash = "12cc72fb147f2d580f9f9e2a9bdfbec3f7b0e977871a27ccc941cd0b1aaa634c"
@@ -339653,8 +340059,8 @@ rule SIGNATURE_BASE_Coreimpact_Sysdll_Exe
date = "2014-12-27"
modified = "2023-01-06"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_coreimpact_agent.yar#L6-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_coreimpact_agent.yar#L6-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f89a4d4ae5cca6d69a5256c96111e707"
logic_hash = "332b68e797e8ee3e26d797e106ae31e7240585ccb0ea599bebd8ac8f94313eab"
score = 70
@@ -339684,8 +340090,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_1 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L13-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L13-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fcfe8fcf054bd8b19226d592617425e320e4a5bb4798807d6f067c39dfc6d1ff"
logic_hash = "d8ed432fea930eb9b4d695a4a68b833f4324fe0bbea3f0ccac2fe5934bfa1c22"
score = 75
@@ -339709,8 +340115,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_2 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L33-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L33-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "801a64a730fc8d80e17e59e93533c1455686ca778e6ba99cf6f1971a935eda4c"
logic_hash = "0c298176e5849b2b202089f27cffb7646243d19a90898bbf079a97d2f624a27e"
score = 75
@@ -339735,8 +340141,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_3 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L53-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L53-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "92efbecc24fbb5690708926b6221b241b10bdfe3dd0375d663b051283d0de30f"
logic_hash = "ad39864eec58b1c655bd3d510faa314702d118cee845da55d189e7252174eafb"
score = 75
@@ -339760,8 +340166,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_4 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L68-L99"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L68-L99"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a1629e8abce9d670fdb66fa1ef73ad4181706eefb8adc8a9fd257b6a21be48c6"
logic_hash = "1889ce1101ebb352c33279d40641f1f2312c45c6f7e267f4912a9faf320e5971"
score = 75
@@ -339797,8 +340203,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_6 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L101-L115"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L101-L115"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "49ef2b98b414c321bcdbab107b8fa71a537958fe1e05ae62aaa01fe7773c3b4b"
logic_hash = "ee671bc09cc0c84c9817ed800f1416a75f18a70fd2cf6a7e9f063fffa01fa003"
score = 75
@@ -339823,8 +340229,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_7 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L117-L130"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L117-L130"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a4ce3a356d61fbbb067e1430b8ceedbe8965e0cfedd8fb43f1f719e2925b094a"
hash = "a8bfc1e013f15bc395aa5c047f22ff2344c343c22d420804b6d2f0a67eb6db64"
hash = "959612f2a9a8ce454c144d6aef10dd326b201336a85e69a604e6b3892892d7ed"
@@ -339846,8 +340252,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_8 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L132-L145"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L132-L145"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "73270fe9bca94fead1b5b38ddf69fae6a42e574e3150d3e3ab369f5d37d93d88"
logic_hash = "1a42667463ff006b155c93b8986ab75441ba00d0c3c146c2d4c6929250627d8d"
score = 75
@@ -339870,8 +340276,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_10 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L147-L163"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L147-L163"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70992a72412c5d62d003a29c3967fcb0687189d3290ebbc8671fa630829f6694"
hash = "48f0bbc3b679aac6b1a71c06f19bb182123e74df8bb0b6b04ebe99100c57a41e"
hash = "5475ae24c4eeadcbd49fcd891ce64d0fe5d9738f1c10ba2ac7e6235da97d3926"
@@ -339896,8 +340302,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_11 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L165-L178"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L165-L178"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "278e9d130678615d0fee4d7dd432f0dda6d52b0719649ee58cbdca097e997c3f"
logic_hash = "847681b3e9d4fc38c483663f5a7e16e7f8f95cfa77728d7316edbe6fbf5fe2c1"
score = 75
@@ -339921,8 +340327,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_12 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L180-L201"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L180-L201"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b9aba520eeaf6511877c1eec5f7d71e0eea017312a104f30d3b8f17c89db47e8"
logic_hash = "31798a39d10bfa4520d91e1f555302e9ac4e38d90f8bc27376a5e7e1ccfcc5e1"
score = 75
@@ -339951,8 +340357,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_13 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L203-L215"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L203-L215"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d31374adc0b96a8a8b56438bbbc313061fd305ecee32a12738dd965910c8890f"
hash = "c74a8e6c88f8501fb066ae07753efe8d267afb006f555811083c51c7f546cb67"
logic_hash = "8cc611685a822e0484146a08f4ebc2fa8dd260dc8627929333060696d8dc35ce"
@@ -339973,8 +340379,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_14 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L217-L231"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L217-L231"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "388ef4b4e12a04eab451bd6393860b8d12948f2bce12e5c9022996a9167f4972"
logic_hash = "37515683804e9aa076a588048713b420501b2aaf6b8617501ef550484abd1c03"
score = 75
@@ -339998,8 +340404,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_15 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L233-L248"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L233-L248"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "be6bea22e909bd772d21647ffee6d15e208e386e8c3c95fd22816c6b94196ae8"
hash = "72a8fa454f428587d210cba0e74735381cd0332f3bdcbb45eecb7e271e138501"
hash = "9cc38ea106efd5c8e98c2e8faf97c818171c52fa3afa0c4c8f376430fa556066"
@@ -340023,8 +340429,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_16 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L250-L263"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L250-L263"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58bb3859e02b8483e9f84cc56fbd964486e056ef28e94dd0027d361383cc4f4a"
logic_hash = "2d0ee163e7f6f04bfe6941575d0916e18ce2e5c2426e0af326c9567560df3122"
score = 75
@@ -340047,8 +340453,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_17 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L265-L284"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L265-L284"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fa380dac35e16da01242e456f760a0e75c2ce9b68ff18cfc7cfdd16b2f4dec56"
hash = "854b64155f9ceac806b49f3e352949cc292e5bc33f110d965cf81a93f78d2f07"
hash = "1e462d8968e8b6e8784d7ecd1d60249b41cf600975d2a894f15433a7fdf07a0f"
@@ -340078,8 +340484,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_18 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L286-L313"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L286-L313"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d8df60524deb6df4f9ddd802037a248f9fbdd532151bb00e647b233e845b1617"
hash = "c55cb6b42cfabf0edf1499d383817164d1b034895e597068e019c19d787ea313"
hash = "32144ba8370826e069e5f1b6745a3625d10f50a809f3f2a72c4c7644ed0cab03"
@@ -340111,8 +340517,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_19 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L315-L332"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L315-L332"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "05e2912f2a593ba16a5a094d319d96715cbecf025bf88bb0293caaf6beb8bc20"
hash = "e7bbdb275773f43c8e0610ad75cfe48739e0a2414c948de66ce042016eae0b2e"
logic_hash = "218c16d1b67e3e80dc7fdaf67a869e92b39744cb336e70761ac960da36c00372"
@@ -340140,8 +340546,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_20 : FILE
date = "2018-05-04"
modified = "2023-01-06"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L334-L355"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L334-L355"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5c12379cd7ab3cb03dac354d0e850769873d45bb486c266a893c0daa452aa03c"
hash = "172cd90fd9e31ba70e47f0cc76c07d53e512da4cbfd197772c179fe604b75369"
hash = "1ce88e98c8b37ea68466657485f2c01010a4d4a88587ba0ae814f37680a2e7a8"
@@ -340168,8 +340574,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_21 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L357-L376"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L357-L376"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4b7b9c2a9d5080ccc4e9934f2fd14b9d4e8f6f500889bf9750f1d672c8724438"
logic_hash = "4fdb162575bd108bb35e5c8ed10f7cac7539a15349218222dbb82d8eae8ad4bb"
score = 75
@@ -340197,8 +340603,8 @@ rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_22 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L378-L395"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L378-L395"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fa116cf9410f1613003ca423ad6ca92657a61b8e9eda1b05caf4f30ca650aee5"
logic_hash = "af2d7917f54ca365465383484b6d19a941d4801898d162a6d3afa7b7c8491a0f"
score = 75
@@ -340225,8 +340631,8 @@ rule SIGNATURE_BASE_MAL_Airdviper_Sample_Apr18_1 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L398-L422"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L398-L422"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9f453f1d5088bd17c60e812289b4bb0a734b7ad2ba5a536f5fd6d6ac3b8f3397"
logic_hash = "cbe1f36320eb9640ffbb6495faf7e5a062c5929d022bb56cbf0ebee810ef4e94"
score = 75
@@ -340256,8 +340662,8 @@ rule SIGNATURE_BASE_MAL_Winnti_Sample_May18_1 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L426-L440"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L426-L440"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "528d9eaaac67716e6b37dd562770190318c8766fa1b2f33c0974f7d5f6725d41"
logic_hash = "e235396de278120cbc4700f239c41e7f21e97ba111c07022ae505de540dda2bc"
score = 75
@@ -340282,8 +340688,8 @@ rule SIGNATURE_BASE_MAL_Visel_Sample_May18_1 : FILE
date = "2018-05-04"
modified = "2023-12-05"
reference = "https://401trg.pw/burning-umbrella/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_burning_umbrella.yar#L442-L460"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_burning_umbrella.yar#L442-L460"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "35db8e6a2eb5cf09cd98bf5d31f6356d0deaf4951b353fc513ce98918b91439c"
logic_hash = "3200e3224e037a116451b09ce265c1794a05406876376531ac81eb720fcb6945"
score = 75
@@ -340308,8 +340714,8 @@ rule SIGNATURE_BASE_MAL_Webmonitor_RAT : FILE
date = "2018-04-13"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/04/unit42-say-cheese-webmonitor-rat-comes-c2-service-c2aas/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_webmonitor_rat.yar#L1-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_webmonitor_rat.yar#L1-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "27aaad8a7b3fd53d99077a9202e8bed05696c843ed2485bea6eb9e33a1c273ac"
hash = "05111c305028b5d822ecd12de9879560223c42860cc9d448c47886c236648607"
logic_hash = "fbf6368527a7bd841b7679d668d6b77ce720fd0f6bcbd5fa9ff6301ae72199ec"
@@ -340346,8 +340752,8 @@ rule SIGNATURE_BASE_WEBSHELL_Csharp_Hash_String_Oct22 : FILE
date = "2022-10-27"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_webshell_csharp.yar#L2-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_webshell_csharp.yar#L2-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "29c187ad46d3059dc25d5f0958e0e8789fb2a51b9daaf90ea27f001b1a9a603c"
logic_hash = "28a07f3dd17fc469388867fa82a0e21abeee9c4e114af245b684535e4e194891"
score = 60
@@ -340376,8 +340782,8 @@ rule SIGNATURE_BASE_Remsec_Executable_Blob_32
date = "2016-08-08"
modified = "2023-12-05"
reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_strider.yara#L8-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_strider.yara#L8-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1cfc43ab15b3d220a636c150315c30f5654e53fad67d20534ce4d5c00295e35e"
score = 80
quality = 85
@@ -340398,8 +340804,8 @@ rule SIGNATURE_BASE_Remsec_Executable_Blob_64
date = "2016-08-08"
modified = "2023-12-05"
reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_strider.yara#L22-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_strider.yara#L22-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "957e5b6afabec3fb1b169dd85d0e950107e219f7dec8ef779a18bd90d9824a97"
score = 80
quality = 85
@@ -340420,8 +340826,8 @@ rule SIGNATURE_BASE_Remsec_Executable_Blob_Parser
date = "2016-08-08"
modified = "2023-12-05"
reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_strider.yara#L36-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_strider.yara#L36-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2f6db962807c07ff1bbe8b53eeb386d7b0ac88f95b76439c0d8b65d597739bdd"
score = 80
quality = 85
@@ -340442,8 +340848,8 @@ rule SIGNATURE_BASE_Remsec_Encrypted_Api
date = "2016-08-08"
modified = "2023-12-05"
reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_strider.yara#L50-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_strider.yara#L50-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4f10c24a8480c17c2939fe3fecba2820b22f8a47bc2b2e73ac1080a355025d7c"
score = 80
quality = 85
@@ -340464,8 +340870,8 @@ rule SIGNATURE_BASE_Remsec_Packer_A
date = "2016-08-08"
modified = "2023-12-05"
reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_strider.yara#L64-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_strider.yara#L64-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b46a41686fbf1c63e8a8b583859f23bf789bc9f11ee6b1fb01bb08e602772e76"
score = 80
quality = 85
@@ -340486,8 +340892,8 @@ rule SIGNATURE_BASE_Remsec_Packer_B
date = "2016-08-08"
modified = "2023-12-05"
reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_strider.yara#L78-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_strider.yara#L78-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9c63b5934d60b59a33364ef56c913220e59b9798a682a7f97e6755270adf4e4b"
score = 80
quality = 85
@@ -340508,8 +340914,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Backdoorlogger
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L3-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L3-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c7716b21e85d7e9fb1e1503071c6cd7dc2f4713051e0b03013e3d123a0d800a6"
score = 70
quality = 85
@@ -340531,8 +340937,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Jasus
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L19-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L19-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7d6cd7f0f264a0bfdc6af422baa1a0e257cb8f4c39a2cb27a1edaf70201e8564"
score = 70
quality = 85
@@ -340555,8 +340961,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Loggermodule
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L36-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L36-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dd937bc3fc7054874a3c61bbef859dd8a8ec37872a30be6d3e1776957f98db80"
score = 70
quality = 85
@@ -340578,8 +340984,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Netc
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L52-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L52-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7da739c33da91f07e9e35ceab88a37477372998b4cf4b692b8d26cd1a4d936de"
score = 70
quality = 85
@@ -340601,8 +341007,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Shellcreator2
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L68-L82"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L68-L82"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5422cf4e4809c1183c3c9870d9a5ddcf806082d8cae81a014255f5f18576101d"
score = 70
quality = 85
@@ -340624,8 +341030,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Smartcopy2
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L84-L98"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L84-L98"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5b83588fa80558cd387511d38e9d1c51c488216b9cd27e848d8bdc59cd8ce348"
score = 70
quality = 85
@@ -340647,8 +341053,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Synflooder
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L100-L115"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L100-L115"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b5349931c4eb5733f9bf05e7cfac6a434063a01d802665f70384cb29d9ae2a3d"
score = 70
quality = 85
@@ -340671,8 +341077,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Tinyzbot
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L117-L138"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L117-L138"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fdc41fbec71602e13105a03a4f44319a139018bda00e87e8f4d9b5e2f6269c14"
score = 70
quality = 85
@@ -340701,8 +341107,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Zhoupinexploitcrew
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L140-L154"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L140-L154"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1541f1ebc026d3eaf9b62150085415d12523ee1395fb8cf7ade8608a1b0a11b6"
score = 70
quality = 85
@@ -340724,8 +341130,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Antivirusdetector
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L156-L171"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L156-L171"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9a8c2bbd27efab4c5579ea143abbd2f71c477dfd0ddbfb1741359e4d34140d9b"
score = 70
quality = 85
@@ -340748,8 +341154,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Csext
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L173-L188"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L173-L188"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b4d070b71b685608ab84e757d01293749f2c017a6cd5b6ade6591264adc9836b"
score = 70
quality = 85
@@ -340772,8 +341178,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Kagent
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L190-L204"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L190-L204"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "bd72ade7d40db830dc980def5107261f9cb41b713f9a0a1b2f41f7658b31653e"
score = 70
quality = 85
@@ -340795,8 +341201,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Mimikatzwrapper
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L206-L220"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L206-L220"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c643e248a9d8dd653ec99f8b59cdc7af945857a6a0321f93cc6983e85f84baba"
score = 70
quality = 85
@@ -340818,8 +341224,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Pvz_In
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L222-L236"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L222-L236"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "eae778162be5dcfa0005bb237c5209e7103db3549e06706744f9ebdf04e192df"
score = 70
quality = 85
@@ -340841,8 +341247,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Pvz_Out
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L238-L252"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L238-L252"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "849300c32d2df42a011386903495d271810fd8a40c76d1a0c6295c059deb3a05"
score = 70
quality = 85
@@ -340864,8 +341270,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Wndtest
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L254-L269"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L254-L269"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3b29c2b92b816bd0559695cb6b0b6e050ca8c5e256ec92448535fe9edf20757f"
score = 70
quality = 85
@@ -340888,8 +341294,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Zhcat
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L271-L285"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L271-L285"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ef5112532ba62cb2cf6a1c62b344d9146c5b8e2da50990c8cfd60d91b99bcb5e"
score = 70
quality = 85
@@ -340911,8 +341317,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Zhlookup
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L287-L300"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L287-L300"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9cc476e016708fd1604a63e2391057dc9dd0865448b62742ec596d6de54bf8f6"
score = 70
quality = 85
@@ -340933,8 +341339,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Zhmimikatz
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L302-L316"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L302-L316"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1d6ce5b3351d4b01abe0c2f614d002d4e96599b4bfa01138704a3fdf345d0786"
score = 70
quality = 85
@@ -340956,8 +341362,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Parviz_Developer
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L318-L332"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L318-L332"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6ae043ee5baa7361def79811350317baf54eb76cf15001a7785808dc7947fddc"
score = 70
quality = 85
@@ -340979,8 +341385,8 @@ rule SIGNATURE_BASE_OPCLEAVER_Ccproxy_Config
date = "2014-12-02"
modified = "2023-12-05"
reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_cleaver.yar#L334-L352"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_cleaver.yar#L334-L352"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6e5c1c75a499434ad6ddd2439d28ac91d500b18418e693761d0b236bf6d6ce42"
score = 70
quality = 85
@@ -341006,8 +341412,8 @@ rule SIGNATURE_BASE_Mywscript_Compiledscript : FILE
date = "2017-07-27"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_mywscript_dropper.yar#L10-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_mywscript_dropper.yar#L10-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "515f5188ba6d039b8c38f60d3d868fa9c9726e144f593066490c7c97bf5090c8"
logic_hash = "5619de9589e3d34026bf4ec223f2c6b94fcb7362c8f3c26f7582030cfc4385cf"
score = 65
@@ -341032,8 +341438,8 @@ rule SIGNATURE_BASE_Poisonivy_Sample_APT : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_poisonivy.yar#L2-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_poisonivy.yar#L2-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b874b76ff7b281c8baa80e4a71fc9be514093c70"
logic_hash = "938df757d1f5ee1028d61dbc2ab76a33c788a44f87cb0d84626420e20bfb5fa4"
score = 70
@@ -341061,8 +341467,8 @@ rule SIGNATURE_BASE_Poisonivy_Sample_APT_2 : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_poisonivy.yar#L24-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_poisonivy.yar#L24-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "333f956bf3d5fc9b32183e8939d135bc0fcc5770"
logic_hash = "58d62278d776c9f7c3ae0815aa4b248f85c5fc648405b8d1ba2b8eb2847e1e88"
score = 70
@@ -341105,8 +341511,8 @@ rule SIGNATURE_BASE_Poisonivy_Sample_APT_3 : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_poisonivy.yar#L60-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_poisonivy.yar#L60-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "df3e1668ac20edecc12f2c1a873667ea1a6c3d6a"
logic_hash = "96f8324dcf85f5baa64178774abf17516a9e023dd6fa38e2bce0fe5159a4f704"
score = 70
@@ -341131,8 +341537,8 @@ rule SIGNATURE_BASE_Poisonivy_Sample_APT_4 : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_poisonivy.yar#L79-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_poisonivy.yar#L79-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "558f0f0b728b6da537e2666fbf32f3c9c7bd4c0c"
logic_hash = "7ba10269d31e985dff582ae4103ef1179172ae475e078161864f185380bb5035"
score = 70
@@ -341163,8 +341569,8 @@ rule SIGNATURE_BASE_Poisonivy_Sample_5 : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_poisonivy.yar#L103-L123"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_poisonivy.yar#L103-L123"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "545e261b3b00d116a1d69201ece8ca78d9704eb2"
logic_hash = "3f88b673b80b67a110915285a87ead265ad0176ea414426ba55e780e3aa396fe"
score = 70
@@ -341193,8 +341599,8 @@ rule SIGNATURE_BASE_Poisonivy_Sample_6 : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_poisonivy.yar#L126-L164"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_poisonivy.yar#L126-L164"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8c2630ab9b56c00fd748a631098fa4339f46d42b"
hash = "36b4cbc834b2f93a8856ff0e03b7a6897fb59bd3"
logic_hash = "0d77fd224b8d2dfd506faf0d3e359bf04172cc2854dc737e05c4bf99d0e1f3f7"
@@ -341237,8 +341643,8 @@ rule SIGNATURE_BASE_Poisonivy_Sample_7 : FILE
date = "2015-06-03"
modified = "2023-12-05"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_poisonivy.yar#L166-L185"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_poisonivy.yar#L166-L185"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9480cf544beeeb63ffd07442233eb5c5f0cf03b3"
logic_hash = "28db3fb7fa5b5e60ad1d1cc2b6d3d9d30a1948491105439201574ca354eb8bd1"
score = 70
@@ -341266,8 +341672,8 @@ rule SIGNATURE_BASE_Poisonivy_RAT_Ssmuidll : FILE
date = "2016-04-22"
modified = "2023-12-05"
reference = "http://goo.gl/WiwtYT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_poisonivy.yar#L196-L230"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_poisonivy.yar#L196-L230"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a424ad3f3106b87e8e82c7125834d7d8af8730a2a97485a639928f66d5f6bf4"
hash = "6eb7657603edb2b75ed01c004d88087abe24df9527b272605b8517a423557fe6"
hash = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
@@ -341296,8 +341702,8 @@ rule SIGNATURE_BASE_Gen_Excel_Auto_Open_Evasion : FILE
date = "2020-09-24"
modified = "2023-12-05"
reference = "https://malware.pizza/2020/05/12/evading-av-with-excel-macros-and-biff8-xls/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_excel_auto_open_evasion.yar#L1-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_excel_auto_open_evasion.yar#L1-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e23f9f55e10f3f31a2e76a12b174b6741a2fa1f51cf23dbd69cf169d92c56ed5"
hash = "bb3c9739de8ffe2e0f375847d41a010463ec19f1d3f578ac053651a51ed69bbc"
hash = "56ff65b7f6bf5936883f52b50ca66e768b2088158cc77af681ffab7122be7753"
@@ -341325,8 +341731,8 @@ rule SIGNATURE_BASE_APT_Pupyrat_PY : FILE
date = "2017-02-17"
modified = "2023-12-05"
reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_magichound.yar#L10-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_magichound.yar#L10-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8d89f53b0a6558d6bb9cdbc9f218ef699f3c87dd06bc03dd042290dedc18cb71"
logic_hash = "b30bc3082be3229ea2ef5d7c51ab6f97df2f612c80c45892e1a13fde1fb56725"
score = 75
@@ -341354,8 +341760,8 @@ rule SIGNATURE_BASE_APT_Magichound_Malmacro : FILE
date = "2017-02-17"
modified = "2023-12-05"
reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_magichound.yar#L33-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_magichound.yar#L33-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "66d24a529308d8ab7b27ddd43a6c2db84107b831257efb664044ec4437f9487b"
hash = "e5b643cb6ec30d0d0b458e3f2800609f260a5f15c4ac66faf4ebf384f7976df6"
logic_hash = "198c6e7ab957d5c1bb45449b0b2210532e97ed11700f8435201200746e0dfa48"
@@ -341382,8 +341788,8 @@ rule SIGNATURE_BASE_MAL_Gopuram_Apr23 : FILE
date = "2023-04-04"
modified = "2023-12-05"
reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_gopuram.yar#L1-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_gopuram.yar#L1-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c"
hash = "97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7"
logic_hash = "58d978bd09a656f2a10a4d5d2585e51efe5cfb6b6648a4b3c2ce8c4f5d2256d4"
@@ -341407,8 +341813,8 @@ rule SIGNATURE_BASE_APT_RANCOR_JS_Malware : FILE
date = "2018-06-26"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rancor.yar#L13-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rancor.yar#L13-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458"
logic_hash = "0d1e86d4395d4f84518750b5d58d15ed79b79570fbe50010d5d790b4c2511bb2"
score = 75
@@ -341433,8 +341839,8 @@ rule SIGNATURE_BASE_APT_RANCOR_PLAINTEE_Variant : FILE
date = "2018-06-26"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rancor.yar#L30-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rancor.yar#L30-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31"
hash = "bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e"
logic_hash = "d22aa91d0f66dbb85b79c0f121f0508135bf817929d81f3ff0b3fdf223ba53ec"
@@ -341464,8 +341870,8 @@ rule SIGNATURE_BASE_APT_RANCOR_PLAINTEE_Malware_Exports : FILE
date = "2018-06-26"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rancor.yar#L51-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rancor.yar#L51-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d"
logic_hash = "aa55452d4639dbaec760277908906c4ff9e8b66a60b1bcdc157ce23bd5d596db"
score = 75
@@ -341486,8 +341892,8 @@ rule SIGNATURE_BASE_APT_RANCOR_DDKONG_Malware_Exports : FILE
date = "2018-06-26"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rancor.yar#L64-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rancor.yar#L64-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d"
logic_hash = "2d11d46530c22b323c504344448d91fd43c0eecd29cf29aa4da7b2c797d27ff9"
score = 75
@@ -341508,8 +341914,8 @@ rule SIGNATURE_BASE_Keyboys_Malware_1 : FILE
date = "2017-11-02"
modified = "2023-12-05"
reference = "http://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_keyboys.yar#L13-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_keyboys.yar#L13-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1d716cee0f318ee14d7c3b946a4626a1afe6bb47f69668065e00e099be362e22"
hash = "a6e9951583073ab2598680b17b8b99bab280d6dca86906243bafaf3febdf1565"
hash = "34f740e5d845710ede1d942560f503e117600bcc7c5c17e03c09bfc66556196c"
@@ -341548,8 +341954,8 @@ rule SIGNATURE_BASE_Keyboy_Installclient : FILE
date = "2018-03-26"
modified = "2023-12-05"
reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_keyboys.yar#L52-L73"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_keyboys.yar#L52-L73"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "85d32cb3ae046a38254b953a00b37bb87047ec435edb0ce359a867447ee30f8b"
hash = "b0f120b11f727f197353bc2c98d606ed08a06f14a1c012d3db6fe0a812df528a"
hash = "d65f809f7684b28a6fa2d9397582f350318027999be3acf1241ff44d4df36a3a"
@@ -341579,8 +341985,8 @@ rule SIGNATURE_BASE_Keyboy_Wab32Res : FILE
date = "2018-03-26"
modified = "2023-12-05"
reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_keyboys.yar#L75-L96"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_keyboys.yar#L75-L96"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "02281e26e89b61d84e2df66a0eeb729c5babd94607b1422505cd388843dd5456"
hash = "fb9c9cbf6925de8c7b6ce8e7a8d5290e628be0b82a58f3e968426c0f734f38f6"
logic_hash = "5e23bfeed0587ac69527234dd3f8b4f8c5628128ab667af7b99c4d75ca99459b"
@@ -341611,8 +342017,8 @@ rule SIGNATURE_BASE_Keyboy_Rasauto : FILE
date = "2018-03-26"
modified = "2023-12-05"
reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_keyboys.yar#L98-L126"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_keyboys.yar#L98-L126"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "49df4fec76a0ffaee5e4d933a734126c1a7b32d1c9cb5ab22a868e8bfc653245"
logic_hash = "87529000522d5fad4346a0228c96d3adf122587d91b0cff083948787e53cc024"
score = 75
@@ -341645,8 +342051,8 @@ rule SIGNATURE_BASE_Keyboy_876_0X4E20000 : FILE
date = "2018-03-26"
modified = "2023-12-05"
reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_keyboys.yar#L128-L155"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_keyboys.yar#L128-L155"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6e900e5b6dc4f21a004c5b5908c81f055db0d7026b3c5e105708586f85d3e334"
logic_hash = "092bb19cd7a4250560ea71a3e54780a8fd34a229caa294e4cd5b6d522850d519"
score = 75
@@ -341679,8 +342085,8 @@ rule SIGNATURE_BASE_LOG_Teamviewer_Connect_Chinese_Keyboard_Layout
date = "2019-10-12"
modified = "2020-12-16"
reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/log_teamviewer_keyboard_layouts.yar#L2-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/log_teamviewer_keyboard_layouts.yar#L2-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ba3bc7cbdfc5a47f6bc4cd9049c52eb95d25465af107ae3d068ef785b714279a"
score = 60
quality = 85
@@ -341705,8 +342111,8 @@ rule SIGNATURE_BASE_LOG_Teamviewer_Connect_Russian_Keyboard_Layout
date = "2019-10-12"
modified = "2022-12-07"
reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/log_teamviewer_keyboard_layouts.yar#L23-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/log_teamviewer_keyboard_layouts.yar#L23-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9de52ec41fb410fcff50d49eb7871eadd07b520c3cfa089e1eeecc580e610eaa"
score = 60
quality = 85
@@ -341729,8 +342135,8 @@ rule SIGNATURE_BASE_Gen_Suspicious_Inpage_Dropper : FILE
date = "2019-07-03"
modified = "2023-12-05"
reference = "https://twitter.com/Ahmedfshosha/status/1138138981521154049"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_InPage_dropper.yar#L1-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_InPage_dropper.yar#L1-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "013417bd5465d6362cd43c70015c7a74a1b8979785b842b7cfa543cb85985852"
hash = "1d1e7a6175e6c514aaeca8a43dabefa017ddc5b166ccb636789b6a767181a022"
hash = "bd293bdf3be0a44a92bdb21e5fa75c124ad1afed3c869697bf90c9732af0e994"
@@ -341757,8 +342163,8 @@ rule SIGNATURE_BASE_Andromeda_Malbot_Jun_1A : FILE
date = "2017-06-30"
modified = "2022-12-21"
reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_andromeda_jun17.yar#L12-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_andromeda_jun17.yar#L12-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9"
hash = "73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98"
hash = "66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4"
@@ -341792,8 +342198,8 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Notable_Strings : FILE
date = "2022-02-23"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_cyclops_blink.yar#L6-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_cyclops_blink.yar#L6-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
hash = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
logic_hash = "fdd3a1de9d178370fcc66dbca4628d7bedfbc002bca9e463e11cb444302900ea"
@@ -341827,8 +342233,8 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Module_Initialisation : FILE
date = "2022-02-23"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_cyclops_blink.yar#L39-L55"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_cyclops_blink.yar#L39-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
hash = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
logic_hash = "8bde37f642cf07e323beabaacd5c62f8422b451777fc1fc4a6bdf474db49de12"
@@ -341852,8 +342258,8 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Modified_Install_Upgrade : FILE
date = "2022-02-23"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_cyclops_blink.yar#L57-L88"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_cyclops_blink.yar#L57-L88"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
hash = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
hash = "7d61c0dd0cd901221a9dff9df09bb90810754f10"
@@ -341886,8 +342292,8 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Core_Command_Check : FILE
date = "2022-02-23"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_cyclops_blink.yar#L90-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_cyclops_blink.yar#L90-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
hash = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
logic_hash = "71c9da1f0e9e64be87293c985f2a4a59a6c87ffd127ce5104ebe95a0ccb316af"
@@ -341910,8 +342316,8 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Config_Identifiers : FILE
date = "2022-02-23"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_cyclops_blink.yar#L106-L126"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_cyclops_blink.yar#L106-L126"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
hash = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
logic_hash = "6fa39442d717a69dd6f31a4bb2e5865c3f16156ce24a2b419d95ed751bb0d8ee"
@@ -341936,8 +342342,8 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0Xf_Command : FILE
date = "2022-02-23"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_cyclops_blink.yar#L128-L150"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_cyclops_blink.yar#L128-L150"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
hash = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
logic_hash = "6e3eebe404c8cd24e1e16eb3c881b1eda78ba6b365bf89c2557329e6f89396ac"
@@ -341964,8 +342370,8 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Default_Config_Values : FILE
date = "2022-02-23"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_cyclops_blink.yar#L152-L174"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_cyclops_blink.yar#L152-L174"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
hash = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
logic_hash = "180993057c110c0c0327b673c6d6e251534012de51cf6475838691e0942a1aa8"
@@ -341992,8 +342398,8 @@ rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0X51_Command : FILE
date = "2022-02-23"
modified = "2023-12-05"
reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_cyclops_blink.yar#L176-L200"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_cyclops_blink.yar#L176-L200"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
hash = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
logic_hash = "8a68f4a5f5b7a45819e9a198881aa41b75a65181b63788c8b824b339bfd6fc67"
@@ -342022,8 +342428,8 @@ rule SIGNATURE_BASE_Winnti_Fonfig : FILE
date = "2017-01-25"
modified = "2023-12-05"
reference = "https://goo.gl/VbvJtL"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_ms_report_201701.yar#L10-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_ms_report_201701.yar#L10-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2c9882854a60c624ecf6b62b6c7cc7ed04cf4a29814aa5ed1f1a336854697641"
logic_hash = "715892268431bf76cf9bf0bdbeaf4129befdc590b5b2dcae479d95dfe77561a4"
score = 75
@@ -342047,8 +342453,8 @@ rule SIGNATURE_BASE_Winnti_Nlaifsvc : FILE
date = "2017-01-25"
modified = "2023-12-05"
reference = "https://goo.gl/VbvJtL"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_ms_report_201701.yar#L26-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_ms_report_201701.yar#L26-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5"
logic_hash = "7268c79baf37174e04b391ae42cdd6014f17478c5b89d0c7b8042eb839324f87"
score = 75
@@ -342073,8 +342479,8 @@ rule SIGNATURE_BASE_Gen_Excel_Xor_Obfuscation_Velvetsweatshop : FILE
date = "2020-10-09"
modified = "2023-12-05"
reference = "https://twitter.com/BouncyHat/status/1308896366782042113"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_excel_xor_obfuscation_velvetsweatshop.yar#L3-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_excel_xor_obfuscation_velvetsweatshop.yar#L3-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "da1999c23ee2dae02a169fd2208b9766cb8f046a895f5f52bed45615eea94da0"
hash = "14a32b8a504db3775e793be59d7bd5b584ea732c3ca060b2398137efbfd18d5a"
hash = "dd3e89e7bde993f6f1b280f2bf933a5cc2797f4e8736aed4010aaf46e9854f23"
@@ -342100,8 +342506,8 @@ rule SIGNATURE_BASE_SUSP_Office_Dropper_Strings : FILE
date = "2018-09-13"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_office_dropper.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_office_dropper.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3a66a86eb99a3e7cd02e3444714c6c88b423cd0ea1e6210bf91da01cf804105f"
score = 65
quality = 85
@@ -342126,8 +342532,8 @@ rule SIGNATURE_BASE_SUSP_Enablecontent_String_Gen : FILE
date = "2019-02-12"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_office_dropper.yar#L19-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_office_dropper.yar#L19-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de"
logic_hash = "cde995ab0486fdafdc98e36c28a1f786ee7485387158f7337acd5f7dd0e3fed1"
score = 65
@@ -342152,8 +342558,8 @@ rule SIGNATURE_BASE_SUSP_Worddoc_VBA_Macro_Strings : FILE
date = "2019-02-12"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_office_dropper.yar#L42-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_office_dropper.yar#L42-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de"
logic_hash = "441e4a8e90d6045d0ad6a959ce56e834960c48083343add8e4f519f4b83bc82d"
score = 60
@@ -342182,8 +342588,8 @@ rule SIGNATURE_BASE_SUSP_Officedoc_VBA_Base64Decode : FILE
date = "2019-06-21"
modified = "2023-12-05"
reference = "https://github.com/cpaton/Scripting/blob/master/VBA/Base64.bas"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_office_dropper.yar#L65-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_office_dropper.yar#L65-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "52262bb315fa55b7441a04966e176b0e26b7071376797e35c80aa60696b6d6fc"
logic_hash = "1fb094c9991f93e9d1003832dc11a58efa8281e9fe844e61e27dfd077f55ad39"
score = 70
@@ -342207,8 +342613,8 @@ rule SIGNATURE_BASE_SUSP_VBA_Filesystem_Access : FILE
date = "2019-06-21"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_office_dropper.yar#L82-L100"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_office_dropper.yar#L82-L100"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "52262bb315fa55b7441a04966e176b0e26b7071376797e35c80aa60696b6d6fc"
logic_hash = "13d7e0708968a7700308e6216ea5d0a396f9335137ae1e33c3b34a2f54012ec6"
score = 60
@@ -342234,8 +342640,8 @@ rule SIGNATURE_BASE_SUSP_Excel_IQY_Remoteuri_Syntax : FILE
date = "2018-08-17"
modified = "2023-11-25"
reference = "https://twitter.com/ItsReallyNick/status/1030330473954897920"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_office_dropper.yar#L102-L120"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_office_dropper.yar#L102-L120"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7033b0a4226dd289ecc670a0807e4159dd4486f52bc80a6b5ddd34d6961ab163"
score = 55
quality = 85
@@ -342257,8 +342663,8 @@ rule SIGNATURE_BASE_SUSP_Macro_Sheet_Obfuscated_Char : FILE
date = "2020-04-07"
modified = "2023-12-05"
reference = "https://twitter.com/DissectMalware/status/1247595433305800706"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_office_dropper.yar#L122-L139"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_office_dropper.yar#L122-L139"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0e9ec7a974b87f4c16c842e648dd212f80349eecb4e636087770bc1748206c3b"
logic_hash = "0953d1f916df570cb3d053bf4fdac196bdbd806df4b6c0a982ed9949a3676e6c"
score = 65
@@ -342284,11 +342690,11 @@ rule SIGNATURE_BASE_URL_File_Local_EXE : FILE
date = "2017-10-04"
modified = "2023-12-05"
reference = "https://twitter.com/malwareforme/status/915300883012870144"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_url_to_local_exe.yar#L1-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_url_to_local_exe.yar#L1-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b85b723142f52ade68f6eb8ba54bb7dffafce0df6d1ae8a7c08b3ce621ccadd4"
score = 60
- quality = 60
+ quality = 85
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
@@ -342308,8 +342714,8 @@ rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_1 : FILE
date = "2024-07-12"
modified = "2024-12-12"
reference = "https://x.com/0xToxin/status/1811656147943752045"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_bat_obfusc_jul24.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_bat_obfusc_jul24.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "683f4651eb8c5b74eca16e7f97c5c44f0d70f045ea49f1f3726cb6975aba2ab9"
score = 70
quality = 85
@@ -342330,8 +342736,8 @@ rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_2 : FILE
date = "2024-07-12"
modified = "2024-12-12"
reference = "https://x.com/0xToxin/status/1811656147943752045"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_bat_obfusc_jul24.yar#L18-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_bat_obfusc_jul24.yar#L18-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "729ec93d180bf39c146c3fd847655340428abc3231b556ca51d3ca68825e7c3e"
score = 70
quality = 85
@@ -342352,8 +342758,8 @@ rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_3 : FILE
date = "2024-07-12"
modified = "2024-12-12"
reference = "https://x.com/0xToxin/status/1811656147943752045"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_bat_obfusc_jul24.yar#L37-L54"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_bat_obfusc_jul24.yar#L37-L54"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ecbe7850349f0368620ff4294e5d0ca277983799eed510f8bf8abe4d4c192197"
score = 70
quality = 85
@@ -342375,8 +342781,8 @@ rule SIGNATURE_BASE_LOG_EXPL_SUSP_Teamcity_CVE_2023_42793_Oct23_1 : CVE_2023_427
date = "2023-10-02"
modified = "2023-12-05"
reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_teamcity_2023_42793.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_teamcity_2023_42793.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3b6c8e3e3ff91563899ca94904a56460cd702a3e58e0aacf1c3acb506ec3f959"
score = 70
quality = 85
@@ -342400,8 +342806,8 @@ rule SIGNATURE_BASE_LOG_EXPL_SUSP_Teamcity_Oct23_1
date = "2023-10-02"
modified = "2023-12-05"
reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_teamcity_2023_42793.yar#L20-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_teamcity_2023_42793.yar#L20-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a2f0abffb9c72e6b32875310e5af7365b6cab4e6c4f6188daa3085b57c38ed0e"
score = 70
quality = 85
@@ -342424,8 +342830,8 @@ rule SIGNATURE_BASE_CHAOS_Payload : FILE
date = "2017-07-15"
modified = "2023-12-05"
reference = "https://github.com/tiagorlampert/CHAOS"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_chaos_payload.yar#L11-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_chaos_payload.yar#L11-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0962fcfcb1b52df148720c2112b036e75755f09279e3ebfce1636739af9b4448"
hash = "5c3553345f824b7b6de09ccb67d834e428b8df17443d98816471ca28f5a11424"
logic_hash = "ca409d3d0430fbc4c5ae52ce22616132da3a90c1ec3889571c6314e8787eee67"
@@ -342449,8 +342855,8 @@ rule SIGNATURE_BASE_SUSP_LNX_Sindoor_ELF_Obfuscation_Aug25 : FILE
date = "2025-08-29"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt36_operation_sindoor.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt36_operation_sindoor.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443"
logic_hash = "c1258c1f6d4b49104bedf3fbef932f1775ede7d32191df2e5479ca9b291add9e"
score = 70
@@ -342472,8 +342878,8 @@ rule SIGNATURE_BASE_SUSP_LNX_Sindoor_Desktopfile_Aug25 : FILE
date = "2025-08-29"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt36_operation_sindoor.yar#L19-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt36_operation_sindoor.yar#L19-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59"
logic_hash = "1549aac3132c5f3e73d984c3404a5530507e967df4ab6d5ccd408abc874a5306"
score = 70
@@ -342497,8 +342903,8 @@ rule SIGNATURE_BASE_MAL_Sindoor_Decryptor_Aug25 : FILE
date = "2025-08-29"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt36_operation_sindoor.yar#L38-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt36_operation_sindoor.yar#L38-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4b"
logic_hash = "4172fd9aee39a1a0681483f6dada6394debc62149a588ab4807e3016a823bed3"
score = 80
@@ -342524,8 +342930,8 @@ rule SIGNATURE_BASE_MAL_Sindoor_Downloader_Aug25 : FILE
date = "2025-08-29"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt36_operation_sindoor.yar#L65-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt36_operation_sindoor.yar#L65-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4"
logic_hash = "c55be65cd077cb04b625636dffcb02af74efa06bb49da734c8616da233a34d1a"
score = 80
@@ -342551,8 +342957,8 @@ rule SIGNATURE_BASE_Hatman_Compiled_Python : HATMAN
date = "2017-12-19"
modified = "2026-05-15"
reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hatman.yar#L102-L111"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hatman.yar#L102-L111"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a18018e4c6ea5b7ab6e1dbdc050e565f66520676565db6d352f58a786097960f"
score = 75
quality = 85
@@ -342570,8 +342976,8 @@ rule SIGNATURE_BASE_Hatman_Injector : HATMAN
date = "2017-12-19"
modified = "2023-01-09"
reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hatman.yar#L112-L122"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hatman.yar#L112-L122"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "19edf44bec6e1cbccefa145c5ae1bf0820729a80ac3ef1c8e7100b465b487e3c"
score = 75
quality = 85
@@ -342589,8 +342995,8 @@ rule SIGNATURE_BASE_Hatman_Payload : HATMAN
date = "2017-12-19"
modified = "2026-05-15"
reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hatman.yar#L123-L132"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hatman.yar#L123-L132"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9a6e5d2c2f2be35e6dc8b418e33419977460006923ecd9f029cacf51d8c0477a"
score = 75
quality = 85
@@ -342609,12 +343015,12 @@ rule SIGNATURE_BASE_MAL_PE_Type_Babyshark_Loader : FILE
date = "2019-02-24"
modified = "2023-12-05"
reference = "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_babyshark.yar#L4-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_babyshark.yar#L4-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6f76a8e16908ba2d576cf0e8cdb70114dcb70e0f7223be10aab3a728dc65c41c"
logic_hash = "0ab9a30cb731922d965a9cf58094fea36d5c74b9989324efee603808591ea6a5"
score = 75
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -342635,8 +343041,8 @@ rule SIGNATURE_BASE_APT_NK_Babyshark_Kimjoingrat_Apr19_1 : FILE
date = "2019-04-27"
modified = "2023-12-05"
reference = "https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_babyshark.yar#L29-L53"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_babyshark.yar#L29-L53"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712"
logic_hash = "3fec0f21e299e09ae9734f256edbbca81a53f860b42e99a78b07d344552f1062"
score = 75
@@ -342665,8 +343071,8 @@ rule SIGNATURE_BASE_Getuserspns_VBS
date = "2016-05-21"
modified = "2023-12-05"
reference = "https://github.com/skelsec/PyKerberoast"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_kerberoast.yar#L8-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_kerberoast.yar#L8-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8dcb568d475fd8a0557e70ca88a262b7c06d0f42835c855b52e059c0f5ce9237"
logic_hash = "ece81cd717fed6ca1f9053384911fd59462b6f3b01210ceeb037ba3da2f7a318"
score = 75
@@ -342691,8 +343097,8 @@ rule SIGNATURE_BASE_Getuserspns_PS1
date = "2016-05-21"
modified = "2023-12-05"
reference = "https://github.com/skelsec/PyKerberoast"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_kerberoast.yar#L25-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_kerberoast.yar#L25-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b69206b8d93ac86fe364178011723f4b1544fff7eb1ea544ab8912c436ddc04"
logic_hash = "204b009677a02bf8725f928c2bfff321b4543a883760e312a0c92f187684c8e9"
score = 75
@@ -342718,8 +343124,8 @@ rule SIGNATURE_BASE_Kerberoast_PY
date = "2016-05-21"
modified = "2023-12-05"
reference = "https://github.com/skelsec/PyKerberoast"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_kerberoast.yar#L43-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_kerberoast.yar#L43-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "73155949b4344db2ae511ec8cab85da1ccbf2dfec3607fb9acdc281357cdf380"
logic_hash = "3b285cc55733bd4c499ffb4821a92675806bf66faf3b3565ffb6de867bed538d"
score = 75
@@ -342745,8 +343151,8 @@ rule SIGNATURE_BASE_HKTL_Khepri_Beacon_Sep21_1 : FILE
date = "2021-09-08"
modified = "2023-12-05"
reference = "https://github.com/geemion/Khepri/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_khepri.yar#L2-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_khepri.yar#L2-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "86c48679db5f4c085fd741ebec5235bc6cf0cdf8ef2d98fd8a689ceb5088f431"
logic_hash = "c688dbda6006ef28305285f6aeec24a23cbfe9174d09cf4e3586bd0cf7290e60"
score = 90
@@ -342782,8 +343188,8 @@ rule SIGNATURE_BASE_Honeybee_Dropper_Maldoc : FILE
date = "2018-03-03"
modified = "2023-12-05"
reference = "https://goo.gl/JAHZVL"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_honeybee.yar#L13-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_honeybee.yar#L13-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "86981680172bbf0865e7693fe5a2bbe9b3ba12b3f1a1536ef67915daab78004c"
hash = "0d4352322160339f87be70c2f3fe096500cfcdc95a8dea975fdfc457bd347c44"
logic_hash = "8bc680a59a7bd269eea001c2c74e41ecd93a9b848210779fc7d9c24dfab7767a"
@@ -342815,8 +343221,8 @@ rule SIGNATURE_BASE_Ophoneybee_Malware_1 : FILE
date = "2018-03-03"
modified = "2023-12-05"
reference = "https://goo.gl/JAHZVL"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_honeybee.yar#L37-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_honeybee.yar#L37-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d31fe5cfa884e04ee26f323b8d104dcaa91146f5c7c216212fd3053afaade80f"
hash = "fc2bcd38659ae83fd25b4f7091412ae9ba011612fa4dcc3ef665b2cae2a1d74f"
hash = "2c5e5c86ca4fa172341c6bcbaa50984fb168d650ae9a33f2c6e6dccc1d57b369"
@@ -342854,8 +343260,8 @@ rule SIGNATURE_BASE_Ophoneybee_Maocheng_Dropper : FILE
date = "2018-03-03"
modified = "2023-12-05"
reference = "https://goo.gl/JAHZVL"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_honeybee.yar#L73-L86"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_honeybee.yar#L73-L86"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "35904f482d37f5ce6034d6042bae207418e450f4"
logic_hash = "85bcde1d821c052636a75dce4d8c3753188dd7da5fce2b3401d51c02d1c2fa6b"
score = 75
@@ -342879,8 +343285,8 @@ rule SIGNATURE_BASE_EXT_APT32_Goopdate_Installer
date = "2021-02-25"
modified = "2023-12-05"
reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt32.yar#L3-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt32.yar#L3-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "69730f2c2bb9668a17f8dfa1f1523e0e1e997ba98f027ce98f5cbaa869347383"
logic_hash = "1dcb3009c5c19ff4e54d82d3a4b99b3431e78664f1660522a781e815d96958c4"
score = 75
@@ -342906,8 +343312,8 @@ rule SIGNATURE_BASE_EXT_APT32_Osx_Backdoor_Loader : FILE
date = "2021-02-25"
modified = "2023-12-05"
reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt32.yar#L22-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt32.yar#L22-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "768510fa9eb807bba9c3dcb3c7f87b771e20fa3d81247539e9ea4349205e39eb"
logic_hash = "26964f95a9298b838e06fb9d7f739c8b87a976d8da7fb08416e952d26e84b84e"
score = 75
@@ -342937,8 +343343,8 @@ rule SIGNATURE_BASE_Brc4_Shellcode
date = "2022-11-19"
modified = "2023-12-05"
reference = "https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit/blob/main/deprecated/brc4.yara"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/hktl_bruteratel_c4.yar#L263-L290"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_bruteratel_c4.yar#L263-L290"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a2816eb0316cebc96569847c17eae3bc50b988b07aa471176a09695fcefc21ec"
score = 75
quality = 83
@@ -342974,8 +343380,8 @@ rule SIGNATURE_BASE_MAL_Malware_Imphash_Mar23_1 : HIGHVOL FILE
date = "2023-03-20"
modified = "2023-03-22"
reference = "https://yaraify.abuse.ch/statistics/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_imphash_detection.yar#L4-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_imphash_detection.yar#L4-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "167dde6bd578cbfcc587d5853e7fc2904cda10e737ca74b31df52ba24db6e7bc"
hash = "0a25a78c6b9df52e55455f5d52bcb3816460001cae3307b05e76ac70193b0636"
hash = "d87a35decd0b81382e0c98f83c7f4bf25a2b25baac90c9dcff5b5a147e33bcc8"
@@ -343042,8 +343448,8 @@ rule SIGNATURE_BASE_HKTL_Imphashes_Aug22_1 : FILE
date = "2022-08-17"
modified = "2023-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_imphash_detection.yar#L93-L192"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_imphash_detection.yar#L93-L192"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e76701b889138f9635cfe3a2f08710db3a6f0a3c3a15faa705ff0904d0566a1f"
score = 80
quality = 85
@@ -343062,8 +343468,8 @@ rule SIGNATURE_BASE_SUSP_Imphash_Mar23_2 : HIGHVOL FILE
date = "2023-03-23"
modified = "2023-11-25"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_imphash_detection.yar#L194-L295"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_imphash_detection.yar#L194-L295"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12bf2795f4a140adbaa0af6ad4b2508d398d8ba69e9dadb155f800b10f7458c4"
hash = "14ec56489fbcc3c7f1ef9a4d4a80ff302a5e233cdc4429a29c635a88fb1278d6"
hash = "13731912823d6ce01c28a8d7d7f961505f461620bb35adbb409d4954ba1f4b8e"
@@ -343113,8 +343519,8 @@ rule SIGNATURE_BASE_SUSP_Imphash_Mar23_3 : FILE
date = "2023-03-23"
modified = "2026-03-09"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_imphash_detection.yar#L297-L329"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_imphash_detection.yar#L297-L329"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b5296cf0eb22fba6e2f68d0c9de9ef7845f330f7c611a0d60007aa87e270c62a"
hash = "5a5a5f71c2270cea036cd408cde99f4ebf5e04a751c558650f5cb23279babe6d"
hash = "481b0d9759bfd209251eccb1848048ebbe7bd2c87c5914a894a5bffc0d1d67ff"
@@ -343143,8 +343549,8 @@ rule SIGNATURE_BASE_SUSP_Macro_Staroffice : FILE
date = "2019-02-06"
modified = "2021-05-27"
reference = "https://twitter.com/JohnLaTwC/status/1093259873993732096"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_macro_staroffice_suspicious.yar#L1-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_macro_staroffice_suspicious.yar#L1-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8495d37825dab8744f7d2c8049fc6b70b1777b9184f0abe69ce314795480ce39"
hash = "25b4214da1189fd30d3de7c538aa8b606f22c79e50444e5733fb1c6d23d71fbe"
hash = "322f314102f67a16587ab48a0f75dfaf27e4b044ffdc3b88578351c05b4f39db"
@@ -343184,8 +343590,8 @@ rule SIGNATURE_BASE_SUSP_Unsigned_OSPPSVC : FILE
date = "2019-09-26"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/2019/09/24/no-summer-vacations-zebrocy/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_sign_anomalies.yar#L4-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_sign_anomalies.yar#L4-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5294a730f1f0a176583b9ca2b988b3f5ec65dad8c6ebe556b5135566f2c16a56"
logic_hash = "27d8d8d19e25a2e3cffb765a0b3122e38dcb72d60c00c554163ee193a04b3d82"
score = 65
@@ -343215,8 +343621,8 @@ rule SIGNATURE_BASE_SUSP_PE_Signed_By_Suspicious_Entitiy_Mar23 : FILE
date = "2023-03-06"
modified = "2023-12-05"
reference = "https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_sign_anomalies.yar#L28-L214"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_sign_anomalies.yar#L28-L214"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2fb7a38e69a88e3da8fece4c6a1a81842c1be6ae9d6ac299afa4aef4eb55fd4b"
hash = "9a24befcc0c0926abb49d43174fe25c2469cca06d6ab3b5000d7c9d434c42fe9"
hash = "9ad716f0173489e74fefe086000dfbea9dc093b1c3460bed9cdb82f923073806"
@@ -343401,8 +343807,8 @@ rule SIGNATURE_BASE_MAL_Win_Amadey_Jun25 : FILE
date = "2025-06-18"
modified = "2026-05-15"
reference = "https://0x0d4y.blog/amadey-targeted-analysis/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_win_amadey_jun25.yar#L1-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_win_amadey_jun25.yar#L1-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "08dc17aa8f7e83bc349339a9a1b48184b094d8c66273d7199a15b206c6416946"
score = 80
quality = 85
@@ -343429,8 +343835,8 @@ rule SIGNATURE_BASE_Streamex_Shellcrew
date = "2017-02-09"
modified = "2023-12-05"
reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_shellcrew_streamex.yar#L11-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_shellcrew_streamex.yar#L11-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a82ff51c1dcd1ebe3d7acc96b46b0b79dcead9146204f060f5413c4c7b5286d3"
score = 80
quality = 85
@@ -343457,8 +343863,8 @@ rule SIGNATURE_BASE_Shellcrew_Streamex_1 : FILE
date = "2017-02-10"
modified = "2022-12-21"
reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_shellcrew_streamex.yar#L40-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_shellcrew_streamex.yar#L40-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "81f411415aefa5ad7f7ed2365d9a18d0faf33738617afc19215b69c23f212c07"
logic_hash = "4da0b8843de87e53243af40700afaab77120531af28dc311d9100bce6721650b"
score = 75
@@ -343486,8 +343892,8 @@ rule SIGNATURE_BASE_Shellcrew_Streamex_1_Msi : FILE
date = "2017-02-10"
modified = "2023-12-05"
reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_shellcrew_streamex.yar#L61-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_shellcrew_streamex.yar#L61-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8c9048e2f5ea2ef9516cac06dc0fba8a7e97754468c0d9dc1e5f7bce6dbda2cc"
logic_hash = "fa853dac58c067a88f1784ac4017fd558151e54ed10ceb32ab90c99e970460fe"
score = 75
@@ -343515,8 +343921,8 @@ rule SIGNATURE_BASE_Shellcrew_Streamex_1_Msi_Dll : FILE
date = "2017-02-10"
modified = "2023-12-05"
reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_shellcrew_streamex.yar#L82-L98"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_shellcrew_streamex.yar#L82-L98"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "883108119d2f4db066fa82e37aa49ecd2dbdacda67eb936b96720663ed6565ce"
hash = "5311f862d7c824d13eea8293422211e94fb406d95af0ae51358accd4835aaef8"
hash = "191cbeffa36657ab1ef3939da023cacbc9de0285bbe7775069c3d6e18b372c3f"
@@ -343542,8 +343948,8 @@ rule SIGNATURE_BASE_SUSP_EXPL_Msg_CVE_2023_23397_Mar23 : CVE_2023_23397 FILE
date = "2023-03-15"
modified = "2024-12-03"
reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_outlook_cve_2023_23397.yar#L1-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_outlook_cve_2023_23397.yar#L1-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
@@ -343575,8 +343981,8 @@ rule SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 : CVE_2023_2
date = "2023-03-15"
modified = "2023-03-18"
reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_outlook_cve_2023_23397.yar#L41-L81"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_outlook_cve_2023_23397.yar#L41-L81"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
@@ -343609,8 +344015,8 @@ rule SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_SMTP_Mail_Mar23 : CVE_2023_
date = "2023-03-17"
modified = "2023-03-24"
reference = "https://twitter.com/wdormann/status/1636491612686622723"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_outlook_cve_2023_23397.yar#L83-L112"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_outlook_cve_2023_23397.yar#L83-L112"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a361eb3abf98655f43efff2a5399f112d9ac2d23df85a642ab744c78e98330e0"
score = 60
quality = 85
@@ -343638,8 +344044,8 @@ rule SIGNATURE_BASE_APT_MAL_Maldoc_Cloudatlas_Oct20_1 : FILE
date = "2020-10-13"
modified = "2023-12-05"
reference = "https://twitter.com/jfslowik/status/1316050637092651009"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cloudatlas.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cloudatlas.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7ba76b2311736dbcd4f2817c40dae78f223366f2404571cd16d6676c7a640d70"
logic_hash = "772bdd8ec89edf2054e675e9ecb321a7bfe0307a7086a4e5b65f8d8b8cf80ecc"
score = 75
@@ -343661,8 +344067,8 @@ rule SIGNATURE_BASE_APT_MAL_URL_Cloudatlas_Oct20_2 : FILE
date = "2020-10-13"
modified = "2023-12-05"
reference = "https://twitter.com/jfslowik/status/1316050637092651009"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cloudatlas.yar#L18-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cloudatlas.yar#L18-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a6a58b614a9f5ffa1d90b5d42e15521f52e2295f02c1c0e5cd9cbfe933303bee"
logic_hash = "8bb60c262a34babbe8839f5d39d1c972eeb41ea77eaae02cc877d908c7033f13"
score = 75
@@ -343687,8 +344093,8 @@ rule SIGNATURE_BASE_ATM_Malware_Xfscashncr_1 : FILE
date = "2019-08-28"
modified = "2023-12-05"
reference = "https://twitter.com/r3c0nst/status/1166773324548063232"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_atm_xfscashncr.yar#L2-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_atm_xfscashncr.yar#L2-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d6dff67a6b4423b5721908bdcc668951f33b3c214e318051c96e8c158e8931c0"
logic_hash = "014d07115543c6e041649a1c57206a75fd555bf0458c7578a33c81b473c72751"
score = 75
@@ -343717,8 +344123,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Crime_Dearcry_Mar2021_1 : FILE
date = "2021-03-12"
modified = "2023-12-05"
reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_dearcry_ransom.yar#L1-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_dearcry_ransom.yar#L1-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
hash = "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
hash = "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
@@ -343750,8 +344156,8 @@ rule SIGNATURE_BASE_MAL_CRIME_RANSOM_Dearcry_Mar21_1 : FILE
date = "2021-03-12"
modified = "2023-12-05"
reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_dearcry_ransom.yar#L29-L53"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_dearcry_ransom.yar#L29-L53"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
hash = "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
hash = "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
@@ -343782,8 +344188,8 @@ rule SIGNATURE_BASE_Emdivi_SFX : FILE
date = "2015-08-20"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bluetermite_emdivi.yar#L9-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bluetermite_emdivi.yar#L9-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a3c81b2b3c14b9cd913692347019887b607c54152b348d6d3ccd3ecfd406196"
hash = "8c3df4e4549db3ce57fc1f7b1b2dfeedb7ba079f654861ca0b608cbfa1df0f6b"
logic_hash = "3257983c64c52f36b04e3fe7b12180a37531338349137d4df00fc6f704557b2e"
@@ -343810,8 +344216,8 @@ rule SIGNATURE_BASE_Emdivi_Gen1 : FILE
date = "2015-08-20"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bluetermite_emdivi.yar#L32-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bluetermite_emdivi.yar#L32-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
hash = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
hash = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
@@ -343847,8 +344253,8 @@ rule SIGNATURE_BASE_Emdivi_Gen2 : FILE
date = "2015-08-20"
modified = "2023-01-27"
reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bluetermite_emdivi.yar#L62-L85"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bluetermite_emdivi.yar#L62-L85"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9a351885bf5f6fec466f30021088504d96e9db10309622ed198184294717add1"
hash = "a5be7cb1f37030c9f9211c71e0fbe01dae19ff0e6560c5aab393621f18a7d012"
hash = "9183abb9b639699cd2ad28d375febe1f34c14679b7638d1a79edb49d920524a4"
@@ -343879,8 +344285,8 @@ rule SIGNATURE_BASE_MAL_Emdivi_Gen3 : FILE
date = "2015-08-20"
modified = "2023-01-06"
reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bluetermite_emdivi.yar#L87-L114"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bluetermite_emdivi.yar#L87-L114"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
hash = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
logic_hash = "ff89a0855481d723f23e0c00f6b6eaf912e6df3a7e9ebe4ff1e6ccf2b02f0888"
@@ -343910,8 +344316,8 @@ rule SIGNATURE_BASE_Emdivi_Gen4 : FILE
date = "2015-08-20"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_bluetermite_emdivi.yar#L116-L143"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_bluetermite_emdivi.yar#L116-L143"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
hash = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
hash = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
@@ -343947,8 +344353,8 @@ rule SIGNATURE_BASE_Duqu2_Sample1 : FILE
date = "2016-07-02"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_duqu2.yar#L10-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_duqu2.yar#L10-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6b146e3a59025d7085127b552494e8aaf76450a19c249bfed0b4c09f328e564f"
hash = "8e97c371633d285cd8fc842f4582705052a9409149ee67d97de545030787a192"
hash = "2796a119171328e91648a73d95eb297edc220e8768f4bbba5fb7237122a988fc"
@@ -343975,8 +344381,8 @@ rule SIGNATURE_BASE_Duqu2_Sample2 : FILE
date = "2016-07-02"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_duqu2.yar#L30-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_duqu2.yar#L30-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d12cd9490fd75e192ea053a05e869ed2f3f9748bf1563e6e496e7153fb4e6c98"
hash = "5ba187106567e8d036edd5ddb6763f89774c158d2a571e15d76572d8604c22a0"
hash = "6e09e1a4f56ea736ff21ad5e188845615b57e1a5168f4bdaebe7ddc634912de9"
@@ -344005,8 +344411,8 @@ rule SIGNATURE_BASE_Duqu2_Sample3 : FILE
date = "2016-07-02"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_duqu2.yar#L52-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_duqu2.yar#L52-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2a9a5afc342cde12c6eb9a91ad29f7afdfd8f0fb17b983dcfddceccfbc17af69"
logic_hash = "4adaf71a4acd8ce122af0b6f1267dc34c5190efcb4a6fa3322c1e6cf67a546a5"
score = 80
@@ -344029,8 +344435,8 @@ rule SIGNATURE_BASE_Duqu2_Sample4 : FILE
date = "2016-07-02"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_duqu2.yar#L68-L85"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_duqu2.yar#L68-L85"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3536df7379660d931256b3cf49be810c0d931c3957c464d75e4cba78ba3b92e3"
logic_hash = "ddecd1d7fa007b83fe6e29ac8983d02511a89a16ab2365f8086ec92a52d4bf33"
score = 80
@@ -344056,8 +344462,8 @@ rule SIGNATURE_BASE_Duqu2_Uas : FILE
date = "2016-07-02"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_duqu2.yar#L86-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_duqu2.yar#L86-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "52fe506928b0262f10de31e783af8540b6a0b232b15749d647847488acd0e17a"
hash = "81cdbe905392155a1ba8b687a02e65d611b60aac938e470a76ef518e8cffd74d"
logic_hash = "8bf27ca851c580080514dfa886c0d7c69ac114efb5dbc35ccd1e7686c3dd44b1"
@@ -344084,8 +344490,8 @@ rule SIGNATURE_BASE_NK_Miner_Malware_Jan18_1 : FILE
date = "2018-01-09"
modified = "2023-12-05"
reference = "https://goo.gl/PChE1z"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_nkminer.yar#L11-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_nkminer.yar#L11-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0024e32c0199ded445c0b968601f21cc92fc0c534d2642f2dd64c1c978ff01f3"
hash = "42300b6a09f183ae167d7a11d9c6df21d022a5f02df346350d3d875d557d3b76"
logic_hash = "eb75fe7d70b547a4774b74c01e11479949dfccb8645af330f87b51daaf0d8dbf"
@@ -344121,8 +344527,8 @@ rule SIGNATURE_BASE_Win_Privesc_Gp3Finder_V4_0 : FILE
date = "2016-06-02"
modified = "2023-12-05"
reference = "http://grimhacker.com/2015/04/10/gp3finder-group-policy-preference-password-finder/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_win_privesc.yar#L10-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_win_privesc.yar#L10-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7d34e214ef2ca33516875fb91a72d5798f89b9ea8964d3990f99863c79530c06"
logic_hash = "7d5618315ae5293ce1aea18d255d08bb007f39a466021fb636605684433da158"
score = 80
@@ -344147,8 +344553,8 @@ rule SIGNATURE_BASE_Win_Privesc_Folderperm
date = "2016-06-02"
modified = "2023-12-05"
reference = "http://www.greyhathacker.net/?p=738"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_win_privesc.yar#L28-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_win_privesc.yar#L28-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1aa87df34826b1081c40bb4b702750587b32d717ea6df3c29715eb7fc04db755"
logic_hash = "899fda75e4c6d9f588767e5170dbd30241a492ba89f7cc1b0ad4adb2fcd173cb"
score = 80
@@ -344173,8 +344579,8 @@ rule SIGNATURE_BASE_Win_Privesc_Adaclscan4_3
date = "2016-06-02"
modified = "2023-12-05"
reference = "https://adaclscan.codeplex.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_win_privesc.yar#L46-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_win_privesc.yar#L46-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3473ddb452de7640fab03cad3e8aaf6a527bdd6a7a311909cfef9de0b4b78333"
logic_hash = "ca657e5c4172d240f46a890fc112ee89d5bdf9e35e7d412332ee11bdaf166215"
score = 60
@@ -344199,8 +344605,8 @@ rule SIGNATURE_BASE_MAL_Litellm_Supplychain_Mar26 : FILE
date = "2026-03-28"
modified = "2026-05-15"
reference = "https://github.com/BerriAI/litellm/issues/24512"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_teampcp_mar26.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_teampcp_mar26.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238"
logic_hash = "4bf25020a0daebda3731a23e6a4191e0d83ff746a2482b6e0394d4c6a8f5c4b0"
score = 80
@@ -344224,8 +344630,8 @@ rule SIGNATURE_BASE_MAL_Telnyx_Supplychain_Mar26 : FILE
date = "2026-03-28"
modified = "2026-05-15"
reference = "https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_teampcp_mar26.yar#L19-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_teampcp_mar26.yar#L19-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ab4c4aebb52027bf3d2f6b2dcef593a1a2cff415774ea4711f7d6e0aa1451d4e"
logic_hash = "fac4c1a120bd8b046b2cfee677eff47fec6a9347a5a90648b07918337accc9cc"
score = 80
@@ -344250,8 +344656,8 @@ rule SIGNATURE_BASE_SUSP_LNX_Linux_Malware_Indicators_Aug20_1 : FILE
date = "2020-08-03"
modified = "2026-01-04"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_lnx_malware_indicators.yar#L1-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_lnx_malware_indicators.yar#L1-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1d07d424f2a66b60e55d21dff6d4c4f9f2591c3ab622dcfbc1cd989d28b44017"
score = 65
quality = 85
@@ -344282,8 +344688,8 @@ rule SIGNATURE_BASE_SUSP_Fake_AMSI_DLL_Jun23_1 : FILE
date = "2023-06-07"
modified = "2023-06-12"
reference = "https://twitter.com/eversinc33/status/1666121784192581633?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_fake_amsi_dll.yar#L3-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_fake_amsi_dll.yar#L3-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ec3db233ab22144bc65614b45bb894a7ea5a4fd40ccb603e6e52cc1b9ff8805b"
score = 65
quality = 85
@@ -344310,8 +344716,8 @@ rule SIGNATURE_BASE_HKTL_Sentinelone_Remotepotato0_Privesc : FILE
date = "2021-04-26"
modified = "2023-12-05"
reference = "https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_remote_potato0.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_remote_potato0.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f3a3a917908af6260f40b217f966750a095140abb6bf85cf3a728725bc16996f"
score = 75
quality = 79
@@ -344336,8 +344742,8 @@ rule SIGNATURE_BASE_Chafer_Mimikatz_Custom : FILE
date = "2018-03-22"
modified = "2023-12-05"
reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig_chafer_mar18.yar#L11-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig_chafer_mar18.yar#L11-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9709afeb76532566ee3029ecffc76df970a60813bcac863080cc952ad512b023"
logic_hash = "d3b74be6d221592fb867bd9589f5e4b246a093bd276efa3515d9e948a38eda48"
score = 75
@@ -344359,8 +344765,8 @@ rule SIGNATURE_BASE_Chafer_Exploit_Copyright_2017 : FILE
date = "2018-03-22"
modified = "2023-12-05"
reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig_chafer_mar18.yar#L25-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig_chafer_mar18.yar#L25-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cdac69caad8891c5e1b8eabe598c869674dee30af448ce4e801a90eb79973c66"
logic_hash = "53d3e735bc368de152f4f4058617bc2cc5574bc13777f743442ff2bfafe92791"
score = 75
@@ -344385,8 +344791,8 @@ rule SIGNATURE_BASE_Chafer_Portscanner : FILE
date = "2018-03-22"
modified = "2023-12-05"
reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig_chafer_mar18.yar#L45-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig_chafer_mar18.yar#L45-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "88274a68a6e07bdc53171641e7349d6d0c71670bd347f11dcc83306fe06656e9"
logic_hash = "6e0475a5c0fc8155359376113f88f3de080968388bd3ea60664a063540688faf"
score = 75
@@ -344410,8 +344816,8 @@ rule SIGNATURE_BASE_Oilrig_Myrtille : FILE
date = "2018-03-22"
modified = "2022-12-21"
reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig_chafer_mar18.yar#L61-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig_chafer_mar18.yar#L61-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "67945f2e65a4a53e2339bd361652c6663fe25060888f18e681418e313d1292ca"
logic_hash = "373115c0a3fbfe93435aca07cbac52c7649a77d8b7d6eda8af5ce4a1a42e53a6"
score = 75
@@ -344435,8 +344841,8 @@ rule SIGNATURE_BASE_Chafer_Packed_Mimikatz : FILE
date = "2018-03-22"
modified = "2023-12-05"
reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig_chafer_mar18.yar#L78-L92"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig_chafer_mar18.yar#L78-L92"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5f2c3b5a08bda50cca6385ba7d84875973843885efebaff6a482a38b3cb23a7c"
logic_hash = "0cee5270c9b76f1419c6989113dca221c5ba6f027a104d71f61d38cb59af51cd"
score = 75
@@ -344460,8 +344866,8 @@ rule SIGNATURE_BASE_Oilrig_PS_Cnc : FILE
date = "2018-03-22"
modified = "2023-12-05"
reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig_chafer_mar18.yar#L94-L107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig_chafer_mar18.yar#L94-L107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9198c29a26f9c55317b4a7a722bf084036e93a41ba4466cbb61ea23d21289cfa"
logic_hash = "0566f0707021af0d08426eec497292098273d46b020a5f0be6b98835ceeb82bc"
score = 75
@@ -344484,11 +344890,11 @@ rule SIGNATURE_BASE_LOG_EXPL_Ivanti_EPMM_Mobileiron_Core_CVE_2023_35078_Jul23_1
date = "2023-07-25"
modified = "2023-12-05"
reference = "Ivanti Endpoint Manager Mobile (EPMM) CVE-2023-35078 - Analysis Guidance"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L2-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L2-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ebc59032b7450aa438ca30170560c95550cda6ff7774b8ce1486309716da9e6c"
score = 75
- quality = 60
+ quality = 85
tags = "CVE-2023-35078"
strings:
@@ -344506,8 +344912,8 @@ rule SIGNATURE_BASE_MAL_WAR_Ivanti_EPMM_Mobileiron_Mi_War_Aug23 : CVE_2023_35078
date = "2023-08-01"
modified = "2023-12-05"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L16-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L16-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6255c75e2e52d779da39367e7a7d4b8d1b3c9c61321361952dcc05819251a127"
logic_hash = "0083727e34118d628c8507459bfb7f949f11af8197e201066e29e263e2c3f944"
score = 85
@@ -344530,8 +344936,8 @@ rule SIGNATURE_BASE_MAL_WAR_Ivanti_EPMM_Mobileiron_Logclear_JAVA_Aug23 : CVE_202
date = "2023-08-01"
modified = "2023-12-05"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L34-L53"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L34-L53"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "deb381c25d7a511b9eb936129eeba2c0341cff7f4bd2168b05e40ab2ee89225e"
logic_hash = "c42c2eca784d7089aab56addca11bad658a4a6c34a81ae823bd0c3dad41a1c99"
score = 80
@@ -344557,8 +344963,8 @@ rule SIGNATURE_BASE_APT_NK_Lazarus_RC4_Loop : FILE
date = "2020-06-10"
modified = "2023-12-05"
reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_aug20.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_aug20.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b0e96bfff924a0c9b39e1ab03097ae0790743417d9da70917d64bc238905971e"
score = 75
quality = 85
@@ -344581,8 +344987,8 @@ rule SIGNATURE_BASE_APT_NK_Lazarus_Network_Backdoor_Unpacked : FILE
date = "2020-06-10"
modified = "2023-12-05"
reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_aug20.yar#L17-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_aug20.yar#L17-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "bfc3cf400eeea332e2e44b65f9728e94af0adde76b32ed4be527b25484f80745"
score = 75
quality = 75
@@ -344612,8 +345018,8 @@ rule SIGNATURE_BASE_Octowave_Loader_03_2025 : FILE
date = "2025-03-19"
modified = "2025-03-21"
reference = "https://yaratoolkit.securitybreak.io/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_octowave_loader_mar25.yar#L1-L285"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_octowave_loader_mar25.yar#L1-L285"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0504bfbacb6e10b81196f625f2fe37b33500e7bf65fd82d3510a2b178c6cd5bd"
hash = "3a2db0cb9ee01549a6b660d58115d112d36a744d65705394b54d7d95287c7a74"
hash = "eb50d06057fe123d6e9f7a76d3d1a4bc5307e8f15d017be8f6031e92136cf36a"
@@ -344766,8 +345172,8 @@ rule SIGNATURE_BASE_Octowave_Loader_Supporting_File_03_2025 : FILE
date = "2025-03-19"
modified = "2025-03-21"
reference = "https://x.com/CyberRaiju/status/1893450184224362946?t=u0X6ST2Qgnrf-ujjphGOSg&s=19"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_octowave_loader_mar25.yar#L287-L312"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_octowave_loader_mar25.yar#L287-L312"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c4cbaa7e4521fa0ed9cc634c5e2bacbf41f46842ca4526b7904d98843a7e9db9"
hash = "f5cfb2e634539d5dc7ffe202ffdc422ef7457100401ba1fbc21dd05558719865"
hash = "56f1967f7177c166386d864807cdf03d5bbd3f118a285ce67ea226d02e5cf58c"
@@ -344797,8 +345203,8 @@ rule SIGNATURE_BASE_Minidionis_Readerview : FILE
date = "2015-07-20"
modified = "2023-12-05"
reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_minidionis.yar#L10-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_minidionis.yar#L10-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
hash = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
hash = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
@@ -344830,8 +345236,8 @@ rule SIGNATURE_BASE_Malicious_SFX1 : FILE
date = "2015-07-20"
modified = "2023-12-05"
reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_minidionis.yar#L39-L53"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_minidionis.yar#L39-L53"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f"
logic_hash = "fd7b4c504a52e68fe87eeb9f7066c61ddc47257ac9324a60d219c022d3affbbf"
score = 75
@@ -344855,8 +345261,8 @@ rule SIGNATURE_BASE_Malicious_SFX2 : FILE
date = "2015-07-20"
modified = "2023-12-05"
reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_minidionis.yar#L55-L70"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_minidionis.yar#L55-L70"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d"
logic_hash = "a2ed7660604ff3c9f2d0dbb454f5d168cd61d1d5e647b5c74fe24f25ebb3dbfd"
score = 75
@@ -344881,8 +345287,8 @@ rule SIGNATURE_BASE_Minidionis_VBS_Dropped : FILE
date = "2015-07-21"
modified = "2023-12-05"
reference = "https://malwr.com/analysis/ZDc4ZmIyZDI4MTVjNGY5NWI0YzE3YjIzNGFjZTcyYTY/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_minidionis.yar#L72-L89"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_minidionis.yar#L72-L89"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "97dd1ee3aca815eb655a5de9e9e8945e7ba57f458019be6e1b9acb5731fa6646"
logic_hash = "a24fe4cdff6dd7951af10710eb63ab1fd90ab0e43bbce4388d6687abac206da5"
score = 75
@@ -344909,8 +345315,8 @@ rule SIGNATURE_BASE_Gen_Base64_EXE : HIGHVOL FILE
date = "2017-04-21"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/general_cloaking.yar#L71-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/general_cloaking.yar#L71-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6fe18ee727a836c0baaac4dbbffdb9f50065f56a4c6eeee7e54792a8a66229de"
score = 75
quality = 85
@@ -344937,8 +345343,8 @@ rule SIGNATURE_BASE_Binary_Drop_Certutil : FILE
date = "2015-07-15"
modified = "2023-12-05"
reference = "https://goo.gl/9DNn8q"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/general_cloaking.yar#L92-L107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/general_cloaking.yar#L92-L107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3e2b62442b5da6ab887e1eb03cdd44932651fa51ce11e87e6fc29015e708d2f3"
score = 70
quality = 85
@@ -344962,8 +345368,8 @@ rule SIGNATURE_BASE_Stegokatz : FILE
date = "2015-09-11"
modified = "2023-12-05"
reference = "https://goo.gl/jWPBBY"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/general_cloaking.yar#L109-L123"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/general_cloaking.yar#L109-L123"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "091b07220d2a89822aa382edcecf5869d463e375747cc41f52417e66ccf0e2da"
score = 70
quality = 85
@@ -344986,8 +345392,8 @@ rule SIGNATURE_BASE_Obfuscated_VBS_April17 : FILE
date = "2017-04-21"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/general_cloaking.yar#L125-L137"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/general_cloaking.yar#L125-L137"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "590dca22a4fcbc2bbfb4358c53f7cb6c06824970139cca251c4cf1bd435817b0"
score = 75
quality = 85
@@ -345009,8 +345415,8 @@ rule SIGNATURE_BASE_Obfuscated_JS_April17 : FILE
date = "2017-04-21"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/general_cloaking.yar#L139-L153"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/general_cloaking.yar#L139-L153"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c75bf0ad8dd35fabbaedb54c2630249497edbb215b6ce2b707e32f82e8fb8f56"
score = 75
quality = 85
@@ -345034,8 +345440,8 @@ rule SIGNATURE_BASE_Mal_Babbleloader_Win_Jan24 : FILE
date = "2025-01-27"
modified = "2026-05-15"
reference = "https://0x0d4y.blog/babbleloader-technical-malware-analysis/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_babbleloader_win_jan24.yar#L1-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_babbleloader_win_jan24.yar#L1-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fa3d03c319a7597712eeff1338dabf92"
logic_hash = "d4f7915146b1f3fe50febc231247e14323e9d68a94b2b9c8149a5727c06162ca"
score = 100
@@ -345064,8 +345470,8 @@ rule SIGNATURE_BASE_APT_Backdoor_Win_GORAT_3_1 : FILE
date = "2020-12-08"
modified = "2025-02-12"
reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_fireeye_redteam_tools.yar#L47-L83"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_fireeye_redteam_tools.yar#L47-L83"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "995120b35db9d2f36d7d0ae0bfc9c10d"
logic_hash = "4fda951281b3d711e50c24f543b528b93295a119af39245b4bece77f641bbf2b"
score = 75
@@ -345111,8 +345517,8 @@ rule SIGNATURE_BASE_Credtheft_MSIL_Adpasshunt_2_1 : FILE
date = "2020-12-08"
modified = "2025-02-12"
reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_fireeye_redteam_tools.yar#L845-L861"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_fireeye_redteam_tools.yar#L845-L861"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6efb58cf54d1bb45c057efcfbbd68a93"
logic_hash = "a76faa34a1f9cc891aeaa65525c8698e49d5a141854ca0cffb42f06a251bea43"
score = 50
@@ -345139,8 +345545,8 @@ rule SIGNATURE_BASE_APT_Backdoor_Win_Gorat_Memory_1
date = "2020-12-08"
modified = "2025-02-12"
reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_fireeye_redteam_tools.yar#L1013-L1039"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_fireeye_redteam_tools.yar#L1013-L1039"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3b926b5762e13ceec7ac3a61e85c93bb"
logic_hash = "bf8d80b7a7d35c1bcb353ff66d10bc95c2e6502043acc6554887465a467cdcf7"
score = 75
@@ -345173,8 +345579,8 @@ rule SIGNATURE_BASE_Hacktool_MSIL_Sharpivot_3_1 : FILE
date = "2020-12-08"
modified = "2025-02-12"
reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_fireeye_redteam_tools.yar#L1145-L1174"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_fireeye_redteam_tools.yar#L1145-L1174"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e4efa759d425e2f26fbc29943a30f5bd"
logic_hash = "f51ac9637f47a98beee1b3c37b594e292aab0e1d3f9e49c41b1f3c3ce02e17de"
score = 75
@@ -345213,8 +345619,8 @@ rule SIGNATURE_BASE_Hacktool_MSIL_SEATBELT_1_1 : FILE
date = "2020-12-08"
modified = "2023-01-27"
reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_fireeye_redteam_tools.yar#L1210-L1233"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_fireeye_redteam_tools.yar#L1210-L1233"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "848837b83865f3854801be1f25cb9f4d"
logic_hash = "89275ec08b75cef371b70fb749cbcada3f30309869094ab7940811fe40f8a008"
score = 75
@@ -345245,8 +345651,8 @@ rule SIGNATURE_BASE_APT_Builder_PY_REDFLARE_2_1
date = "2020-12-01"
modified = "2020-12-01"
reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_fireeye_redteam_tools.yar#L1376-L1391"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_fireeye_redteam_tools.yar#L1376-L1391"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4410e95de247d7f1ab649aa640ee86fb"
logic_hash = "0f28fb23c0c1d589466c7c541c8dc588b038d02dded0c66c4a448d1f768c95c5"
score = 75
@@ -345270,8 +345676,8 @@ rule SIGNATURE_BASE_APT_Backdoor_Win_GORAT_2_1 : FILE
date = "2020-12-08"
modified = "2025-02-12"
reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_fireeye_redteam_tools.yar#L1453-L1484"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_fireeye_redteam_tools.yar#L1453-L1484"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f59095f0ab15f26a1ead7eed8cdb4902"
logic_hash = "45c83e0d39184abcbc0ccc5804ab745b4feec1fad424a543a05754e5b4cca311"
score = 75
@@ -345313,8 +345719,8 @@ rule SIGNATURE_BASE_APT_Backdoor_Win_GORAT_4_1 : FILE
date = "2020-12-08"
modified = "2025-02-12"
reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_fireeye_redteam_tools.yar#L1706-L1716"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_fireeye_redteam_tools.yar#L1706-L1716"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f59095f0ab15f26a1ead7eed8cdb4902"
logic_hash = "fa76e994beb2ab1b7950cf9d6391adf4e1ba45586a14a6340fa8a25a904821e4"
score = 75
@@ -345333,8 +345739,8 @@ rule SIGNATURE_BASE_Hacktool_MSIL_PXELOOT_2_1 : FILE
date = "2020-12-08"
modified = "2023-01-27"
reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_fireeye_redteam_tools.yar#L2088-L2113"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_fireeye_redteam_tools.yar#L2088-L2113"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d93100fe60c342e9e3b13150fd91c7d8"
logic_hash = "f9a9167b806e0e3df3720c13b4009e18c5a36913d255978cb001c2284533ea82"
score = 75
@@ -345367,8 +345773,8 @@ rule SIGNATURE_BASE_Bin_Ndisk : FILE
date = "2015-07-07"
modified = "2023-12-05"
reference = "https://www.virustotal.com/en/file/a03a6ed90b89945a992a8c69f716ec3c743fa1d958426f4c50378cca5bef0a01/analysis/1436184181/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hackingteam_rules.yar#L10-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hackingteam_rules.yar#L10-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cf5089752ba51ae827971272a5b761a4ab0acd84"
logic_hash = "d93147e9631065eab35cbbc4ce112cfef92f81063cf8570bc021fbfe72811ab6"
score = 100
@@ -345398,8 +345804,8 @@ rule SIGNATURE_BASE_Hackingteam_Elevator_DLL : FILE
date = "2015-07-07"
modified = "2023-12-05"
reference = "http://t.co/EG0qtVcKLh"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hackingteam_rules.yar#L33-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hackingteam_rules.yar#L33-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b7ec5d36ca702cc9690ac7279fd4fea28d8bd060"
logic_hash = "f2860c0bb6176f7cc57cb703e9d4235c4cf0b9cc1c0e7c47fb4c8ba47155a616"
score = 70
@@ -345431,8 +345837,8 @@ rule SIGNATURE_BASE_Hackingteam_Elevator_EXE : FILE
date = "2015-07-07"
modified = "2023-12-05"
reference = "Hacking Team Disclosure elevator.c"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hackingteam_rules.yar#L58-L86"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hackingteam_rules.yar#L58-L86"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "40a10420b9d49f87527bc0396b19ec29e55e9109e80b52456891243791671c1c"
hash = "92aec56a859679917dffa44bd4ffeb5a8b2ee2894c689abbbcbe07842ec56b8d"
hash = "9261693b67b6e379ad0e57598602712b8508998c0cb012ca23139212ae0009a1"
@@ -345468,8 +345874,8 @@ rule SIGNATURE_BASE_XMRIG_Monero_Miner : HIGHVOL FILE
date = "2018-01-04"
modified = "2022-11-10"
reference = "https://github.com/xmrig/xmrig/releases"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/pua_xmrig_monero_miner.yar#L11-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/pua_xmrig_monero_miner.yar#L11-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5c13a274adb9590249546495446bb6be5f2a08f9dcd2fc8a2049d9dc471135c0"
hash = "08b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7"
hash = "f3f2703a7959183b010d808521b531559650f6f347a5830e47f8e3831b10bad5"
@@ -345499,8 +345905,8 @@ rule SIGNATURE_BASE_XMRIG_Monero_Miner_Config : FILE
date = "2018-01-04"
modified = "2023-12-05"
reference = "https://github.com/xmrig/xmrig/releases"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/pua_xmrig_monero_miner.yar#L35-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/pua_xmrig_monero_miner.yar#L35-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "031333d44a3a917f9654d7e7257e00c9d961ada3bee707de94b7c7d06234909a"
hash = "409b6ec82c3bdac724dae702e20cb7f80ca1e79efa4ff91212960525af016c41"
logic_hash = "5df14af366cdb0a5bf6fd88b50876fd78abfe0b795cf10af8fab0d23a54f700f"
@@ -345526,8 +345932,8 @@ rule SIGNATURE_BASE_PUA_LNX_XMRIG_Cryptominer : FILE
date = "2018-06-28"
modified = "2023-01-06"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/pua_xmrig_monero_miner.yar#L53-L70"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/pua_xmrig_monero_miner.yar#L53-L70"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "10a72f9882fc0ca141e39277222a8d33aab7f7a4b524c109506a407cd10d738c"
logic_hash = "501bc5b2d38882f48d1ef972dbbd379afb89f2e7c9bf69192c7bee2e19384816"
score = 75
@@ -345553,8 +345959,8 @@ rule SIGNATURE_BASE_SUSP_XMRIG_String : FILE
date = "2018-12-28"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/pua_xmrig_monero_miner.yar#L72-L84"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/pua_xmrig_monero_miner.yar#L72-L84"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eb18ae69f1511eeb4ed9d4d7bcdf3391a06768f384e94427f4fc3bd21b383127"
logic_hash = "d2c3145c50939e7f407125f7b9312161724b7b1a6fcbf7e27d049e49e982c7e9"
score = 65
@@ -345577,8 +345983,8 @@ rule SIGNATURE_BASE_MAL_Hogfish_Report_Related_Sample : FILE
date = "2018-05-01"
modified = "2023-12-05"
reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt10_redleaves.yar#L13-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt10_redleaves.yar#L13-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f9acc706d7bec10f88f9cfbbdf80df0d85331bd4c3c0188e4d002d6929fe4eac"
hash = "7188f76ca5fbc6e57d23ba97655b293d5356933e2ab5261e423b3f205fe305ee"
hash = "4de5a22cd798950a69318fdcc1ec59e9a456b4e572c2d3ac4788ee96a4070262"
@@ -345604,8 +346010,8 @@ rule SIGNATURE_BASE_MAL_Redleaves_Apr18_1 : FILE
date = "2018-05-01"
modified = "2023-12-05"
reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt10_redleaves.yar#L33-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt10_redleaves.yar#L33-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f6449e255bc1a9d4a02391be35d0dd37def19b7e20cfcc274427a0b39cb21b7b"
hash = "db7c1534dede15be08e651784d3a5d2ae41963d192b0f8776701b4b72240c38d"
hash = "d956e2ff1b22ccee2c5d9819128103d4c31ecefde3ce463a6dea19ecaaf418a1"
@@ -345626,8 +346032,8 @@ rule SIGNATURE_BASE_APT_IN_TA397_Wmrat : HUNTING
date = "2024-11-20"
modified = "2025-01-17"
reference = "https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta397_dec24.yar#L2-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta397_dec24.yar#L2-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3bf4bbd5564f4381820fb8da5810bd4d9718b5c80a7e8f055961007c6f30da2b"
hash = "3e9a08972b8ec9c2e64eeb46ce1db92ae3c40bc8de48d278ba4d436fc3c8b3a4"
hash = "40ddb4463be9d8131f363fd78e21d9de5d838a3ec4044526aea45a473d6ddd61"
@@ -345711,8 +346117,8 @@ rule SIGNATURE_BASE_SUSP_RAR_NTFS_ADS : HUNTING FILE
date = "2024-12-17"
modified = "2025-01-17"
reference = "https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta397_dec24.yar#L82-L110"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta397_dec24.yar#L82-L110"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "feec47858379c29300d249d1693f68dc085300f493891d1a9d4ea83b8db6e3c3"
hash = "53a653aae9678075276bdb8ccf5eaff947f9121f73b8dcf24858c0447922d0b1"
logic_hash = "bcca4771e8f940ce8cfcff08284545fec6163df549e1fb589d89ca3fa335f04c"
@@ -345748,8 +346154,8 @@ rule SIGNATURE_BASE_HKTL_EXPL_POC_Libssh_Auth_Bypass_CVE_2023_2283_Jun23_1 : CVE
date = "2023-06-08"
modified = "2023-12-05"
reference = "https://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_libssh_cve_2023_2283_jun23.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_libssh_cve_2023_2283_jun23.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4c3d54d7f4902c1da664e41096b5931e6534aaaf63243f12e05b81af63d8b28f"
score = 85
quality = 85
@@ -345771,8 +346177,8 @@ rule SIGNATURE_BASE_Ransom_Lockergoga_Mar19_1 : FILE
date = "2019-03-19"
modified = "2023-12-05"
reference = "https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_lockergoga.yar#L2-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_lockergoga.yar#L2-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15"
hash = "7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26"
hash = "bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f"
@@ -345806,8 +346212,8 @@ rule SIGNATURE_BASE_Rocketkitten_Keylogger : FILE
date = "2015-09-01"
modified = "2023-12-05"
reference = "https://goo.gl/SjQhlp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rocketkitten_keylogger.yar#L8-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rocketkitten_keylogger.yar#L8-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1c9e519dca0468a87322bebe2a06741136de7969a4eb3efda0ab8db83f0807b4"
hash = "495a15f9f30d6f6096a97c2bd8cc5edd4d78569b8d541b1d5a64169f8109bc5b"
logic_hash = "c8523a50075c6ee9675d37d870da55d9e6193bbc770f6b916e700ab9aad438cc"
@@ -345839,11 +346245,11 @@ rule SIGNATURE_BASE_EXPL_Log4J_Callbackdomain_Iocs_Dec21_1 : CVE_2021_44228
date = "2021-12-12"
modified = "2025-03-29"
reference = "https://gist.github.com/superducktoes/9b742f7b44c71b4a0d19790228ce85d8"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_log4j_cve_2021_44228.yar#L2-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_log4j_cve_2021_44228.yar#L2-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8d5e60f91b715242c6f8ee806ab81d3e296ce1467cf2d065b053f33e3ae00f14"
score = 60
- quality = 60
+ quality = 85
tags = "CVE-2021-44228"
strings:
@@ -345861,8 +346267,8 @@ rule SIGNATURE_BASE_EXPL_JNDI_Exploit_Patterns_Dec21_1
date = "2021-12-12"
modified = "2025-03-29"
reference = "https://github.com/pimps/JNDI-Exploit-Kit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_log4j_cve_2021_44228.yar#L16-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_log4j_cve_2021_44228.yar#L16-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9442c8c4eee76539892752361657c86e80acc7990876e787317b042a4637f669"
score = 60
quality = 85
@@ -345903,8 +346309,8 @@ rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_JAVA_Exception_Dec21_1 : CVE_2021_
date = "2021-12-12"
modified = "2025-03-29"
reference = "https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_log4j_cve_2021_44228.yar#L51-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_log4j_cve_2021_44228.yar#L51-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "98eabec4ad2f5c4d22db9c3bebdc82c8dc6723599748360875fc7b613b1019ab"
score = 60
quality = 85
@@ -345927,8 +346333,8 @@ rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_Soft : FILE CVE_2021_44228
date = "2021-12-10"
modified = "2025-03-24"
reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_log4j_cve_2021_44228.yar#L68-L92"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_log4j_cve_2021_44228.yar#L68-L92"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "61a005060e2041afa5a9aa0b2a5e26cfc9a53cbafa78b15e4dd2c3b38127373a"
score = 50
quality = 85
@@ -345959,8 +346365,8 @@ rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_OBFUSC : CVE_2021_44228
date = "2021-12-12"
modified = "2021-12-13"
reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_log4j_cve_2021_44228.yar#L94-L116"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_log4j_cve_2021_44228.yar#L94-L116"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "00231db2ae83a89c187dbde1f2bc67fdaedcf1cbdf872afdcc374d2d0abee515"
score = 60
quality = 85
@@ -345989,11 +346395,11 @@ rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_Hard : FILE CVE_2021_44228
date = "2021-12-10"
modified = "2025-03-20"
reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_log4j_cve_2021_44228.yar#L118-L140"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_log4j_cve_2021_44228.yar#L118-L140"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9a4fc285dd1680ebc8a1042eeb5fbba73b9e2df70678adf3163122d84405325e"
score = 65
- quality = 60
+ quality = 85
tags = "FILE, CVE-2021-44228"
strings:
@@ -346018,8 +346424,8 @@ rule SIGNATURE_BASE_SUSP_Base64_Encoded_Exploit_Indicators_Dec21 : CVE_2021_4422
date = "2021-12-10"
modified = "2021-12-13"
reference = "https://twitter.com/Reelix/status/1469327487243071493"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_log4j_cve_2021_44228.yar#L142-L165"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_log4j_cve_2021_44228.yar#L142-L165"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "703a83916c7279bcdc3cd61602472c2a3815140235be169f5b2063a547438c61"
score = 70
quality = 85
@@ -346046,11 +346452,11 @@ rule SIGNATURE_BASE_SUSP_Jdniexploit_Indicators_Dec21 : FILE
date = "2021-12-10"
modified = "2021-12-12"
reference = "https://github.com/flypig5211/JNDIExploit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_log4j_cve_2021_44228.yar#L167-L180"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_log4j_cve_2021_44228.yar#L167-L180"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7886a67672001f0db72575d96d3a12341bfcdc49a9951e3d5e2a88ab46bf5a5d"
score = 70
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -346068,8 +346474,8 @@ rule SIGNATURE_BASE_SUSP_EXPL_OBFUSC_Dec21_1 : CVE_2021_44228 FILE
date = "2021-12-11"
modified = "2022-11-08"
reference = "https://twitter.com/testanull/status/1469549425521348609"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_log4j_cve_2021_44228.yar#L182-L211"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_log4j_cve_2021_44228.yar#L182-L211"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d6ffb70da82fe16e7a76feb31c01aa3e0cfc5625cc0e2b237ec851c646550839"
score = 60
quality = 85
@@ -346098,8 +346504,8 @@ rule SIGNATURE_BASE_SUSP_Jdniexploit_Error_Indicators_Dec21_1
date = "2021-12-10"
modified = "2023-06-23"
reference = "https://twitter.com/marcioalm/status/1470361495405875200?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_log4j_cve_2021_44228.yar#L213-L226"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_log4j_cve_2021_44228.yar#L213-L226"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2ab98814b2ed66b0bda875fecc0b09db82035d7edcdb0af65f815817ec8c6cc8"
score = 70
quality = 85
@@ -346120,8 +346526,8 @@ rule SIGNATURE_BASE_SUSP_RANSOMWARE_Indicator_Jul20 : FILE
date = "2020-07-28"
modified = "2023-12-05"
reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_generic.yar#L2-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_generic.yar#L2-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
hash = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
hash = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"
@@ -346161,8 +346567,8 @@ rule SIGNATURE_BASE_Recon_Commands_Windows_Gen1 : FILE
date = "2017-07-10"
modified = "2023-12-05"
reference = "https://goo.gl/MSJCxP"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_recon_indicators.yar#L12-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_recon_indicators.yar#L12-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "36beb09c428949140cb007c1022c385c9a1ae4eea8c1f1a419f96b36b8030c7c"
score = 60
quality = 85
@@ -346206,8 +346612,8 @@ rule SIGNATURE_BASE_SUSP_Recon_Outputs_Jun20_1 : FILE
date = "2020-06-04"
modified = "2023-12-05"
reference = "https://securelist.com/cycldek-bridging-the-air-gap/97157/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_recon_indicators.yar#L52-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_recon_indicators.yar#L52-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "652b28bfb45a11eaaee198c76560c1f55edc5b32c5394e606bb5426551260f24"
score = 60
quality = 85
@@ -346232,11 +346638,11 @@ rule SIGNATURE_BASE_Chinachopper_Generic : FILE
date = "2015-03-10"
modified = "2022-10-27"
reference = "https://www.fireeye.com/content/dam/legacy/resources/pdfs/fireeye-china-chopper-report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_webshell_chinachopper.yar#L2-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_webshell_chinachopper.yar#L2-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "34cb81b077d6dae5b4565001b2ab28897c6c554f00aa102601fb9c416c6c0f09"
score = 75
- quality = 60
+ quality = 85
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
@@ -346258,8 +346664,8 @@ rule SIGNATURE_BASE_LOG_F5_BIGIP_Exploitation_Artefacts_CVE_2021_22986_Mar21_1 :
date = "2021-03-20"
modified = "2023-12-05"
reference = "https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_f5_bigip_cve_2021_22986_log.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_f5_bigip_cve_2021_22986_log.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "748bb429d4a086e2890773558ea502ef06f507aed5f0f70470e2cd97a3fd5007"
score = 80
quality = 85
@@ -346282,8 +346688,8 @@ rule SIGNATURE_BASE_APT_RU_APT27_Hyperbro_Vftrace_Loader_Jan22_1 : FILE
date = "2022-01-14"
modified = "2023-12-05"
reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt27_hyperbro.yar#L3-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt27_hyperbro.yar#L3-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "333b52c2cfac56b86ee9d54aef4f0ff4144528917bc1aa1fe1613efc2318339a"
logic_hash = "d8785ea937891636bea5ed8128de44fa6084a1a48800c1586739c5ca9e4c43bd"
score = 75
@@ -346307,8 +346713,8 @@ rule SIGNATURE_BASE_APT_CN_APT27_Compromised_Certficate_Jan22_1
date = "2022-01-29"
modified = "2023-12-05"
reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt27_hyperbro.yar#L21-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt27_hyperbro.yar#L21-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "94a40d55936fc341eaba5e1accc8bfe3a401114298e7a3cc4d5c64af36eadf9e"
score = 80
quality = 85
@@ -346326,8 +346732,8 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Decrypted_Stage2 : FILE
date = "2022-02-07"
modified = "2023-12-05"
reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt27_hyperbro.yar#L35-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt27_hyperbro.yar#L35-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fc5a58bf0fce9cb96f35ee76842ff17816fe302e3164bc7c6a5ef46f6eff67ed"
logic_hash = "6eb56c4a92e89977e536ccc3c70170062aca072c6981b40aeea184ea2ca461a6"
score = 75
@@ -346355,8 +346761,8 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3 : FILE
date = "2022-02-07"
modified = "2023-01-07"
reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt27_hyperbro.yar#L59-L84"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt27_hyperbro.yar#L59-L84"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
logic_hash = "49c1e70d63d93244b4b44525f2b30c05512b5f3a30d6d7c43c9366a95c84e79b"
score = 50
@@ -346387,8 +346793,8 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3_C2
date = "2022-02-07"
modified = "2023-12-05"
reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt27_hyperbro.yar#L86-L100"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt27_hyperbro.yar#L86-L100"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
logic_hash = "676df1eaa782c6b876df138a0ddddc3c63e277b84d4414b044314ee219674420"
score = 50
@@ -346411,8 +346817,8 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3_Persistence
date = "2022-02-07"
modified = "2023-12-05"
reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt27_hyperbro.yar#L103-L117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt27_hyperbro.yar#L103-L117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
logic_hash = "db4b7be2bafe29b5e7c81a90e17a660cf73cff1c2e8edd04a9421daba09e3e0e"
score = 75
@@ -346435,8 +346841,8 @@ rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Encrypted_Stage2 : FILE
date = "2022-02-07"
modified = "2023-12-05"
reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt27_hyperbro.yar#L120-L389"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt27_hyperbro.yar#L120-L389"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fc5a58bf0fce9cb96f35ee76842ff17816fe302e3164bc7c6a5ef46f6eff67ed"
logic_hash = "c3b07bdb19730fc9c8cca8aa7581a32eb80e3dbc5c4d366fbb2f9966081c1a21"
score = 75
@@ -346713,8 +347119,8 @@ rule SIGNATURE_BASE_Coinminer_Strings : SCRIPT HIGHVOL FILE
date = "2018-01-04"
modified = "2021-10-26"
reference = "https://minergate.com/faq/what-pool-address"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/pua_cryptocoin_miner.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/pua_cryptocoin_miner.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2d63bf90560c83ab6c09e0c82b6a6449bca6e7e7d0945d3782c2fa9a726b2ca1"
score = 60
quality = 85
@@ -346738,8 +347144,8 @@ rule SIGNATURE_BASE_Coinhive_Javascript_Monerominer : HIGHVOL FILE
date = "2018-01-04"
modified = "2023-12-05"
reference = "https://coinhive.com/documentation/miner"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/pua_cryptocoin_miner.yar#L20-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/pua_cryptocoin_miner.yar#L20-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4146b034a9785f1bb7c60db62db0e478d960f2ac9adb7c5b74b365186578ca47"
score = 50
quality = 85
@@ -346761,8 +347167,8 @@ rule SIGNATURE_BASE_PUA_Cryptominer_Jan19_1 : FILE
date = "2019-01-31"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/pua_cryptocoin_miner.yar#L35-L52"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/pua_cryptocoin_miner.yar#L35-L52"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ede858683267c61e710e367993f5e589fcb4b4b57b09d023a67ea63084c54a05"
logic_hash = "7097d404e0317230a5f60fc66fbcb2a2a5315f8fd348a7e689aaf75c26684f9e"
score = 80
@@ -346788,8 +347194,8 @@ rule SIGNATURE_BASE_PUA_Crypto_Mining_Commandline_Indicators_Oct21 : SCRIPT FILE
date = "2021-10-24"
modified = "2023-12-05"
reference = "https://www.poolwatch.io/coin/monero"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/pua_cryptocoin_miner.yar#L54-L88"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/pua_cryptocoin_miner.yar#L54-L88"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7ae1a77d8ff02ec539ce2b8be668530c3f509f0c408dfa7f2b749b0a4d6f45b7"
score = 65
quality = 85
@@ -346824,8 +347230,8 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen1 : FILE
date = "2016-10-12"
modified = "2023-12-05"
reference = "https://goo.gl/QMRZ8K"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig.yar#L12-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig.yar#L12-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d808f3109822c185f1d8e1bf7ef7781c219dc56f5906478651748f0ace489d34"
hash = "80161dad1603b9a7c4a92a07b5c8bce214cf7a3df897b561732f9df7920ecb3e"
hash = "662c53e69b66d62a4822e666031fd441bbdfa741e20d4511c6741ec3cb02475f"
@@ -346881,8 +347287,8 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal1 : FILE
date = "2016-10-12"
modified = "2023-12-05"
reference = "https://goo.gl/QMRZ8K"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig.yar#L69-L86"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig.yar#L69-L86"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e17e1978563dc10b73fd54e7727cbbe95cc0b170a4e7bd0ab223e059f6c25fcc"
logic_hash = "b5fc4329bb639765890c49907860883b96d278381b83307c906f624e6645dedd"
score = 75
@@ -346909,8 +347315,8 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen2 : FILE
date = "2016-10-12"
modified = "2023-01-07"
reference = "https://goo.gl/QMRZ8K"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig.yar#L88-L110"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig.yar#L88-L110"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c6437f57a8f290b5ec46b0933bfa8a328b0cb2c0c7fbeea7f21b770ce0250d3d"
hash = "293522e83aeebf185e653ac279bba202024cedb07abc94683930b74df51ce5cb"
logic_hash = "861ae1696aaa89c81d04214e67d77d98ae85bd7f64ae2979fbe932dc696fd32c"
@@ -346941,8 +347347,8 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen3 : FILE
date = "2016-10-12"
modified = "2023-01-07"
reference = "https://goo.gl/QMRZ8K"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig.yar#L112-L129"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig.yar#L112-L129"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5e9ddb25bde3719c392d08c13a295db418d7accd25d82d020b425052e7ba6dc9"
hash = "bd0920c8836541f58e0778b4b64527e5a5f2084405f73ee33110f7bc189da7a9"
hash = "90639c7423a329e304087428a01662cc06e2e9153299e37b1b1c90f6d0a195ed"
@@ -346968,8 +347374,8 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal2 : FILE
date = "2016-10-12"
modified = "2023-12-05"
reference = "https://goo.gl/QMRZ8K"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig.yar#L131-L149"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig.yar#L131-L149"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "65920eaea00764a245acb58a3565941477b78a7bcc9efaec5bf811573084b6cf"
logic_hash = "b1de7dc3c205c78825f52ea30608b10bafa2c486db53693aa90aa07138fb1a87"
score = 75
@@ -346997,8 +347403,8 @@ rule SIGNATURE_BASE_Oilrig_Campaign_Reconnaissance : FILE
date = "2016-10-12"
modified = "2023-12-05"
reference = "https://goo.gl/QMRZ8K"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig.yar#L151-L166"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig.yar#L151-L166"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5893eae26df8e15c1e0fa763bf88a1ae79484cdb488ba2fc382700ff2cfab80c"
logic_hash = "04c9f482c0c4abc1bf316459dc3085154defadb0fd5fe74ff274d8b3ee807b7f"
score = 75
@@ -347023,8 +347429,8 @@ rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal3 : FILE
date = "2016-10-12"
modified = "2023-12-05"
reference = "https://goo.gl/QMRZ8K"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig.yar#L168-L183"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig.yar#L168-L183"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "02226181f27dbf59af5377e39cf583db15200100eea712fcb6f55c0a2245a378"
logic_hash = "62a6f6c4e574a3c577f0b1fdd85eaa3e775a7ae0e457c59a6b6f741ad895e510"
score = 75
@@ -347050,8 +347456,8 @@ rule SIGNATURE_BASE_Oilrig_Malware_Nov17_13 : FILE
date = "2017-11-22"
modified = "2023-12-05"
reference = "https://twitter.com/ClearskySec/status/933280188733018113"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig.yar#L185-L206"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig.yar#L185-L206"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4f1e2df85c538875a7da877719555e21c33a558ac121eb715cf4e779d77ab445"
logic_hash = "eab15229f084681b27cec7ed959ef4cd1193a0b38aaed4341dcd6761e2505804"
score = 75
@@ -347077,8 +347483,8 @@ rule SIGNATURE_BASE_Oilrig_Intelsecuritymanager_Macro : FILE
date = "2018-01-19"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig.yar#L208-L233"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig.yar#L208-L233"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "35e540b87bb7425b601fad76f0ff33c60a4d91579fc50f5902d708d06fa755f6"
score = 75
quality = 85
@@ -347112,8 +347518,8 @@ rule SIGNATURE_BASE_Oilrig_Intelsecuritymanager : FILE
date = "2018-01-19"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig.yar#L235-L255"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig.yar#L235-L255"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "97debd5e74730e22133f29c89a0cf049862459c24d1b46634a973908040db3a7"
score = 75
quality = 85
@@ -347143,8 +347549,8 @@ rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_1
date = "2019-04-17"
modified = "2023-12-05"
reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig.yar#L267-L283"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig.yar#L267-L283"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b1d621091740e62c84fc8c62bcdad07873c8b61b83faba36097ef150fd6ec768"
logic_hash = "afe203fdfcc9dcafb170bee972d45e66e5483a777112a00fa30516dfe81bbf88"
score = 75
@@ -347169,8 +347575,8 @@ rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_2
date = "2019-04-17"
modified = "2023-12-05"
reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig.yar#L285-L304"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig.yar#L285-L304"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2943e69e6c34232dee3236ced38d41d378784a317eeaf6b90482014210fcd459"
logic_hash = "57c8f02ebfb05f739fc4791a88be4a981ce7b89e2bd283669f85aae1a5c14d02"
score = 75
@@ -347198,8 +347604,8 @@ rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_3
date = "2019-04-17"
modified = "2023-01-06"
reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_oilrig.yar#L306-L326"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_oilrig.yar#L306-L326"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "27e03b98ae0f6f2650f378e9292384f1350f95ee4f3ac009e0113a8d9e2e14ed"
logic_hash = "77ba71a59d6026c4b393bc66af586066e11b0c496367a38d847396a23b3dffbe"
score = 75
@@ -347228,8 +347634,8 @@ rule SIGNATURE_BASE_Lazarus_Dec_17_1 : FILE
date = "2017-12-20"
modified = "2023-12-05"
reference = "https://goo.gl/8U6fY2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_dec17.yar#L12-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_dec17.yar#L12-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48"
logic_hash = "50ff8418cf342147a81ef3a418e5e61d42f0e5764982e43b51d4dd3a983a548e"
score = 75
@@ -347256,8 +347662,8 @@ rule SIGNATURE_BASE_Lazarus_Dec_17_2 : FILE
date = "2017-12-20"
modified = "2023-12-05"
reference = "https://goo.gl/8U6fY2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_dec17.yar#L31-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_dec17.yar#L31-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411"
hash = "9ca3e56dcb2d1b92e88a0d09d8cab2207ee6d1f55bada744ef81e8b8cf155453"
logic_hash = "273cd54a0c3ecf53893de0ef9c41d784725eea6cc843e04df01cd8f29d61a797"
@@ -347284,8 +347690,8 @@ rule SIGNATURE_BASE_Lazarus_Dec_17_4 : FILE
date = "2017-12-20"
modified = "2023-12-05"
reference = "https://goo.gl/8U6fY2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_dec17.yar#L53-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_dec17.yar#L53-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3"
hash = "7975c09dd436fededd38acee9769ad367bfe07c769770bd152f33a10ed36529e"
logic_hash = "70801347699d339cb47cad03ec3f694b09a976e32b70052a97fade09fcac679d"
@@ -347309,8 +347715,8 @@ rule SIGNATURE_BASE_Lazarus_Dec_17_5 : FILE
date = "2017-12-20"
modified = "2023-12-05"
reference = "https://goo.gl/8U6fY2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_dec17.yar#L69-L89"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_dec17.yar#L69-L89"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471"
logic_hash = "480ec19f7050d34713ed621ae9ec5d5463b1cc4710b473465cc78e533796d2e4"
score = 75
@@ -347340,8 +347746,8 @@ rule SIGNATURE_BASE_MAL_WIPER_Bibi_Oct23 : FILE
date = "2023-11-01"
modified = "2023-12-05"
reference = "https://x.com/ESETresearch/status/1719437301900595444?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_bibi_wiper_oct23.yar#L24-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_bibi_wiper_oct23.yar#L24-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad"
hash = "40417e937cd244b2f928150cae6fa0eff5551fdb401ea072f6ecdda67a747e17"
logic_hash = "c22dc994005f91f81d0e8e5f8d400b12ecd28336866bc62b8527e104f6339372"
@@ -347371,12 +347777,12 @@ rule SIGNATURE_BASE_EXPL_Office_Templateinjection_Aug19 : FILE
modified = "2025-03-20"
old_rule_name = "EXPL_Office_TemplateInjection"
reference = "https://attack.mitre.org/techniques/T1221/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_office_template_injection.yar#L1-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_office_template_injection.yar#L1-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f2bdf3716b39d29a9c6c3b7b3355e935594b8d8e9149a784a59dc2381fa1628a"
logic_hash = "8f79a12a7d1e7284fe19d925910988dbbe7448e73df8d5d075310997d09a6348"
score = 75
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -347396,8 +347802,8 @@ rule SIGNATURE_BASE_HKTL_Redmimicry_Agent
date = "2020-06-22"
modified = "2023-01-06"
reference = "https://redmimicry.com"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_redmimicry.yar#L2-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_redmimicry.yar#L2-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "645da2764ca911c4aae80b90622d2c61933dee929403858fc49f7bc0d44300c6"
score = 75
quality = 85
@@ -347428,8 +347834,8 @@ rule SIGNATURE_BASE_HKTL_Redmimicry_Winntiloader
date = "2020-06-22"
modified = "2023-01-10"
reference = "https://redmimicry.com"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_redmimicry.yar#L28-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_redmimicry.yar#L28-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d8ef457ac41a7c45cc7e97330bdd3de12eb3391c03d0a6a87ddc669c841c325d"
score = 75
quality = 85
@@ -347453,8 +347859,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Csharp
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L2-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L2-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e77fcd2ac0c21db54563b15466962a775a5e8ef73cedb3af5cd00d5b0d615e4c"
score = 75
quality = 85
@@ -347482,8 +347888,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Powershell_Dropper
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L24-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L24-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "19f56e69685ae8c13b9dd884f8322915835c16e2c6313f01f9fa447218419108"
score = 75
quality = 85
@@ -347506,8 +347912,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Powershell_B64Encoded
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L40-L52"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L40-L52"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "bcf9a75dbbf90044db76c56ffd07971d4252b0e75d73abf402ca4fadbfb59767"
score = 75
quality = 85
@@ -347528,11 +347934,11 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Py
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L54-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L54-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9b6eba750c96501aae1d86eef458d3e80de665efc7ce9d5aff842bc44363bad2"
score = 75
- quality = 60
+ quality = 85
tags = ""
strings:
@@ -347559,8 +347965,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Py_B64Encoded
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L77-L89"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L77-L89"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "279fb27637d9b62b484283f778215d042de9fb83110a233e048452e921c540ee"
score = 75
quality = 85
@@ -347581,8 +347987,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Keylogger_Py
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L91-L107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L91-L107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2dc2ce153d559d795f302f5ca4a9ef9e6e5c54762472e38e6f4a26ef8a28a184"
score = 75
quality = 85
@@ -347607,8 +348013,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Keylogger_File
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L109-L121"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L109-L121"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6d2d677b69eaf31843e8352bfe040c9e5a8d423d17900e022b769d28789f2d98"
score = 75
quality = 85
@@ -347629,8 +348035,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Xserver_Csharp
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L123-L141"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L123-L141"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1201ee45df78cf3aec4b4bbb59cb7e4a70af6928895bb7c968ef02075a963405"
score = 75
quality = 85
@@ -347657,8 +348063,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Xserver_Powershell_B64Encoded
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L143-L155"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L143-L155"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "77315f0fc8387fa87892fc8fcea1f6e8a95560049aaa9a87519859020d0a7a3e"
score = 75
quality = 85
@@ -347680,8 +348086,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Xserver_Powershell_Dropper
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L157-L168"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L157-L168"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "640c9e52f3cf3df4e954177624e6fba4bab80a2c9442b718fe90e8577dafbbd6"
score = 75
quality = 85
@@ -347702,8 +348108,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Injector_Bin
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L170-L193"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L170-L193"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c8cd4e3c87c6d80b39069f7a94e512e3f7b739c21f6fd70c2a79829c5a04f32f"
score = 75
quality = 85
@@ -347735,8 +348141,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Timeliner_Bin
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L195-L213"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L195-L213"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c3a8cddc34134faaab93ee0df0086604e4a7b031530dd65e2e8dab705483305b"
score = 75
quality = 85
@@ -347763,8 +348169,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Checkadmin_Bin
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L215-L232"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L215-L232"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "784ec960ce2733aebc404ee5c09bb852eb45553ad167db292d05b82feedbd5a6"
score = 75
quality = 85
@@ -347790,8 +348196,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Getos_Py
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L234-L295"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L234-L295"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2535c01b703c0fcba43e771832db8cd969e4a4b112ef28e4ddfeac6491ba604c"
score = 75
quality = 85
@@ -347854,8 +348260,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Info_Vbs
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L297-L316"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L297-L316"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e37f8768c7920b8c3d9fdd6bb3a4e748c47a6c06a8aaed01655355ef3d8c3457"
score = 75
quality = 85
@@ -347883,8 +348289,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Console_Jsp
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L318-L335"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L318-L335"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e70c15ef10b63a011edbcedc773a8e2917fd915c3ecc273c3bf2b78eb10fc570"
score = 75
quality = 85
@@ -347910,8 +348316,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Index_Jsp
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L337-L353"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L337-L353"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "870dad9fb5456f8edbd9f3c2d0b8764cf1143399626ce4df53c93919bcb1a0cb"
score = 75
quality = 85
@@ -347936,8 +348342,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Ver_Jsp
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L355-L372"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L355-L372"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ada6de4b07a76e79bb17793cda2b51f96554a35992a73f59c360487638ae3be3"
score = 75
quality = 85
@@ -347963,8 +348369,8 @@ rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Webinfo
date = "2019-12-20"
modified = "2023-12-05"
reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_op_wocao.yar#L374-L394"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_op_wocao.yar#L374-L394"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "711737a56067f24f422cc7d5aeba4389741fe18a0e66f2715fce626c3b6aef19"
score = 75
quality = 85
@@ -347992,8 +348398,8 @@ rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_1
date = "2022-12-22"
modified = "2023-12-05"
reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxynotshell_owassrf_dec22.yar#L2-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxynotshell_owassrf_dec22.yar#L2-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1e8f5a3440f8b4b1850fddbd19f63796ad0f28178c678e9f464b7e4ab5ca944f"
score = 70
quality = 85
@@ -348019,11 +348425,11 @@ rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_2
date = "2022-12-22"
modified = "2023-12-05"
reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxynotshell_owassrf_dec22.yar#L24-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxynotshell_owassrf_dec22.yar#L24-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "73ce86b7a673719c916666fa06963b774edad5b2cd804994614afd83ea75ecef"
score = 60
- quality = 60
+ quality = 85
tags = "CVE-2022-41040, CVE-2022-41082"
strings:
@@ -348046,8 +348452,8 @@ rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_3
date = "2022-12-22"
modified = "2023-12-05"
reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxynotshell_owassrf_dec22.yar#L47-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxynotshell_owassrf_dec22.yar#L47-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "607d3743a46e0c5000b9c7847dd89f5d7ccf29f4f1af9bce6870d7738f071f5c"
score = 60
quality = 85
@@ -348073,8 +348479,8 @@ rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_Powershell_Proxy_Log_Dec22_1 : CVE_20
date = "2022-12-22"
modified = "2023-01-26"
reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxynotshell_owassrf_dec22.yar#L68-L86"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxynotshell_owassrf_dec22.yar#L68-L86"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f2aac61bc17f74901ec8d638d5cfaaa45bbd2a4e40e5d915bf2a946daed411d2"
score = 70
quality = 85
@@ -348098,8 +348504,8 @@ rule SIGNATURE_BASE_MAL_Information_Collector_May26 : FILE
date = "2026-05-05"
modified = "2026-05-15"
reference = "https://securelist.com/tr/daemon-tools-backdoor/119654/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/threat_compromised_daemon_tools_lite_may26.yar#L1-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/threat_compromised_daemon_tools_lite_may26.yar#L1-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a916e56121212613d17932e124b68752c9312e73bde8f2351054bd64394257df"
logic_hash = "fe05c931037eb62a78f4f696a2697b44672751538eadd37ff20379d9bdd4f013"
score = 80
@@ -348126,14 +348532,14 @@ rule SIGNATURE_BASE_MAL_DAEMON_Tools_Lite_Compromised_May26 : FILE
date = "2026-05-05"
modified = "2026-05-15"
reference = "https://securelist.com/tr/daemon-tools-backdoor/119654/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/threat_compromised_daemon_tools_lite_may26.yar#L29-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/threat_compromised_daemon_tools_lite_may26.yar#L29-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12edcaafab7703d0819b1395f45c35e3083dd83fb8b128292cb11033453fb6e8"
hash = "0066ed9b9de2b8e251f7bcf73edcb549218179398cf90124a221958fedce6212"
hash = "d2a5c9cbb73849cc0667987c33a9bf3822718e1528faef005f1628de3348ffb0"
logic_hash = "ad1be188405bf272ea7d8f4c92d4402917d04340d9eb62d9bbbf636f0cbf2ec1"
score = 80
- quality = 35
+ quality = 60
tags = "FILE"
strings:
@@ -348154,8 +348560,8 @@ rule SIGNATURE_BASE_MAL_Backdoor_May26
date = "2026-05-05"
modified = "2026-05-15"
reference = "https://securelist.com/tr/daemon-tools-backdoor/119654/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/threat_compromised_daemon_tools_lite_may26.yar#L52-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/threat_compromised_daemon_tools_lite_may26.yar#L52-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5d581534b48d09855ac045aaf9b196ca26396a6c08616213f9f9afc656849c2f"
logic_hash = "6173f47f8b50b409bbe63cfa512b0081f5085357df8c9ffd0db198a7d4717625"
score = 80
@@ -348178,8 +348584,8 @@ rule SIGNATURE_BASE_MAL_Minimalistic_Backdoor_May26 : FILE
date = "2026-05-05"
modified = "2026-05-15"
reference = "https://securelist.com/tr/daemon-tools-backdoor/119654/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/threat_compromised_daemon_tools_lite_may26.yar#L68-L92"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/threat_compromised_daemon_tools_lite_may26.yar#L68-L92"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "395ec7acd475a8acd358adc75c4615cf41737aed8a96c4f2dd792c8a6af4140c"
logic_hash = "0f5e1f95d28fe5e45a10d652a11e9940823b4ac113dcf9b547f81d35bcda6cc7"
score = 80
@@ -348206,8 +348612,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Darkside_May21_1 : FILE
date = "2021-05-10"
modified = "2023-12-05"
reference = "https://app.any.run/tasks/020c1740-717a-4191-8917-5819aa25f385/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_darkside.yar#L2-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_darkside.yar#L2-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ec368752c2cf3b23efbfa5705f9e582fc9d6766435a7b8eea8ef045082c6fbce"
logic_hash = "84de92b0b36e373aa61e314a04597bd0578a04af34c501ae9071e5f4fa27c07a"
score = 75
@@ -348235,8 +348641,8 @@ rule SIGNATURE_BASE_MAL_Ransomware_Win_DARKSIDE_V1_1 : FILE
date = "2021-03-22"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_darkside.yar#L25-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_darkside.yar#L25-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1a700f845849e573ab3148daef1a3b0b"
logic_hash = "b3612510bd1f2ca7543e217e97037b02d312bcda2b2df16d9be3216749ea4beb"
score = 75
@@ -348258,8 +348664,8 @@ rule SIGNATURE_BASE_MAL_Dropper_Win_Darkside_1 : FILE
date = "2021-05-11"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_darkside.yar#L39-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_darkside.yar#L39-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "131b3666ae444e0de043eafdf7cfd3324b927d18d8ad56d5004ea09b2da5610e"
score = 75
quality = 79
@@ -348286,8 +348692,8 @@ rule SIGNATURE_BASE_MAL_Backdoor_Win_C3_1 : FILE
date = "2021-05-11"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_darkside.yar#L58-L77"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_darkside.yar#L58-L77"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7cdac4b82a7573ae825e5edb48f80be5"
logic_hash = "369c54b9426edb449004466d30e1010ecefe8cfbea106306eb8eb90b27610dbf"
score = 75
@@ -348317,8 +348723,8 @@ rule SIGNATURE_BASE_MAL_Gandcrab_Apr18_1 : FILE
date = "2018-04-23"
modified = "2023-12-05"
reference = "https://twitter.com/MarceloRivero/status/988455516094550017"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_mal_grandcrab.yar#L3-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_mal_grandcrab.yar#L3-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6fafe7bb56fd2696f2243fc305fe0c38f550dffcfc5fca04f70398880570ffff"
logic_hash = "70fc8deb91126a7404095aaa512e9b7542fe8605f83a037a10f8ccff76c27d4f"
score = 75
@@ -348338,8 +348744,8 @@ rule SIGNATURE_BASE_PUP_Installrex_Antifwb : FILE
date = "2015-05-13"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_antifw_installrex.yar#L2-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_antifw_installrex.yar#L2-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bb5607cd2ee51f039f60e32cf7edc4e21a2d95cd"
logic_hash = "04f25497ee9a9af20179b81679d993315d6bb3d7bf7d8e9cbb01374395019610"
score = 55
@@ -348366,8 +348772,8 @@ rule SIGNATURE_BASE_TA17_293A_Malware_1
date = "2017-07-17"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_293A.yar#L14-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_293A.yar#L14-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61c909d2f625223db2fb858bbdf42a76"
hash = "a07aa521e7cafb360294e56969eda5d6"
hash = "ba756dd64c1147515ba2298b6a760260"
@@ -348421,11 +348827,11 @@ rule SIGNATURE_BASE_TA17_293A_Energetic_Bear_Api_Hashing_Tool : FILE
description = "Energetic Bear API Hashing Tool"
author = "CERT RE Team"
id = "4e58800a-9618-5d8b-954c-e843be6002c2"
- date = "2026-02-06"
+ date = "2026-02-13"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_293A.yar#L77-L93"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_293A.yar#L77-L93"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5f8a770c727cdd2d32d7cd1ad45ee8b37f7fc63c9e7f4311d318eb15d9050909"
score = 75
quality = 85
@@ -348451,8 +348857,8 @@ rule SIGNATURE_BASE_TA17_293A_Query_XML_Code_MAL_DOC_PT_2 : FILE
date = "2017-10-21"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_293A.yar#L95-L106"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_293A.yar#L95-L106"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8d4c1b23aa8323fa9ddec362bb36e13e5f992883fbf7936b34cf03fe62ee6127"
score = 75
quality = 85
@@ -348475,8 +348881,8 @@ rule SIGNATURE_BASE_TA17_293A_Query_XML_Code_MAL_DOC : FILE
date = "2017-10-21"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_293A.yar#L108-L120"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_293A.yar#L108-L120"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fb3a84b66554e6c286ba64046d9b18a819f81108ee965862f288637ccee816d2"
score = 75
quality = 85
@@ -348500,8 +348906,8 @@ rule SIGNATURE_BASE_TA17_293A_Query_Javascript_Decode_Function : FILE
date = "2017-10-21"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_293A.yar#L122-L140"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_293A.yar#L122-L140"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8b42c67bdcdbb7c38128d8956904baa524d155b1e6957c5c1b5bc28fd8a57e8a"
score = 75
quality = 83
@@ -348526,8 +348932,8 @@ rule SIGNATURE_BASE_TA17_293A_Hacktool_PS_1 : FILE
date = "2017-10-21"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_293A.yar#L152-L166"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_293A.yar#L152-L166"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "72a28efb6e32e653b656ca32ccd44b3111145a695f6f6161965deebbdc437076"
logic_hash = "a59834684cc1e7a34eeb8fb7f6cd1c414d6eab3ae58c6df763b2ec548705b371"
score = 75
@@ -348551,8 +348957,8 @@ rule SIGNATURE_BASE_TA17_293A_Hacktool_Touch_MAC_Modification : FILE
date = "2017-10-21"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_293A.yar#L168-L184"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_293A.yar#L168-L184"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "070d7082a5abe1112615877214ec82241fd17e5bd465e24d794a470f699af88e"
logic_hash = "5f4c6b653d1b6f4427c6582513d3c19cb8d580e669260a1afda01eecf8ce3bfc"
score = 75
@@ -348578,8 +348984,8 @@ rule SIGNATURE_BASE_TA17_293A_Hacktool_Exploit_MS16_032 : FILE
date = "2017-10-21"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_293A.yar#L186-L202"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_293A.yar#L186-L202"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b97290300abb68fb48480718e6318ee2cdd4f099aa6438010fb2f44803e0b58"
logic_hash = "0f0bd4f8ae1e9689f111233ca8fdb9a9b6c20e526f22350c8204f64a54639dcd"
score = 75
@@ -348606,8 +349012,8 @@ rule SIGNATURE_BASE_Imphash_UPX_Packed_Malware_1_TA17_293A : FILE
date = "2017-10-21"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_293A.yar#L206-L217"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_293A.yar#L206-L217"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a278256fbf2f061cfded7fdd58feded6765fade730374c508adad89282f67d77"
logic_hash = "398ccbd5e492fb1efa80dc07900ef77611c4b5bab95f715fce7b5dbeb0aff49d"
score = 75
@@ -348628,8 +349034,8 @@ rule SIGNATURE_BASE_Imphash_Malware_2_TA17_293A : HIGHVOL FILE
date = "2017-10-21"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_293A.yar#L219-L229"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_293A.yar#L219-L229"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5f91c07a9cc65c31eb9fd09bdd2752bc285c5a4b118ffe647391f7d187765de4"
score = 75
quality = 85
@@ -348648,8 +349054,8 @@ rule SIGNATURE_BASE_VULN_LNX_OMI_RCE_CVE_2021_386471_Sep21 : CVE_2021_38647 FILE
date = "2021-09-16"
modified = "2023-12-05"
reference = "https://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vul_cve_2021_386471_omi.yar#L1-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vul_cve_2021_386471_omi.yar#L1-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "99fddcf763f41a08a8ef8240d544ef67b840a1b5ae709bd7efbcbcad8268e8a5"
score = 50
quality = 85
@@ -348689,8 +349095,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Bypassuac : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "https://github.com/PowerShellEmpire/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_empire.yar#L9-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_empire.yar#L9-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ab0f900a6915b7497313977871a64c3658f3e6f73f11b03d2d33ca61305dc6a8"
logic_hash = "1697065405fa0e255cdd77fa39f53866118caf0bad6a3d72756590303610e7b6"
score = 70
@@ -348716,8 +349122,8 @@ rule SIGNATURE_BASE_Empire_Lib_Modules_Trollsploit_Message : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "https://github.com/PowerShellEmpire/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_empire.yar#L28-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_empire.yar#L28-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "71f2258177eb16eafabb110a9333faab30edacf67cb019d5eab3c12d095655d5"
logic_hash = "70b7d91395ae30131c1448511425abf32ddedf04632266454aa008330ff28222"
score = 70
@@ -348743,8 +349149,8 @@ rule SIGNATURE_BASE_Empire_Persistence : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "https://github.com/PowerShellEmpire/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_empire.yar#L47-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_empire.yar#L47-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae8875f7fcb8b4de5cf9721a9f5a9f7782f7c436c86422060ecdc5181e31092f"
logic_hash = "3c398aa180b6f2225a25f9b1430e89991c7e391930e2be140e89c67da67b3614"
score = 70
@@ -348769,8 +349175,8 @@ rule SIGNATURE_BASE_Empire_Portscan : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "https://github.com/PowerShellEmpire/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_empire.yar#L65-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_empire.yar#L65-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b355efa1e7b3681b1402e22c58ce968795ef245fd08a0afb948d45c173e60b97"
logic_hash = "162ac4ccc8629a2d017831cdc6d1bf8d7a62b844bf68a0d61956b2f41a5e004b"
score = 70
@@ -348794,8 +349200,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Shellcode : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "https://github.com/PowerShellEmpire/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_empire.yar#L82-L98"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_empire.yar#L82-L98"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fa75cfd57269fbe3ad6bdc545ee57eb19335b0048629c93f1dc1fe1059f60438"
logic_hash = "968a140f75aa17bd9aac243483cade931dc047854b65b2f61146492c2cf01ea5"
score = 70
@@ -348820,8 +349226,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Mimikatz : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "https://github.com/PowerShellEmpire/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_empire.yar#L100-L116"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_empire.yar#L100-L116"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c5481864b757837ecbc75997fa24978ffde3672b8a144a55478ba9a864a19466"
logic_hash = "3e16bed3dd7b36920cdf01507f35e38d004e3ce2f3301911a8ee4aedbae6c5c3"
score = 70
@@ -348846,8 +349252,8 @@ rule SIGNATURE_BASE_Empire_Lib_Modules_Credentials_Mimikatz_Pth : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "https://github.com/PowerShellEmpire/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_empire.yar#L118-L133"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_empire.yar#L118-L133"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6dee1cf931e02c5f3dc6889e879cc193325b39e18409dcdaf987b8bf7c459211"
logic_hash = "6989c2e50ce642e0300e1293f46cd36e5141274d1e7172a8312595bb515bede2"
score = 70
@@ -348871,8 +349277,8 @@ rule SIGNATURE_BASE_Empire_Write_Hijackdll : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "https://github.com/PowerShellEmpire/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_empire.yar#L135-L151"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_empire.yar#L135-L151"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "155fa7168e28f15bb34f67344f47234a866e2c63b3303422ff977540623c70bf"
logic_hash = "e01157fe4adaf647474292bfbbb8196c0b7e89433da52a386a8d9573ae543679"
score = 70
@@ -348897,8 +349303,8 @@ rule SIGNATURE_BASE_Empire_Skeleton_Key : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "https://github.com/PowerShellEmpire/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_empire.yar#L153-L170"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_empire.yar#L153-L170"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3d02f16dcc38faaf5e97e4c5dbddf761f2816004775e6af8826cde9e29bb750f"
logic_hash = "910451b2b2ed7cb5f7891d97d15e49da24b182adc903926f539fc4bfe589f2d5"
score = 70
@@ -348924,8 +349330,8 @@ rule SIGNATURE_BASE_Empire_Invoke_Wmi : FILE
date = "2015-08-06"
modified = "2023-12-05"
reference = "https://github.com/PowerShellEmpire/Empire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_empire.yar#L172-L188"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_empire.yar#L172-L188"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a914cb227f652734a91d3d39745ceeacaef7a8b5e89c1beedfd6d5f9b4615a1d"
logic_hash = "7179a22eec8eb9e59bf590e671e6849d5b960c58eb8fa591bc3b340d64f1d076"
score = 70
@@ -348950,8 +349356,8 @@ rule SIGNATURE_BASE_APT15_Malware_Mar18_Royalcli : FILE
date = "2018-03-10"
modified = "2023-12-05"
reference = "https://goo.gl/HZ5XMN"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt15.yar#L13-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt15.yar#L13-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
logic_hash = "27fb5e8ff299201d1d13f4a45c401570f76ddfa4c3c1153eff50187170ada06e"
score = 75
@@ -348981,8 +349387,8 @@ rule SIGNATURE_BASE_APT15_Malware_Mar18_Royaldns : FILE
date = "2018-03-10"
modified = "2023-12-05"
reference = "https://goo.gl/HZ5XMN"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt15.yar#L34-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt15.yar#L34-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
logic_hash = "5d42f48d7d816c0b0ea05145e9dd43b1b2589f3131bf286e1b39c0efaf1c6fac"
score = 75
@@ -349012,8 +349418,8 @@ rule SIGNATURE_BASE_APT15_Malware_Mar18_BS2005 : FILE
date = "2018-03-10"
modified = "2023-12-05"
reference = "https://goo.gl/HZ5XMN"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt15.yar#L61-L87"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt15.yar#L61-L87"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "750d9eecd533f89b8aa13aeab173a1cf813b021b6824bc30e60f5db6fa7b950b"
logic_hash = "306903da4ecc9f5bf670d8c49039dee0ce5500c185acaef74786a2c109a4734b"
score = 75
@@ -349044,8 +349450,8 @@ rule SIGNATURE_BASE_APT15_Malware_Mar18_Msexchangetool : FILE
date = "2018-03-10"
modified = "2023-12-05"
reference = "https://goo.gl/HZ5XMN"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt15.yar#L89-L106"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt15.yar#L89-L106"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "16b868d1bef6be39f69b4e976595e7bd46b6c0595cf6bc482229dbb9e64f1bce"
logic_hash = "4e9e29bc69383ab6248241622394afddde6e18032ed6e2b64575362773f25a94"
score = 75
@@ -349072,8 +349478,8 @@ rule SIGNATURE_BASE_Clean_Apt15_Patchedcmd : FILE
date = "2018-03-12"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt15.yar#L118-L131"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt15.yar#L118-L131"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "90d1f65cfa51da07e040e066d4409dc8a48c1ab451542c894a623bc75c14bf8f"
logic_hash = "08a68e14793d2f44ee75e49a43521c7d8bc1fc5ddd005e1fb71cc844966e16ba"
score = 75
@@ -349098,8 +349504,8 @@ rule SIGNATURE_BASE_Malware_Apt15_Royalcli_1 : FILE
date = "2018-03-12"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt15.yar#L133-L152"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt15.yar#L133-L152"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
logic_hash = "3cc0cd81db58e20fbf31fbd9fe65d113b7160e7d2b6739c01987d9e317099b9b"
score = 75
@@ -349130,8 +349536,8 @@ rule SIGNATURE_BASE_Malware_Apt15_Royalcli_2 : FILE
date = "2018-03-12"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt15.yar#L154-L167"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt15.yar#L154-L167"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c57ae92ba84355652cd56c8eaad3f277a8f514f8d078f053f3e8208b8bec535f"
score = 75
quality = 85
@@ -349156,8 +349562,8 @@ rule SIGNATURE_BASE_Malware_Apt15_Royaldll
date = "2018-03-12"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt15.yar#L196-L243"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt15.yar#L196-L243"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
logic_hash = "2ed0d38993a072da189f02233bd7cc0bf1be02e926f687db224f52de9b3a44fc"
score = 75
@@ -349187,8 +349593,8 @@ rule SIGNATURE_BASE_Malware_Apt15_Royaldll_2 : FILE
date = "2018-03-12"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt15.yar#L245-L261"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt15.yar#L245-L261"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
logic_hash = "94e2b61ff19b1377f461203cb22c607e718683691e54a3de3ed32bf6ed2897fa"
score = 75
@@ -349214,8 +349620,8 @@ rule SIGNATURE_BASE_Malware_Apt15_Exchange_Tool : FILE
date = "2018-03-12"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt15.yar#L263-L283"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt15.yar#L263-L283"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d21a7e349e796064ce10f2f6ede31c71"
logic_hash = "e7b5ac97f3dcf125e64001be53aca73ee19c1be8b192a762f231106c47f76867"
score = 75
@@ -349247,8 +349653,8 @@ rule SIGNATURE_BASE_Malware_Apt15_Generic
date = "2018-03-12"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt15.yar#L285-L307"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt15.yar#L285-L307"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e939a5ab4a4b2b289d5809e18dd57dd85e3da19a176719adba4707dfd605fc81"
score = 75
quality = 85
@@ -349271,8 +349677,8 @@ rule SIGNATURE_BASE_Projectm_Darkcomet_1 : FILE
date = "2016-03-26"
modified = "2023-01-27"
reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_m.yar#L10-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_m.yar#L10-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cc488690ce442e9f98bac651218f4075ca36c355d8cd83f7a9f5230970d24157"
logic_hash = "81ffaa382bb6f817fe2917a096a3eee49d2e8c281271da551ccd65679692712f"
score = 75
@@ -349300,8 +349706,8 @@ rule SIGNATURE_BASE_Projectm_Crimsondownloader : FILE
date = "2016-03-26"
modified = "2023-12-05"
reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_project_m.yar#L32-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_project_m.yar#L32-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc8bd60695070152c94cbeb5f61eca6e4309b8966f1aa9fdc2dd0ab754ad3e4c"
logic_hash = "3c9a4f5aca4c9fc26d371027a32e349a456ef25d6b403a66b9afb1ee19dd4d00"
score = 75
@@ -349329,8 +349735,8 @@ rule SIGNATURE_BASE_APT_UNC4841_ESG_Barracuda_CVE_2023_2868_Forensic_Artifacts_J
date = "2023-06-15"
modified = "2023-06-16"
reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_barracuda_esg_unc4841_jun23.yar#L2-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_barracuda_esg_unc4841_jun23.yar#L2-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fa7cac1e0f6cb6fa3ac271c1fff0039ff182b6859920b4eca25541457654acde"
score = 75
quality = 85
@@ -349362,8 +349768,8 @@ rule SIGNATURE_BASE_APT_MAL_UNC4841_SEASPY_Jun23_1 : CVE_2023_2868 FILE
date = "2023-06-16"
modified = "2023-12-05"
reference = "https://blog.talosintelligence.com/alchimist-offensive-framework/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_barracuda_esg_unc4841_jun23.yar#L30-L55"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_barracuda_esg_unc4841_jun23.yar#L30-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3f26a13f023ad0dcd7f2aa4e7771bba74910ee227b4b36ff72edc5f07336f115"
logic_hash = "c1dcb841fb872f0d5e661bfd90fca3075f5efc95b1f9dfff72fa318ed131e9d1"
score = 85
@@ -349393,8 +349799,8 @@ rule SIGNATURE_BASE_APT_MAL_UNC4841_SEASPY_LUA_Jun23_1 : FILE
date = "2023-06-16"
modified = "2023-12-05"
reference = "https://blog.talosintelligence.com/alchimist-offensive-framework/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_barracuda_esg_unc4841_jun23.yar#L57-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_barracuda_esg_unc4841_jun23.yar#L57-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "56e8066bf83ff6fe0cec92aede90f6722260e0a3f169fc163ed88589bffd7451"
logic_hash = "f78823a4ba9e025ba4833a2d5234c7baba33c1167c0247f13b8b2baa430aa4e5"
score = 90
@@ -349419,8 +349825,8 @@ rule SIGNATURE_BASE_APT_HKTL_Proxy_Tool_Jun23_1 : FILE
date = "2023-06-16"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_barracuda_esg_unc4841_jun23.yar#L76-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_barracuda_esg_unc4841_jun23.yar#L76-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ca72fa64ed0a9c22d341a557c6e7c1b6a7264b0c4de0b6f717dd44bddf550bca"
hash = "57e4b180fd559f15b59c43fb3335bd59435d4d76c4676e51a06c6b257ce67fb2"
logic_hash = "7e2152e1aa74e1842519e2eecd2acd3ef8eb8d517f3c0ef9f05c983616f223c3"
@@ -349445,8 +349851,8 @@ rule SIGNATURE_BASE_SUSP_Fscan_Port_Scanner_Output_Jun23 : SCRIPT FILE
date = "2023-06-15"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_barracuda_esg_unc4841_jun23.yar#L103-L117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_barracuda_esg_unc4841_jun23.yar#L103-L117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "49b5055c96d7b7446ee5ae8667a5aa3645f0f98d8b5f2bffcd6ef3b20bc64e05"
score = 70
quality = 85
@@ -349469,8 +349875,8 @@ rule SIGNATURE_BASE_SUSP_PY_Shell_Spawn_Jun23_1 : SCRIPT
date = "2023-06-15"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_barracuda_esg_unc4841_jun23.yar#L119-L131"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_barracuda_esg_unc4841_jun23.yar#L119-L131"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "63e94447930d5a00399de753076facbfb2bf18dd8c815f01aaefd14678aea034"
score = 70
quality = 85
@@ -349491,8 +349897,8 @@ rule SIGNATURE_BASE_APT_MAL_Hunting_LUA_SEASIDE_1 : FILE
date = "2023-06-15"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_barracuda_esg_unc4841_jun23.yar#L136-L152"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_barracuda_esg_unc4841_jun23.yar#L136-L152"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cd2813f0260d63ad5adf0446253c2172"
logic_hash = "82b61325a78bf8ab09d426cfadceb614a256dfcafb2e1f75595de63593ed2574"
score = 70
@@ -349517,8 +349923,8 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Hunting_Linux_WHIRLPOOL_1 : FILE
date = "2023-06-15"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_barracuda_esg_unc4841_jun23.yar#L154-L173"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_barracuda_esg_unc4841_jun23.yar#L154-L173"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "177add288b289d43236d2dba33e65956"
logic_hash = "d03c0e292b9b97bbf76585fc74208e4263d753807b8e4a445be80d41264d5432"
score = 70
@@ -349546,8 +349952,8 @@ rule SIGNATURE_BASE_APT_MAL_LUA_Hunting_SKIPJACK_1
date = "2023-06-15"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_barracuda_esg_unc4841_jun23.yar#L175-L193"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_barracuda_esg_unc4841_jun23.yar#L175-L193"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e4e86c273a2b67a605f5d4686783e0cc"
logic_hash = "8890cd9ab8190f12997e0653e43c89816df03c7bd41842e5ad21b1986819843e"
score = 70
@@ -349574,8 +349980,8 @@ rule SIGNATURE_BASE_APT_MAL_LUA_Hunting_Lua_SKIPJACK_2
date = "2023-06-15"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_barracuda_esg_unc4841_jun23.yar#L195-L212"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_barracuda_esg_unc4841_jun23.yar#L195-L212"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "87847445f9524671022d70f2a812728f"
logic_hash = "093e8857c410bd30a076f87ef63d7e1e66f50e3dce75b4add67161782386ee24"
score = 70
@@ -349601,8 +350007,8 @@ rule SIGNATURE_BASE_APT_MAL_LUA_Hunting_Lua_SEASPRAY_1
date = "2023-06-15"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_barracuda_esg_unc4841_jun23.yar#L213-L228"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_barracuda_esg_unc4841_jun23.yar#L213-L228"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "35cf6faf442d325961935f660e2ab5a0"
logic_hash = "856bfb47557b60f69aa1141477d6ce446ea13ebbe899022d7996ceef08bdefbb"
score = 70
@@ -349627,8 +350033,8 @@ rule SIGNATURE_BASE_MAL_Ryuk_Ransomware : FILE
date = "2018-12-31"
modified = "2023-12-05"
reference = "https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ryuk_ransomware.yar#L3-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ryuk_ransomware.yar#L3-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26"
hash = "b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d"
logic_hash = "01e8ad348e5954374fc0f9fc25ba1ee83db4a2a50e622b27640aa2eb394dc5a0"
@@ -349655,8 +350061,8 @@ rule SIGNATURE_BASE_MAL_WIPER_Unknown_Jun25 : FILE
date = "2025-06-19"
modified = "2026-05-15"
reference = "https://x.com/cyb3rops/status/1935707307805134975"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_wipers_jun25.yar#L2-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_wipers_jun25.yar#L2-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12c39f052f030a77c0cd531df86ad3477f46d1287b8b98b625d1dcf89385d721"
logic_hash = "64569f65814d63e55ea938e3dd9bd359da4597328887bdacf37bb5545ea32424"
score = 75
@@ -349680,8 +350086,8 @@ rule SIGNATURE_BASE_SUSP_LNX_SH_Disk_Wiper_Script_Jun25 : FILE
date = "2025-06-19"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_wipers_jun25.yar#L24-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_wipers_jun25.yar#L24-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f662f69fc7f4240cd8c00661db9484e76b5d02f903590140b4086fefcf9d9331"
logic_hash = "99a0a393c2a636c10195c7ad85f3b282a30ba05fbc0f0db7fc04b0f79fbc6760"
score = 65
@@ -349705,8 +350111,8 @@ rule SIGNATURE_BASE_SUSP_PY_Pyinstaller_Swiper_Jun25 : FILE
date = "2025-06-19"
modified = "2026-05-15"
reference = "https://x.com/cyb3rops/status/1935707307805134975"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_wipers_jun25.yar#L43-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_wipers_jun25.yar#L43-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4f669ecbe12e95d51f37be76933de4c2626d20bb01729086ce2efc603c4ffdf3"
logic_hash = "824bdda031336b2d9a60b09bfa36e68a2e03159b217c9c25dd708df454144e1e"
score = 65
@@ -349731,8 +350137,8 @@ rule SIGNATURE_BASE_APT_MAL_IR_Druidfly_Wiper_Jun25 : FILE
date = "2025-06-21"
modified = "2026-05-15"
reference = "https://x.com/threatintel/status/1936049254432231444"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_wipers_jun25.yar#L64-L91"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_wipers_jun25.yar#L64-L91"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "81eb22828306f3197b35fef2035cef2c548f587f8511902852964850023389d7"
logic_hash = "9d3872506b03ea03a2c3cd7304c6b2d9dfafa04a29e19dc9be4924eaaa5db2d6"
score = 80
@@ -349760,8 +350166,8 @@ rule SIGNATURE_BASE_Apt_Win32_Dll_Rat_1A53B0Cp32E46G0Qio7 : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_inocnation.yar#L1-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_inocnation.yar#L1-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "75d3d1f23628122a64a2f1b7ef33f5cf"
hash = "d9821468315ccd3b9ea03161566ef18e"
hash = "b9af5f5fd434a65d7aa1b55f5441c90a"
@@ -349794,8 +350200,8 @@ rule SIGNATURE_BASE_Xtreme_Sep17_1 : FILE
date = "2017-09-27"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_xtreme_rat.yar#L14-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_xtreme_rat.yar#L14-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6"
logic_hash = "fa78b43f729032291c27f67dc53bd39a85c9a50323c7adf909ca2a8c5acdd861"
score = 75
@@ -349824,8 +350230,8 @@ rule SIGNATURE_BASE_Xtreme_Sep17_2 : FILE
date = "2017-09-27"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_xtreme_rat.yar#L39-L53"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_xtreme_rat.yar#L39-L53"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f8413827c52a5b073bdff657d6a277fdbfda29d909b4247982f6973424fa2dcc"
logic_hash = "cb86167e0267d52b1b7503abd8f5b988296e3cde12453ace529c4e043d2ca69e"
score = 75
@@ -349849,8 +350255,8 @@ rule SIGNATURE_BASE_Xtreme_Sep17_3 : FILE
date = "2017-09-27"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_xtreme_rat.yar#L55-L69"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_xtreme_rat.yar#L55-L69"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f540a4cac716438da0c1c7b31661abf35136ea69b963e8f16846b96f8fd63dde"
logic_hash = "c110863028ab1f557270e52de608179ce582a47e0a20994f83d385ed285bda9a"
score = 75
@@ -349875,8 +350281,8 @@ rule SIGNATURE_BASE_Xtreme_RAT_Gen_Imp : FILE
date = "2017-09-27"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_xtreme_rat.yar#L71-L86"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_xtreme_rat.yar#L71-L86"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7b5082bcc8487bb65c38e34c192c2a891e7bb86ba97281352b0837debee6f1cf"
logic_hash = "9cfd6473e7f8d1f899fe2cdbb49a4086ea7ac6151602d0964ed28b16d2d0188d"
score = 75
@@ -349896,8 +350302,8 @@ rule SIGNATURE_BASE_Gen_Exploit_CVE_2017_10271_Weblogic : HIGHVOL CVE_2017_10271
date = "2018-03-21"
modified = "2023-12-05"
reference = "https://github.com/c0mmand3rOpSec/CVE-2017-10271, https://www.fireeye.com/blog/threat-research/2018/02/cve-2017-10271-used-to-deliver-cryptominers.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_exploit_cve_2017_10271_weblogic.yar#L1-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_exploit_cve_2017_10271_weblogic.yar#L1-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "376c2bc11d4c366ad4f6fecffc0bea8b195e680b4c52a48d85a8d3f9fab01c95"
hash = "7d5819a2ea62376e24f0dd3cf5466d97bbbf4f5f730eb9302307154b363967ea"
hash = "864e9d8904941fae90ddd10eb03d998f85707dc2faff80cba2e365a64e830e1d/subfile"
@@ -349928,11 +350334,11 @@ rule SIGNATURE_BASE_EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24 : CVE_2024_2
date = "2024-02-17"
modified = "2024-02-19"
reference = "https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_outlook_cve_2024_21413.yar#L2-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_outlook_cve_2024_21413.yar#L2-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "06cfafe0b92949e493dca6d54f671d0607242d97341144b69f563a0cc24dc6a1"
score = 75
- quality = 60
+ quality = 85
tags = "CVE-2024-21413, FILE"
strings:
@@ -349952,8 +350358,8 @@ rule SIGNATURE_BASE_APT28_CHOPSTICK : FILE
date = "2015-06-02"
modified = "2023-12-05"
reference = "https://goo.gl/v3ebal"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt28.yar#L10-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt28.yar#L10-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f4db2e0881f83f6a2387ecf446fcb4a4c9f99808"
logic_hash = "750b2d5157856e0ffd840406eec601ded51ced7ccb20b577f336bbaf32681835"
score = 60
@@ -349984,8 +350390,8 @@ rule SIGNATURE_BASE_APT28_Sourface_Malware1 : FILE
date = "2015-06-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt28.yar#L34-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt28.yar#L34-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e2450dffa675c61aa43077b25b12851a910eeeb6"
hash = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
logic_hash = "2ec1e5db74b5abe1da0d454b5e901bd808a0be318235f25d713cfdc4aea8d6d7"
@@ -350010,8 +350416,8 @@ rule SIGNATURE_BASE_APT28_Sourface_Malware2 : FILE
date = "2015-06-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt28.yar#L52-L72"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt28.yar#L52-L72"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "367d40465fd1633c435b966fa9b289188aa444bc"
hash = "cf3220c867b81949d1ce2b36446642de7894c6dc"
hash = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
@@ -350040,8 +350446,8 @@ rule SIGNATURE_BASE_APT28_Sourface_Malware3 : FILE
date = "2015-06-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt28.yar#L74-L98"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt28.yar#L74-L98"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "85522190958c82589fa290c0835805f3d9a2f8d6"
hash = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
hash = "367d40465fd1633c435b966fa9b289188aa444bc"
@@ -350074,8 +350480,8 @@ rule SIGNATURE_BASE_APT28_Skinnyboy_Dropper_1 : RUSSIA FILE
date = "2021-05-24"
modified = "2023-12-05"
reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt28.yar#L103-L118"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt28.yar#L103-L118"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9"
logic_hash = "9e29ed985fac8701f72f0860fe101272c3c3342ef6857e30d32f5fea14822945"
score = 75
@@ -350099,8 +350505,8 @@ rule SIGNATURE_BASE_Crime_Win32_Ransom_Maze_Dll_1 : FILE
date = "2020-04-18"
modified = "2023-12-05"
reference = "https://twitter.com/VK_Intel/status/1251388507219726338"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_maze_ransomware.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_maze_ransomware.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5b76636c05141687fa5cc507ac67d6a5d1f6c89166fd302e94fe61b412451159"
score = 75
quality = 85
@@ -350125,8 +350531,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php5 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L8-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L8-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0fd91b6ad400a857a6a65c8132c39e6a16712f19"
logic_hash = "e882f115a67fe31ece1a81e1a2770b46370a92ac3aa23e348a12cdb5735e8a0e"
score = 70
@@ -350150,8 +350556,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Test3693 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L25-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L25-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "246d629ae3ad980b5bfe7e941fe90b855155dbfc"
logic_hash = "a10618d54fb7adbbd89a10f2e1ac067ccd1832140bcaf3b92394ebe7323f2d1e"
score = 70
@@ -350175,8 +350581,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Mycode12 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L42-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L42-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "64be8760be5ab5c2dcf829e3f87d3e50b1922f17"
logic_hash = "94cb0e414634af753db9ec0c63a3a34b4f9104e93e01d67cebab7b3a0c471198"
score = 70
@@ -350200,8 +350606,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Offlibrary : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L59-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L59-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eb5275f99211106ae10a23b7e565d208a94c402b"
logic_hash = "ffec24bedfe0794e8f92da5067c41932339e61ec23d71a67ed4b634434cd10d6"
score = 70
@@ -350225,8 +350631,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Cfm_Xl : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L76-L91"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L76-L91"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "49c3d16ee970945367a7d6ae86b7ade7cb3b5447"
logic_hash = "b6683a24ad58a9444ec91f13e7da5db3e3e768afded09a23e1bbd0a0c23cf6b9"
score = 70
@@ -350250,8 +350656,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Linux : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L93-L108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L93-L108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "78339abb4e2bb00fe8a012a0a5b7ffce305f4e06"
logic_hash = "2c6278acd123e0d41ed4f0f8f0da27d5de1ad56efb8102c9eae442838a0416d0"
score = 70
@@ -350275,8 +350681,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Interception3389_Get : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L110-L126"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L110-L126"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ceb6306f6379c2c1634b5058e1894b43abcf0296"
logic_hash = "649e611c9d8948e60811af4209d737b3e797e6b42beba42439541ae543b062d6"
score = 70
@@ -350301,8 +350707,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Nc_1 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L128-L143"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L128-L143"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "51d83961171db000fe4476f36d703ef3de409676"
logic_hash = "80ea8f16d943a3775fe9999131272af9e7f1af60d413109e58ecdef036484760"
score = 70
@@ -350326,8 +350732,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Blacksky : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L145-L160"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L145-L160"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a60a599c6c8b6a6c0d9da93201d116af257636d7"
logic_hash = "3b92f63f536361d8ba0cde853fb546f271abdec3a7c1d44688a42610f5f90c57"
score = 70
@@ -350351,8 +350757,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp3 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L162-L177"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L162-L177"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
logic_hash = "e5f30a445be30c491e669c633bf2df08cbfb1017ecfc91f9ed83275550488304"
score = 70
@@ -350376,8 +350782,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Sniff : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L179-L194"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L179-L194"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e246256696be90189e6d50a4ebc880e6d9e28dfd"
logic_hash = "198442e75422055e7d65c5d1aef55819036a99077aa79dbd5006ba97c4fe4af8"
score = 70
@@ -350401,8 +350807,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Udf_Udf : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L196-L211"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L196-L211"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "df63372ccab190f2f1d852f709f6b97a8d9d22b9"
logic_hash = "c7db32b5e66601e0b8322ac67b6b9ba8d6222891ed01db557bfac9985140421a"
score = 70
@@ -350426,8 +350832,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_JSP_Jsp : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L213-L228"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L213-L228"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c58fed3d3d1e82e5591509b04ed09cb3675dc33a"
logic_hash = "089e1a553900d149a4087ac81254295d74de15d9baaf73e60ce4f061e450e8c7"
score = 70
@@ -350451,8 +350857,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_T00Ls_Lpk_Sethc_V4_Mail : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L230-L245"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L230-L245"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0a9b7b438591ee78ee573028cbb805a9dbb9da96"
logic_hash = "b835a6d0c736116e0a8b277dadbf25c2ac333b0d7937a6f67ed59887c610a57a"
score = 70
@@ -350476,8 +350882,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Phpwebbackup : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L247-L262"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L247-L262"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c788cb280b7ad0429313837082fe84e9a49efab6"
logic_hash = "45452fc415fbafe170a1b1f5a58df40f0ec65a9a6678e675b40a8c54e2d8bd6c"
score = 70
@@ -350501,8 +350907,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Dz_Phpcms_Phpbb : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L264-L281"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L264-L281"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "33f23c41df452f8ca2768545ac6e740f30c44d1f"
logic_hash = "1455df58f51c3ae7558b89c940d97ea5870f261217b2a09727bb6678bcbd5500"
score = 70
@@ -350528,8 +350934,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Picloaked_1 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L283-L299"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L283-L299"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3eab1798cbc9ab3b2c67d3da7b418d07e775db70"
logic_hash = "a816ac9e98b7c5208f075ffcb9a6525016d6a5c468005d78ecab90d651423705"
score = 70
@@ -350554,8 +350960,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Assembly : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L301-L315"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L301-L315"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2bcb4d22758b20df6b9135d3fb3c8f35a9d9028e"
logic_hash = "34dc47b2f91a15a62175f3cab88d5ff24d2a3aa62f74fb9e43a4aaae96ced999"
score = 70
@@ -350578,8 +350984,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php8 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L317-L334"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L317-L334"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b7b49f1d6645865691eccd025e140c521ff01cce"
logic_hash = "435ceb72c082f702284c464979a907a59a42bb4aa07311f9b2da1a9831efac11"
score = 70
@@ -350605,8 +351011,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Xx : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L336-L352"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L336-L352"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f39f1d9846ae72fc673f9166536dc21d8f396aa"
logic_hash = "67c542f172fd1b97fbee4697fd42bab9486e3d779ce62993617e5a5205bd75d4"
score = 70
@@ -350631,8 +351037,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_JSPMSSQL : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L354-L369"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L354-L369"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c6b4faecd743d151fe0a4634e37c9a5f6533655f"
logic_hash = "c08e69345cb09e41840a81dcd8a015f9e1be93d570b64c310be74631e5314e2f"
score = 70
@@ -350656,8 +351062,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Injection_Transit_Jmpost : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L371-L386"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L371-L386"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
logic_hash = "6c7f52cf7ff6df9867ea2c46cd8f40ef0e077d4e1d9033cde0649a209bffe21b"
score = 70
@@ -350681,8 +351087,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Web_Asp : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L388-L403"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L388-L403"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aebf6530e89af2ad332062c6aae4a8ca91517c76"
logic_hash = "5d2d7e6b9340ee4fd845ff05c99526c919214974b1a0def66492fe3cd4a75fe9"
score = 70
@@ -350706,8 +351112,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Wshell_Asp : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L405-L421"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L405-L421"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4a0afdf5a45a759c14e99eb5315964368ca53e9c"
logic_hash = "f3c4af85e4798d3a809d8edd9cc46d1df44453f14ed050b002fe789da4d6096f"
score = 70
@@ -350732,8 +351138,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp404 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L423-L439"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L423-L439"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bed51971288aeabba6dabbfb80d2843ec0c4ebf6"
logic_hash = "c84be2e561a08317be11cdb0fe103f8ad182a64d8cd1bf987163ebbeabe20f00"
score = 70
@@ -350758,8 +351164,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Asp : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L441-L457"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L441-L457"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
logic_hash = "c98c3f4db5ea812827b6108ef88b57116621142202248f4f26f0c71bd76e33ec"
score = 70
@@ -350784,8 +351190,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Cfm_List : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L459-L474"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L459-L474"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "85d445b13d2aef1df3b264c9b66d73f0ff345cec"
logic_hash = "41c7c5ba6187a8871dec83bcd859b9377813d60cea8ef2b4ad390c67de04e010"
score = 70
@@ -350809,8 +351215,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L476-L491"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L476-L491"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bf12e1d741075cd1bd324a143ec26c732a241dea"
logic_hash = "707e2795d82636fbbc4d9f5324e509a526f77f9ead8f3c4d59dd0e95bc94f11e"
score = 70
@@ -350834,8 +351240,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Oracle : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L493-L509"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L493-L509"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fc7043aaac0ee2d860d11f18ddfffbede9d07957"
logic_hash = "3ad4207e426ed2f9df0e0bac0e906af437b0774ba2ebb541afbe7e29b395ad63"
score = 70
@@ -350860,8 +351266,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx4 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L511-L527"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L511-L527"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "200a8f15ffb6e3af31d28c55588003b5025497eb"
logic_hash = "0aab8e327b4477cb0b8cd5d4b1e4b52c160180656dad57b0498654da1c8d7a29"
score = 70
@@ -350886,8 +351292,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L529-L546"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L529-L546"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8378619b2a7d446477946eabaa1e6744dec651c1"
logic_hash = "b59684633fd72bd1804a96850a8b358db98c169415b6e65fe3ecfb4d9fde72d0"
score = 70
@@ -350913,8 +351319,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Su7_X_9_X : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L548-L563"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L548-L563"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "808396b51023cc8356f8049cfe279b349ca08f1a"
logic_hash = "2d2398cf0f9e253eea343d39b6555f2633f92f627f1c93cc28123d5a7f3d1bf1"
score = 70
@@ -350938,8 +351344,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Cfmshell : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L565-L580"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L565-L580"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "740796909b5d011128b6c54954788d14faea9117"
logic_hash = "0767012ec8fd4a18a64eca04d459efb55fafd29ed052dab8a0eb1b8f4ce7aa66"
score = 70
@@ -350963,8 +351369,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp4 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L582-L598"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L582-L598"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4005b83ced1c032dc657283341617c410bc007b8"
logic_hash = "ae02d1efc975a8592a00cbab823355fb778fbb589f5752dd913aa432b316c3a4"
score = 70
@@ -350989,8 +351395,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_2_Admin_By_Lake2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L600-L617"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L600-L617"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cb8039f213e611ab2687edd23e63956c55f30578"
logic_hash = "a67c08b3a4bed2385d2fa8c007615bfb37a2d739cc13ee2e0f5eda00536b6ea8"
score = 70
@@ -351016,8 +351422,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php3 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L619-L634"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L619-L634"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e2924cb0537f4cdfd6f1bd44caaaf68a73419b9d"
logic_hash = "ba3892feacbbe3d7c6b6308a22ca22b19ae84b6490df2c976852260da2a96ca1"
score = 70
@@ -351041,8 +351447,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_By_Goldsun : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L636-L653"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L636-L653"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
logic_hash = "962b2e75c03f716fc039cf26aa238e9a3faf5a7ea8fb3d4da556fa601790055a"
score = 70
@@ -351068,8 +351474,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php10 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L655-L670"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L655-L670"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3698c566a0ae07234c8957112cdb34b79362b494"
logic_hash = "76bb2dfd518173f031cc3c93b2098edaef4aca09f0dd8228223257b0b7df452b"
score = 70
@@ -351093,8 +351499,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Servu : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L671-L686"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L671-L686"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7de701b86820096e486e64ca34f1fa9f2fbba641"
logic_hash = "d3956b6daa0649233372aea4176e0d43c44d866146884222f92b7efe01f288bb"
score = 70
@@ -351118,8 +351524,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Portrecall_Jsp2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L688-L704"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L688-L704"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "412ed15eb0d24298ba41731502018800ffc24bfc"
logic_hash = "1ec77a1b0d30cdebce1b5b07445247016230b733a594d8d1de642c2c8af63031"
score = 70
@@ -351144,8 +351550,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L706-L723"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L706-L723"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "95db7a60f4a9245ffd04c4d9724c2745da55e9fd"
logic_hash = "7af90992bc3f708d877dcd5841c0d132793e41a0796607907084516d955b3ae0"
score = 70
@@ -351171,8 +351577,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Hy2006A : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L725-L740"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L725-L740"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "20da92b2075e6d96636f883dcdd3db4a38c01090"
logic_hash = "a24bf11a2728bb8d18ea005b057648770956694e0b257d4464ad15ee3e24eda2"
score = 70
@@ -351196,8 +351602,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php1 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L742-L758"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L742-L758"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c2f4b150f53c78777928921b3a985ec678bfae32"
logic_hash = "aadf47ac6231b41e720efdd85c481ebac8fccb572e57b86b27a95dd367c0d81b"
score = 70
@@ -351222,8 +351628,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Jspshell2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L760-L775"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L760-L775"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cc7bc1460416663012fc93d52e2078c0a277ff79"
logic_hash = "3a60991fa557655fbd2450739976ac612a0ea2a3df22873382b05438cac12762"
score = 70
@@ -351247,8 +351653,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Mysql : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L777-L791"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L777-L791"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8e242c40aabba48687cfb135b51848af4f2d389d"
logic_hash = "bde2ea1ccfc88138456a1b255a32a7323f5ef0f677499db6dc6670987cc37585"
score = 70
@@ -351272,8 +351678,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php9 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L793-L807"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L793-L807"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cd3962b1dba9f1b389212e38857568b69ca76725"
logic_hash = "bea117862ebc9220a4d9aee091c808274f9907fceb83b528055998ddcc90aa5f"
score = 70
@@ -351296,8 +351702,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Portrecall_Jsp : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L809-L823"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L809-L823"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "65e8e4d13ad257c820cad12eef853c6d0134fce8"
logic_hash = "98f279c3e50308f67f88ecf8459943187ea152664fe0206c4a7d3435242df2a6"
score = 70
@@ -351320,8 +351726,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx3 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L825-L840"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L825-L840"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dd61481771f67d9593214e605e63b62d5400c72f"
logic_hash = "11bf511ee70ff4bde0a9320cb80dd9efa0f437d432c78a859153cfcc8e80db01"
score = 70
@@ -351345,8 +351751,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Shell_Shell : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L842-L857"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L842-L857"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1816006827d16ed73cefdd2f11bd4c47c8af43e4"
logic_hash = "ac22d89353b4316289bf6c6e13332ac401f4b57f6c29b71861cb48359c1e55f9"
score = 70
@@ -351370,8 +351776,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell__Php1_Php7_Php9 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L859-L878"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L859-L878"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c2f4b150f53c78777928921b3a985ec678bfae32"
hash = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
hash = "cd3962b1dba9f1b389212e38857568b69ca76725"
@@ -351399,8 +351805,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell__Serv_U_By_Goldsun_Asp3_Serv_U_Asp : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L880-L899"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L880-L899"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
hash = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
hash = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
@@ -351428,8 +351834,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell__Asp4_Asp4_MSSQL__MSSQL_ : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L901-L921"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L901-L921"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4005b83ced1c032dc657283341617c410bc007b8"
hash = "4005b83ced1c032dc657283341617c410bc007b8"
hash = "7097c21f92306983add3b5b29a517204cd6cd819"
@@ -351458,8 +351864,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell__Injection_Jmcook_Jmpost_Manualinjection
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L923-L942"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L923-L942"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
hash = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
hash = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
@@ -351487,8 +351893,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Cmfshell : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L944-L959"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L944-L959"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b9b2107c946431e4ad1a8f5e53ac05e132935c0e"
logic_hash = "f138a82c2d6a831626fe200308eb89cb50ffeec2f2722599eb4ccbd082bad73d"
score = 70
@@ -351512,8 +351918,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php4 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L961-L975"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L961-L975"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "179975f632baff6ee4d674fe3fabc324724fee9e"
logic_hash = "e625b6d1fd2c1e62306ccae2775ee7b53ddcdd7a6baef55b386dfcd92dc2e764"
score = 70
@@ -351536,8 +351942,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Linux_2_6_Exploit : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L977-L991"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L977-L991"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ec22fac0510d0dc2c29d56c55ff7135239b0aeee"
logic_hash = "7f3e2937796358a949ce980210ddeb1a606a7b9c2b4d9c4a4acad49bb556dfc8"
score = 70
@@ -351560,8 +351966,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L993-L1009"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L993-L1009"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b3ac478e72a0457798a3532f6799adeaf4a7fc87"
logic_hash = "6107afe9895c4e0c865e78bece160246815a0d3c589bfc79f8b369b94481cd89"
score = 70
@@ -351586,8 +351992,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_FTP_MYSQL_MSSQL_SSH : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L1011-L1029"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L1011-L1029"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fe63b215473584564ef2e08651c77f764999e8ac"
logic_hash = "a66884c71ce0cce05ba6607bf66dc55bfae5393746328c06f5c9ca98005d0caf"
score = 70
@@ -351614,8 +352020,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Shell : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L1031-L1047"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L1031-L1047"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b7b34215c2293ace70fc06cbb9ce73743e867289"
logic_hash = "be3961d6568acfaadfa09efda2f914259a59f4e30725c7d434e89f6020e40515"
score = 70
@@ -351640,8 +352046,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php7 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L1049-L1064"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L1049-L1064"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
logic_hash = "70804d914c6f31422632943bf663f997eb747a290a13b27bfcc66bc3129f136d"
score = 70
@@ -351665,8 +352071,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Rootkit : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L1066-L1081"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L1066-L1081"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3bfc1c95782e702cf56184e7d438edcf5802eab3"
logic_hash = "5569a179f011ece9802676542d5556fe8d2a2b144e26065b9e0c5bd06c970201"
score = 70
@@ -351690,8 +352096,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Jspshell : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L1083-L1098"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L1083-L1098"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d16af622f7688d4e0856a2678c4064d3d120e14b"
logic_hash = "9b952f941eb87d7a1b4f747f4e0b0b5ee8876190c6f684b811057a2c78044047"
score = 70
@@ -351715,8 +352121,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Serv_U : FILE
date = "2015-06-23"
modified = "2023-01-27"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L1100-L1117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L1100-L1117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1c6415a247c08a63e3359b06575b36017befc0c0"
logic_hash = "89cfcbaa38c3b0b6c31af634b4588dcc8bc7a5aa3edac955a162173341d03622"
score = 70
@@ -351741,8 +352147,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Webshell : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L1119-L1135"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L1119-L1135"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
logic_hash = "7d80390a86b1858d2cf4f2be56df7e734aea402de0878adf40ef36721719ca74"
score = 70
@@ -351767,8 +352173,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Mssql_2 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L1137-L1153"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L1137-L1153"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ad55512afa109b205e4b1b7968a89df0cf781dc9"
logic_hash = "1d4b75eeeddda6e92b8ec38679d5e2b9d21abf2d2b467b91a066dcf628725f0a"
score = 70
@@ -351793,8 +352199,8 @@ rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp1 : FILE
date = "2015-06-23"
modified = "2023-12-05"
reference = "Disclosed CN Honker Pentest Toolset"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/cn_pentestset_webshells.yar#L1155-L1171"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/cn_pentestset_webshells.yar#L1155-L1171"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "78b5889b363043ed8a60bed939744b4b19503552"
logic_hash = "3b454b1254d05b2208aee02e966c9c56a338dd3d33a2c6acc2c4df3208314055"
score = 70
@@ -351819,12 +352225,12 @@ rule SIGNATURE_BASE_FE_Webshell_PL_ATRIUM_1
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L12-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L12-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ca0175d86049fa7c796ea06b413857a3"
logic_hash = "869b397616495c644beb997602eac84ddcdbacce4c14755c555f5bda36663ca2"
score = 75
- quality = 60
+ quality = 85
tags = ""
strings:
@@ -351844,12 +352250,12 @@ rule SIGNATURE_BASE_FE_Trojan_SH_ATRIUM_1
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L29-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L29-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a631b7a8a11e6df3fccb21f4d34dbd8a"
logic_hash = "672a293660d89d5d7d62a658c360bad0b6408611d8794744b17a81e6a75ceea7"
score = 75
- quality = 35
+ quality = 60
tags = ""
strings:
@@ -351870,12 +352276,12 @@ rule SIGNATURE_BASE_FE_APT_Webshell_PL_HARDPULSE
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L46-L65"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L46-L65"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "980cba9e82faf194edb6f3cc20dc73ff"
logic_hash = "37fc40fd998d3294edb05707170bc2deec524fc6451bff212901f9ac3e34bb35"
score = 75
- quality = 58
+ quality = 83
tags = ""
strings:
@@ -351899,8 +352305,8 @@ rule SIGNATURE_BASE_FE_APT_Trojan_Linux32_LOCKPICK_1 : FILE
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L66-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L66-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e8bfd3f5a2806104316902bbe1195ee8"
logic_hash = "1623c2dc63fe7d595069a024b715bbca267ec1c9400afcadc377ae58afb81a2a"
score = 75
@@ -351923,8 +352329,8 @@ rule SIGNATURE_BASE_FE_APT_Trojan_Linux32_PACEMAKER : FILE
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L81-L98"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L81-L98"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d7881c4de4d57828f7e1cab15687274b"
logic_hash = "f3f89744ce558179f36da3b412ba4afb3798684e6d976ef59de565b5a3323ad6"
score = 75
@@ -351950,8 +352356,8 @@ rule SIGNATURE_BASE_FE_APT_Trojan_Linux_PACEMAKER : FILE
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L99-L115"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L99-L115"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d7881c4de4d57828f7e1cab15687274b"
logic_hash = "cf83024cbbd500a301ac3c859b680cd79acabc232ea6f42c23fe9f8918a8d914"
score = 75
@@ -351976,12 +352382,12 @@ rule SIGNATURE_BASE_FE_APT_Webshell_PL_PULSECHECK_1
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L116-L136"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L116-L136"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a1dcdf62aafc36dd8cf64774dea80d79fb4e24ba2a82adf4d944d9186acd1cc1"
logic_hash = "aba457dd33232ef37ca145c5b7cd9c5fe809730339a55c5e90ac46b4a136f6cb"
score = 75
- quality = 60
+ quality = 85
tags = ""
strings:
@@ -352006,12 +352412,12 @@ rule SIGNATURE_BASE_FE_APT_Trojan_PL_PULSEJUMP_1
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L137-L153"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L137-L153"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "91ee23ee24e100ba4a943bb4c15adb4c"
logic_hash = "c9aa2b9ef8aff14c20ed6597b1a71eafc3e3c181aabf9a3a68df18945207ff86"
score = 75
- quality = 60
+ quality = 85
tags = ""
strings:
@@ -352032,12 +352438,12 @@ rule SIGNATURE_BASE_FE_APT_Trojan_PL_QUIETPULSE
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L154-L172"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L154-L172"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "00575bec8d74e221ff6248228c509a16"
logic_hash = "226a56369e141834d4834400bbf1a006bbb6e9b39e16e24b0106bff1a9c202a9"
score = 75
- quality = 58
+ quality = 83
tags = ""
strings:
@@ -352060,12 +352466,12 @@ rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_1
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L173-L190"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L173-L190"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d72daafedf41d484f7f9816f7f076a9249a6808f1899649b7daa22c0447bb37b"
logic_hash = "d65a466cc15214d8e26597588c039a6b9fb4637ef8f3b1ebea27f016fbd5cba8"
score = 75
- quality = 58
+ quality = 83
tags = ""
strings:
@@ -352087,12 +352493,12 @@ rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_2
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L191-L208"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L191-L208"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4a2a7cbc1c8855199a27a7a7b51d0117"
logic_hash = "4ade993176c918ec23e99fc585e9ab14d9f9e93a7eca00f2c3b0ebbd13d6ec5b"
score = 75
- quality = 60
+ quality = 85
tags = ""
strings:
@@ -352114,12 +352520,12 @@ rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_3
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L209-L226"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L209-L226"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4a2a7cbc1c8855199a27a7a7b51d0117"
logic_hash = "025308591e058de284f949fd4f788e4a4f46bb2f6c0e1161237f1f811d8179ba"
score = 75
- quality = 60
+ quality = 85
tags = ""
strings:
@@ -352141,8 +352547,8 @@ rule SIGNATURE_BASE_FE_APT_Backdoor_Linux32_SLOWPULSE_1 : FILE
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L227-L244"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L227-L244"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cd09ec795a8f4b6ced003500a44d810f49943514e2f92c81ab96c33e1c0fbd68"
logic_hash = "c1d92ea4ed8e5934c8356e1e52092935c53a138e454026737448f7f523ea06be"
score = 75
@@ -352168,8 +352574,8 @@ rule SIGNATURE_BASE_FE_APT_Webshell_PL_STEADYPULSE_1
date = "2021-04-16"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_pulsesecure.yar#L265-L284"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_pulsesecure.yar#L265-L284"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "168976797d5af7071df257e91fcc31ce1d6e59c72ca9e2f50c8b5b3177ad83cc"
logic_hash = "a0e3ebdd02ccf5cc8fc0a83c1d0224aed45dc5094eb85bd855e5b74b34e3aaaf"
score = 75
@@ -352197,8 +352603,8 @@ rule SIGNATURE_BASE_APT_UTA028_Forensicartefacts_Paloalto_CVE_2024_3400_Apr24_1
date = "2024-04-15"
modified = "2024-04-18"
reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L2-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L2-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1261eecca520daa0619859a45d2289d2c23c73be55e1a3849d2032a38e137f4d"
score = 70
quality = 85
@@ -352226,8 +352632,8 @@ rule SIGNATURE_BASE_EXPL_Paloalto_CVE_2024_3400_Apr24_1 : CVE_2024_3400
date = "2024-04-15"
modified = "2025-03-21"
reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L27-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L27-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9ebc94a07b189a2d2dd252b5079fa494162739678fd2ca742e6877189a140da9"
score = 70
quality = 85
@@ -352252,8 +352658,8 @@ rule SIGNATURE_BASE_SUSP_LNX_Base64_Download_Exec_Apr24 : SCRIPT
date = "2024-04-18"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L48-L65"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L48-L65"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "90b7781812b4078550b0d66ba020b3bb0a8217f2de03492af98db6c619f31929"
score = 75
quality = 85
@@ -352277,8 +352683,8 @@ rule SIGNATURE_BASE_SUSP_PY_Import_Statement_Apr24_1
date = "2024-04-15"
modified = "2025-03-21"
reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L67-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L67-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d5c199d9c3e449ca282f0ca91c94ac783709299b3489f7cec38177a2f843b504"
score = 65
quality = 85
@@ -352299,8 +352705,8 @@ rule SIGNATURE_BASE_SUSP_LNX_Base64_Exec_Apr24 : SCRIPT CVE_2024_3400 FILE
date = "2024-04-18"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L81-L105"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L81-L105"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e96fb7c8faac12c1f0210689f2b3a7903b42a543b97ddff11298e5ae13cae80b"
score = 75
quality = 85
@@ -352326,8 +352732,8 @@ rule SIGNATURE_BASE_Sofacy_Malware_Strangespaces : FILE
date = "2015-12-04"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_dec15.yar#L8-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_dec15.yar#L8-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ee8bbebaa0978d038424cee3775ba312476afa014ce0d57c73d6844f758116ca"
score = 75
quality = 85
@@ -352352,8 +352758,8 @@ rule SIGNATURE_BASE_Sofacy_Malware_AZZY_Backdoor_1 : FILE
date = "2015-12-04"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_dec15.yar#L25-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_dec15.yar#L25-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb"
logic_hash = "9c99f218d856d374423cada147bc38c8319f9ebff1e43e012143fad7af992d29"
score = 75
@@ -352378,8 +352784,8 @@ rule SIGNATURE_BASE_Sofacy_AZZY_Backdoor_Implant_1 : FILE
date = "2015-12-04"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_dec15.yar#L42-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_dec15.yar#L42-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1bab1a3e0e501d3c14652ecf60870e483ed4e90e500987c35489f17a44fef26c"
logic_hash = "b6ddf1274ed78db0c7183e3cc8063c01e4d011bc2947ec05449f3fd0df2050e7"
score = 75
@@ -352406,8 +352812,8 @@ rule SIGNATURE_BASE_Sofacy_AZZY_Backdoor_Helperdll : FILE
date = "2015-12-04"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_dec15.yar#L61-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_dec15.yar#L61-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6cd30c85dd8a64ca529c6eab98a757fb326de639a39b597414d5340285ba91c6"
logic_hash = "100903551eeacf4266fc97a09949bdafe05e94698bed7cea295c8e970df22ec8"
score = 75
@@ -352432,8 +352838,8 @@ rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen1 : FILE
date = "2015-12-04"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_dec15.yar#L80-L97"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_dec15.yar#L80-L97"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
logic_hash = "1b6693fa45fed5ed001d8fb4b43427c7036d95cb36b125e7242864d000085018"
@@ -352460,8 +352866,8 @@ rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen2 : FILE
date = "2015-12-04"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_dec15.yar#L99-L116"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_dec15.yar#L99-L116"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45"
hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
hash = "b1f2d461856bb6f2760785ee1af1a33c71f84986edf7322d3e9bd974ca95f92d"
@@ -352488,8 +352894,8 @@ rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen3 : FILE
date = "2015-12-04"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_dec15.yar#L118-L143"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_dec15.yar#L118-L143"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
hash = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
logic_hash = "8e7f56013629d8b4d0c7600552590e8073deb16d5b6dced11444c2110b88f387"
@@ -352521,8 +352927,8 @@ rule SIGNATURE_BASE_Gen_Python_Pyminifier_Encoded_Payload : FILE
date = "2019-12-16"
modified = "2023-12-05"
reference = "https://github.com/liftoff/pyminifier"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_python_pyminifier_encoded_payload.yar#L1-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_python_pyminifier_encoded_payload.yar#L1-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "01df8765ea35db382d1dd67a502bf1d9647d8fe818ec31abff41c7e41c2816c0"
hash = "15d201152a9465497a0f9dd6939e48315b358702c5e2a3c506ad436bb8816da7"
hash = "ab91f76394ddf866cc0b315d862a19b57ded93be5dfc2dd0a81e6a43d0c5f301"
@@ -352553,8 +352959,8 @@ rule SIGNATURE_BASE_Shellcode_Apihashing_FIN8_1
date = "2021-03-16"
modified = "2023-12-05"
reference = "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fin8.yar#L1-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin8.yar#L1-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5d47119a588aa69b3e241618d6dbb9df6117a6751bbff39a1f95340bc26611a7"
score = 75
quality = 85
@@ -352579,8 +352985,8 @@ rule SIGNATURE_BASE_EXPL_CVE_2021_1647_Apr21_1 : CVE_2021_1647 FILE
date = "2021-05-04"
modified = "2023-12-05"
reference = "https://attackerkb.com/topics/DzXZpEuBeP/cve-2021-1647-microsoft-windows-defender-zero-day-vulnerability"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cve_2021_1647.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cve_2021_1647.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6e1e9fa0334d8f1f5d0e3a160ba65441f0656d1f1c99f8a9f1ae4b1b1bf7d788"
hash = "9eaea8a56c47524f6d6b2e2bb72d035c1aa782a4f069ef9df92a0af5c6ee612b"
hash = "db0e53c9db41d4de21f4bbf1f60d977f5d935239d3fce8b902e8ef0082796cc7"
@@ -352606,11 +353012,11 @@ rule SIGNATURE_BASE_LOG_EXPL_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_2023_29357
date = "2023-09-28"
modified = "2023-10-01"
reference = "https://twitter.com/Gi7w0rm/status/1706764212704591953?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_sharepoint_cve_2023_29357.yar#L2-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_sharepoint_cve_2023_29357.yar#L2-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "03e3a4715c8683dc8d03ad6720c1c9b40482bd0bfa3020aa1152565ec9ec929f"
score = 70
- quality = 60
+ quality = 85
tags = "CVE-2023-29357"
strings:
@@ -352628,8 +353034,8 @@ rule SIGNATURE_BASE_HKTL_EXPL_POC_PY_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_202
date = "2023-10-01"
modified = "2023-10-01"
reference = "https://github.com/Chocapikk/CVE-2023-29357"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_sharepoint_cve_2023_29357.yar#L22-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_sharepoint_cve_2023_29357.yar#L22-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fec7762ab23ba5ee9e793000d080b1d64b93157c6ead9e6939ccfb3c168dd360"
score = 80
quality = 85
@@ -352650,8 +353056,8 @@ rule SIGNATURE_BASE_HKTL_EXPL_POC_NET_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_20
date = "2023-10-01"
modified = "2023-12-05"
reference = "https://github.com/LuemmelSec/CVE-2023-29357"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_sharepoint_cve_2023_29357.yar#L37-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_sharepoint_cve_2023_29357.yar#L37-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cf621cc9c5074f531df61623b09db68478e94ae6a9a7acc26aa8d9dde79bd30c"
score = 80
quality = 85
@@ -352679,8 +353085,8 @@ rule SIGNATURE_BASE_MAL_JS_Efile_Apr23_1
date = "2023-04-06"
modified = "2023-12-05"
reference = "https://twitter.com/Ax_Sharma/status/1643178696084271104/photo/1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_efile_apr23.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_efile_apr23.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6d94162e5719b92d9df349e7d48cd70e218998b0e120870a435a8073fa49c532"
score = 75
quality = 85
@@ -352702,8 +353108,8 @@ rule SIGNATURE_BASE_MAL_PHP_Efile_Apr23_1
date = "2023-04-06"
modified = "2023-12-05"
reference = "https://twitter.com/malwrhunterteam/status/1642988428080865281?s=12&t=C0_T_re0wRP_NfKa27Xw9w"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_efile_apr23.yar#L18-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_efile_apr23.yar#L18-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ec4ac3f5c19f506a70eacb5fe3173cc06bf20567bbc9a96f3b269910382e5fa2"
score = 75
quality = 85
@@ -352726,8 +353132,8 @@ rule SIGNATURE_BASE_APT_Sidewinder_NET_Loader_Aug_2020_1_1 : FILE
date = "2020-08-24"
modified = "2023-12-05"
reference = "https://twitter.com/ShadowChasing1/status/1297902086747598852"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sidewinder.yar#L4-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sidewinder.yar#L4-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4a0947dd9148b3d5922651a6221afc510afcb0dfa69d08ee69429c4c75d4c8b4"
logic_hash = "5ee7029143c589f26e6c325e163bfac85507c950f09778bd51ec2bdf4d4263fa"
score = 75
@@ -352754,8 +353160,8 @@ rule SIGNATURE_BASE_APT_MAL_Sidewinder_Implant : FILE
date = "2020-08-25"
modified = "2023-12-05"
reference = "https://cybersecurity.att.com/blogs/labs-research/a-global-perspective-of-the-sidewinder-apt"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sidewinder.yar#L24-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sidewinder.yar#L24-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c568238dcf1e30d55a398579a4704ddb8196b685"
logic_hash = "bfad86dbdc04463e7e4cc126fd05fc9107617a7ea1bd3f283c0e0170862bd59b"
score = 75
@@ -352791,8 +353197,8 @@ rule SIGNATURE_BASE_ROKRAT_Malware : FILE
date = "2017-04-03"
modified = "2021-09-14"
reference = "http://blog.talosintelligence.com/2017/04/introducing-rokrat.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rokrat.yar#L8-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rokrat.yar#L8-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00"
hash = "cd166565ce09ef410c5bba40bad0b49441af6cfb48772e7e4a9de3d646b4851c"
logic_hash = "8b8fa3f97ce13e501cc25b89e2cfdaf785f1cb9f57a9dbd3461596b1bc6178c2"
@@ -352826,8 +353232,8 @@ rule SIGNATURE_BASE_ROKRAT_Dropper_Nov17 : FILE
date = "2017-11-28"
modified = "2023-12-05"
reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rokrat.yar#L48-L61"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rokrat.yar#L48-L61"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eb6d25e08b2b32a736b57f8df22db6d03dc82f16da554f4e8bb67120eacb1d14"
hash = "a29b07a6fe5d7ce3147dd7ef1d7d18df16e347f37282c43139d53cce25ae7037"
logic_hash = "4a444342a4fb4d10aaf8efb5c26954847ce1089c9cec37d1ab3b03e0ac566c6c"
@@ -352848,8 +353254,8 @@ rule SIGNATURE_BASE_Freeenki_Infostealer_Nov17 : FILE
date = "2017-11-28"
modified = "2023-01-06"
reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rokrat.yar#L63-L92"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rokrat.yar#L63-L92"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
logic_hash = "e823ef5506b2fdf30a6ff9bdf6eee552b767b66a6c007a30618fc212d598b540"
score = 75
@@ -352882,8 +353288,8 @@ rule SIGNATURE_BASE_Freeenki_Infostealer_Nov17_Export_Sig_Testing : FILE
date = "2017-11-28"
modified = "2023-12-05"
reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rokrat.yar#L94-L106"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rokrat.yar#L94-L106"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
logic_hash = "2c6d8784aa976501a77441c4e705b7fdc9654277e8cd3f6d966967fb2e1cd724"
score = 50
@@ -352903,8 +353309,8 @@ rule SIGNATURE_BASE_ROKRAT_Nov17_1 : FILE
date = "2017-11-28"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_rokrat.yar#L110-L127"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_rokrat.yar#L110-L127"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "12641d417408ef32292204f620efa3d1347238fa1c6f63b2b6f09a6c660e9e24"
score = 75
quality = 85
@@ -352931,8 +353337,8 @@ rule SIGNATURE_BASE_MAL_Nitol_Malware_Jan19_1 : FILE
date = "2019-01-14"
modified = "2023-12-05"
reference = "https://twitter.com/shotgunner101/status/1084602413691166721"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_mal_nitol.yar#L4-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_mal_nitol.yar#L4-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e"
logic_hash = "4607496beb37500637c1e5509b42c0fe6f9e79548c85603819dc966fa2cc2be0"
score = 75
@@ -352962,8 +353368,8 @@ rule SIGNATURE_BASE_Shimrat
date = "2015-11-20"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_mofang.yar#L1-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_mofang.yar#L1-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0dd19e6a65b06bd5846ec224f01c3feea066540317223d1991154b2305882b20"
score = 75
quality = 85
@@ -352996,8 +353402,8 @@ rule SIGNATURE_BASE_Shimratreporter
date = "2015-11-20"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_mofang.yar#L28-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_mofang.yar#L28-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "931d65628e5f0b7c63fe270b0a6cd3890f41a4ee7e253ce056b37f2d55542258"
score = 75
quality = 85
@@ -353029,8 +353435,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Gentlemen_Jun26_1 : FILE
date = "2026-06-16"
modified = "2026-06-16"
reference = "https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_ransom_gentlemen.yar#L2-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_ransom_gentlemen.yar#L2-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67"
hash = "f918535f974591ef031bd0f30a8171e3da27a6754e6426a8ba095f83195661c8"
logic_hash = "0821108fe45c60138cdfb5f79278b7f15c650dad7d94ba8abc559439a49f2c51"
@@ -353058,8 +353464,8 @@ rule SIGNATURE_BASE_Lightftp_Fftp_X86_64 : FILE
date = "2015-05-14"
modified = "2023-12-05"
reference = "https://github.com/hfiref0x/LightFTP"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/pup_lightftp.yar#L2-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/pup_lightftp.yar#L2-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "989525f85abef05581ccab673e81df3f5d50be36"
hash = "5884aeca33429830b39eba6d3ddb00680037faf4"
logic_hash = "f29a98a4014fc6c026aef4054bc2bee7bde2e9ad7f26f2368fdf0949f50847bb"
@@ -353087,8 +353493,8 @@ rule SIGNATURE_BASE_Lightftp_Config : FILE
date = "2015-05-14"
modified = "2023-12-05"
reference = "https://github.com/hfiref0x/LightFTP"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/pup_lightftp.yar#L23-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/pup_lightftp.yar#L23-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ce9821213538d39775af4a48550eefa3908323c5"
logic_hash = "1e8c06dac9a5910816703ed15bef83116d9e2d9e612fda69697170ed98ee5f60"
score = 75
@@ -353116,8 +353522,8 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1 : FILE
date = "2020-04-24"
modified = "2023-12-05"
reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_penquin.yar#L2-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_penquin.yar#L2-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
hash = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
hash = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
@@ -353156,8 +353562,8 @@ rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1_Opcode : FILE
date = "2020-04-24"
modified = "2023-12-05"
reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_turla_penquin.yar#L35-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_turla_penquin.yar#L35-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
hash = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
hash = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
@@ -353195,13 +353601,13 @@ rule SIGNATURE_BASE_APT_Lazarus_Dropper_Jun18_1 : FILE
date = "2018-06-01"
modified = "2023-12-05"
reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_jun18.yar#L13-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_jun18.yar#L13-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "086a50476f5ceee4b10871c1a8b0a794e96a337966382248a8289598b732bd47"
hash = "9f2d4fd79d3c68270102c4c11f3e968c10610a2106cbf1298827f8efccdd70a9"
logic_hash = "868297209177471f29c9653747d3205f55a14b74a5da64562b20ebeadb14b1cf"
score = 60
- quality = 40
+ quality = 65
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
@@ -353222,8 +353628,8 @@ rule SIGNATURE_BASE_APT_Lazarus_RAT_Jun18_1 : FILE
date = "2018-06-01"
modified = "2023-12-05"
reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_jun18.yar#L34-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_jun18.yar#L34-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c10363059c57c52501c01f85e3bb43533ccc639f0ea57f43bae5736a8e7a9bc8"
hash = "e98991cdd9ddd30adf490673c67a4f8241993f26810da09b52d8748c6160a292"
logic_hash = "7260f766ffd1122319ca69a6c87b0baa98d5727929f2e063a5b2edb05a44d827"
@@ -353259,8 +353665,8 @@ rule SIGNATURE_BASE_APT_Lazarus_RAT_Jun18_2 : FILE
date = "2018-06-01"
modified = "2023-12-05"
reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_jun18.yar#L68-L83"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_jun18.yar#L68-L83"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e6096fb512a6d32a693491f24e67d772f7103805ad407dc37065cebd1962a547"
logic_hash = "b22b8386791e86f787efc40a394bbabdb4a009fc2d1a7b87aaf5039fc977a5bd"
score = 75
@@ -353285,8 +353691,8 @@ rule SIGNATURE_BASE_EXT_SUSP_OBFUSC_Macos_Roothelper_Obfuscated : FILE
date = "2021-06-07"
modified = "2023-12-05"
reference = "https://twitter.com/imp0rtp3/status/1401912205621202944"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_hktl_roothelper.yar#L2-L55"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_hktl_roothelper.yar#L2-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2121de0409f3f8e4c4e079944efb605776e0475cadc25607eb888cc6461ecaf3"
score = 65
quality = 83
@@ -353327,8 +353733,8 @@ rule SIGNATURE_BASE_Payload_Exe2Hex
date = "2016-01-15"
modified = "2023-12-05"
reference = "https://github.com/g0tmi1k/exe2hex"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/generic_exe2hex_payload.yar#L8-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/generic_exe2hex_payload.yar#L8-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "91b738f0174a267bbc900d59abcb504d2ae0bac8c287c3b7d1ebfc57374a7ee7"
score = 70
quality = 85
@@ -353357,8 +353763,8 @@ rule SIGNATURE_BASE_Mirai_Botnet_Malware : FILE
date = "2016-10-04"
modified = "2023-01-27"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_mirai.yar#L10-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_mirai.yar#L10-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c"
hash = "05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c"
hash = "20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4"
@@ -353402,8 +353808,8 @@ rule SIGNATURE_BASE_Mirai_1_May17 : FILE
date = "2017-05-12"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_mirai.yar#L62-L78"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_mirai.yar#L62-L78"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "172d050cf0d4e4f5407469998857b51261c80209d9fa5a2f5f037f8ca14e85d2"
hash = "9ba8def84a0bf14f682b3751b8f7a453da2cea47099734a72859028155b2d39c"
hash = "a393449a5f19109160384b13d60bb40601af2ef5f08839b5223f020f1f83e990"
@@ -353429,8 +353835,8 @@ rule SIGNATURE_BASE_Miari_2_May17 : FILE
date = "2017-05-12"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_mirai.yar#L80-L99"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_mirai.yar#L80-L99"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9ba8def84a0bf14f682b3751b8f7a453da2cea47099734a72859028155b2d39c"
hash = "a393449a5f19109160384b13d60bb40601af2ef5f08839b5223f020f1f83e990"
logic_hash = "138a7d0c5508f0168f09329e97f00d0aacef17297558338cd88a9dc3ddddfee3"
@@ -353459,8 +353865,8 @@ rule SIGNATURE_BASE_MAL_ELF_LNX_Mirai_Oct10_1 : FILE
date = "2018-10-27"
modified = "2023-01-27"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_mirai.yar#L101-L122"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_mirai.yar#L101-L122"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe"
logic_hash = "d16ed12522b310fccab027355281a206f5087d555f0d1fef4e7746d01d085613"
score = 75
@@ -353486,8 +353892,8 @@ rule SIGNATURE_BASE_MAL_ELF_LNX_Mirai_Oct10_2 : FILE
date = "2018-10-27"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_mirai.yar#L124-L138"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_mirai.yar#L124-L138"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9"
logic_hash = "47d20bdf64c18c925dc1391b022278f913b7fbce13988a7b5de2e9d135c5a265"
score = 75
@@ -353511,8 +353917,8 @@ rule SIGNATURE_BASE_MAL_Mirai_Nov19_1 : FILE
date = "2019-11-13"
modified = "2023-12-05"
reference = "https://twitter.com/bad_packets/status/1194049104533282816"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_mirai.yar#L140-L157"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_mirai.yar#L140-L157"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bbb83da15d4dabd395996ed120435e276a6ddfbadafb9a7f096597c869c6c739"
hash = "fadbbe439f80cc33da0222f01973f27cce9f5ab0709f1bfbf1a954ceac5a579b"
logic_hash = "e1202a9cd445c590c359a9c93e635292f8cf7f09291f4d8504ad9ce6679f6a47"
@@ -353539,8 +353945,8 @@ rule SIGNATURE_BASE_MAL_ARM_LNX_Mirai_Mar13_2022 : FILE
date = "2022-03-16"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_mirai.yar#L159-L181"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_mirai.yar#L159-L181"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68"
logic_hash = "a44a6174a198a658c8a5e2da50192da20bae7f8ed4e4f212c9eebb29fa4b0dd0"
score = 75
@@ -353573,8 +353979,8 @@ rule SIGNATURE_BASE_EXT_NK_GOLDBACKDOOR_Inital_Shellcode
date = "2022-04-21"
modified = "2023-12-05"
reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_goldbackdoor.yar#L2-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_goldbackdoor.yar#L2-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4df97181037a580098dbe34d3b6ceab5c7b83932f1831c36ee99876a8f1524f9"
score = 80
quality = 85
@@ -353600,8 +354006,8 @@ rule SIGNATURE_BASE_EXT_NK_GOLDBACKDOOR_Injected_Shellcode
date = "2022-04-21"
modified = "2023-12-05"
reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_goldbackdoor.yar#L22-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_goldbackdoor.yar#L22-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b45f408c0f342591e66ef0dfcfc1c09f8558c5e8f4bd7f824b30f00d531c7511"
score = 80
quality = 85
@@ -353630,8 +354036,8 @@ rule SIGNATURE_BASE_EXT_NK_GOLDBACKDOOR_Generic_Shellcode
date = "2022-04-21"
modified = "2023-12-05"
reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_goldbackdoor.yar#L44-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_goldbackdoor.yar#L44-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e046a70b1dee020ba73d960a9d91daaccd0b5c262965c8647f608c5c83a28257"
score = 75
quality = 85
@@ -353654,8 +354060,8 @@ rule SIGNATURE_BASE_Cheshirecat_Sample2 : FILE
date = "2015-08-08"
modified = "2023-12-05"
reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cheshirecat.yar#L11-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cheshirecat.yar#L11-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
logic_hash = "4dd299cfe36545dba5ccac22d2eedc405f548fe5f976514d1cfa8238b472782c"
score = 70
@@ -353683,8 +354089,8 @@ rule SIGNATURE_BASE_Cheshirecat_Gen1 : FILE
date = "2015-08-08"
modified = "2023-12-05"
reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cheshirecat.yar#L35-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cheshirecat.yar#L35-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
hash = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
hash = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
@@ -353729,8 +354135,8 @@ rule SIGNATURE_BASE_Cheshirecat_Gen2 : FILE
date = "2015-08-08"
modified = "2023-12-05"
reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cheshirecat.yar#L76-L108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cheshirecat.yar#L76-L108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
hash = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
hash = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
@@ -353769,8 +354175,8 @@ rule SIGNATURE_BASE_Snaketurla_Malware_May17_1 : FILE
date = "2017-05-04"
modified = "2023-01-06"
reference = "https://goo.gl/QaOh4V"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_snaketurla_osx.yar#L11-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_snaketurla_osx.yar#L11-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5b7792a16c6b7978fca389882c6aeeb2c792352076bf6a064e7b8b90eace8060"
logic_hash = "12b18c9e03f1a471541de2fb3ecc6b90a13910ca299a9b7d2bad9dd11f881506"
score = 75
@@ -353793,8 +354199,8 @@ rule SIGNATURE_BASE_Snaketurla_Malware_May17_2 : FILE
date = "2017-05-04"
modified = "2023-12-05"
reference = "https://goo.gl/QaOh4V"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_snaketurla_osx.yar#L27-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_snaketurla_osx.yar#L27-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b8ee4556dc09b28826359b98343a4e00680971a6f8c6602747bd5d723d26eaea"
logic_hash = "35bd8650afbc515ecd1cef393fd75f9b77a1e31111612227f0f4557fe8b312a7"
score = 75
@@ -353819,8 +354225,8 @@ rule SIGNATURE_BASE_Snaketurla_Malware_May17_4 : FILE
date = "2017-05-04"
modified = "2023-12-05"
reference = "https://goo.gl/QaOh4V"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_snaketurla_osx.yar#L44-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_snaketurla_osx.yar#L44-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d5ea79632a1a67abbf9fb1c2813b899c90a5fb9442966ed4f530e92715087ee2"
logic_hash = "7b6aac2313ea7dae572114e92ad0b5437c5be2542853de3b184bef780faee68b"
score = 75
@@ -353843,8 +354249,8 @@ rule SIGNATURE_BASE_Snaketurla_Installd_SH : FILE
date = "2017-05-04"
modified = "2023-12-05"
reference = "https://goo.gl/QaOh4V"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_snaketurla_osx.yar#L59-L72"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_snaketurla_osx.yar#L59-L72"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5b16107434951ddb212996909d53dfbcdae74ed13df6690ce3f6c74258ab4670"
score = 75
quality = 85
@@ -353867,8 +354273,8 @@ rule SIGNATURE_BASE_Snaketurla_Install_SH : FILE
date = "2017-05-04"
modified = "2023-12-05"
reference = "https://goo.gl/QaOh4V"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_snaketurla_osx.yar#L74-L87"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_snaketurla_osx.yar#L74-L87"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "019d20ca6632759cf01962d336c22831edc64b6927d8b27d026b76eb118fce02"
score = 75
quality = 85
@@ -353891,8 +354297,8 @@ rule SIGNATURE_BASE_Tools_Cmd : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L10-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L10-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "02e37b95ef670336dc95331ec73dbb5a86f3ba2b"
logic_hash = "fe1a157d53bd9a48848f2711844c5e12356652ca01c84c19429c55bbb12ea488"
score = 75
@@ -353924,8 +354330,8 @@ rule SIGNATURE_BASE_Trigger_Drop : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L35-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L35-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "165dd2d82bf87285c8a53ad1ede6d61a90837ba4"
logic_hash = "fc998ea5c2a446278823e4336ddc6a22741f82c43fbdcd95b3d12ee6a27b1dd7"
score = 75
@@ -353951,8 +354357,8 @@ rule SIGNATURE_BASE_Injectionparameters : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L53-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L53-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4f11aa5b3660c45e527606ee33de001f4994e1ea"
logic_hash = "6bb786256f7154013408323eeb597f91c609a2a26f5ae9e6d61e16bd9c16a577"
score = 75
@@ -353976,8 +354382,8 @@ rule SIGNATURE_BASE_Users_List : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L69-L84"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L69-L84"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6fba1a1a607198ed232405ccbebf9543037a63ef"
logic_hash = "debd8e1d882cbbe6e720b86bec3ff3c78393cb225b3f0f9c7725cfced6582e71"
score = 75
@@ -354002,8 +354408,8 @@ rule SIGNATURE_BASE_Trigger_Modify : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L86-L103"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L86-L103"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c93cd7a6c3f962381e9bf2b511db9b1639a22de0"
logic_hash = "6ea0221af9e9a29d3280a01eec69e31e79c358e664d286f8c80259f5e826876c"
score = 75
@@ -354030,8 +354436,8 @@ rule SIGNATURE_BASE_Customize : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L105-L121"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L105-L121"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "db556879dff9a0101a7a26260a5d0dc471242af2"
logic_hash = "f4e0a7342a01411ae060c9d995072518f2e3299af1b0d396bb319eeec42c1519"
score = 75
@@ -354057,8 +354463,8 @@ rule SIGNATURE_BASE_Oracle_Data
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L123-L138"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L123-L138"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6cf070017be117eace4752650ba6cf96d67d2106"
logic_hash = "1ab9b6c4349dd891103a24a77c93c2abb784d3ed616523f3aaec68b05082983e"
score = 75
@@ -354083,8 +354489,8 @@ rule SIGNATURE_BASE_Reduhservers_Reduh : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L140-L155"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L140-L155"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "377886490a86290de53d696864e41d6a547223b0"
logic_hash = "dcb1515da696566d01ec64029a34438a56d2df480b9cd2ea586f71ffe3324c1a"
score = 75
@@ -354110,8 +354516,8 @@ rule SIGNATURE_BASE_Item_Old : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L157-L172"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L157-L172"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "daae358bde97e534bc7f2b0134775b47ef57e1da"
logic_hash = "181e46408050490dccc4f321bd1072da0436d920e16cc4711b16425eb5bd73ed"
score = 75
@@ -354136,8 +354542,8 @@ rule SIGNATURE_BASE_Tools_2014 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L174-L189"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L174-L189"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "74518faf08637c53095697071db09d34dbe8d676"
logic_hash = "caa365cc1a641b7dcd5d2082240d981e66caf6da1379ee109a0bb1f651d1f00f"
score = 75
@@ -354162,8 +354568,8 @@ rule SIGNATURE_BASE_Reduhservers_Reduh_2 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L191-L206"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L191-L206"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "512d0a3e7bb7056338ad0167f485a8a6fa1532a3"
logic_hash = "954115da374b6d72c35244673799be6e8bae5288f53509dea04e3ae3c489af12"
score = 75
@@ -354188,8 +354594,8 @@ rule SIGNATURE_BASE_Customize_2 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L208-L222"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L208-L222"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "37cd17543e14109d3785093e150652032a85d734"
logic_hash = "aa0940a21eea6ba50a93dd36a8f914f636fdba0685048fc67e16dd68c1c2794e"
score = 75
@@ -354213,8 +354619,8 @@ rule SIGNATURE_BASE_Chinachopper_One : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L224-L237"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L224-L237"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6cd28163be831a58223820e7abe43d5eacb14109"
logic_hash = "f9a6e4b8556eb3f1e1cbe0bc4eb225b9564ac59aae4a97f184806c6bec95578d"
score = 75
@@ -354237,8 +354643,8 @@ rule SIGNATURE_BASE_CN_Tools_Old : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L239-L255"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L239-L255"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f8a007758fda8aa1c0af3c43f3d7e3186a9ff307"
logic_hash = "3f0ac357e9a9fb4ee937b53145b33ba1041310d979cbc3feb0a4caf026b9b730"
score = 75
@@ -354264,8 +354670,8 @@ rule SIGNATURE_BASE_Item_301 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L257-L273"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L257-L273"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "15636f0e7dc062437608c1f22b1d39fa15ab2136"
logic_hash = "623e235ff3eb0922fe8aee732144a15bcc0c580229654ae988353176f488b085"
score = 75
@@ -354291,8 +354697,8 @@ rule SIGNATURE_BASE_CN_Tools_Item : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L275-L291"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L275-L291"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a584db17ad93f88e56fd14090fae388558be08e4"
logic_hash = "1e927fd093aa11ad525f3f64d657f314520669b4237eac8f87d0be53cd848044"
score = 75
@@ -354318,8 +354724,8 @@ rule SIGNATURE_BASE_F3_Diy : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L293-L307"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L293-L307"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f39c2f64abe5e86d8d36dbb7b1921c7eab63bec9"
logic_hash = "37d6bc61d790ff30c98ded08ff875431fda525cd3ac10b4b1ba3f8f42167ed8c"
score = 75
@@ -354343,8 +354749,8 @@ rule SIGNATURE_BASE_Chinachopper_Temp : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L309-L325"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L309-L325"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b0561ea52331c794977d69704345717b4eb0a2a7"
logic_hash = "3669dfa10867970456f6638035a87d448e2b728387fbd07b59ffd981a1ab6200"
score = 75
@@ -354370,8 +354776,8 @@ rule SIGNATURE_BASE_Tools_2015 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L327-L344"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L327-L344"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8fc67359567b78cadf5d5c91a623de1c1d2ab689"
logic_hash = "2b93ef42c277fd8415cf89bf1bef3e841c56a2b4aa1507d99b84cd8adc9a0644"
score = 75
@@ -354398,8 +354804,8 @@ rule SIGNATURE_BASE_Chinachopper_Temp_2 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L346-L359"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L346-L359"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "604a4c07161ce1cd54aed5566e5720161b59deee"
logic_hash = "1b6d840797afcdbf7c72836557dbd486780c760471e79133810346c301cca80b"
score = 75
@@ -354422,8 +354828,8 @@ rule SIGNATURE_BASE_Templatr : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L361-L374"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L361-L374"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "759df470103d36a12c7d8cf4883b0c58fe98156b"
logic_hash = "80d207ee47c0c602ddd281e0e187b83cdb4f1385f4b46ad2a4f5630b8f9e96a1"
score = 75
@@ -354446,8 +354852,8 @@ rule SIGNATURE_BASE_Reduhservers_Reduh_3 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L376-L392"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L376-L392"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0744f64c24bf4c0bef54651f7c88a63e452b3b2d"
logic_hash = "5a3bc023e0e8a5ccc8ee8e1b5e7ee0fca64e3f92b72d0aad15b25c82a23da487"
score = 75
@@ -354473,8 +354879,8 @@ rule SIGNATURE_BASE_Chinachopper_Temp_3 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L394-L408"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L394-L408"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
logic_hash = "6a0d7817607362f325957e30cace24d32635b7e0411e161588ee573118f91b6a"
score = 75
@@ -354498,8 +354904,8 @@ rule SIGNATURE_BASE_Shell_Asp : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L410-L425"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L410-L425"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5e0bc914ac287aa1418f6554ddbe0ce25f2b5f20"
logic_hash = "47c5c242713446471d5da4d9245b99561c26ad7fa016059076a6f0acab542c3c"
score = 75
@@ -354524,8 +354930,8 @@ rule SIGNATURE_BASE_Txt_Aspxtag : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L428-L443"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L428-L443"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "42cb272c02dbd49856816d903833d423d3759948"
logic_hash = "6ffeee18945cab96673e4b9efc143017d168be12b794fa26aa4a304f15ae8e13"
score = 75
@@ -354550,8 +354956,8 @@ rule SIGNATURE_BASE_Txt_Php : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L445-L461"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L445-L461"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eaa1af4b898f44fc954b485d33ce1d92790858d0"
logic_hash = "ace26e7c0dca285febf6b9192cbe59cc7e55e80f2f4e1a99aba25afcbeadeec1"
score = 75
@@ -354577,8 +354983,8 @@ rule SIGNATURE_BASE_Txt_Aspx1 : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L463-L477"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L463-L477"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
logic_hash = "20bdadd6c8b61ab14f6280f55a90f541bf65c33675f979ebe489cc3967438e15"
score = 75
@@ -354602,8 +355008,8 @@ rule SIGNATURE_BASE_Txt_Shell : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L479-L496"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L479-L496"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8342b634636ef8b3235db0600a63cc0ce1c06b62"
logic_hash = "020e9e6ef776a9d69939fa3dec771dc516b0184086738bab439063acca89bd76"
score = 75
@@ -354630,8 +355036,8 @@ rule SIGNATURE_BASE_Txt_Asp : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L498-L512"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L498-L512"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a63549f749f4d9d0861825764e042e299e06a705"
logic_hash = "9eab239310fbebe8c88cbf8d0ee4123b8f3e2ebe601949e1e984e9cfde9869e7"
score = 75
@@ -354655,8 +355061,8 @@ rule SIGNATURE_BASE_Txt_Asp1 : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L514-L530"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L514-L530"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "95934d05f0884e09911ea9905c74690ace1ef653"
logic_hash = "77a4409b852d24228b0e1701f1ccc2abe3930c2c7240a43796b23042e706d9bf"
score = 75
@@ -354682,8 +355088,8 @@ rule SIGNATURE_BASE_Txt_Php_2 : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L532-L552"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L532-L552"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a7d5fcbd39071e0915c4ad914d31e00c7127bcfc"
logic_hash = "c08f62c3d468c2ebacd10fff6aa0c63bd303d627d487c070a9d22419bf6906cd"
score = 75
@@ -354713,8 +355119,8 @@ rule SIGNATURE_BASE_Txt_Ftp : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L554-L573"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L554-L573"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3495e6bcb5484e678ce4bae0bd1a420b7eb6ad1d"
logic_hash = "02eae9b19274ab7b816d7c336017af8f0fdd5273664eb37be92be12661f3ef1f"
score = 75
@@ -354743,8 +355149,8 @@ rule SIGNATURE_BASE_Txt_Lcx : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L575-L592"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L575-L592"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ddb3b6a5c5c22692de539ccb796ede214862befe"
logic_hash = "48121824d3173b77b54b52dc60d3422a904ada46a6ebb20bb585086911cd8360"
score = 75
@@ -354771,8 +355177,8 @@ rule SIGNATURE_BASE_Txt_Jspcmd : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L594-L608"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L594-L608"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1d4e789031b15adde89a4628afc759859e53e353"
logic_hash = "d2cbf753fbd9e261234e6beb6f79aecb407a368704ae09d907d128d04c242053"
score = 75
@@ -354796,8 +355202,8 @@ rule SIGNATURE_BASE_Txt_Jsp : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L610-L626"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L610-L626"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "74518faf08637c53095697071db09d34dbe8d676"
logic_hash = "039b145031cf1127cb1b2aeda063d578d9eb151559232d7e6049965111df1e28"
score = 75
@@ -354823,8 +355229,8 @@ rule SIGNATURE_BASE_Txt_Aspxlcx : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L628-L644"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L628-L644"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "453dd3160db17d0d762e032818a5a10baf234e03"
logic_hash = "a6e41e6882e74b0dd55ec4afbf6f8708e28267657e304c97d1304266fe1fbc93"
score = 75
@@ -354850,8 +355256,8 @@ rule SIGNATURE_BASE_Txt_Xiao : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L646-L663"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L646-L663"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b3b98fb57f5f5ccdc42e746e32950834807903b7"
logic_hash = "e99c307482148e4d0eb660281fa70f2dcece200ac8aed032bbef41e421d2a155"
score = 75
@@ -354878,8 +355284,8 @@ rule SIGNATURE_BASE_Txt_Aspx : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L665-L681"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L665-L681"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ce24e277746c317d887139a0d71dd250bfb0ed58"
logic_hash = "43c386bfa88db77801b0494d6a5e4406688f957ffedeb4d2ecdd244549dec708"
score = 75
@@ -354905,8 +355311,8 @@ rule SIGNATURE_BASE_Txt_Sql : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L683-L699"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L683-L699"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f7813f1dfa4eec9a90886c80b88aa38e2adc25d5"
logic_hash = "0712b6736d8bdc1f19b3494dc3aab9e9a04dde167b5f843e319755cd311e29bd"
score = 75
@@ -354932,8 +355338,8 @@ rule SIGNATURE_BASE_Txt_Hello : FILE
date = "2015-06-14"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_webshells.yar#L701-L717"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_webshells.yar#L701-L717"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "697a9ebcea6a22a16ce1a51437fcb4e1a1d7f079"
logic_hash = "823a0a74b07c8f4821247b3cf0450069a9888d44ccd87144330da88594f260c0"
score = 75
@@ -354959,8 +355365,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_SH_Esxi_Attacks_Feb23_1 : FILE
date = "2023-02-04"
modified = "2023-12-05"
reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_ransom_esxi_attacks_feb23.yar#L6-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_ransom_esxi_attacks_feb23.yar#L6-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459"
logic_hash = "1143ee36603f604874432ee280314a9f62ffe64e58ec5cd4eb114b7b175b365a"
score = 85
@@ -354986,8 +355392,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_ELF_Esxi_Attacks_Feb23_1 : FILE
date = "2023-02-04"
modified = "2023-12-05"
reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_ransom_esxi_attacks_feb23.yar#L30-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_ransom_esxi_attacks_feb23.yar#L30-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66"
logic_hash = "27ff018574323c10821993c30cf74de15121caa92a308fbcae4eceae954e63b6"
score = 85
@@ -355016,8 +355422,8 @@ rule SIGNATURE_BASE_APT_PY_Esxi_Backdoor_Dec22 : FILE
date = "2022-12-14"
modified = "2023-12-05"
reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_ransom_esxi_attacks_feb23.yar#L58-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_ransom_esxi_attacks_feb23.yar#L58-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "86b628f007720aa706c30d91e845d867ed481d1e99bcc9315c84a4e0b7b1b2a6"
score = 85
quality = 85
@@ -355039,8 +355445,8 @@ rule SIGNATURE_BASE_APT_SH_Esxi_Backdoor_Dec22 : FILE
date = "2022-12-14"
modified = "2023-12-05"
reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_ransom_esxi_attacks_feb23.yar#L73-L87"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_ransom_esxi_attacks_feb23.yar#L73-L87"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "155a90a6c55b99285555634d91a66fca9c7e7297f05314fa4d6ce1d84257ee11"
score = 75
quality = 85
@@ -355063,8 +355469,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_SH_Esxi_Attacks_Feb23_2 : FILE
date = "2023-02-06"
modified = "2023-12-05"
reference = "https://dev.to/xakrume/esxiargs-encryption-malware-launches-massive-attacks-against-vmware-esxi-servers-pfe"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_ransom_esxi_attacks_feb23.yar#L89-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_ransom_esxi_attacks_feb23.yar#L89-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3f240784873a0239cbf61f7f420fdd72b8992d5943ffc3d4dcad43c836569f4d"
score = 85
quality = 85
@@ -355085,8 +355491,8 @@ rule SIGNATURE_BASE_SUSP_Esxiargs_Endpoint_Conf_Aug23 : FILE
date = "2023-08-04"
modified = "2023-12-05"
reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-47"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_ransom_esxi_attacks_feb23.yar#L103-L120"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_ransom_esxi_attacks_feb23.yar#L103-L120"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "794d460eec0e2f0b48e6ced94b125a1e48acde6be6281866e0b4a2ae6c2d3b51"
score = 75
quality = 85
@@ -355111,8 +355517,8 @@ rule SIGNATURE_BASE_APT_PY_Bluelight_Loader : INKYSQUID
date = "2021-06-22"
modified = "2023-12-05"
reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_inkysquid.yar#L39-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_inkysquid.yar#L39-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "80269413be6ad51b8b19631b2f5559c9572842e789bbce031babe6e879d2e120"
logic_hash = "e7e18a6d648b1383706439ba923335ac4396f6b5d2a3dc8f30f63ded7df29eda"
score = 75
@@ -355139,8 +355545,8 @@ rule SIGNATURE_BASE_APT_MAL_Win_Decrok : INKYSQUID
date = "2021-06-23"
modified = "2023-12-05"
reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_inkysquid.yar#L61-L82"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_inkysquid.yar#L61-L82"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6a452d088d60113f623b852f33f8f9acf0d4197af29781f889613fed38f57855"
logic_hash = "47fa03e95ac17ba7195858cd63b1769e5d56ab8a5edf872b345989b767050b87"
score = 75
@@ -355166,8 +355572,8 @@ rule SIGNATURE_BASE_APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine : APT
date = "2021-05-20"
modified = "2023-12-05"
reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_inkysquid.yar#L104-L133"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_inkysquid.yar#L104-L133"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a97041a06729d639c22a4ee272cc96555345b692fc0da8b62e898891d02b23ea"
score = 75
quality = 85
@@ -355191,8 +355597,8 @@ rule SIGNATURE_BASE_APT_NK_Scarcruft_Evolved_ROKRAT : APT FILE
date = "2021-07-09"
modified = "2023-12-05"
reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_inkysquid.yar#L135-L179"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_inkysquid.yar#L135-L179"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "01a2f410687c943d6c6e421ffacfe42f9e7b6afb82e43ba03a8d525e075a3a3c"
score = 75
quality = 85
@@ -355229,8 +355635,8 @@ rule SIGNATURE_BASE_Win7Elevatev2 : FILE
date = "2015-05-14"
modified = "2023-12-05"
reference = "http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_uac_elevators.yar#L2-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_uac_elevators.yar#L2-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4f53ff6a04e46eda92b403faf42219a545c06c29"
hash = "808d04c187a524db402c5b2be17ce799d2654bd1"
logic_hash = "2f5859388c6074f1a75f0c40387f30ffa50d6b87f20f518fd1af7398c95cd650"
@@ -355269,8 +355675,8 @@ rule SIGNATURE_BASE_UACME_Akagi
date = "2015-05-14"
modified = "2023-12-05"
reference = "https://github.com/hfiref0x/UACME"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_uac_elevators.yar#L35-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_uac_elevators.yar#L35-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "edd2138bbd9e76c343051c6dc898054607f2040a"
hash = "e3a919ccc2e759e618208ededa8a543954d49f8a"
logic_hash = "e10f39837a53dcc6d301d21a69fca965aeca0a07cfc832a9a0142b08d280f955"
@@ -355306,8 +355712,8 @@ rule SIGNATURE_BASE_Uacelevator : FILE
date = "2015-05-14"
modified = "2023-12-05"
reference = "https://github.com/MalwareTech/UACElevator"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_uac_elevators.yar#L66-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_uac_elevators.yar#L66-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fd29d5a72d7a85b7e9565ed92b4d7a3884defba6"
logic_hash = "8215746b2c84a5500221580969fb2eac8ee11cbb5af4ba5bf2dbd1def65b8745"
score = 75
@@ -355339,8 +355745,8 @@ rule SIGNATURE_BASE_S4U : FILE
date = "2015-06-05"
modified = "2023-12-05"
reference = "https://github.com/aurel26/s-4-u-for-windows"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_uac_elevators.yar#L92-L139"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_uac_elevators.yar#L92-L139"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cfc18f3d5306df208461459a8e667d89ce44ed77"
logic_hash = "b1882710f2514fb44ff01631636c0a66beef620c8bea644ebe05cd5385a9e494"
score = 50
@@ -355390,8 +355796,8 @@ rule SIGNATURE_BASE_UACME_Akagi_2 : FILE
date = "2017-02-03"
modified = "2023-12-05"
reference = "https://github.com/hfiref0x/UACME"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_uac_elevators.yar#L151-L174"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_uac_elevators.yar#L151-L174"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "caf744d38820accb48a6e50216e547ed2bb3979604416dbcfcc991ce5e18f4ca"
hash = "609e9b15114e54ffc40c05a8980cc90f436a4a77c69f3e32fe391c0b130ff1c5"
logic_hash = "f79a82d466f51c86a0e6fb89688708c35dbcc7ba8f4543e5fb7565d41dd3faab"
@@ -355422,8 +355828,8 @@ rule SIGNATURE_BASE_Shifu_Banking_Trojan : FILE
date = "2015-09-01"
modified = "2023-12-05"
reference = "https://securityintelligence.com/shifu-masterful-new-banking-trojan-is-attacking-14-japanese-banks/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_shifu_trojan.yar#L8-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_shifu_trojan.yar#L8-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4ff1ebea2096f318a2252ebe1726bcf3bbc295da9204b6c720b5bbf14de14bb2"
hash = "4881c7d89c2b5e934d4741a653fbdaf87cc5e7571b68c723504069d519d8a737"
logic_hash = "f65fa80638e6a8bf8c5afb3dbe1262572ca0a7c56507369934ac3d958f3e6267"
@@ -355451,8 +355857,8 @@ rule SIGNATURE_BASE_SHIFU_Banking_Trojan : FILE
date = "2015-10-31"
modified = "2023-12-05"
reference = "http://goo.gl/52n8WE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_shifu_trojan.yar#L29-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_shifu_trojan.yar#L29-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0066d1c8053ff8b0c07418c7f8d20e5cd64007bb850944269f611febd0c1afe0"
hash = "3956d32a870d81be34cafc867769b2a2f55a96360070f1cb3d9addc2918357d5"
hash = "3fde1b2b50fcb36a695f1e6bc577cd930c2343066d98982cf982393e55bfce0d"
@@ -355494,8 +355900,8 @@ rule SIGNATURE_BASE_MAL_WIN_Akira_Apr25 : FILE
date = "2025-04-11"
modified = "2026-05-15"
reference = "https://ish.com.br/wp-content/uploads/2025/04/A-Anatomia-do-Ransomware-Akira-e-sua-expansao-multiplataforma.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_win_akira_apr25.yar#L1-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_win_akira_apr25.yar#L1-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "205589629ead5d3c1d9e914b49c08589"
logic_hash = "112f844dff4c48d861f86736503da51e8fbc58805f463df1f9358781034f2e24"
score = 90
@@ -355526,8 +355932,8 @@ rule SIGNATURE_BASE_Armitage_Msfconsole : FILE
date = "2017-12-24"
modified = "2022-08-18"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_armitage.yar#L14-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_armitage.yar#L14-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "662ba75c7ed5ac55a898f480ed2555d47d127a2d96424324b02724b3b2c95b6a"
logic_hash = "cf9df9858ca584288288fd0b55fdcf65aeea410f25531ee3d8cf48c30d23824a"
score = 75
@@ -355551,8 +355957,8 @@ rule SIGNATURE_BASE_Armitage_Meterpretersession_Strings : FILE
date = "2017-12-24"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_armitage.yar#L33-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_armitage.yar#L33-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b258b2f12f57ed05d8eafd29e9ecc126ae301ead9944a616b87c240bf1e71f9a"
hash = "144cb6b1cf52e60f16b45ddf1633132c75de393c2705773b9f67fce334a3c8b8"
logic_hash = "3a21a42df8f15e3e81c797feb284edfe2de7d1c182547e8606f0e48dc08f6939"
@@ -355579,8 +355985,8 @@ rule SIGNATURE_BASE_Armitage_OSX : FILE
date = "2017-12-24"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_armitage.yar#L52-L68"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_armitage.yar#L52-L68"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2680d9900a057d553fcb28d84cdc41c3fc18fd224a88a32ee14c9c1b501a86af"
hash = "b7b506f38d0553cd2beb4111c7ef383c821f04cee5169fed2ef5d869c9fbfab3"
logic_hash = "25c94b9715fdc10d0e04eea7d5b9974e60f3e248f51b80de80542b169996fc7a"
@@ -355606,8 +356012,8 @@ rule SIGNATURE_BASE_Exp_EPS_CVE20152545 : CVE_2015_2545 FILE
date = "2017-07-19"
modified = "2023-12-05"
reference = "Internal Research - ME"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2015_2545.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2015_2545.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e1aac80a06dd71352d2776b4dfccce901d47363459853a37669af69be6e962c7"
score = 70
quality = 85
@@ -355630,8 +356036,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASP_Embedded_Mar21_1 : FILE
date = "2021-03-05"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4a8b4cea6f53dad9771cb694ec55f305f04dfdbd8e663154cad672ca414c138c"
score = 85
quality = 85
@@ -355654,8 +356060,8 @@ rule SIGNATURE_BASE_APT_WEBSHELL_HAFNIUM_Secchecker_Mar21_1 : FILE
date = "2021-03-05"
modified = "2023-12-05"
reference = "https://twitter.com/markus_neis/status/1367794681237667840"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L18-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L18-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0"
logic_hash = "e0e4df860bdde7d5c277f596535c493d926095be6f46f6ba41b6177afbfc5cd9"
score = 75
@@ -355678,8 +356084,8 @@ rule SIGNATURE_BASE_APT_HAFNIUM_Forensic_Artefacts_Mar21_1
date = "2021-03-02"
modified = "2023-12-05"
reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L35-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L35-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "eb86595956092506c2e29373faaf39a3987f9feed36a53b191bedd498db05cbb"
score = 75
quality = 85
@@ -355702,8 +356108,8 @@ rule SIGNATURE_BASE_APT_WEBSHELL_HAFNIUM_Chopper_Webshell : APT HAFNIUM WEBSHELL
date = "2021-03-05"
modified = "2023-12-05"
reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L50-L65"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L50-L65"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c185a8da2a18fa59a8eeb36dbd95ba12c9c61717efc5f2d19d2d5b27ee243f2b"
score = 75
quality = 85
@@ -355727,8 +356133,8 @@ rule SIGNATURE_BASE_APT_WEBSHELL_Tiny_Webshell : APT HAFNIUM WEBSHELL FILE
date = "2021-03-05"
modified = "2023-12-05"
reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L67-L82"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L67-L82"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "099c8625c58b315b6c11f5baeb859f4c"
logic_hash = "9309f9b57353b6fe292048d00794699a8637a3e6e429c562fb36c7e459003a3b"
score = 75
@@ -355752,8 +356158,8 @@ rule SIGNATURE_BASE_HKTL_PS1_Powercat_Mar21 : FILE
date = "2021-03-02"
modified = "2023-12-05"
reference = "https://github.com/besimorhino/powercat"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L84-L103"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L84-L103"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c55672b5d2963969abe045fe75db52069d0300691d4f1f5923afeadf5353b9d2"
logic_hash = "cbd5c6f7c5b4ed713482588ee4490a2326fe11cfaacfb3bfc6a6d94130a8bc83"
score = 75
@@ -355779,8 +356185,8 @@ rule SIGNATURE_BASE_HKTL_Nishang_PS1_Invoke_Powershelltcponeline
date = "2021-03-03"
modified = "2023-12-05"
reference = "https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L105-L119"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L105-L119"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f4c948974da341412ab742e14d8cdd33c1efa22b90135fcfae891f08494ac32"
logic_hash = "59622bff95de1077d26ee4547f37cd1045c0c1fc6817df40ff2564b33a962a07"
score = 75
@@ -355804,8 +356210,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Simpleseesharp : WEBSHELL UNCLASSIFIED FILE
date = "2021-03-01"
modified = "2023-12-05"
reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L121-L136"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L121-L136"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "893cd3583b49cb706b3e55ecb2ed0757b977a21f5c72e041392d1256f31166e2"
logic_hash = "6f62249a68bae94e5cbdb4319ea5cde9dc071ec7a4760df3aafe78bc1e072c30"
score = 75
@@ -355828,8 +356234,8 @@ rule SIGNATURE_BASE_WEBSHELL_CVE_2021_27065_Webshells : CVE_2021_27065 FILE
date = "2021-03-05"
modified = "2023-12-05"
reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L182-L200"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L182-L200"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "71795ba67bc8a4cea06b93da34b6291029ff74b200e37eb66f6ac51a6ff194cd"
score = 75
quality = 61
@@ -355857,8 +356263,8 @@ rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_3 : FILE
date = "2021-03-07"
modified = "2023-12-05"
reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L202-L216"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L202-L216"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "391b366d78c2f24dc006a5365ec232a9a3c2fe0ea514b18897701ceeffcc81ca"
score = 85
quality = 85
@@ -355880,8 +356286,8 @@ rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_4 : FILE
date = "2021-03-07"
modified = "2023-12-05"
reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L218-L233"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L218-L233"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "933ab74a0e30e2a728444d491c9eb0ff134db05d905aeb48efe3ba65674a3730"
score = 85
quality = 79
@@ -355904,8 +356310,8 @@ rule SIGNATURE_BASE_APT_HAFNIUM_Forensicartefacts_WER_Mar21_1 : CVE_2021_26857 F
date = "2021-03-07"
modified = "2023-12-05"
reference = "https://twitter.com/cyb3rops/status/1368471533048446976"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L235-L250"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L235-L250"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2e135cb47f9fb5ca19ee1058fa6b4f39c098d2dfbab69bc19e80412ab695f126"
score = 40
quality = 85
@@ -355927,8 +356333,8 @@ rule SIGNATURE_BASE_APT_HAFNIUM_Forensicartefacts_Cab_Recon_Mar21_1 : FILE
date = "2021-03-11"
modified = "2023-12-05"
reference = "https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3?u=dstepanic"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L252-L273"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L252-L273"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "de3acb2d01ad14d73263af9e62ef7c715cde259e3f2fbbcbbb41d55589c3f0ab"
score = 70
quality = 85
@@ -355952,11 +356358,11 @@ rule SIGNATURE_BASE_WEBSHELL_Compiled_Webshell_Mar2021_1 : FILE
date = "2021-03-05"
modified = "2021-03-12"
reference = "https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/Vorfaelle/Exchange-Schwachstellen-2021/MSExchange_Schwachstelle_Detektion_Reaktion.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L275-L295"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L275-L295"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d2e5f91f7bb50984c491eb9632d3863febc986760e4d03c8255872887ce4dc4a"
score = 75
- quality = 56
+ quality = 81
tags = "FILE"
strings:
@@ -355982,8 +356388,8 @@ rule SIGNATURE_BASE_APT_MAL_ASP_DLL_HAFNIUM_Mar21_1 : FILE
date = "2021-03-05"
modified = "2023-12-05"
reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L297-L325"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L297-L325"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "097f5f700c000a13b91855beb61a931d34fb0abb738a110368f525e25c5bc738"
hash = "15744e767cbaa9b37ff7bb5c036dda9b653fc54fc9a96fe73fbd639150b3daa3"
hash = "52ae4de2e3f0ef7fe27c699cb60d41129a3acd4a62be60accc85d88c296e1ddb"
@@ -356016,8 +356422,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Fileexplorer_Mar21_1 : FILE
date = "2021-03-31"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L363-L397"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L363-L397"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75"
logic_hash = "7b4ffd222b38e76455fff2650b72bdcaff281323103f342b427013cd3fffdc21"
score = 80
@@ -356057,8 +356463,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Chopper_Like_Mar21_1 : FILE
date = "2021-03-31"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_hafnium.yar#L399-L416"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_hafnium.yar#L399-L416"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ac44513e5ef93d8cbc17219350682c2246af6d5eb85c1b4302141d94c3b06c90"
logic_hash = "baa9eb1e3c4ac5ce49d27b1c3f75c8b6590567e25d98761a8b704478f2cee970"
score = 85
@@ -356083,8 +356489,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Scheduledtask_Loader : FILE
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L3-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L3-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2d32ee777cb40c6fa58787e92c0de074ea5b81d629a17ccb4f9432d62436f03c"
score = 80
quality = 85
@@ -356107,8 +356513,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Kaosrat_Yamabot
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L20-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L20-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "92182aac2e56041292102b0486b7de1ee6eb3d54a9fc6786c567acd92073cd84"
score = 70
quality = 85
@@ -356139,8 +356545,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Trifaux_Easyrat_JUPITER : FILE
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L44-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L44-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6108035dbebd34fe994fc1f8b4123321321f6ed5c022be6e84a88f905ea6fb73"
score = 80
quality = 85
@@ -356163,8 +356569,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Cutiedrop_Magicrat : FILE
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L61-L85"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L61-L85"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f289bbd71bdeaf2c42063642454679ec26de5ed24c020af40db694a0ced54884"
score = 80
quality = 85
@@ -356192,8 +356598,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_HHSD_Filetransfertool : FILE
date = "2024-07-25"
modified = "2025-07-09"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L87-L125"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L87-L125"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "665c1b27d64d5377be98aa4e629b077e56f3a44273d98653a338439b3dc05b65"
score = 70
quality = 85
@@ -356217,8 +356623,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Atharvan_3RAT : FILE
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L127-L141"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L127-L141"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "741318234e245a35accc0b102a7891559ce5ef868ccdc3e6e4c8e59d8dea8b24"
score = 80
quality = 85
@@ -356240,8 +356646,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Lilithrat_Variant : FILE
date = "2024-07-25"
modified = "2024-07-26"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L143-L178"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L143-L178"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3ce68908468ff85683b081842fa4faa579fbf6f7dc1a7fab5dcf7eac63d90aea"
score = 80
quality = 85
@@ -356271,8 +356677,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Sockstroy_Strings_Opcodes : FILE
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L180-L199"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L180-L199"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6ab31b285d0dba1745a2d8b172bd02931c6138e2b8e541203b88f111d179549b"
score = 80
quality = 85
@@ -356296,8 +356702,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Agni : FILE
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L201-L216"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L201-L216"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "302899b65e5a3a6beabbb46e80e3f0ff246c209206cc3a7f871011d68871d0b9"
score = 80
quality = 85
@@ -356319,8 +356725,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Handshake
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L218-L230"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L218-L230"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1978210d07d3298c0051c9faca16685636e3fb45131b4c2fcb7053a0b3ef84d1"
score = 75
quality = 85
@@ -356341,8 +356747,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Tasks
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L232-L247"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L232-L247"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0d3fb944888b289d345ffc8dfcc988abd04b8cabd1729a66e8236f95ee6147ee"
score = 80
quality = 85
@@ -356366,8 +356772,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Blackstring : FILE
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L249-L261"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L249-L261"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "07ea38890e99dd53437a23b7c4002851604b69a83bd7fb8971609226249e5954"
score = 90
quality = 85
@@ -356388,8 +356794,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_ELF_Backdoor_Fipps : FILE
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L291-L307"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L291-L307"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3b57eb6c6b89e93863b9600c4a1384f3e064f236e827ef9ffc37b1e5dcff7d24"
score = 80
quality = 85
@@ -356413,8 +356819,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Bindshell : FILE
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L309-L328"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L309-L328"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "409aa6a27d81e14ea90d90ee02924cb11f5fecef592e6577b084f9ab2dde35fc"
score = 50
quality = 85
@@ -356440,8 +356846,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Grease2 : FILE
date = "2024-07-25"
modified = "2024-07-26"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L330-L351"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L330-L351"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "138fc915206e0c2834090ebc0a808913488121d51c17de3dbfadcb4099fbfa2f"
score = 80
quality = 85
@@ -356465,8 +356871,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Nopineapple_Dtrack_Unpacked : FILE
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L353-L368"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L353-L368"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cf5f92a66ba3ff4db61102dcc50b781e8dd14ca7cb1eb70dae8eba2ed0910b66"
score = 80
quality = 85
@@ -356489,8 +356895,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Dtrack_Unpacked : FILE
date = "2024-07-25"
modified = "2024-07-26"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L370-L393"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L370-L393"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d8de583fc0de01e6784305d28dbf7cea859a24cf4df1dc59356601bc830e4770"
score = 75
quality = 85
@@ -356515,8 +356921,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Tigerrat_Crowdsourced_Rule : FILE
date = "2024-07-25"
modified = "2024-07-26"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L395-L424"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L395-L424"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5d203d8c7e624796571f4597f70be0b8303f21c096640f25018cad29d4abc05b"
score = 75
quality = 85
@@ -356544,8 +356950,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_WIN_Tiger_RAT_Auto : FILE
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L426-L565"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L426-L565"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1deef66efb44c0d17f33508a8b6f0d6253f0308f309e81657f78eb0f87121bf5"
score = 75
quality = 85
@@ -356581,8 +356987,8 @@ rule SIGNATURE_BASE_MAL_APT_NK_WIN_Dtrack_Auto : FILE
date = "2024-07-25"
modified = "2026-01-29"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_andariel_jul24.yar#L567-L706"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_andariel_jul24.yar#L567-L706"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2bd68ee6e5f35a9b80c07120beba3fe1f3ba9a9137ee15bb04bb2740381a9a44"
score = 75
quality = 85
@@ -356617,8 +357023,8 @@ rule SIGNATURE_BASE_Revengerat_Sep17 : FILE
date = "2017-09-04"
modified = "2020-07-27"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_revenge_rat.yar#L11-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_revenge_rat.yar#L11-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2a86a4b2dcf1657bcb2922e70fc787aa9b66ec1c26dc2119f669bd2ce3f2e94a"
hash = "7c271484c11795876972aabeb277c7b3035f896c9e860a852d69737df6e14213"
hash = "fe00c4f9c8439eea50b44f817f760d8107f81e2dba7f383009fde508ff4b8967"
@@ -356649,8 +357055,8 @@ rule SIGNATURE_BASE_SUSP_LNK_Suspicious_Folders_Jan25 : FILE
date = "2025-01-24"
modified = "2025-03-20"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mixed_open_source_export.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mixed_open_source_export.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "776adb706e165389d0abdf8d6f719f6db1ec6d2f3d9d96e1c4a5f2b55e482c31"
score = 65
quality = 85
@@ -356672,8 +357078,8 @@ rule SIGNATURE_BASE_Cobaltgang_PDF_Metadata_Rev_A
date = "2018-10-25"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cobalt_gang_pdf.yar#L1-L12"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cobalt_gang_pdf.yar#L1-L12"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8020ccff761b49d98e18cd5cb3c0695956a88e86a0958bfba1a19b7e3e629bb9"
score = 75
quality = 85
@@ -356694,8 +357100,8 @@ rule SIGNATURE_BASE_SUSP_Base64_Encoded_Hex_Encoded_Code
date = "2019-04-29"
modified = "2026-05-15"
reference = "https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_obfuscation.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_obfuscation.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f1451e2dd0e4e70a0f39f609331762cce369642e9fadbef83d932da2a0a6c60b"
score = 65
quality = 85
@@ -356718,8 +357124,8 @@ rule SIGNATURE_BASE_SUSP_Reversed_Base64_Encoded_EXE : FILE
date = "2020-04-06"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_obfuscation.yar#L63-L84"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_obfuscation.yar#L63-L84"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8"
logic_hash = "0a2f1caf2235ee24f531c9f9a5ebdc0c97a90890218669749a4c83bede80a336"
score = 80
@@ -356748,8 +357154,8 @@ rule SIGNATURE_BASE_SUSP_Script_Base64_Blocks_Jun20_1
date = "2020-06-05"
modified = "2026-05-15"
reference = "https://posts.specterops.io/covenant-v0-5-eee0507b85ba"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_obfuscation.yar#L86-L99"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_obfuscation.yar#L86-L99"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7d456cbbbd76f543afe144a2876a02db834aa6b09ecd4d6aa2f25ce8eeac5de8"
score = 70
quality = 85
@@ -356771,8 +357177,8 @@ rule SIGNATURE_BASE_SUSP_Reversed_Hacktool_Author : FILE
date = "2020-06-10"
modified = "2026-05-15"
reference = "https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_obfuscation.yar#L101-L115"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_obfuscation.yar#L101-L115"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3681fb11dabf9905915d23f4198145b503a260d628415fd79ad71d7703ba9f6f"
score = 65
quality = 85
@@ -356794,8 +357200,8 @@ rule SIGNATURE_BASE_SUSP_Base64_Encoded_Hacktool_Dev : FILE
date = "2020-06-10"
modified = "2026-05-15"
reference = "https://twitter.com/cyb3rops/status/1270626274826911744"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_obfuscation.yar#L117-L137"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_obfuscation.yar#L117-L137"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7345a528a12f87e5cbcabccf649566a038dd2115e8aec4f39599e357c8c6d57f"
score = 65
quality = 85
@@ -356825,8 +357231,8 @@ rule SIGNATURE_BASE_SUSP_Xored_URL_In_EXE : FILE
date = "2020-03-09"
modified = "2022-09-16"
reference = "https://twitter.com/stvemillertime/status/1237035794973560834"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_xor.yar#L4-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_xor.yar#L4-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2113324ae04a9022be4cf5c615ad231206eeefb5aa87a2236ec3c9deee9e7ec2"
score = 50
quality = 85
@@ -356866,8 +357272,8 @@ rule SIGNATURE_BASE_SVG_Loadurl : FILE
date = "2015-05-24"
modified = "2023-12-05"
reference = "http://goo.gl/psjCCc"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cryptowall_svg.yar#L2-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cryptowall_svg.yar#L2-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ac8ef9df208f624be9c7e7804de55318"
hash = "3b9e67a38569ebe8202ac90ad60c52e0"
hash = "7e2be5cc785ef7711282cea8980b9fee"
@@ -356896,8 +357302,8 @@ rule SIGNATURE_BASE_MAL_CRIME_RAT_WIN_PE_Godrat_Aug25 : GODRAT RAT WINDOWS GH0ST
date = "2025-08-23"
modified = "2026-05-15"
reference = "https://securelist.com/godrat/117119/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_crime_win_pe_godrat_aug25.yar#L4-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_crime_win_pe_godrat_aug25.yar#L4-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "154e800ed1719dbdcb188c00d5822444717c2a89017f2d12b8511eeeda0c2f41"
logic_hash = "eda3175277bbf9f6408f5d2dd25d6780552aad4104fe62bb92125c734f9fdd98"
score = 75
@@ -356933,8 +357339,8 @@ rule SIGNATURE_BASE_MAL_JS_NPM_Supplychain_Attack_Sep25 : FILE
date = "2025-09-09"
modified = "2025-11-29"
reference = "https://www.linkedin.com/feed/update/urn:li:activity:7370889385992437760/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_npm_supply_chain_sep25.yar#L1-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_npm_supply_chain_sep25.yar#L1-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "16f6c756bc8ce5ef5d9aa1ded0f811ec0c9cee3d8f85cc151b8ca1df7b8a4337"
logic_hash = "1b83d1bd79cdff02ed2fff7bf1feb57801ff9a933de1bd4f7ceecf738213ab4c"
score = 85
@@ -356959,8 +357365,8 @@ rule SIGNATURE_BASE_MAL_JS_NPM_Supplychain_Compromise_Sep25 : FILE
date = "2025-09-16"
modified = "2025-09-17"
reference = "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_npm_supply_chain_sep25.yar#L23-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_npm_supply_chain_sep25.yar#L23-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6ddcf152ee8b90496d9d3f7f51dc239d927a3a2095082d13c6cc7e21819097f4"
score = 80
quality = 85
@@ -356985,8 +357391,8 @@ rule SIGNATURE_BASE_Hawkeye_Keylogger_Feb18_1 : FILE
date = "2018-02-12"
modified = "2023-01-06"
reference = "https://app.any.run/tasks/ae2521dd-61aa-4bc7-b0d8-8c85ddcbfcc9"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_hawkeye.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_hawkeye.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bb58922ad8d4a638e9d26076183de27fb39ace68aa7f73adc0da513ab66dc6fa"
logic_hash = "39037ccb90b747c098fbf5a504aee4a6a716901ff5841ae328ea40d06cc3fcfd"
score = 90
@@ -357010,8 +357416,8 @@ rule SIGNATURE_BASE_MAL_Hawkeye_Keylogger_Gen_Dec18
date = "2018-12-10"
modified = "2023-12-05"
reference = "https://twitter.com/James_inthe_box/status/1072116224652324870"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_hawkeye.yar#L20-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_hawkeye.yar#L20-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad"
logic_hash = "b850f02849030d9912b7571e33e969427ac8f721d2f288ae3ac3e971c4ee4263"
score = 75
@@ -357035,8 +357441,8 @@ rule SIGNATURE_BASE_HKTL_FRP_Apr20_1
date = "2020-04-07"
modified = "2022-11-03"
reference = "https://github.com/fatedier/frp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_frp_proxy.yar#L2-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_frp_proxy.yar#L2-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "05537c1c4e29db76a24320fb7cb80b189860389cdb16a9dbeb0c8d30d9b37006"
hash = "08c685c8febb5385f7548c2a64a27bae7123a937c5af958ebc08a3accb29978d"
logic_hash = "21f91fd99aed8b62d804504889c41ca77567fd345cf4ea0ef00161eefa9324a7"
@@ -357063,8 +357469,8 @@ rule SIGNATURE_BASE_HKTL_FRP_INI_Apr20_1 : FILE
date = "2020-04-07"
modified = "2023-12-05"
reference = "Chinese Hacktools OpenDir"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_frp_proxy.yar#L24-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_frp_proxy.yar#L24-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1dabef3c170e4e559c50d603d47fb7f66f6e3da75a65c3435b18175d6e9785bb"
logic_hash = "cc997dc876d7a49292b62a0fb4ff12b34dacacfd8a1b90226d6a9aee303cacdf"
score = 60
@@ -357091,8 +357497,8 @@ rule SIGNATURE_BASE_SUSP_Maldoc_Excelmacro : FILE
date = "2020-11-03"
modified = "2023-12-05"
reference = "YARA Exchange - Undisclosed Macro Builder"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_macro_builders.yar#L2-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_macro_builders.yar#L2-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c5d0655eaf2ca36c828675f9673a1d4284ef8719fd9ec1d354ee3284d1fb0a0c"
score = 65
quality = 85
@@ -357117,8 +357523,8 @@ rule SIGNATURE_BASE_EXPL_HKTL_LNX_Dirtyfraglpe_May26 : FILE
date = "2026-05-07"
modified = "2026-05-15"
reference = "https://github.com/V4bel/dirtyfrag/tree/master"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_lnx_dirtyfrag.yar#L1-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_lnx_dirtyfrag.yar#L1-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c35594d42f7a5d5d2895164147ee1bc62bb8e294c8468093b7d6fcaab0b174c8"
logic_hash = "8b804b3f2d00eccb1f4208173fde15f0525ac710388f14d6a4f9844c49d3660e"
score = 80
@@ -357145,8 +357551,8 @@ rule SIGNATURE_BASE_EXPL_HKTL_LNX_Dirtyfragshellcode_May26
date = "2026-05-07"
modified = "2026-05-15"
reference = "https://github.com/V4bel/dirtyfrag/tree/master"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_lnx_dirtyfrag.yar#L28-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_lnx_dirtyfrag.yar#L28-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a02ea2ba8108a9b7a997faa8808cfc55bb69af54e69178fa5aa1785681cf0ced"
logic_hash = "af23343955d917f302bbba3faf48d4a57ab3b37f77ec7556e17c3e9bac6cdc5f"
score = 80
@@ -357187,8 +357593,8 @@ rule SIGNATURE_BASE_EXPL_LNX_Dirtyfrag_Forensicartefacts_May26 : FILE
date = "2026-05-08"
modified = "2026-05-15"
reference = "https://github.com/V4bel/dirtyfrag/tree/master"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_lnx_dirtyfrag.yar#L62-L77"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_lnx_dirtyfrag.yar#L62-L77"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3790a19c180d1fcdcaf91c13b858d63adf126e9282999ccd424a0e6b9ae0e094"
score = 75
quality = 85
@@ -357211,8 +357617,8 @@ rule SIGNATURE_BASE_APT_Liudoor : WIN32_DLL
date = "2015-07-23"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_terracotta_liudoor.yar#L1-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_terracotta_liudoor.yar#L1-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "78b56bc3edbee3a425c96738760ee406"
hash = "5aa0510f6f1b0e48f0303b9a4bfc641e"
hash = "531d30c8ee27d62e6fbe855299d0e7de"
@@ -357247,8 +357653,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpsetthreadcontext : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/djhohnstein/CSharpSetThreadContext"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L6-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L6-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1fab70ce4bb1a00d8e8155ce7d859aa2f8d193dd40378a8fff0fdfb1c94f9a76"
score = 75
quality = 85
@@ -357271,8 +357677,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injection : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/ihack4falafel/DLL-Injection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L22-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L22-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a9ad0c7a68602214cf31d9b065b9b2c5f7eb616bcec0f3428e958c0f762282b2"
score = 75
quality = 85
@@ -357294,8 +357700,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Limeusb_Csharp : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/LimeUSB-Csharp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L37-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L37-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cd5b12c43046e56ebef78104fd7a9389476686bd4adca4964fc8b559432ae236"
score = 75
quality = 85
@@ -357317,8 +357723,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ladon : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/k8gege/Ladon"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L52-L65"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L52-L65"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1a2c6d3bb2964847aaff4828bbd7b75301e287bcff3f27324bc7767c0f73820f"
score = 75
quality = 85
@@ -357340,8 +357746,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Whitelistevasion : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/khr0x40sh/WhiteListEvasion"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L67-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L67-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "38838b45c3c7359e49f890f5f7608e5a6026421e83b0ef7371c8558c571395a6"
score = 75
quality = 85
@@ -357363,8 +357769,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Downloader : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/Lime-Downloader"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L82-L95"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L82-L95"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8086f6be648bcb5535b98aafc5fd898dc975273eec3c19a54263f74bb7c0f629"
score = 75
quality = 85
@@ -357386,8 +357792,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Darkeye : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/K1ngSoul/DarkEye"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L97-L110"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L97-L110"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7571ed93fd3ea690549ab35682b0073e1c2b9ac57e36394d35794aba7c50b79e"
score = 75
quality = 85
@@ -357409,8 +357815,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpkatz : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/b4rtik/SharpKatz"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L112-L125"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L112-L125"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8899192a8006bb31ce4277fc371a30b301ffc1a42030ca3a4059a2b53c889bae"
score = 75
quality = 85
@@ -357432,8 +357838,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Externalc2 : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/ryhanson/ExternalC2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L127-L141"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L127-L141"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "81042972411ab82da8460f9e263614f563bc67e3ce585f1a955b565b066ee8c9"
score = 75
quality = 85
@@ -357456,8 +357862,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Povlsomware : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/povlteksttv/Povlsomware"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L143-L156"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L143-L156"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f8e246080ffcaa73ad727d2d9a1f2b75f2d413b49dff0c3b50831a41e1f14a2f"
score = 75
quality = 85
@@ -357479,8 +357885,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Runshellcode : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/zerosum0x0/RunShellcode"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L158-L171"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L158-L171"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5df20e170651f32e41a905992d0bb52542638e2d0a56841db900b70e324c9afe"
score = 75
quality = 85
@@ -357502,8 +357908,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharploginprompt : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/shantanu561993/SharpLoginPrompt"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L173-L186"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L173-L186"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e8abbc67d568956bf98e733b1e98910d0501225d4a0dc0bec6be9b572fcc2b36"
score = 75
quality = 85
@@ -357525,8 +357931,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Adamantium_Thief : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/LimerBoy/Adamantium-Thief"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L188-L201"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L188-L201"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "37303dd37952d08ca2f85d03b4a9a8d52a3c55870e1350bca7ac84749942dfd8"
score = 75
quality = 85
@@ -357548,8 +357954,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Psbypassclm : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/padovah4ck/PSByPassCLM"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L203-L216"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L203-L216"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a2646ff961b5fc94035fae0b7e5afedc054dfcfe710701dbf9ba17674c2bb6c8"
score = 75
quality = 85
@@ -357571,8 +357977,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Physmem2Profit : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/FSecureLABS/physmem2profit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L218-L231"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L218-L231"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "57e6159bc047c372bb7fa9ac0f77183fe06fe3f41b83039f8b0185f2743cc774"
score = 75
quality = 85
@@ -357594,8 +358000,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Noamci : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/med0x2e/NoAmci"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L233-L246"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L233-L246"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7d934503bab7318930f958b1818037f00d3d5be7f5f89f3b519c5072bb4fee03"
score = 75
quality = 85
@@ -357617,8 +358023,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpblock : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/CCob/SharpBlock"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L248-L261"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L248-L261"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7bc689efc6f89ac685f1066da4e9735a0e2b985008679c51e14664cebdaebe4a"
score = 75
quality = 85
@@ -357640,8 +358046,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Nopowershell : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/bitsadmin/nopowershell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L263-L276"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L263-L276"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5e4088d451cdc939608fb82f0259d3b60ce8247dfd2f76de839681c9e3d60414"
score = 75
quality = 85
@@ -357663,8 +358069,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Limelogger : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/LimeLogger"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L278-L291"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L278-L291"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "58588726f5f548b9aa948eac6d752404aa43fed18ccd4340422a652b9b061c9b"
score = 75
quality = 85
@@ -357686,8 +358092,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aggressorscripts : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/harleyQu1nn/AggressorScripts"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L293-L306"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L293-L306"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b5d84b6dea0290b901f1d911f341a2b15ab42cf9197775d9bb2f613f4baeb69d"
score = 75
quality = 85
@@ -357709,8 +358115,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Gopher : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/EncodeGroup/Gopher"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L308-L321"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L308-L321"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "430727d064ae07a4ca4411ee78fe74c684ce21d287283467c1afb9795545003e"
score = 75
quality = 85
@@ -357732,8 +358138,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aviator : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/Ch0pin/AVIator"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L323-L336"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L323-L336"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9101444f7d9306058a42b0325fefc0a088d1669932e4a6ba23b387829f01a097"
score = 75
quality = 85
@@ -357755,8 +358161,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Njcrypter : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/0xPh0enix/njCrypter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L338-L352"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L338-L352"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2e3c616b75e15ad082cf0871b7ef8e04f0c2a937000f4bea6927962451ac7f12"
score = 75
quality = 85
@@ -357779,8 +358185,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpminidump : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/b4rtik/SharpMiniDump"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L354-L367"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L354-L367"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "eea9a60c5d0acb1ffa7cbfec59f2a3f7f29b507fba2c3694480627c583d24c97"
score = 75
quality = 85
@@ -357802,8 +358208,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Cinarat : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/wearelegal/CinaRAT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L369-L383"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L369-L383"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d3e006450f3bd35d9d8b0d5c74470f555917d8b3583285ac3ac925ce2a83972b"
score = 75
quality = 85
@@ -357826,8 +358232,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Toxiceye : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/LimerBoy/ToxicEye"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L385-L398"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L385-L398"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "58070408e4c08d20a3f37a2bf59f4b125ef4608e9ee3e7ed5fe1e26ad51b6c88"
score = 75
quality = 85
@@ -357849,8 +358255,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Disable_Windows_Defender : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/Disable-Windows-Defender"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L400-L413"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L400-L413"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "65cc86433a3c4cb22ad54065b90010a0f3eb18ad8791c45343d103deea880195"
score = 75
quality = 85
@@ -357872,8 +358278,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke_Poc : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/dtrizna/DInvoke_PoC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L415-L428"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L415-L428"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "51299abecf7244d150e7c148b5896cd64bcf5817a9a962013d6a986891bd321f"
score = 75
quality = 85
@@ -357895,8 +358301,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Reverseshell : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/chango77747/ReverseShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L430-L444"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L430-L444"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cf8220444b6ffe810451e4754f8561e80acd99f8b5fbb013e8eef488b3c4243e"
score = 75
quality = 85
@@ -357919,8 +358325,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpc2 : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/SharpC2/SharpC2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L446-L464"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L446-L464"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5439cbe057d5735e3d35ac01966fc65ca0727e1c1c353564d38d1c20bb04484a"
score = 75
quality = 85
@@ -357947,8 +358353,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyexec : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/HackingThings/SneakyExec"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L466-L479"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L466-L479"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cb2d505666c4395c9e43607468332c7559807d4da063eb69b31638f2520fee0e"
score = 75
quality = 85
@@ -357970,8 +358376,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Urbanbishoplocal : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/slyd0g/UrbanBishopLocal"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L481-L494"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L481-L494"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cd0ded2fbfbf0fb8c53928e3f1bc4425bfa6112b92b609f421d517f931814faa"
score = 75
quality = 85
@@ -357993,8 +358399,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshell : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/cobbr/SharpShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L496-L510"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L496-L510"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9d49e6a85514fb47bd6875372cbbc8fc1d30e8572ce6e5caa594da07f58d4c06"
score = 75
quality = 85
@@ -358017,8 +358423,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Evilwmiprovider : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/sunnyc7/EvilWMIProvider"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L512-L525"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L512-L525"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "431aa788d1cd192803ad7a5cc66ea48b7a83d47e009c42280e3e77c6ffb8662c"
score = 75
quality = 85
@@ -358040,8 +358446,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Gadgettojscript : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/med0x2e/GadgetToJScript"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L527-L541"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L527-L541"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b072024bc927eaff8bb81bc660dd55a126f9b78e5db591042137b59647631544"
score = 75
quality = 85
@@ -358064,8 +358470,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Azurecli_Extractor : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/0x09AL/AzureCLI-Extractor"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L543-L556"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L543-L556"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6c55a291ba3475a7c7faa2a0152c04b01066a3b3569a5fb052c092b08a8e75ae"
score = 75
quality = 85
@@ -358087,8 +358493,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Escaper : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/UAC-Escaper"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L558-L571"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L558-L571"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8b7315970124c7997ca7d7d21e6c26ac9c905cdbc1ee009f7800b6bc98f9c3d4"
score = 75
quality = 85
@@ -358110,8 +358516,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Httpsbeaconshell : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L573-L586"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L573-L586"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4e51832b9a5f7b82da2f11bcb34664b0a8d0308b0e823436f4339233c07213b3"
score = 75
quality = 85
@@ -358133,8 +358539,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Amsiscanbufferbypass : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/rasta-mouse/AmsiScanBufferBypass"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L588-L601"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L588-L601"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "227b9878e11d1e14aa216cc9d46364cff727b1443f4c18f083971be8dd5e603c"
score = 75
quality = 85
@@ -358156,8 +358562,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcodeloader : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/Hzllaga/ShellcodeLoader"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L603-L616"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L603-L616"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3461e21a0a0661be9830023d56ecdd0434ab9f32328118ad87b2216061851127"
score = 75
quality = 85
@@ -358179,8 +358585,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Keystrokeapi : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/fabriciorissetto/KeystrokeAPI"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L618-L632"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L618-L632"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "36690992d1e5f3df52ad3a3fc218335ee78ce5e1bf7433fa769c8ee618f00b9e"
score = 75
quality = 85
@@ -358203,8 +358609,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcoderunner : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/antman1p/ShellCodeRunner"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L634-L648"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L634-L648"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fecb1562fe42fa512ab3dd932019fa9ba2c09d574e909361c3af9e190cd5db17"
score = 75
quality = 85
@@ -358227,8 +358633,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivecsharp : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/diljith369/OffensiveCSharp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L650-L674"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L650-L674"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "64beb345845aeb7083a2c35d94fa433e95dd810b82c0cf392dd5e3de3bb5b110"
score = 75
quality = 85
@@ -358261,8 +358667,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_SHAPESHIFTER : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/matterpreter/SHAPESHIFTER"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L676-L689"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L676-L689"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "87804b4f657dd838e969e41320d08455470611688f1624632df03868d204490d"
score = 75
quality = 85
@@ -358284,8 +358690,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Evasor : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/cyberark/Evasor"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L691-L704"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L691-L704"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "883dcb8214c036d4a81ee09f97f206f19f24c6a6526437ba61145cb01cb2b1ba"
score = 75
quality = 85
@@ -358307,8 +358713,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Stracciatella : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/mgeeky/Stracciatella"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L706-L719"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L706-L719"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ca28e325cd98f2c9793c434dfd57404e17ed80e57023095d877993a01ee718ee"
score = 75
quality = 85
@@ -358330,8 +358736,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Logger : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/xxczaki/logger"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L721-L734"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L721-L734"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "bf77dcb7fccad566e998df42e9a8248a117a8636500b80fe885d756cfa999f37"
score = 75
quality = 85
@@ -358353,8 +358759,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Internal_Monologue : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/eladshamir/Internal-Monologue"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L736-L750"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L736-L750"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "983273ebcba36e8a22d5bda8bdbba0e1fb31fb128a76a7b39aa012bc83873aff"
score = 75
quality = 85
@@ -358377,8 +358783,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_GRAT2 : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/r3nhat/GRAT2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L752-L765"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L752-L765"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "535f24d46b317dc5c74779931deb92dd922a79cba4f48588763a3d717bbdec82"
score = 75
quality = 85
@@ -358400,8 +358806,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Powershdll : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/p3nt4/PowerShdll"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L767-L780"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L767-L780"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0c2b4a2e3008605c35296d2064d4ab3dbb62230db57d1756f0c11e47a303c007"
score = 75
quality = 85
@@ -358423,8 +358829,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpamsibypass : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/WayneJLee/CsharpAmsiBypass"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L782-L795"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L782-L795"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "65daf297f51dd75ed3616504df96aea9b7a61aebd5a3b43c208f1709daedc193"
score = 75
quality = 85
@@ -358446,8 +358852,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hastyseries : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/obscuritylabs/HastySeries"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L797-L819"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L797-L819"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4987c7afbf339a6a21634eb4647a0b09bfa149d330b7fb2aea2467a25e629c62"
score = 75
quality = 85
@@ -358478,8 +358884,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dreamprotectorfree : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/Paskowsky/DreamProtectorFree"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L821-L834"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L821-L834"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "bd8a6373695b9ab69fdf9e7f4a65c2db4e7a5f6f04f6d308ec352322a396aa44"
score = 75
quality = 85
@@ -358501,8 +358907,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Redsharp : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/padovah4ck/RedSharp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L836-L849"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L836-L849"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b751bedba84e8fc253686a7acd33e46a96140f2903f99ce1df6b4932d475bf30"
score = 75
quality = 85
@@ -358524,8 +358930,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_ESC : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/NetSPI/ESC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L851-L865"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L851-L865"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0a8244145b25260912c8b1d2968fe33fb8497762a6d8f2bbb88a734346990d55"
score = 75
quality = 85
@@ -358548,8 +358954,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Csharp_Loader : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/Csharp-Loader"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L867-L880"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L867-L880"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "aa1a176ce3dbf6ae43d921822d2ab1689a4bf74077fa2a9aa72534ab3cfa3ecc"
score = 75
quality = 85
@@ -358571,8 +358977,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Bantam : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/gellin/bantam"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L882-L895"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L882-L895"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2dce37cd31fa359658519bd50fbb335fc6fd82af5e78a4d86d173d3628e0951f"
score = 75
quality = 85
@@ -358594,8 +359000,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptask : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/jnqpblc/SharpTask"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L897-L910"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L897-L910"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c3f4ddf4ea9389e01611880a47f2a199938e9a5e0f05df4e7f772f7a9acedc61"
score = 75
quality = 85
@@ -358617,8 +359023,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsplague : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/RITRedteam/WindowsPlague"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L912-L925"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L912-L925"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "01ad0621f2bb129fd963093b65cd054bc2a2e185f21041c779b02b1e63475a1c"
score = 75
quality = 85
@@ -358640,8 +359046,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Misc_Csharp : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/jnqpblc/Misc-CSharp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L927-L941"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L927-L941"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "32893d4396842c3df3756d7090a1e86bf73c5ad2476aab5d6c53db8bdae9c31a"
score = 75
quality = 85
@@ -358664,8 +359070,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpspray : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/jnqpblc/SharpSpray"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L943-L956"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L943-L956"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "15ad567589656894f0da6ee56c26f48868936db015d0b41c04ccd6fd56f5753e"
score = 75
quality = 85
@@ -358687,8 +359093,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Obfuscator : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/3xpl01tc0d3r/Obfuscator"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L958-L971"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L958-L971"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "523ce9e83bd6cd7152d86fe77a441a3f721d79f8df45c4041e47cae4b15673d5"
score = 75
quality = 85
@@ -358710,8 +359116,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Safetykatz : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/GhostPack/SafetyKatz"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L973-L986"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L973-L986"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "08b1e8ee951140dc6ac07f2646e0bf84bb22bea9948d231e1ba8d4cf0a28a2e8"
score = 75
quality = 85
@@ -358733,8 +359139,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dropless_Malware : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/Dropless-Malware"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L988-L1001"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L988-L1001"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "833b7758aea58d3065c2c3153f0ab21b7b6a54f7e7083655f2a52c2861080f7d"
score = 75
quality = 85
@@ -358756,8 +359162,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Silentclean : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/EncodeGroup/UAC-SilentClean"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1003-L1016"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1003-L1016"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "32d331148578923e7f5017ce874f9daa234a759ea5a87cbddc1e111834acf920"
score = 75
quality = 85
@@ -358779,8 +359185,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Desktopgrabber : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/DesktopGrabber"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1018-L1031"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1018-L1031"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1937fa6b9e5af3c12a2eef6356aed2c93e6534db492ebc7a8955c4cac240a840"
score = 75
quality = 85
@@ -358802,8 +359208,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Wsmanager : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/guillaC/wsManager"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1033-L1046"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1033-L1046"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cbcdcf8c4895263b881f45f54df01b6a6a3d76cf1be195475217ccffa9eedfed"
score = 75
quality = 85
@@ -358825,8 +359231,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Uglyexe : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/fashionproof/UglyEXe"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1048-L1061"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1048-L1061"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "caf7c8ae7060822e0014710e521020e5d502eedb505165374b7600b11dea7bad"
score = 75
quality = 85
@@ -358848,8 +359254,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdump : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/GhostPack/SharpDump"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1063-L1076"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1063-L1076"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "95217122df1b56132e7774c10c0e993d914cdf8e2463f949cfbab59cb0d99ca4"
score = 75
quality = 85
@@ -358871,8 +359277,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Educationalrat : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/securesean/EducationalRAT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1078-L1091"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1078-L1091"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c46fee5ff948537fb1defe636f3987b3de52b2e37a1130b4b425c6645d74b11b"
score = 75
quality = 85
@@ -358894,8 +359300,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Stealth_Kid_RAT : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/ctsecurity/Stealth-Kid-RAT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1093-L1107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1093-L1107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9a885a48053d501273fc8043e990166558458239781feb9e09f972c52d57e8da"
score = 75
quality = 85
@@ -358918,8 +359324,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcradle : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/anthemtotheego/SharpCradle"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1109-L1122"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1109-L1122"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4213877aaf5606c9e5f3f38a1f057f8068e0fa062a5f1eb4389d83c6032df6c3"
score = 75
quality = 85
@@ -358941,8 +359347,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Bypassuac : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/cnsimo/BypassUAC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1124-L1138"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1124-L1138"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "05dbd4d443664735a10bd48dbbda4edf7ba3756c9dd3f53cb25e066e8f5f1b61"
score = 75
quality = 85
@@ -358965,8 +359371,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hanzoinjection : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/P0cL4bs/hanzoInjection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1140-L1153"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1140-L1153"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "692e5288fffb8eb65b6f84017c31bb3d5d7320c141cd5a60eef6d9482385bb88"
score = 75
quality = 85
@@ -358988,8 +359394,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Clr_Meterpreter : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/OJ/clr-meterpreter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1155-L1173"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1155-L1173"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5d48897457c5f3ea7a9c24a24ab63207c3841bc3ac444d1c42987cb291f05941"
score = 75
quality = 85
@@ -359016,8 +359422,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_BYTAGE : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/KNIF/BYTAGE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1175-L1188"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1175-L1188"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2d295501a64515a68bbd9a3c7f0f5ca0bbf59df5f6c91dd66d2ce6e744ce3fc1"
score = 75
quality = 85
@@ -359039,8 +359445,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Multios_Reverseshell : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/belane/MultiOS_ReverseShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1190-L1203"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1190-L1203"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a0b7f881aee1097dcbbd39a832073aada103b23ebc5b167052e9483083fec02d"
score = 75
quality = 85
@@ -359062,8 +359468,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hidefromamsi : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/0r13lc0ch4v1/HideFromAMSI"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1205-L1218"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1205-L1218"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "05fccd4c7346c1ac1830984f945f5d37ca3e44a479287d681dfdb06d200764f1"
score = 75
quality = 85
@@ -359085,8 +359491,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnetavbypass_Master : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/lockfale/DotNetAVBypass-Master"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1220-L1233"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1220-L1233"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3382613db4970475922fb7db70b6ce4f9c247f083a2164b86ba9e81a770e0e36"
score = 75
quality = 85
@@ -359108,8 +359514,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdpapi : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/GhostPack/SharpDPAPI"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1235-L1249"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1235-L1249"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "70f40bc48eeba3f835a280e7e2ce06b2a16179be9914d5c2548c820b02f4c837"
score = 75
quality = 85
@@ -359132,8 +359538,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Telegra_Csharp_C2 : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/sf197/Telegra_Csharp_C2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1251-L1264"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1251-L1264"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ebdec8d1781ffc106f93f3686eb96e6b79810fbb0c7b1eb7cbbb161397298adc"
score = 75
quality = 85
@@ -359155,8 +359561,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcompile : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/SpiderLabs/SharpCompile"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1266-L1279"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1266-L1279"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a8b46bf3017f336dc669b6c81a339953cc8931df49283b67172f45d1715ef422"
score = 75
quality = 85
@@ -359178,8 +359584,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Carbuncle : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/checkymander/Carbuncle"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1281-L1294"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1281-L1294"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f792c3ed1f62915635dc9090cc608475701d1a4ec60810946336a5d72280af48"
score = 75
quality = 85
@@ -359201,8 +359607,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ossfiletool : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/B1eed/OSSFileTool"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1296-L1309"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1296-L1309"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0dda05d0a53babdf83a2edf9ac0ed21954c059baa73963c79fb840c737865df1"
score = 75
quality = 85
@@ -359224,8 +359630,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Rubeus : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/GhostPack/Rubeus"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1311-L1324"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1311-L1324"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3d2df79b86b2c1eb4721ee9b6fce920db3e48f9cf96fa693876a6d7d8dad54e6"
score = 75
quality = 85
@@ -359247,8 +359653,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Simple_Loader : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/cribdragg3r/Simple-Loader"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1326-L1339"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1326-L1339"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0dff8268f2c0c0764736727c78c648567b42cd3e177a7b73aa47a5afdf2f6d4a"
score = 75
quality = 85
@@ -359270,8 +359676,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Minidump : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/3xpl01tc0d3r/Minidump"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1341-L1354"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1341-L1354"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "798c1c569b224442c2f7b98254062e8cd3b008cb6d7aefef3063d9d57dbfbaee"
score = 75
quality = 85
@@ -359293,8 +359699,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbypassuac : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/FatRodzianko/SharpBypassUAC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1356-L1369"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1356-L1369"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fa9aae20fc35bba3b88e32f03e832579ee48d03303e789a13949a859a6da1a3d"
score = 75
quality = 85
@@ -359316,8 +359722,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharppack : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/Lexus89/SharpPack"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1371-L1391"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1371-L1391"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "43701a68c6bbb5fc1217f9b47096dcc87d2b1ffa9399ba50df9f7e99cec2c0d8"
score = 75
quality = 85
@@ -359346,8 +359752,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Salsa_Tools : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/Hackplayers/Salsa-tools"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1393-L1407"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1393-L1407"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "086108496c5ff6df15a26453da7f0922c29132fd4136cca9a02c21afc9c55ad5"
score = 75
quality = 85
@@ -359370,8 +359776,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsdefender_Payload_Downloader : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/notkohlrexo/WindowsDefender-Payload-Downloader"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1409-L1422"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1409-L1422"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "587784216f3cf47e291219e08dc2b38bd43b11519d612eaccc631539ecc27c60"
score = 75
quality = 85
@@ -359393,8 +359799,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/Mrakovic-ORG/Privilege_Escalation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1424-L1437"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1424-L1437"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "18f5d4f917e1e3f0902ab50d6ae2c249782c65d0fc1ed4bc4d06ffae4d286598"
score = 75
quality = 85
@@ -359416,8 +359822,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Marauder : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/maraudershell/Marauder"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1439-L1452"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1439-L1452"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b1a14c6dd80beedd1f385f3b85cec44a443020a76d4da03ea3a53e1c7c0a7b82"
score = 75
quality = 85
@@ -359439,8 +359845,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_AV_Evasion_Tool : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/1y0n/AV_Evasion_Tool"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1454-L1468"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1454-L1468"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9962ed855d43e12ecfcb38337e20db714315d0ec9d83f74d115765a973939b5c"
score = 75
quality = 85
@@ -359463,8 +359869,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Fenrir : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/nccgroup/Fenrir"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1470-L1483"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1470-L1483"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9b62914aea33db4027c62ecf57854d20942197d1b9212245d1932c0a6b80fe5f"
score = 75
quality = 85
@@ -359486,8 +359892,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Stormkitty : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/LimerBoy/StormKitty"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1485-L1499"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1485-L1499"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e346a56a555fe8fae6d5f3704a39b97e82de79160da93cba7646eb7d6a98d5a8"
score = 75
quality = 85
@@ -359510,8 +359916,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Crypter_Runtime_AV_S_Bypass : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/netreverse/Crypter-Runtime-AV-s-bypass"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1501-L1514"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1501-L1514"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4427fdd90b88576b05bc47c0a24a6daa92e066868e3c738007bfcf9c29058b2e"
score = 75
quality = 85
@@ -359533,8 +359939,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Runasuser : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/atthacks/RunAsUser"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1516-L1529"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1516-L1529"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8ac64be85ae1a55c3390dace5e43580453568758a712bdca0a5e81817d0a7fb0"
score = 75
quality = 85
@@ -359556,8 +359962,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hwidbypass : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/yunseok/HWIDbypass"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1531-L1544"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1531-L1544"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1b19d3560fdf5bfbfd3c4fb434474cdde5efa42de611fb97e76312664b8cedb7"
score = 75
quality = 85
@@ -359579,8 +359985,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Xoredreflectivedll : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/r3nhat/XORedReflectiveDLL"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1546-L1560"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1546-L1560"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "92df3b5c8d1b531dd4b4d04ba53aa6ae5ebf9d1f6869a0d46cd972b082fa1b9f"
score = 75
quality = 85
@@ -359603,8 +360009,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Suite : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/FuzzySecurity/Sharp-Suite"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1562-L1596"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1562-L1596"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cffb4eae9fe3f2034fb03defcd0e0f3f1abaaa2638b137bdfdf67d071e055d42"
score = 75
quality = 83
@@ -359646,8 +360052,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Rat_Shell : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/stphivos/rat-shell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1598-L1612"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1598-L1612"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3d88c891393c914b4b1520bbdb575e78740f21bd361fe4187fdd08aeed708540"
score = 75
quality = 85
@@ -359670,8 +360076,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnet_Gargoyle : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/countercept/dotnet-gargoyle"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1614-L1629"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1614-L1629"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c7ad2c6c775ed6355dd93b06e31e04916277564301b45fe13b69d3e25dcd7bad"
score = 75
quality = 85
@@ -359695,8 +360101,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aresskit : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/BlackVikingPro/aresskit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1631-L1644"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1631-L1644"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3f7c2cb5dee0d77f70ea1fe231e498d1a16c11f92a8b930c9a603fa64a54cec0"
score = 75
quality = 85
@@ -359718,8 +360124,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injector : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/tmthrgd/DLL-Injector"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1646-L1660"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1646-L1660"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fe92cb643d8ddbc0d8d09a88e90655965001375d05c799d6c2437e6c94b26c7a"
score = 75
quality = 85
@@ -359742,8 +360148,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Trufflesnout : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/dsnezhkov/TruffleSnout"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1662-L1675"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1662-L1675"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "03b340ccf4b314ec5d3c33e83e5a47b55e935a8e55acbd6bd9daba43443d53a1"
score = 75
quality = 85
@@ -359765,8 +360171,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Anti_Analysis : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/Anti-Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1677-L1690"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1677-L1690"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1a4141b376afbf36a7a9aa340ea5514b85dd6b0fab003554bae06c0240c98a79"
score = 75
quality = 85
@@ -359788,8 +360194,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Backnet : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/valsov/BackNet"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1692-L1708"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1692-L1708"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "82ab970de2e27e711c502903cc2ede47da296df3ea346c870698c920a4ece282"
score = 75
quality = 85
@@ -359814,8 +360220,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Allthethings : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/johnjohnsp1/AllTheThings"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1710-L1723"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1710-L1723"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a4a562e4db2477be34fa4ccf2c83afafc7aafead3a9eae434b4bc0a5ea6430f7"
score = 75
quality = 85
@@ -359837,8 +360243,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Addreferencedotredteam : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/ceramicskate0/AddReferenceDotRedTeam"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1725-L1738"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1725-L1738"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ec7e0c39db13d212ff9aac4ec8d7d9b4274f3a404997f9291dcbfeaf311f31b4"
score = 75
quality = 85
@@ -359860,8 +360266,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Crypter : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/Lime-Crypter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1740-L1753"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1740-L1753"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ab4243f5e4efcadc9d1a9a34bdb4d5aedcf500accf4cb3681a73015c7f3f6900"
score = 75
quality = 85
@@ -359884,8 +360290,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Browserghost : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/QAX-A-Team/BrowserGhost"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1755-L1770"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1755-L1770"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "448177aae4b0b2f17faefb22599649b7264c85e3af96b1d78bab6ada891b7a82"
score = 75
quality = 85
@@ -359907,8 +360313,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshot : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/tothi/SharpShot"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1772-L1785"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1772-L1785"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "65bbe20eb2aac648648b828c176e418648ebdc6372d287e4bc3b0d3edf233e86"
score = 75
quality = 85
@@ -359930,8 +360336,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Offensive__NET : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/mrjamiebowman/Offensive-.NET"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1787-L1800"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1787-L1800"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dddbee2e6d1cd4046f91192fe26841cc6c359dd9188d472c8b2acca691c15a34"
score = 75
quality = 85
@@ -359953,8 +360359,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ruralbishop : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/rasta-mouse/RuralBishop"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1802-L1815"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1802-L1815"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8dfa8652507851305da814b1410a7854be2c1c78cac325881118829be3456776"
score = 75
quality = 85
@@ -359976,8 +360382,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Deviceguardbypasses : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/tyranid/DeviceGuardBypasses"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1817-L1835"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1817-L1835"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "aff1a0236c532d5822a440f1d9a0a0265b422ebe0b53d799d53e838aef5f64ad"
score = 75
quality = 85
@@ -360004,8 +360410,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_AMSI_Handler : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/two06/AMSI_Handler"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1837-L1853"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1837-L1853"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3b27157331b3b9f6897134172f7dd9198fad7747c12d1020cb3e2d924c2910ce"
score = 75
quality = 85
@@ -360030,8 +360436,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_RAT_Telegramspybot : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/SebastianEPH/RAT.TelegramSpyBot"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1855-L1868"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1855-L1868"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9fc671ef600548d962a2d5ab12ba3111ed19e83ef96d2d536eb343bb8fb4b0d2"
score = 75
quality = 85
@@ -360053,8 +360459,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Thehacktoolboxteek : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/teeknofil/TheHackToolBoxTeek"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1870-L1889"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1870-L1889"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f18d6be2789371f3db649d0df3fc31a2e97604b399873c9843c1e08c981be0da"
score = 75
quality = 85
@@ -360082,8 +360488,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Usbtrojan : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/mashed-potatoes/USBTrojan"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1891-L1904"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1891-L1904"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2280803c42311b8b78a51f0917d9fb4cdd8ca427ce2361372914e5922a1a0b68"
score = 75
quality = 85
@@ -360105,8 +360511,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_IIS_Backdoor : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/WBGlIl/IIS_backdoor"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1906-L1920"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1906-L1920"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "61fcba7e59ac005db140d8eee1d8a1fd4ce8cd18c069053270e0195ee9d63ccc"
score = 75
quality = 85
@@ -360129,8 +360535,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Shellgen : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/jasondrawdy/ShellGen"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1922-L1935"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1922-L1935"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "80c7291653e6cb5d7ef4d69390f7508cd95149d92b59aa3b5c8e6e0fe3723bfe"
score = 75
quality = 85
@@ -360152,8 +360558,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Mass_RAT : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/Mass-RAT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1937-L1952"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1937-L1952"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "53ef9b1d44e6497bafe0982f2e6be65240fcf5684a7b5a6c32a704ab3b7e085c"
score = 75
quality = 85
@@ -360177,8 +360583,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Browser_Externalc2 : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/mdsecactivebreach/Browser-ExternalC2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1954-L1967"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1954-L1967"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1a0027775fb2a06d01cfe30c85ce03e11cf43976abe9bf7b2c61895a55d26404"
score = 75
quality = 85
@@ -360200,8 +360606,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivepowershelltasking : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/leechristensen/OffensivePowerShellTasking"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1969-L1983"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1969-L1983"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "21d7192eaefeeed030b1ef1be29b54c12826914dc6f0945789f3690a39bee217"
score = 75
quality = 85
@@ -360224,8 +360630,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dohc2 : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/SpiderLabs/DoHC2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L1985-L1998"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L1985-L1998"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1601c438c4359d3daa1b5b3cc36a82e049a5ed379ec7a52cdd4a9bca83518dd3"
score = 75
quality = 85
@@ -360247,8 +360653,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Syscallpoc : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/SolomonSklash/SyscallPOC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2000-L2014"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2000-L2014"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a12628052d5c1043b3aae0bedb62908a35cb27871e329f84b0fc22e29149f89e"
score = 75
quality = 85
@@ -360271,8 +360677,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Pen_Test_Tools : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/awillard1/Pen-Test-Tools"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2016-L2040"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2016-L2040"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dc124d65fd724a2e73c708925f44fd87dcd067c121f2875a15ed790c84405899"
score = 50
quality = 85
@@ -360305,8 +360711,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_The_Collection : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/Tlgyt/The-Collection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2042-L2059"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2042-L2059"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d8e28d972aaf44caff35bf982788a6e9b69d0acce4b11c8cfa00c65466412305"
score = 75
quality = 85
@@ -360332,8 +360738,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Change_Lockscreen : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/nccgroup/Change-Lockscreen"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2061-L2074"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2061-L2074"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6b3cd265c6ccdae529a52c3609610f0e633f0112180afd63a5d9892e78d12ef1"
score = 75
quality = 85
@@ -360355,8 +360761,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_LOLBITS : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/Kudaes/LOLBITS"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2076-L2089"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2076-L2089"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fa5978a49940cef63308ae228607eff22d19ea05373b2c4a3a293074af422b20"
score = 75
quality = 85
@@ -360378,8 +360784,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Keylogger : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/BlackVikingPro/Keylogger"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2091-L2104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2091-L2104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "490fb06375b32c70041754e8855cc1d26b76531d24a58bb0b719a998fdb809d6"
score = 75
quality = 85
@@ -360401,8 +360807,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1337 : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/neofito/CVE-2020-1337"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2106-L2119"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2106-L2119"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "05d557a3592845030880c3b87d8134565c2858db89218e1c38edbb025b945d72"
score = 75
quality = 85
@@ -360424,8 +360830,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplogger : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/djhohnstein/SharpLogger"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2121-L2134"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2121-L2134"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9f63dc6bf41b6a062e80b6726c86bbeb7db68e319a78d1bd0187eef234a1c090"
score = 75
quality = 85
@@ -360447,8 +360853,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Asyncrat_C_Sharp : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2136-L2159"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2136-L2159"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ac6319ecfbfc2ddb096b8674a9b494d9460181ebaa2b32ee337d46f6dd33f21d"
score = 75
quality = 85
@@ -360480,8 +360886,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Darkfender : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/0xyg3n/DarkFender"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2161-L2174"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2161-L2174"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2afa4ff5719cb5b3a53b45a880e08e2cac6df8bb1ff053ee290ad6b025f9a6b5"
score = 75
quality = 85
@@ -360503,8 +360909,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Minerdropper : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/DylanAlloy/MinerDropper"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2194-L2208"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2194-L2208"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1a604745a0d95c54be0d1b183486aad0751aee825574500fbff6380571565a18"
score = 75
quality = 85
@@ -360527,8 +360933,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdomainspray : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/HunnicCyber/SharpDomainSpray"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2210-L2223"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2210-L2223"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "da8a964691758e8179199b5725b0811a5b37de964f6a5fa01d6adac286bc544a"
score = 75
quality = 85
@@ -360550,8 +360956,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ispykeylogger : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/mwsrc/iSpyKeylogger"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2225-L2241"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2225-L2241"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0c0b0a8d53efc5e922f73eec7550e6927f19aaef950921fde95b7bd651adeec7"
score = 75
quality = 85
@@ -360576,8 +360982,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Solarflare : FILE
date = "2020-12-15"
modified = "2025-08-15"
reference = "https://github.com/mubix/solarflare"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2243-L2256"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2243-L2256"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9968c4f65672e98ec1ced26e2344e9b12141e3ea7e58be650d077089c9f6bd1c"
score = 75
quality = 85
@@ -360599,8 +361005,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Snaffler : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/SnaffCon/Snaffler"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2258-L2272"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2258-L2272"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a99f8012e45bbc7b689c49d2f6b5e86918b3984ce211fc4b459b6297d75c233a"
score = 75
quality = 85
@@ -360623,8 +361029,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshares : FILE
date = "2020-12-13"
modified = "2025-08-15"
reference = "https://github.com/djhohnstein/SharpShares/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2274-L2287"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2274-L2287"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "09151f0ee360aaa74ebd0fe809ee45135705475a8559f78762ea80e261d173f3"
score = 75
quality = 85
@@ -360646,8 +361052,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpedrchecker : FILE
date = "2020-12-18"
modified = "2025-08-15"
reference = "https://github.com/PwnDexter/SharpEDRChecker"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2289-L2302"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2289-L2302"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9a5a192bb5aedf801465760fd362e0917c7a68c97058c82d0954ce44d3632c43"
score = 75
quality = 85
@@ -360669,8 +361075,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcliphistory : FILE
date = "2020-12-21"
modified = "2025-08-15"
reference = "https://github.com/FSecureLABS/SharpClipHistory"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2304-L2317"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2304-L2317"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "18558f9c446847d2021c3f2a99315c490fc26b1c585dd8a7a0ba4470be8d1e45"
score = 75
quality = 85
@@ -360692,8 +361098,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpo_Remoteaccesspolicies : FILE
date = "2020-12-21"
modified = "2025-08-15"
reference = "https://github.com/FSecureLABS/SharpGPO-RemoteAccessPolicies"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2319-L2332"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2319-L2332"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e2e3168f733ce8a3e6129e4f2faa6a90a47f6cfc683c840032c0323170720a1b"
score = 75
quality = 85
@@ -360715,8 +361121,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Absinthe : FILE
date = "2020-12-21"
modified = "2025-08-15"
reference = "https://github.com/cameronhotchkies/Absinthe"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2334-L2347"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2334-L2347"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "54040db5bdcfc711a26401d082693471c3f98fc043a550d1253f72a2d2611ae4"
score = 75
quality = 85
@@ -360738,8 +361144,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Exploitremotingservice : FILE
date = "2020-12-21"
modified = "2025-08-15"
reference = "https://github.com/tyranid/ExploitRemotingService"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2349-L2364"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2349-L2364"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b22513722be15f582d06c23fb6db53722c0edf2f89f17e28ca067f431ffd4616"
score = 75
quality = 85
@@ -360763,8 +361169,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Xploit : FILE
date = "2020-12-21"
modified = "2025-08-15"
reference = "https://github.com/shargon/Xploit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2366-L2389"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2366-L2389"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0b622acce9ff8186266c69d4ca097902027f5ca652408bfa4ec36fa145e14737"
score = 75
quality = 85
@@ -360796,8 +361202,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Poc : FILE
date = "2020-12-21"
modified = "2025-08-15"
reference = "https://github.com/thezdi/PoC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2391-L2404"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2391-L2404"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f3001a60ce4b6415de2cb035ab56023cd2ee5f4c73e745d87409e5fef1fc9e8a"
score = 75
quality = 85
@@ -360819,8 +361225,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpoabuse : FILE
date = "2020-12-21"
modified = "2025-08-15"
reference = "https://github.com/FSecureLABS/SharpGPOAbuse"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2406-L2419"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2406-L2419"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "683be1b4cee3ba705146f62cdc36c99ce5e4711cd38aec8103584321afd934f1"
score = 75
quality = 85
@@ -360842,8 +361248,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Watson : FILE
date = "2020-12-21"
modified = "2025-08-15"
reference = "https://github.com/rasta-mouse/Watson"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2421-L2434"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2421-L2434"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0fa1d96e9c9fdd612f092dbdcde980956cf4bf24b384991d77737af43637bb34"
score = 75
quality = 85
@@ -360865,8 +361271,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Standin : FILE
date = "2020-12-21"
modified = "2025-08-15"
reference = "https://github.com/FuzzySecurity/StandIn"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2436-L2449"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2436-L2449"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "db008e841cef47916e06167661b3825d1272357a347f522ccea25cc887438480"
score = 75
quality = 85
@@ -360888,8 +361294,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Azure_Password_Harvesting : FILE
date = "2020-12-21"
modified = "2025-08-15"
reference = "https://github.com/guardicore/azure_password_harvesting"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2451-L2464"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2451-L2464"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "eac946e4110f9e7fdcc69ca562ed37a5e77216a325ccd11e29ec7348c2dd12d4"
score = 75
quality = 85
@@ -360911,8 +361317,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Powerops : FILE
date = "2020-12-21"
modified = "2025-08-15"
reference = "https://github.com/fdiskyou/PowerOPS"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2466-L2479"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2466-L2479"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7afb5a5c5eaaba574f31d2041ec2e23f969508bac76aeb58a98714b06b8e6ae7"
score = 75
quality = 85
@@ -360934,8 +361340,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Random_Csharptools : FILE
date = "2020-12-21"
modified = "2025-08-15"
reference = "https://github.com/xorrior/Random-CSharpTools"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2481-L2500"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2481-L2500"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "633cfdc2f1950f36474e15cb186fc4673e7cbc9417fdbee61409b14be94bc6cb"
score = 75
quality = 85
@@ -360963,8 +361369,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_0668 : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/RedCursorSecurityConsulting/CVE-2020-0668"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2502-L2515"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2502-L2515"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ac81e20fa9e5a4f701172d3e68c016b33e5cbda6053505d46f761337fb374161"
score = 75
quality = 85
@@ -360986,8 +361392,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsrpcclients : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/tyranid/WindowsRpcClients"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2517-L2536"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2517-L2536"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2e99c98514bde102450b119cda3cc3c20d7680de5ccbbf64124b719fb8333e8d"
score = 75
quality = 85
@@ -361015,8 +361421,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpfruit : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/rvrsh3ll/SharpFruit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2538-L2551"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2538-L2551"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "da59a7c8fb038171a560d337a49f33a28a2ea88e4c7b08df12eaeb85906c0753"
score = 75
quality = 85
@@ -361038,8 +361444,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwitness : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/rasta-mouse/SharpWitness"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2553-L2566"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2553-L2566"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9a9bc18362347f55b77ec275ad377da9e72ac8a65cab06a867ae55b61b69e7cd"
score = 75
quality = 85
@@ -361061,8 +361467,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Rexcrypter : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/syrex1013/RexCrypter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2568-L2581"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2568-L2581"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fc8bd8eaa3561431bc8886de74b1d569d5fa1f2de7f866146669b4e918a3bf30"
score = 75
quality = 85
@@ -361084,8 +361490,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpersist : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/fireeye/SharPersist"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2583-L2596"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2583-L2596"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "265f42a83973cacb82d4ff12db210ad6cb10265acc38724ed895dc772cf7855e"
score = 75
quality = 85
@@ -361107,8 +361513,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1253 : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/padovah4ck/CVE-2019-1253"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2598-L2611"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2598-L2611"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f365dcec83696032370192d95312999d3baa950379472b99af17687a501dfa9c"
score = 75
quality = 85
@@ -361130,8 +361536,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Scout : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/jaredhaight/scout"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2613-L2626"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2613-L2626"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b677eb07dde231e1d6d542aaafcc0350ce51a66c5396949dd0f1d41311a822b5"
score = 75
quality = 85
@@ -361153,8 +361559,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Grouper2 : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/l0ss/Grouper2/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2628-L2641"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2628-L2641"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b89180f81c4231ea03bb49631b0931b2b7e4ff9e97f44798dd50f6fa4d12b75f"
score = 75
quality = 85
@@ -361176,8 +361582,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Casperstager : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/ustayready/CasperStager"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2643-L2657"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2643-L2657"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "556dd774b6ba38371951ca416133573b0539d699671200e3accfe5bc6fbc979d"
score = 75
quality = 85
@@ -361200,8 +361606,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Tellmeyoursecrets : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/0xbadjuju/TellMeYourSecrets"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2659-L2672"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2659-L2672"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b606c11986ff26d279db58c088633f39eddb41c96c2510f7738cfcef5ff4941f"
score = 75
quality = 85
@@ -361223,8 +361629,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexcel4_DCOM : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/rvrsh3ll/SharpExcel4-DCOM"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2674-L2687"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2674-L2687"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "278eeabdfa26eec5f9e6d2fba093b4698a9813813f644b65e4e28791b600a5dc"
score = 75
quality = 85
@@ -361246,8 +361652,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshooter : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/mdsecactivebreach/SharpShooter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2689-L2702"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2689-L2702"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "79a63f9a24b94327b5b720c415143977c7fba088930dd94f6f2f2784770d182d"
score = 75
quality = 85
@@ -361269,8 +361675,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Nomsbuild : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/rvrsh3ll/NoMSBuild"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2704-L2718"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2704-L2718"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "df8bfecf2f983975a4885cbabc79d2b42c1281bdd918aa0fc9fa50ef75bbfe5d"
score = 75
quality = 85
@@ -361293,8 +361699,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Teleshadow2 : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/ParsingTeam/TeleShadow2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2720-L2734"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2720-L2734"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "df4f26856b5ee348393ddb41e53bdfc8e2bed58ed9fc7b4f758cd1746431d85c"
score = 75
quality = 85
@@ -361317,8 +361723,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Badpotato : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/BeichenDream/BadPotato"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2736-L2749"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2736-L2749"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b78b623666279dab22c263a5a925fc665646ddcc24d1638ebe54bad2ccd5ed4c"
score = 75
quality = 85
@@ -361340,8 +361746,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lethalhta : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/codewhitesec/LethalHTA"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2751-L2765"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2751-L2765"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ebcf9df0cdbab82ee2eea25479058366651746990b32e5af7cbf4da7dae8fafe"
score = 75
quality = 85
@@ -361364,8 +361770,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstat : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/Raikia/SharpStat"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2767-L2780"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2767-L2780"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b163520c47d593244a66ee64071147824486bde4174a5276972a3329b0271a73"
score = 75
quality = 85
@@ -361387,8 +361793,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyservice : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/malcomvetter/SneakyService"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2782-L2795"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2782-L2795"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3f9e4a9666875e8b70ced55924f7dae661e9be6e033bafe4efc1614fb65a7f08"
score = 75
quality = 85
@@ -361410,8 +361816,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexec : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/anthemtotheego/SharpExec"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2797-L2810"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2797-L2810"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "099c18601efc20cb50e7e463755ebda5898cce5d4a0253216a72018337da07f4"
score = 75
quality = 85
@@ -361433,8 +361839,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcom : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/rvrsh3ll/SharpCOM"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2812-L2825"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2812-L2825"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f409d4390fbf8eea8b288e02fbe75d4ecf338a239d8015511f4a9979a1e8a7df"
score = 75
quality = 85
@@ -361456,8 +361862,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Inception : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/two06/Inception"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2827-L2840"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2827-L2840"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "846dfe525380eae42905a3adfbfc56f6c0e6de8abfa4f92e5f02889448dbcc29"
score = 75
quality = 85
@@ -361480,8 +361886,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_1 : FILE
modified = "2025-08-15"
old_rule_name = "HKTL_NET_GUID_sharpwmi"
reference = "https://github.com/QAX-A-Team/sharpwmi"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2842-L2856"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2842-L2856"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "295315b876579ee0d2eb60a44e4be643c143ec1331b155faf0ba61ab016df07f"
score = 75
quality = 85
@@ -361503,8 +361909,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1064 : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/RythmStick/CVE-2019-1064"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2858-L2871"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2858-L2871"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5f72f2569d7e3c1ee6fcd742e22d56331bcbf130b9f2bbc63fbc1504c6597e57"
score = 75
quality = 85
@@ -361526,8 +361932,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenvator : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/0xbadjuju/Tokenvator"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2873-L2886"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2873-L2886"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "45e75eee8ece293a35ac385311994cf8b23fd4f38d84bf53bd724e03ec092e4e"
score = 75
quality = 85
@@ -361549,8 +361955,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Wheresmyimplant : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/0xbadjuju/WheresMyImplant"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2888-L2901"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2888-L2901"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e25816823669753dc475c059320634203e9f9450c320baac3af0d6c996a17264"
score = 75
quality = 85
@@ -361572,8 +361978,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Naga : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/byt3bl33d3r/Naga"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2903-L2917"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2903-L2917"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c579546957c1b05d5fff7ad914d4b6de22ccf216bda92972abd66b0dae89895b"
score = 75
quality = 85
@@ -361596,8 +362002,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbox : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/P1CKLES/SharpBox"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2919-L2932"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2919-L2932"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1a52663ffad8b36d8e6be74c341fb26205b9605df35530b19ab2f4a4c454eb16"
score = 75
quality = 85
@@ -361619,8 +362025,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Rundotnetdll32 : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/0xbadjuju/rundotnetdll32"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2934-L2947"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2934-L2947"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d0a0fa8604eaca14e2fc8545c5b008d26ef1a09f3d792b62549d76fb2d5155d1"
score = 75
quality = 85
@@ -361642,8 +362048,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Antidebug : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/malcomvetter/AntiDebug"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2949-L2962"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2949-L2962"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b665c72e191cc42307f6eecbf0a9ea9238da886e8d5d73b2d569cda2dabe2b1a"
score = 75
quality = 85
@@ -361665,8 +362071,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvisibleregistry : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/NVISO-BE/DInvisibleRegistry"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2964-L2977"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2964-L2977"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7703b24ca72770547d76ebfb8b94b5d13d9d7fa1c65cc8e2ffbf8eca30c1f8d0"
score = 75
quality = 85
@@ -361688,8 +362094,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Tikitorch : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/rasta-mouse/TikiTorch"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L2979-L2998"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L2979-L2998"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "394b4e7ecb7333e7d0944690276de6d942dfa949ba04d28d5576da639a5489bc"
score = 75
quality = 85
@@ -361717,8 +362123,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Hivejack : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/Viralmaniar/HiveJack"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3000-L3013"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3000-L3013"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "46eb7b01deb14eb7a9e1b59f04844b442a47a5c3545fa9925448349ef50e317e"
score = 75
quality = 85
@@ -361740,8 +362146,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Decryptautologon : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/securesean/DecryptAutoLogon"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3015-L3028"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3015-L3028"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "122f265f812e81aef554c1907c8397ac4ad03ff85f53254806abe36049c9b746"
score = 75
quality = 85
@@ -361763,8 +362169,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Unstoppableservice : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/malcomvetter/UnstoppableService"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3030-L3043"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3030-L3043"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ad88047730485852c1d051f168b762da18a85242acf0850204dd5fc86b313390"
score = 75
quality = 85
@@ -361787,8 +362193,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_2 : FILE
modified = "2025-08-15"
old_rule_name = "HKTL_NET_GUID_SharpWMI"
reference = "https://github.com/GhostPack/SharpWMI"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3045-L3059"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3045-L3059"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "968eddc046e0629fed50d77c3b6c55a6d88d4fa68f05bab77f4b43bea6ad62fc"
score = 75
quality = 85
@@ -361810,8 +362216,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ewstoolkit : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/rasta-mouse/EWSToolkit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3061-L3074"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3061-L3074"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d8e10bc2bc8dc0b526f919eed141660555334b97f528d3a74c5b91db05394fad"
score = 75
quality = 85
@@ -361833,8 +362239,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sweetpotato : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/CCob/SweetPotato"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3076-L3090"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3076-L3090"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "36430e0c2874aed1d86e061f9413c16bbb4527d0d04dfb8993214920083cc30a"
score = 75
quality = 85
@@ -361857,8 +362263,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Memscan : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/nccgroup/memscan"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3092-L3105"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3092-L3105"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9885512853fc46cc680b70ab26b40d4e51393b1f0b744565d4a4aa063cb78440"
score = 75
quality = 85
@@ -361880,8 +362286,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstay : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/0xthirteen/SharpStay"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3107-L3120"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3107-L3120"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "91fe0fd4bea7678df8bdb0948a0952e01b6588e07836d535f5aaa3700294d838"
score = 75
quality = 85
@@ -361903,8 +362309,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplocker : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/Pickfordmatt/SharpLocker"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3122-L3135"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3122-L3135"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "030b7a87042ce70c9de6031d0e03f07e508563f4ca2da4d6dc80e87f8bf483de"
score = 75
quality = 85
@@ -361926,8 +362332,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sauroneye : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/vivami/SauronEye"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3137-L3151"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3137-L3151"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "feeda6aec173cb13209559dc3a156bdc3d4be6e14cbe52ffb2e1bb7bf652441a"
score = 75
quality = 85
@@ -361950,8 +362356,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sitrep : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/mdsecactivebreach/sitrep"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3153-L3166"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3153-L3166"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "113e3a23c3f8258707f9d0c1baa143b3599e5da10928f275fca908c3a57f76e8"
score = 75
quality = 85
@@ -361973,8 +362379,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpclipboard : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/slyd0g/SharpClipboard"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3168-L3181"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3168-L3181"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5070ae56bb7f5df31e915104ce42e18dbf86b93a327c49dabddcfbd141d468ac"
score = 75
quality = 85
@@ -361996,8 +362402,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcookiemonster : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/m0rv4i/SharpCookieMonster"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3183-L3196"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3183-L3196"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1aac6d1c4e1d28805ec7e61ee00d105795ce355dce6238981b22b6f7cf9d4e29"
score = 75
quality = 85
@@ -362019,8 +362425,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_P0Wnedshell : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/Cn33liz/p0wnedShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3198-L3211"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3198-L3211"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7c6d8dbcd1ff31a9b34c36b4db2867f0b9e3fac98c7039d2a51bfe5a45afcc71"
score = 75
quality = 85
@@ -362042,8 +362448,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmove : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/0xthirteen/SharpMove"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3213-L3226"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3213-L3226"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4980a9b197479b2514e12b78aa5a3bf9825772f8578d3abd219607e39af7e470"
score = 75
quality = 85
@@ -362065,8 +362471,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_C_Sharp_R_A_T_Client : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/AdvancedHacker101/C-Sharp-R.A.T-Client"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3228-L3241"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3228-L3241"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a090996b8453fb41483888f433da57340a6509221439ffd8f17e546424686c55"
score = 75
quality = 85
@@ -362088,8 +362494,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpprinter : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/rvrsh3ll/SharpPrinter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3243-L3256"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3243-L3256"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "86eb7194039aa8bb89f77041215a3421bb35acd790aa769156298f30a124e9b3"
score = 75
quality = 85
@@ -362111,8 +362517,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Evilfoca : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/ElevenPaths/EvilFOCA"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3258-L3271"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3258-L3271"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f903e2552bdb75a985065e9b78229b56c8005041cf3a75be355192684582caee"
score = 75
quality = 85
@@ -362134,8 +362540,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Poshc2_Misc : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/nettitude/PoshC2_Misc"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3273-L3287"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3273-L3287"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2ad0da62428f8412c748418b44d943a143191bbe789394ffc7b21658f87c27b9"
score = 75
quality = 85
@@ -362158,8 +362564,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpire : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/0xbadjuju/Sharpire"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3289-L3302"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3289-L3302"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c53b3205e58257292e34526ea4fd0e0550bbdcf4039f94d268a313ae28733182"
score = 75
quality = 85
@@ -362181,8 +362587,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Smbexec : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/checkymander/Sharp-SMBExec"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3304-L3317"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3304-L3317"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d6938d7492904a202e80525ff8f1b95c19bd65b1450f2f7e4271ab01f2e25a50"
score = 75
quality = 85
@@ -362204,8 +362610,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Misctools : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/rasta-mouse/MiscTools"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3319-L3336"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3319-L3336"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ffa89aeac49c1652618def1b63506915ec6a364708eb805ef2d9abe710111edf"
score = 75
quality = 85
@@ -362231,8 +362637,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Memorymapper : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/jasondrawdy/MemoryMapper"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3338-L3351"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3338-L3351"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "691aae2ac0c6dec88c64fd1195f67e34235514037c54ebd1f1ac04d92aa3bbb1"
score = 75
quality = 85
@@ -362254,8 +362660,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Vanillarat : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/DannyTheSloth/VanillaRAT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3353-L3367"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3353-L3367"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7e3dd2e631b06201fa3065ebf10c1bb258839106443228af7f07706530a3070d"
score = 75
quality = 85
@@ -362278,8 +362684,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Unmanagedpowershell : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/leechristensen/UnmanagedPowerShell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3369-L3382"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3369-L3382"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "027b0dcbbacaafe6709e18a29b0c001f17f14128648cb64afdcf946804aa8796"
score = 75
quality = 85
@@ -362301,8 +362707,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Quasar : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/quasar/Quasar"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3384-L3398"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3384-L3398"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "51eed0545b985c20db7aae64251a0e7513cb352f2ff76f64d7697d2767f95db2"
score = 75
quality = 85
@@ -362325,8 +362731,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpadidnsdump : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/b4rtik/SharpAdidnsdump"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3400-L3413"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3400-L3413"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "edda1bb7a0a1702941fa35b38120f7e9ae64b6188a47e63a0939a864980b6281"
score = 75
quality = 85
@@ -362348,8 +362754,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/tyranid/DotNetToJScript"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3415-L3428"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3415-L3428"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "07f220695607b5aa6cda9045c3bc1e434828cb5835154710969666482dbe09c4"
score = 75
quality = 85
@@ -362371,8 +362777,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Inferno : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/LimerBoy/Inferno"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3430-L3443"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3430-L3443"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6e286b28bdc490d16892926ba95227d39aebb151067896e740d497024c526c0e"
score = 75
quality = 85
@@ -362394,8 +362800,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsearch : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/djhohnstein/SharpSearch"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3445-L3458"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3445-L3458"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1a383fd8e4ec8fa9f1fbc01bdeb3d5b1e32ec825a24c1eaad6c42e86ac682530"
score = 75
quality = 85
@@ -362417,8 +362823,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsecdump : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/G0ldenGunSec/SharpSecDump"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3460-L3473"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3460-L3473"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "749130efbcdbd068bf4711cc5e4960eb97a3ae2ddadde2beb0ff707429495484"
score = 75
quality = 85
@@ -362440,8 +362846,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Net_Gpppassword : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/outflanknl/Net-GPPPassword"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3475-L3488"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3475-L3488"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "46ae3156e5428c40278b124b7206b68922f955a297077df3288722c154d09fba"
score = 75
quality = 85
@@ -362463,8 +362869,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Filesearcher : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/NVISO-BE/FileSearcher"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3490-L3503"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3490-L3503"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b72d3a7104ca7718d3d490149483a5d2d30790fb6d2b00b10c69da43c491e577"
score = 75
quality = 85
@@ -362486,8 +362892,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Adfsdump : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/fireeye/ADFSDump"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3505-L3518"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3505-L3518"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3735495d2c3a0b6f9de278014d5450f3d2e78dda9c04ede614550c75a05b43d2"
score = 75
quality = 85
@@ -362509,8 +362915,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprdp : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/0xthirteen/SharpRDP"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3520-L3533"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3520-L3533"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "96a5d82e8d03b6242d69cbd5bca2fcc3d4403e7a51099a37dcf9091a0bd53b6e"
score = 75
quality = 85
@@ -362532,8 +362938,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcall : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/jhalon/SharpCall"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3535-L3548"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3535-L3548"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4b4a8943e4fc07f41ce87d64266fd56af9912832b688f21769f4fe5a8152703b"
score = 75
quality = 85
@@ -362555,8 +362961,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ysoserial_Net : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/pwntester/ysoserial.net"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3550-L3564"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3550-L3564"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7d775864610e2e60faa3570746aa7a689bd719b02c3a47f43a2be097e4a81c5a"
score = 75
quality = 85
@@ -362579,8 +362985,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Managedinjection : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/malcomvetter/ManagedInjection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3566-L3581"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3566-L3581"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "eac722f30fea497f98d75293514e0f6f4dd17263c7377211605b1ab2f13ddf2f"
score = 75
quality = 85
@@ -362604,8 +363010,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsocks : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/nettitude/SharpSocks"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3583-L3597"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3583-L3597"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "477adf09ee9d04888ee5e352c11e95f855c433588771138ebb5970cae7aa044f"
score = 75
quality = 85
@@ -362628,8 +363034,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Wmiexec : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/checkymander/Sharp-WMIExec"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3599-L3612"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3599-L3612"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "df683be102decfc65209195d0d2e640985dd7e7cf040fb074fb10c8749e98614"
score = 75
quality = 85
@@ -362651,8 +363057,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Keethief : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/GhostPack/KeeThief"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3614-L3632"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3614-L3632"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f91aeb1862b803ae44c398a71e6c6ed0017d28206deffa39e4e0bca8faae6701"
score = 75
quality = 85
@@ -362678,8 +363084,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Fakelogonscreen : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/bitsadmin/fakelogonscreen"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3634-L3647"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3634-L3647"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "93353997e52fda3cebb03c2c63afc16ea477d3d5d4a7cf8dee26940ccffecd7a"
score = 75
quality = 85
@@ -362701,8 +363107,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Poshsecframework : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/PoshSec/PoshSecFramework"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3649-L3663"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3649-L3663"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6af81da2f23a0ad87d918e4ecb5869e8113b03e175c114e553856c4eabfacb71"
score = 75
quality = 85
@@ -362725,8 +363131,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpattack : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/jaredhaight/SharpAttack"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3665-L3678"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3665-L3678"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "eb2f706a8f91c0702472663d5c5672b0e0a9afa775668706377899b36bdb684c"
score = 75
quality = 85
@@ -362748,8 +363154,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Altman : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/keepwn/Altman"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3680-L3710"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3680-L3710"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4d7046ac7a0deebb33a33995f4c2b9c6b65d4821262d55aecd8e00379ba93b00"
score = 75
quality = 85
@@ -362788,8 +363194,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Browserpass : FILE
date = "2020-12-28"
modified = "2025-08-15"
reference = "https://github.com/jabiel/BrowserPass"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3712-L3725"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3712-L3725"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ce5f5eaa71fd7358d99743e56a8518c1a852faa39c4a7d1888e0a218e9e7a8ef"
score = 75
quality = 85
@@ -362811,8 +363217,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Mythic : FILE
date = "2020-12-29"
modified = "2025-08-15"
reference = "https://github.com/its-a-feature/Mythic"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3727-L3741"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3727-L3741"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3d3b942e110bbf181ecbda5d4b3c2f7775e8e9b4860722238fe686c36422d456"
score = 75
quality = 85
@@ -362835,8 +363241,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Nuages : FILE
date = "2020-12-29"
modified = "2025-08-15"
reference = "https://github.com/p3nt4/Nuages"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3743-L3756"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3743-L3756"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a0d7d89449a6a21bd118ace6a7062ff8d1fa356cf2421cc8c53f2da3719e52fb"
score = 75
quality = 85
@@ -362858,8 +363264,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsniper : FILE
date = "2020-12-29"
modified = "2025-08-15"
reference = "https://github.com/HunnicCyber/SharpSniper"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3758-L3771"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3758-L3771"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "52ae4a89b9cca9bee19e904617ed8c78857a9cee58d691f337fd4a736798aa1e"
score = 75
quality = 85
@@ -362881,8 +363287,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphound3 : FILE
date = "2020-12-29"
modified = "2025-08-15"
reference = "https://github.com/BloodHoundAD/SharpHound3"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3773-L3786"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3773-L3786"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9de8457f59133adb09df0c40ece45331ac716fd56d58bd37a40ce7f1d0a53378"
score = 75
quality = 85
@@ -362904,8 +363310,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Blocketw : FILE
date = "2020-12-29"
modified = "2025-08-15"
reference = "https://github.com/Soledge/BlockEtw"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3788-L3801"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3788-L3801"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8953751277594d4075907e8371764d02307209a732bb05d7cfec8141e23c7765"
score = 75
quality = 85
@@ -362927,8 +363333,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwifigrabber : FILE
date = "2020-12-29"
modified = "2025-08-15"
reference = "https://github.com/r3nhat/SharpWifiGrabber"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3803-L3816"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3803-L3816"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6984510cbc43987fee53e5b164d973f56ecdd682d9263dc7cf560ab8728769d9"
score = 75
quality = 85
@@ -362950,8 +363356,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmapexec : FILE
date = "2020-12-29"
modified = "2025-08-15"
reference = "https://github.com/cube0x0/SharpMapExec"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3818-L3831"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3818-L3831"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cc155390b8c739b7c96f45b79a8a078128528d6c7d070161d67484880c51a714"
score = 75
quality = 85
@@ -362973,8 +363379,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_K8Fly : FILE
date = "2020-12-29"
modified = "2025-08-15"
reference = "https://github.com/zzwlpx/k8fly"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3833-L3846"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3833-L3846"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "99fb07cefac5572180f5f66e9ebce39b8d17c3a2acc56dd8fea426452127be5a"
score = 75
quality = 85
@@ -362996,8 +363402,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Stealer : FILE
date = "2020-12-29"
modified = "2025-08-15"
reference = "https://github.com/malwares/Stealer"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3848-L3863"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3848-L3863"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "37f829449b4f8a9524400d9409b985fab2ff70024a88fdd96ba391956a3398e3"
score = 75
quality = 85
@@ -363021,8 +363427,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Porttran : FILE
date = "2020-12-29"
modified = "2025-08-15"
reference = "https://github.com/k8gege/PortTran"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3865-L3879"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3865-L3879"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f8417a677e88bd923236855d6734cbf3db864c7e3ea60a1e500554fc5946f76a"
score = 75
quality = 85
@@ -363045,8 +363451,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Gray_Keylogger_2 : FILE
date = "2020-12-30"
modified = "2025-08-15"
reference = "https://github.com/graysuit/gray-keylogger-2"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3882-L3896"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3882-L3896"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "92ab6b703064beeab4ef6811732ee76d187958bf4b16f70fa062a7a71ecfb289"
score = 75
quality = 85
@@ -363069,8 +363475,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Miner : FILE
date = "2020-12-30"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/Lime-Miner"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3898-L3911"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3898-L3911"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4b7f810efd907477736f40b9537d1ad99896e28c89bd571244256c385c387bfa"
score = 75
quality = 85
@@ -363092,8 +363498,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Blacknet : FILE
date = "2020-12-30"
modified = "2025-08-15"
reference = "https://github.com/BlackHacker511/BlackNET"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3913-L3929"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3913-L3929"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5e3c6e6e50888c942d541ad893b34c65f784614de7576e9a752822c433753d55"
score = 75
quality = 85
@@ -363118,8 +363524,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Plasmarat : FILE
date = "2020-12-30"
modified = "2025-08-15"
reference = "https://github.com/mwsrc/PlasmaRAT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3931-L3945"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3931-L3945"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "78d0da86cdef86b06fca37fb378297df26ca792ab6069e87c19c7b075687b07d"
score = 75
quality = 85
@@ -363142,8 +363548,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_RAT : FILE
date = "2020-12-30"
modified = "2025-08-15"
reference = "https://github.com/NYAN-x-CAT/Lime-RAT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3947-L3980"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3947-L3980"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "eee41a29dc6b336c14abedaad767b8a0a529917bbc9096829114f302ed93f53c"
score = 75
quality = 83
@@ -363185,8 +363591,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Njrat : FILE
date = "2020-12-30"
modified = "2025-08-15"
reference = "https://github.com/mwsrc/njRAT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L3982-L4000"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L3982-L4000"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fc54c34e2d908e617781ffe8b4c5538304830cfec317ed2eab4157f72bbbf059"
score = 75
quality = 85
@@ -363213,8 +363619,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Manager : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/TheWover/Manager"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4002-L4016"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4002-L4016"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3783108ecfa26ee1a8d0ecfced9e601a41a159777d56a237ae82ad7860b45d5f"
score = 75
quality = 85
@@ -363237,8 +363643,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Neo_Confuserex : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/XenocodeRCE/neo-ConfuserEx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4018-L4031"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4018-L4031"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c916b5443d5df0d58020aec6f3576e3d9cec50fa00b764d86ec7f3a49d0a8d93"
score = 75
quality = 85
@@ -363260,8 +363666,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpallowedtoact : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/pkb1s/SharpAllowedToAct"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4033-L4046"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4033-L4046"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "688c1e5944a96b3cc40deb3c3949da0391e9dbde8c78bcc05a1f48817ae7a0d4"
score = 75
quality = 85
@@ -363283,8 +363689,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Supersqlinjectionv1 : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/shack2/SuperSQLInjectionV1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4048-L4061"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4048-L4061"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cc4d7ac59d1092c357e0c1ac23eab1618a712cf846a65097c283ef62cfcb0c7d"
score = 75
quality = 85
@@ -363306,8 +363712,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Adsearch : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/tomcarver16/ADSearch"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4063-L4076"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4063-L4076"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d925d212b9474078cb3e8694048de22e56de94b33839647c187f3254149bf4ff"
score = 75
quality = 85
@@ -363329,8 +363735,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation_Awesome_Scripts_Suite : F
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4078-L4091"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4078-L4091"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1fdaa169213f31229973956cba064128ea6d256e339a8e3eb42cc9798ddf007f"
score = 75
quality = 85
@@ -363352,8 +363758,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1206_POC : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/ZecOps/CVE-2020-1206-POC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4093-L4108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4093-L4108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "26511510a1075457c8f133001fac18c8b44c997bd368b9336751bca714ec6ec3"
score = 75
quality = 85
@@ -363377,8 +363783,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/TheWover/DInvoke"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4110-L4123"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4110-L4123"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4e7479d36ce78332d2224f16bc2f3059baa418f3035bca8b1ae1e5053dd4d3c3"
score = 75
quality = 85
@@ -363400,8 +363806,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchisel : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/shantanu561993/SharpChisel"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4125-L4138"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4125-L4138"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b2efa0f3757bf93a677d1faea14a71d2e63f45de99b7c9e55a951e6c401f6bd8"
score = 75
quality = 85
@@ -363423,8 +363829,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpscribbles : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/V1V1/SharpScribbles"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4140-L4154"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4140-L4154"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e4cff3fb3540fa1e189c71584889d07111ccc4a340c78011213819f206631446"
score = 75
quality = 85
@@ -363447,8 +363853,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpreg : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/jnqpblc/SharpReg"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4156-L4169"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4156-L4169"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d483e590310d69df4a0267ae3091067deb8698526dd8069862a944a6b1faed05"
score = 75
quality = 85
@@ -363470,8 +363876,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Memevm : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/TobitoFatitoRE/MemeVM"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4171-L4186"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4171-L4186"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "88f4b9d0b3050ad676a54a58ea8f6a02fb07041db404c9d84f25fdda6ff3df4a"
score = 75
quality = 85
@@ -363495,8 +363901,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdir : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/jnqpblc/SharpDir"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4188-L4201"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4188-L4201"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a98ee516931d08d82fb28749130be7d8007a8ac2935fd6007bae27820e216a92"
score = 75
quality = 85
@@ -363518,8 +363924,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Atyourservice : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/mitchmoser/AtYourService"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4203-L4216"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4203-L4216"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c15c466ff048af2818cf9b59794786ba6d11f70d7dee5ef5ee5f050a9b547790"
score = 75
quality = 85
@@ -363541,8 +363947,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Lockless : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/GhostPack/LockLess"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4218-L4231"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4218-L4231"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "57e09a929cc90c399068fb00ddd00c462df34d285d51273aedf27220a0647a38"
score = 75
quality = 85
@@ -363564,8 +363970,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Easynet : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/TheWover/EasyNet"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4233-L4248"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4233-L4248"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "75f69a226391fc6da86c6995295addbefe0a7e1a9ff972f211174a845816061f"
score = 75
quality = 85
@@ -363589,8 +363995,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbyebear : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/S3cur3Th1sSh1t/SharpByeBear"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4250-L4264"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4250-L4264"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f39d756b6e0b8f9037d862bdfa9b14fc2eeddf0eafad805892b8b02410f78c63"
score = 75
quality = 85
@@ -363613,8 +364019,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphide : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/outflanknl/SharpHide"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4266-L4279"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4266-L4279"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "62264aafeafe98ce23e7c03ce75be750ab95d77d3523c0748bdcb2f50d0c04cb"
score = 75
quality = 85
@@ -363636,8 +364042,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsvc : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/jnqpblc/SharpSvc"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4281-L4294"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4281-L4294"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cb91c4cd858a49f5cf437d3d1fb173afa7fe44442d41ea8533797007003c35d4"
score = 75
quality = 85
@@ -363659,8 +364065,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcrasheventlog : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/slyd0g/SharpCrashEventLog"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4296-L4309"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4296-L4309"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f53cfa44168a3ed81370ebb61153b6fab521801ffef33ace23aa8ed3376688eb"
score = 75
quality = 85
@@ -363682,8 +364088,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript_Languagemodebreakout : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/FuzzySecurity/DotNetToJScript-LanguageModeBreakout"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4311-L4324"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4311-L4324"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "de83b8138f49fe6aced5d9ebe77104f780496630f35550fbf0244429a2cb4917"
score = 75
quality = 85
@@ -363705,8 +364111,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpermission : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/mitchmoser/SharPermission"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4326-L4339"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4326-L4339"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "061a7ba9fb838b59a96e480356309af0c4b02d3ba3f2e83944c8dd98b739f6b6"
score = 75
quality = 85
@@ -363728,8 +364134,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Registrystrikesback : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/mdsecactivebreach/RegistryStrikesBack"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4341-L4354"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4341-L4354"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1e2aa9ddf6cbf35cb636e35c18159468ec98eb2c30078c2a1a2a635d14599959"
score = 75
quality = 85
@@ -363751,8 +364157,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Clonevault : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/mdsecactivebreach/CloneVault"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4356-L4369"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4356-L4369"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "830802635e6fc9e364ec574bc9f04b062100c46bfbed7029f437c0392ce983bc"
score = 75
quality = 85
@@ -363774,8 +364180,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Donut : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/TheWover/donut"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4371-L4387"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4371-L4387"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "aae1ca872f60ddc6919938e55d98d27bf88fb382e8d47c06cfc3d3e795ce9f2a"
score = 75
quality = 85
@@ -363800,8 +364206,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphandler : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/jfmaes/SharpHandler"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4389-L4403"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4389-L4403"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3aee0d00306603786fdcf828dc2b1a2faed6c8e651b56eb1985c1b640966da20"
score = 75
quality = 85
@@ -363824,8 +364230,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Driver_Template : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/FuzzySecurity/Driver-Template"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4405-L4418"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4405-L4418"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6d8e59b58b7d9d15b9bbafd70a2e303e2b275f9a81fc66ea60b1ffd4a4601207"
score = 75
quality = 85
@@ -363847,8 +364253,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Nashavm : FILE
date = "2021-01-21"
modified = "2025-08-15"
reference = "https://github.com/Mrakovic-ORG/NashaVM"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4420-L4433"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4420-L4433"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b472d072c39e35c476fa9f0fbca8bf0125ca9359f2e6aac7da58f66ea1b11ed6"
score = 75
quality = 85
@@ -363870,8 +364276,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsqlpwn : FILE
date = "2022-11-21"
modified = "2025-08-15"
reference = "https://github.com/lefayjey/SharpSQLPwn.git"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4435-L4448"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4435-L4448"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e9210d12c7a8d5973e33aa7bb559ce1c744fd7a810979bec37f95d731c3b50ac"
score = 75
quality = 85
@@ -363893,8 +364299,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Group3R : FILE
date = "2022-11-21"
modified = "2025-08-15"
reference = "https://github.com/Group3r/Group3r.git"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4450-L4464"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4450-L4464"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "898569553257991c3776835ec10d5fae697e55bca9c14667ff72c079a095bbf1"
score = 75
quality = 85
@@ -363917,8 +364323,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenstomp : FILE
date = "2022-11-21"
modified = "2025-08-15"
reference = "https://github.com/MartinIngesen/TokenStomp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4466-L4479"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4466-L4479"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "931950e70ecfd3e87e535b32bd8af43d70b36670d5e0142e2fb95ed92c85fbd9"
score = 75
quality = 85
@@ -363940,8 +364346,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Krbrelay : FILE
date = "2022-11-21"
modified = "2025-08-15"
reference = "https://github.com/cube0x0/KrbRelay"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4481-L4495"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4481-L4495"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b5f8a3f6ba7ba5fa59cdc52337f92256257ec0994ae16fce074d70ad5afa3bc6"
score = 75
quality = 85
@@ -363964,8 +364370,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sqlrecon : FILE
date = "2023-01-20"
modified = "2025-08-15"
reference = "https://github.com/skahwah/SQLRecon"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4497-L4510"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4497-L4510"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d1cf5a34a09ed323aeee69080e2f046b613f18294328529a4cca1c49c14da575"
score = 75
quality = 85
@@ -363987,8 +364393,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Certify : FILE
date = "2023-03-06"
modified = "2025-08-11"
reference = "https://github.com/GhostPack/Certify"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4512-L4527"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4512-L4527"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "da585a8d4985082873cb86204d546d3f53668e034c61e42d247b11e92b5e8fc3"
logic_hash = "cc31eb8f11f8c48d8c6d34c343c273ac085fdac214ffc7521d26b4a19edd0c4c"
score = 75
@@ -364012,8 +364418,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aladdin : FILE
date = "2023-03-13"
modified = "2025-08-15"
reference = "https://github.com/nettitude/Aladdin"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4529-L4544"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4529-L4544"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e038ea5b2caed819df725e454ad31ba00b2b1b356875eecd73f2b8a0908c2e33"
score = 75
quality = 85
@@ -364037,8 +364443,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpldaprelayscan : FILE
date = "2023-03-15"
modified = "2025-08-15"
reference = "https://github.com/klezVirus/SharpLdapRelayScan"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4546-L4559"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4546-L4559"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d0b9573ee9893225c5621d02f99f67296193d93a42390125611fe0560bc95fa9"
score = 75
quality = 85
@@ -364060,8 +364466,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Ldapsigncheck : FILE
date = "2023-03-15"
modified = "2025-08-15"
reference = "https://github.com/cube0x0/LdapSignCheck"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4561-L4574"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4561-L4574"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ffeee319b4161611e3e792aaec2e74c8e368d69c7f5ba9738105f536590099e8"
score = 75
quality = 85
@@ -364083,8 +364489,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsccm : FILE
date = "2023-03-15"
modified = "2025-08-15"
reference = "https://github.com/Mayyhem/SharpSCCM"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4576-L4590"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4576-L4590"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a6650a1a2ad710b85363ea04d66f2467b835bc7bd1097404238f67e07cc3f719"
score = 75
quality = 85
@@ -364107,8 +364513,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Koh : FILE
date = "2023-03-18"
modified = "2025-08-15"
reference = "https://github.com/GhostPack/Koh"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4592-L4605"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4592-L4605"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dbb36a1a8f559d10152d14459509408b14f3dc52a685d81f3a3d5e936f5e2a66"
score = 75
quality = 85
@@ -364130,8 +364536,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Forgecert : FILE
date = "2023-03-18"
modified = "2025-08-15"
reference = "https://github.com/GhostPack/ForgeCert"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4607-L4620"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4607-L4620"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4cb79315afc5aae2b35a1d171e8cff34304534a8970b51831568d34135e5c5e6"
score = 75
quality = 85
@@ -364153,8 +364559,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Crassus : FILE
date = "2023-03-18"
modified = "2025-08-15"
reference = "https://github.com/vu-ls/Crassus"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4622-L4635"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4622-L4635"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c6442a8bd4737f0a874c388c74a632bea29c0c8b8c7cc132ad4f145d7a73446b"
score = 75
quality = 85
@@ -364176,8 +364582,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Restrictedadmin : FILE
date = "2023-03-18"
modified = "2025-08-15"
reference = "https://github.com/GhostPack/RestrictedAdmin"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4637-L4650"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4637-L4650"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "876d0a89429c3e504696a63056b154acacdfa44fddba23298c2432accb71dfd2"
score = 75
quality = 85
@@ -364199,8 +364605,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_P2P : FILE
date = "2023-03-19"
modified = "2025-08-15"
reference = "https://github.com/miroslavpejic85/p2p"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4652-L4665"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4652-L4665"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5cdbf5555f4a0dbcbd206708e8678d69ed64f20f734425becd5809396fcfa4b4"
score = 75
quality = 85
@@ -364222,8 +364628,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwsus : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/nettitude/SharpWSUS"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4667-L4680"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4667-L4680"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e42a5341d03da8b7efedb6bb71b2d908881a7b0df9101e8ad56984a3372915fe"
score = 75
quality = 85
@@ -364245,8 +364651,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpimpersonation : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/S3cur3Th1sSh1t/SharpImpersonation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4682-L4695"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4682-L4695"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1fd989607bb22f903ad85905ae4fe9f84aa429f75cedd482a318d8cb6c37af19"
score = 75
quality = 85
@@ -364268,8 +364674,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcloud : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/chrismaddalena/SharpCloud"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4697-L4710"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4697-L4710"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b57f9577edcc15aef82f4fb7ceaf33bce73ae5e9d94b33152da49663a9a8f0c9"
score = 75
quality = 85
@@ -364291,8 +364697,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpssdp : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/rvrsh3ll/SharpSSDP"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4712-L4725"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4712-L4725"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3bb849d481b4db321374e084c5bc83fef683fab5f70a429d79d72988f77d8403"
score = 75
quality = 85
@@ -364314,8 +364720,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Wiretap : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/djhohnstein/WireTap"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4727-L4740"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4727-L4740"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8dfe01e827fca5b6a2abb847b1615bf71c9d98ea7213b02aa94bb8691d085ac5"
score = 75
quality = 85
@@ -364337,8 +364743,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Kittylitter : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/djhohnstein/KittyLitter"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4742-L4757"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4742-L4757"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e0cfb39be4d51d2a929712e4f82851b9cafb46643e1403cd4ea8414624a0a2b6"
score = 75
quality = 85
@@ -364362,8 +364768,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpview : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/tevora-threat/SharpView"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4759-L4772"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4759-L4772"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b87f7c5c4d72a5d9d0f493720388f4328dc519677cc8cc218c4f0f95cc970a1e"
score = 75
quality = 85
@@ -364385,8 +364791,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Farmer : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/mdsecactivebreach/Farmer"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4774-L4790"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4774-L4790"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3e8559dd84fdc698c47acdf19a3f28fe094c96a36d645422f69ad905df5b2263"
score = 75
quality = 85
@@ -364411,8 +364817,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Aesshellcodeinjector : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/san3ncrypt3d/AESShellCodeInjector"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4792-L4805"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4792-L4805"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "38858c4e5f13eea32d47178a9221a35be92c9fbb408a542a712ce9b708591e42"
score = 75
quality = 85
@@ -364434,8 +364840,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchromium : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/djhohnstein/SharpChromium"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4807-L4820"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4807-L4820"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f675d60987e5791550dff9cccc00109a2e30971de12c7f4c77288cf34122f7f2"
score = 75
quality = 85
@@ -364457,8 +364863,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Get_RBCD_Threaded : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/FatRodzianko/Get-RBCD-Threaded"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4822-L4835"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4822-L4835"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a3cb7097f5fd5a2e5eac5ace774ea4e7f845989ee953f5aa140b0e05f3d04380"
score = 75
quality = 85
@@ -364480,8 +364886,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Whisker : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/eladshamir/Whisker"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4837-L4850"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4837-L4850"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2d0e0436f83b5e4c4e2e7ef7237d5769a901f35b0462d5396bb5e398a72176dd"
score = 75
quality = 85
@@ -364503,8 +364909,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Shadowspray : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/Dec0ne/ShadowSpray"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4852-L4865"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4852-L4865"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d45c8c20a782dbcb80db5c990ce02f6227e40a8b6d9875b1158735c5a53d4771"
score = 75
quality = 85
@@ -364526,8 +364932,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Malsccm : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/nettitude/MalSCCM"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4867-L4880"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4867-L4880"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "064835e594c8e28903e5e18aa63c8bda53e74ddb3b8eda813ac62c7677b4e3fc"
score = 75
quality = 85
@@ -364549,8 +364955,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Spoolsample : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/leechristensen/SpoolSample"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4882-L4895"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4882-L4895"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8633b34f478b3d581f9403909d2ee20e7049d3ea02ecaf4fcb5dd61909681ba4"
score = 75
quality = 85
@@ -364572,8 +364978,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpoxidresolver : FILE
date = "2023-03-22"
modified = "2025-08-15"
reference = "https://github.com/S3cur3Th1sSh1t/SharpOxidResolver"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4897-L4910"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4897-L4910"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "168d2d817fecdb9a457af26668f6e543556901151b025d322a4cfd63106cafed"
score = 75
quality = 85
@@ -364595,8 +365001,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcat : FILE
date = "2023-11-30"
modified = "2025-08-18"
reference = "https://github.com/theart42/Sharpcat"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4912-L4924"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4912-L4924"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "143757610d66c5d7bbba96ef810d518f38ad8ea0e924be23aa59e8c514154fe0"
score = 75
quality = 83
@@ -364618,8 +365024,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpnamedpipepth : FILE
date = "2023-11-30"
modified = "2025-08-18"
reference = "https://github.com/S3cur3Th1sSh1t/SharpNamedPipePTH"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4926-L4938"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4926-L4938"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "437a8a41073174e86f642717537bdeeb5343cc8683c95477a52d6801a46aac21"
score = 75
quality = 83
@@ -364641,8 +365047,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptokenfinder : FILE
date = "2023-12-06"
modified = "2025-08-18"
reference = "https://github.com/HuskyHacks/SharpTokenFinder"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4940-L4952"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4940-L4952"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f9681a13b094b6e05cab69f0684d52e3bb3b465cfcdb1c83a890c9c8fda79169"
score = 75
quality = 83
@@ -364664,8 +365070,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprodc : FILE
date = "2023-12-06"
modified = "2025-08-18"
reference = "https://github.com/wh0amitz/SharpRODC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4954-L4966"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4954-L4966"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3d24237804509d2bf241f7310843591608a9d7e8abb38eb324aa5909995ebfaf"
score = 75
quality = 83
@@ -364687,8 +365093,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Gmsapasswordreader : FILE
date = "2023-12-06"
modified = "2025-08-18"
reference = "https://github.com/rvazarkar/GMSAPasswordReader"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4968-L4980"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4968-L4980"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8db260b15b8b8158e5f66268b9086b456386af017e4351025ea27b9f994e5bf5"
score = 75
quality = 83
@@ -364710,8 +365116,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsharefinder : FILE
date = "2023-12-19"
modified = "2025-08-18"
reference = "https://github.com/mvelazc0/SharpShareFinder"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4982-L4994"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4982-L4994"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "72b2c6c9f4da68ba8e9656ff2d9da962f9d791f031c1d7fb74d74ddd17ba49de"
score = 75
quality = 83
@@ -364733,8 +365139,8 @@ rule SIGNATURE_BASE_HKTL_NET_GUID_Postdump : FILE
date = "2023-12-19"
modified = "2025-08-18"
reference = "https://github.com/YOLOP0wn/POSTDump"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_net_redteam_tools_guids.yar#L4997-L5009"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_net_redteam_tools_guids.yar#L4997-L5009"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e5bbef2fe7122855d7e5300ebf78631149e60b08793a4a21a4ac8b337f4bee60"
score = 75
quality = 83
@@ -364756,8 +365162,8 @@ rule SIGNATURE_BASE_Worddoc_Powershell_Urldownloadtofile : FILE
date = "2017-02-23"
modified = "2024-04-03"
reference = "https://www.arbornetworks.com/blog/asert/additional-insights-shamoon2/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_susp.yar#L10-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_susp.yar#L10-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "33ee8a57e142e752a9c8960c4f38b5d3ff82bf17ec060e4114f5b15d22aa902e"
hash = "388b26e22f75a723ce69ad820b61dd8b75e260d3c61d74ff21d2073c56ea565d"
hash = "71e584e7e1fb3cf2689f549192fe3a82fd4cd8ee7c42c15d736ebad47b028087"
@@ -364786,11 +365192,11 @@ rule SIGNATURE_BASE_Suspicious_Powershell_Code_1 : FILE
date = "2017-02-22"
modified = "2024-04-03"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_susp.yar#L32-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_susp.yar#L32-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0a254e0e4f0fdaa5907f5fe0b0c3d5226e2fdac4072349019abc2b2b11cbde30"
score = 60
- quality = 58
+ quality = 83
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
@@ -364814,8 +365220,8 @@ rule SIGNATURE_BASE_Suspicious_Powershell_Webdownload_1 : HIGHVOL FILE
date = "2017-02-22"
modified = "2024-04-03"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_susp.yar#L52-L91"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_susp.yar#L52-L91"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "56ad9c71c34956e94325452d829627a30b1499552725232a07100f05a050ef1b"
score = 60
quality = 85
@@ -364860,8 +365266,8 @@ rule SIGNATURE_BASE_Powershell_In_Word_Doc : FILE
date = "2017-06-27"
modified = "2024-04-03"
reference = "Internal Research - ME"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_susp.yar#L104-L119"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_susp.yar#L104-L119"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4fd4a7b5ef5443e939015276fc4bf8ffa6cf682dd95845ef10fdf8158fdd8905"
logic_hash = "6a9b295f1c430c285aedc5e6df268ea2023c8bdaccd04cf8a5d021419cd6bd64"
score = 50
@@ -364885,8 +365291,8 @@ rule SIGNATURE_BASE_Susp_Powershell_Sep17_1 : FILE
date = "2017-09-30"
modified = "2024-04-03"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_susp.yar#L131-L148"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_susp.yar#L131-L148"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8e28521749165d2d48bfa1eac685c985ac15fc9ca5df177d4efadf9089395c56"
logic_hash = "6c8a1e72b2c4685a5a5749d86901b123976092aee373412bf04c62aa32145be8"
score = 60
@@ -364911,8 +365317,8 @@ rule SIGNATURE_BASE_Susp_Powershell_Sep17_2 : FILE
date = "2017-09-30"
modified = "2024-04-03"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_susp.yar#L150-L170"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_susp.yar#L150-L170"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e387f6c7a55b85e0675e3b91e41e5814f5d0ae740b92f26ddabda6d4f69a8ca8"
logic_hash = "0819f57afb6d1d878e4db4079bfd43ccac520829c877de04d16d8bd048a35ab5"
score = 65
@@ -364938,8 +365344,8 @@ rule SIGNATURE_BASE_Wscript_Shell_Powershell_Combo : FILE
date = "2018-02-07"
modified = "2024-04-03"
reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_susp.yar#L172-L193"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_susp.yar#L172-L193"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b"
logic_hash = "0ab5808593c999c1ce342051a8e292153aa20516cf48071565d677399adfb160"
score = 50
@@ -364966,8 +365372,8 @@ rule SIGNATURE_BASE_SUSP_Powershell_String_K32_Remprocess : FILE
date = "2018-03-31"
modified = "2024-04-03"
reference = "https://github.com/nccgroup/redsnarf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_susp.yar#L195-L215"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_susp.yar#L195-L215"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "54a8dd78ec4798cf034c7765d8b2adfada59ac34d019e77af36dcaed1db18912"
hash = "6d52cdd74edea68d55c596554f47eefee1efc213c5820d86e64de0853a4e46b3"
logic_hash = "03c80de8e59e640709c4ee1912dc47c398e265f9b88845a6de88031e2eb46ba3"
@@ -364997,8 +365403,8 @@ rule SIGNATURE_BASE_Powershell_JAB_B64 : FILE
date = "2018-04-02"
modified = "2024-04-03"
reference = "https://twitter.com/ItsReallyNick/status/980915287922040832"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_susp.yar#L217-L231"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_susp.yar#L217-L231"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4746a73774f945e63455ca7dd58ef67290f7c66d2dca80d06d52d2545c69a190"
score = 60
quality = 83
@@ -365021,8 +365427,8 @@ rule SIGNATURE_BASE_SUSP_PS1_Frombase64String_Content_Indicator : FILE
date = "2020-01-25"
modified = "2024-04-03"
reference = "https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_powershell_susp.yar#L233-L284"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_powershell_susp.yar#L233-L284"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a9ec7a00e9faee5cc081a2bc86abf8027fcd3cfe590cdd4f2f99425b6723f23f"
score = 65
quality = 83
@@ -365083,8 +365489,8 @@ rule SIGNATURE_BASE_Cmstar_Malware_Sep17 : FILE
date = "2017-10-03"
modified = "2023-12-05"
reference = "https://goo.gl/pTffPA"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cmstar.yar#L13-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cmstar.yar#L13-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "16697c95db5add6c1c23b2591b9d8eec5ed96074d057b9411f0b57a54af298d5"
logic_hash = "498b6a3e02cf4979babe6379c2d6b3529d2a28210d44a8ce05aef1acdd325953"
score = 75
@@ -365108,8 +365514,8 @@ rule SIGNATURE_BASE_Crime_H2Miner_Kinsing : FILE
date = "2020-06-09"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_h2miner_kinsing.yar#L1-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_h2miner_kinsing.yar#L1-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8795f01f4ce85ca37a4e4667a4ee9756dae6af42884cf79830877a5c35a3bd3b"
score = 75
quality = 85
@@ -365138,8 +365544,8 @@ rule SIGNATURE_BASE_Hunting_Rule_Shikataganai
date = "2019-10-21"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_shikataganai.yar#L1-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_shikataganai.yar#L1-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "733522cb1d61f4bbb300d73ff21d9d7d10a78aae06e03408fce4b88e4c51f662"
score = 50
quality = 85
@@ -365172,8 +365578,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Sharepoint_Drop_CVE_2025_53770_Jul25 : CVE_202
date = "2025-07-20"
modified = "2026-05-15"
reference = "https://research.eye.security/sharepoint-under-siege/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_sharepoint_jul25.yar#L1-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_sharepoint_jul25.yar#L1-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "27c45b8ed7b8a7e5fff473b50c24028bd028a9fe8e25e5cea2bf5e676e531014"
hash = "92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514"
hash = "b336f936be13b3d01a8544ea3906193608022b40c28dd8f1f281e361c9b64e93"
@@ -365199,14 +365605,14 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Compiled_Sharepoint_Drop_CVE_2025_53770_Jul25_
date = "2025-07-20"
modified = "2025-07-25"
reference = "https://research.eye.security/sharepoint-under-siege/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_sharepoint_jul25.yar#L23-L53"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_sharepoint_jul25.yar#L23-L53"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8d3d3f3a17d233bc8562765e61f7314ca7a08130ac0fb153ffd091612920b0f2"
hash = "d8ca5e5d6400ac34ac4cc138efa89d2ec4d5c0e968a78fa3ba5dbc04c7550649"
hash = "7e9b77da1f51d03ee2f96bc976f6aeb781f801cf633862a4b8c356cbb555927d"
logic_hash = "df11e5bd293cf094f3a147b54ecaafbe0804d7d575fcc22f38e77ab155c7ebdc"
score = 75
- quality = 58
+ quality = 83
tags = "CVE-2025-53770, FILE"
strings:
@@ -365230,11 +365636,11 @@ rule SIGNATURE_BASE_APT_EXPL_Sharepoint_CVE_2025_53770_Forensicartefact_Jul25_1
date = "2025-07-20"
modified = "2025-07-23"
reference = "https://research.eye.security/sharepoint-under-siege/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_sharepoint_jul25.yar#L55-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_sharepoint_jul25.yar#L55-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cca885bad087d1ed12f00ccad558bb474027f7cce058be76360df31c9499e771"
score = 75
- quality = 56
+ quality = 81
tags = "CVE-2025-53770"
strings:
@@ -365255,8 +365661,8 @@ rule SIGNATURE_BASE_APT_EXPL_Sharepoint_CVE_2025_53770_Forensicartefact_Jul25_2
date = "2025-07-20"
modified = "2025-07-24"
reference = "https://research.eye.security/sharepoint-under-siege/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_sharepoint_jul25.yar#L76-L106"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_sharepoint_jul25.yar#L76-L106"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "30955794792a7ce045660bb1e1917eef36f1d5865891b8110bf982382b305b27"
hash = "b336f936be13b3d01a8544ea3906193608022b40c28dd8f1f281e361c9b64e93"
logic_hash = "5ae0620e7e1c1908ad54ac4e41c53240f738631c20577fd65fb29008945347a8"
@@ -365289,11 +365695,11 @@ rule SIGNATURE_BASE_EXPL_Exchange_Proxyshell_Failed_Aug21_1 : SCRIPT
date = "2021-08-08"
modified = "2021-08-09"
reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxyshell.yar#L1-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxyshell.yar#L1-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "690e74633ac8671727fe47f6398e536c1b7a4ac469d27d3f7507c75e175716bd"
score = 50
- quality = 60
+ quality = 85
tags = "SCRIPT"
strings:
@@ -365312,11 +365718,11 @@ rule SIGNATURE_BASE_EXPL_Exchange_Proxyshell_Successful_Aug21_1 : SCRIPT
date = "2021-08-08"
modified = "2025-03-21"
reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxyshell.yar#L17-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxyshell.yar#L17-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "06ab609a8efe3b36b6356a9cf7b7b11b2fc2a556ec1df6995008a9df86b3fcee"
score = 65
- quality = 58
+ quality = 83
tags = "SCRIPT"
strings:
@@ -365337,8 +365743,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_2 : FILE
date = "2021-08-13"
modified = "2025-11-03"
reference = "https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-are-getting-hacked-via-proxyshell-exploits/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxyshell.yar#L35-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxyshell.yar#L35-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4ede197d482f0a9e553ba857b5049e7b7405e3df92460e19418fa0653c844982"
score = 75
quality = 85
@@ -365359,8 +365765,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_3 : FILE
date = "2021-08-23"
modified = "2025-11-03"
reference = "https://twitter.com/gossithedog/status/1429175908905127938?s=12"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxyshell.yar#L50-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxyshell.yar#L50-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f071aaa8918b359f786f2ac7447eeaedb5a6fca9e0a0c0e8820e011244424503"
score = 75
quality = 85
@@ -365381,8 +365787,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Sep21_1 : FILE
date = "2021-09-17"
modified = "2025-11-03"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxyshell.yar#L66-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxyshell.yar#L66-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "219468c10d2b9d61a8ae70dc8b6d2824ca8fbe4e53bbd925eeca270fef0fd640"
logic_hash = "233ec15dff8da5f2beaa931eb06849aa37e548947c1068d688a1695d977605d8"
score = 75
@@ -365404,8 +365810,8 @@ rule SIGNATURE_BASE_APT_IIS_Config_Proxyshell_Artifacts : FILE
date = "2021-08-25"
modified = "2025-11-03"
reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxyshell.yar#L82-L105"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxyshell.yar#L82-L105"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a4557694629448d258b8b2fefc278e059217560e7a0ec3279863a16fb9b3989c"
score = 90
quality = 85
@@ -365435,8 +365841,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Exploitation_Aug21_1 : FILE
date = "2021-08-25"
modified = "2025-11-03"
reference = "https://twitter.com/VirITeXplorer/status/1430206853733097473"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxyshell.yar#L107-L119"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxyshell.yar#L107-L119"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8a2417bb85c7f91d98143d2f4c26d30416b3a01ba8abc1445ccfae5609825b4d"
score = 90
quality = 85
@@ -365457,8 +365863,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug15 : FILE
date = "2021-09-04"
modified = "2025-11-03"
reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxyshell.yar#L121-L152"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxyshell.yar#L121-L152"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "46c37f1d80c777acafa6ee64d7df18a6b94768f4463d9196027111a84a63a24f"
score = 75
quality = 85
@@ -365489,8 +365895,8 @@ rule SIGNATURE_BASE_WEBSHELL_Mailbox_Export_PST_Proxyshell_Aug26 : FILE
date = "2021-09-04"
modified = "2025-11-03"
reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxyshell.yar#L154-L180"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxyshell.yar#L154-L180"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "07acbf74a4bf169fc128cd085759f33e89917e217703b3c6557ba5f954822fd4"
score = 85
quality = 85
@@ -365521,8 +365927,8 @@ rule SIGNATURE_BASE_SUSP_IIS_Config_Proxyshell_Artifacts : FILE
date = "2021-08-25"
modified = "2025-11-03"
reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxyshell.yar#L186-L201"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxyshell.yar#L186-L201"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f2822a2b762c8e683c5e3a3f4a8232faa187b9a36182ea71e5286158b0e8115c"
score = 70
quality = 85
@@ -365545,8 +365951,8 @@ rule SIGNATURE_BASE_SUSP_IIS_Config_Virtualdir : FILE
date = "2021-08-25"
modified = "2022-09-17"
reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxyshell.yar#L203-L223"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxyshell.yar#L203-L223"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0b9be085957f368bc1890c42e3f1e8b974eed8c77ecb4d2ba6add4d877a9b488"
score = 60
quality = 85
@@ -365571,8 +365977,8 @@ rule SIGNATURE_BASE_SUSP_ASPX_Possibledropperartifact_Aug21 : FILE
date = "2021-08-23"
modified = "2025-11-03"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxyshell.yar#L225-L255"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxyshell.yar#L225-L255"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7e2fc61897ed859d5165aca7360d8a27891f842a7a8e4894af3926427ac95ceb"
score = 60
quality = 85
@@ -365594,8 +366000,8 @@ rule SIGNATURE_BASE_WEBSHELL_Proxyshell_Exploitation_Nov21_1
date = "2021-11-01"
modified = "2025-11-03"
reference = "https://www.deepinstinct.com/blog/do-not-exchange-it-has-a-shell-inside"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_proxyshell.yar#L257-L271"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_proxyshell.yar#L257-L271"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d9812d3f53c346c4e318609e0c7de66811b27ffa7528a6ddeb6ac8436da59ef5"
score = 85
quality = 85
@@ -365618,8 +366024,8 @@ rule SIGNATURE_BASE_HKTL_Koh_Tokenstealer : FILE
date = "2022-07-09"
modified = "2023-12-05"
reference = "https://github.com/GhostPack/Koh"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_hktl_koh_tokenstealer.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_hktl_koh_tokenstealer.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e2c4d948e23f1a3a92689f35fedde6e041d09cd88deac9ff3249556be0b8f789"
score = 75
quality = 85
@@ -365644,8 +366050,8 @@ rule SIGNATURE_BASE_Dridex_Trojan_XML
date = "2015-03-08"
modified = "2023-12-05"
reference = "https://threatpost.com/dridex-banking-trojan-spreading-via-macros-in-xml-files/111503"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_dridex_xml.yar#L1-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_dridex_xml.yar#L1-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "88d98e18ed996986d26ce4149ae9b2faee0bc082"
hash = "3b2d59adadf5ff10829bb5c27961b22611676395"
hash = "e528671b1b32b3fa2134a088bfab1ba46b468514"
@@ -365676,8 +366082,8 @@ rule SIGNATURE_BASE_Mimipenguin_SH
date = "2017-04-01"
modified = "2023-12-05"
reference = "https://github.com/huntergregal/mimipenguin"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimipenguin.yar#L8-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimipenguin.yar#L8-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5d9827e7adfe667a4a46e23854cac3b63949abcde5709045f0fe65e7b5704265"
score = 75
quality = 85
@@ -365701,8 +366107,8 @@ rule SIGNATURE_BASE_Mimipenguin_1 : FILE
date = "2017-07-08"
modified = "2023-12-05"
reference = "https://github.com/huntergregal/mimipenguin"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimipenguin.yar#L34-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimipenguin.yar#L34-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9e8d13fe27c93c7571075abf84a839fd1d31d8f2e3e48b3f4c6c13f7afcf8cbd"
logic_hash = "60a7b64eee9e2adfbc65fb5762f18e2abc4a35f9368ad704754870b5e8311391"
score = 75
@@ -365728,8 +366134,8 @@ rule SIGNATURE_BASE_Mimipenguin_2 : FILE
date = "2017-07-08"
modified = "2023-12-05"
reference = "https://github.com/huntergregal/mimipenguin"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimipenguin.yar#L52-L69"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimipenguin.yar#L52-L69"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "453bffa90d99a820e4235de95ec3f7cc750539e4023f98ffc8858f9b3c15d89a"
logic_hash = "53a1f47ef9c94ef6bffbc9d7b9f3a8e0a7fb132c0936ea27e6be775cf99792a0"
score = 75
@@ -365756,8 +366162,8 @@ rule SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1 : FILE
date = "2022-06-10"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_ps_jab.yar#L2-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_ps_jab.yar#L2-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9ad61dca5c945ed87642668e3b834b12c813af244437903a5abb5c69459b9456"
score = 70
quality = 85
@@ -365781,8 +366187,8 @@ rule SIGNATURE_BASE_Brooxml_Hunting : HUNTING FILE
date = "2024-11-27"
modified = "2025-06-02"
reference = "https://x.com/threatinsight/status/1861817946508763480"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_brooxml_dec24.yar#L2-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_brooxml_dec24.yar#L2-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8a8d934fe9286c9d1c83a2a0676bb8a5f2501116b96cca32dc27136ecfb9325b"
score = 70
quality = 85
@@ -365811,8 +366217,8 @@ rule SIGNATURE_BASE_Brooxml_Phishing : PHISHING FILE
date = "2024-11-27"
modified = "2025-06-02"
reference = "https://x.com/threatinsight/status/1861817946508763480"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_brooxml_dec24.yar#L41-L54"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_brooxml_dec24.yar#L41-L54"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "884e0b65c6c8b916ca9bc28705134ae02d1705c13cf43bff78f0c9ada894b307"
score = 65
quality = 85
@@ -365834,8 +366240,8 @@ rule SIGNATURE_BASE_MAL_ELF_Xlogin_Nov24_1 : FILE
date = "2024-11-11"
modified = "2024-12-12"
reference = "https://blog.sekoia.io/solving-the-7777-botnet-enigma-a-cybersecurity-quest/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_xlogin_nov24.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_xlogin_nov24.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b09a6811a9d0447f8c6480430eb0f7e3ff64fa933d0b2e8cd6117f38382cc6a"
hash = "d1cbf80786b1ca1ba2e5c31ec09159be276ad3d10fc0a8a0dbff229d8263ca0a"
hash = "ff17e9bcc1ed16985713405b95745e47674ec98e3c6c889df797600718a35b2c"
@@ -365862,8 +366268,8 @@ rule SIGNATURE_BASE_APT_MAL_DTRACK_Oct19_1 : FILE
date = "2019-10-28"
modified = "2023-12-05"
reference = "https://twitter.com/a_tweeter_user/status/1188811977851887616?s=21"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dtrack.yar#L2-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dtrack.yar#L2-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c5c1ca4382f397481174914b1931e851a9c61f029e6b3eb8a65c9e92ddf7aa4c"
hash = "a0664ac662802905329ec6ab3b3ae843f191e6555b707f305f8f5a0599ca3f68"
hash = "93a01fbbdd63943c151679d037d32b1d82a55d66c6cb93c40ff63f2b770e5ca9"
@@ -365911,8 +366317,8 @@ rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23 : FILE
date = "2023-04-20"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_tradingtech_apr23.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_tradingtech_apr23.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
logic_hash = "4fe1a1b09344cd84f981b193b480d23807893b59ad781868d82089a7306c042f"
score = 85
@@ -365936,8 +366342,8 @@ rule SIGNATURE_BASE_SUSP_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23
date = "2023-04-20"
modified = "2023-04-21"
reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_tradingtech_apr23.yar#L19-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_tradingtech_apr23.yar#L19-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
logic_hash = "ccb482a7634dc24fde03b5730bf28a9e028f8d5a9ad46ba9663d1b520264d8f4"
score = 75
@@ -365961,8 +366367,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_1 : FILE
date = "2023-04-20"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_tradingtech_apr23.yar#L37-L55"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_tradingtech_apr23.yar#L37-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "404b09def6054a281b41d309d809a428"
hash = "c6441c961dcad0fe127514a918eaabd4"
logic_hash = "439a201e6a44a00a31fd13efc83a1acf858a52201e3ab48d5cf095bae1e48cf7"
@@ -365989,8 +366395,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2 : FILE
date = "2023-04-20"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_tradingtech_apr23.yar#L57-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_tradingtech_apr23.yar#L57-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "404b09def6054a281b41d309d809a428"
logic_hash = "62f74faa8f136f4dc63a4b703cffcb97b438cc4f180d5d127d1fc4b86d3cd1d1"
score = 75
@@ -366018,8 +366424,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3 : FILE
date = "2023-04-20"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_tradingtech_apr23.yar#L78-L96"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_tradingtech_apr23.yar#L78-L96"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c6441c961dcad0fe127514a918eaabd4"
logic_hash = "2109340edfb1891baef5bd92ba3c9da77f891341de9e8094060a649de62fade2"
score = 75
@@ -366046,8 +366452,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4 : FILE
date = "2023-04-20"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_tradingtech_apr23.yar#L98-L118"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_tradingtech_apr23.yar#L98-L118"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "404b09def6054a281b41d309d809a428"
hash = "c6441c961dcad0fe127514a918eaabd4"
logic_hash = "2a875c39a43ff054ed5a6cf2fa1f17c2adc189452582763db8ceddfa652abfbf"
@@ -366076,8 +366482,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_5 : FILE
date = "2023-04-20"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_tradingtech_apr23.yar#L120-L143"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_tradingtech_apr23.yar#L120-L143"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6727284586ecf528240be21bb6e97f88"
logic_hash = "5d43b8198ad224bee8d290dd7031d73f76a7d957a2e3b44d89e7aaf5f2c94c65"
score = 75
@@ -366109,8 +366515,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_6 : FILE
date = "2023-04-20"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_tradingtech_apr23.yar#L145-L164"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_tradingtech_apr23.yar#L145-L164"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "00a43d64f9b5187a1e1f922b99b09b77"
logic_hash = "d3b1e5f7a6b73fc4cdc5abe19a412130cde33c2d52c0ad78256b865e018e3794"
score = 75
@@ -366139,8 +366545,8 @@ rule SIGNATURE_BASE_SUSP_NK_MAL_M_Hunting_POOLRAT
modified = "2023-12-05"
old_rule_name = "APT_NK_MAL_M_Hunting_POOLRAT"
reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_tradingtech_apr23.yar#L166-L202"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_tradingtech_apr23.yar#L166-L202"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "451c23709ecd5a8461ad060f6346930c"
logic_hash = "ac8db844a9c4ed961930417809afb706ea948c4509a4be1eaeed77f09c86069d"
score = 70
@@ -366167,8 +366573,8 @@ rule SIGNATURE_BASE_APT_NK_Tradingtech_Forensicartifacts_Apr23_1 : FILE
date = "2023-04-20"
modified = "2023-04-21"
reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_tradingtech_apr23.yar#L204-L225"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_tradingtech_apr23.yar#L204-L225"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "50329427e56b70335a12f0dde87a36ac95838377482eebab334d252332fe481b"
score = 60
quality = 85
@@ -366195,8 +366601,8 @@ rule SIGNATURE_BASE_SUSP_TH_APT_UNC4736_Tradingtech_Cert_Apr23_1
date = "2023-04-20"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_tradingtech_apr23.yar#L227-L242"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_tradingtech_apr23.yar#L227-L242"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "47941828b3c18ed39eddacbc73e147651a9bd48e1a0f7b9847ff1d4c6fea6afd"
score = 65
quality = 85
@@ -366219,8 +366625,8 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_Loader : FILE
date = "2022-04-14"
modified = "2025-07-01"
reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_twisted_panda.yar#L1-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_twisted_panda.yar#L1-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5b558c5fcbed8544cb100bd3db3c04a70dca02eec6fedffd5e3dcecb0b04fba0"
hash = "efa754450f199caae204ca387976e197d95cdc7e83641444c1a5a91b58ba6198"
logic_hash = "b7f4f31a26b5f968b1d5c82d9165b4d45d75336993b113dda54fd37f628639ee"
@@ -366246,8 +366652,8 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_SPINNER_1 : FILE
date = "2022-04-14"
modified = "2025-07-01"
reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_twisted_panda.yar#L46-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_twisted_panda.yar#L46-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a9fb7bb40de8508606a318866e0e5ff79b98f314e782f26c7044622939dfde81"
logic_hash = "e7abe4b3f4225596131882a9175f9ac2e45ba00557950772a8e4d1eaeab97d05"
score = 80
@@ -366273,8 +366679,8 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_SPINNER_2 : FILE
date = "2022-04-14"
modified = "2025-07-01"
reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_twisted_panda.yar#L82-L118"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_twisted_panda.yar#L82-L118"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "28ecd1127bac08759d018787484b1bd16213809a2cc414514dc1ea87eb4c5ab8"
logic_hash = "d1e34903e58fb76671a076acbb9f26e10d511c8f00be90b4901d61b73b90a9a7"
score = 80
@@ -366302,8 +366708,8 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_64Bit_Loader : FILE
date = "2022-04-14"
modified = "2025-07-01"
reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_twisted_panda.yar#L120-L155"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_twisted_panda.yar#L120-L155"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e0d4ef7190ff50e6ad2a2403c87cc37254498e8cc5a3b2b8798983b1b3cdc94f"
logic_hash = "644547f9fa6ca3f34ea32e06896f341e0c92f5c57dee3c478aed0cdf87b2f3de"
score = 80
@@ -366327,8 +366733,8 @@ rule SIGNATURE_BASE_APT_CN_Twistedpanda_Droppers : FILE
date = "2022-04-14"
modified = "2025-07-01"
reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_twisted_panda.yar#L157-L194"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_twisted_panda.yar#L157-L194"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "59dea38da6e515af45d6df68f8959601e2bbf0302e35b7989e741e9aba2f0291"
hash = "8b04479fdf22892cdfebd6e6fbed180701e036806ed0ddbe79f0b29f73449248"
hash = "f29a0cda6e56fc0e26efa3b6628c6bcaa0819a3275a10e9da2a8517778152d66"
@@ -366357,8 +366763,8 @@ rule SIGNATURE_BASE_MAL_LNX_Linadoor_Rootkit_May22 : FILE
date = "2022-05-19"
modified = "2023-05-16"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lnx_linadoor_rootkit.yar#L2-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lnx_linadoor_rootkit.yar#L2-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "25ff1efe36eb15f8e19411886217d4c9ec30b42dca072b1bf22f041a04049cd9"
hash = "4792e22d4c9996af1cb58ed54fee921a7a9fdd19f7a5e7f268b6793cdd1ab4e7"
hash = "9067230a0be61347c0cf5c676580fc4f7c8580fc87c932078ad0c3f425300fb7"
@@ -366396,8 +366802,8 @@ rule SIGNATURE_BASE_EXPL_React_Server_CVE_2025_55182_POC_Dec25 : CVE_2025_55182
date = "2025-12-05"
modified = "2026-05-15"
reference = "https://x.com/pyn3rd/status/1996840827897954542/photo/1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/react_pocs_indicators_dec25.yar#L1-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/react_pocs_indicators_dec25.yar#L1-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a4f27fc85807e8f94e6947523a09d87ceed0658334756a9724322181c3eecd20"
score = 70
quality = 85
@@ -366423,8 +366829,8 @@ rule SIGNATURE_BASE_SUSP_WEBSHELL_LOG_Signatures_Dec25 : FILE
date = "2025-12-05"
modified = "2026-05-15"
reference = "https://x.com/pyn3rd/status/1996840827897954542/photo/1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/react_pocs_indicators_dec25.yar#L22-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/react_pocs_indicators_dec25.yar#L22-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d9bc32a48e37708928a658d171f6cac7c363b346d201e7aed17c8cbe48bab115"
score = 60
quality = 85
@@ -366448,8 +366854,8 @@ rule SIGNATURE_BASE_EXPL_RCE_React_Server_CVE_2025_55182_POC_Dec25 : CVE_2025_55
date = "2025-12-05"
modified = "2026-05-15"
reference = "https://www.youtube.com/watch?v=MmdwakT-Ve8"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/react_pocs_indicators_dec25.yar#L41-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/react_pocs_indicators_dec25.yar#L41-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "54854f6cf3d1f4f30fb6de8312a5969bd5bc0d8c7a047a9f0ef195551c1dc2c6"
score = 70
quality = 85
@@ -366471,8 +366877,8 @@ rule SIGNATURE_BASE_EXPL_RCE_React_Server_Next_JS_CVE_2025_66478_Tracebacks_Dec2
date = "2025-12-05"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/react_pocs_indicators_dec25.yar#L58-L72"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/react_pocs_indicators_dec25.yar#L58-L72"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "668316531c7c87248acdd450e6ced2247ed0252f395754cb2d7370f748c30944"
score = 55
quality = 85
@@ -366495,8 +366901,8 @@ rule SIGNATURE_BASE_EXPL_RCE_React_Server_Next_JS_CVE_2025_66478_Errors_Dec25 :
date = "2025-12-05"
modified = "2026-05-15"
reference = "https://github.com/Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/react_pocs_indicators_dec25.yar#L74-L87"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/react_pocs_indicators_dec25.yar#L74-L87"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6e5d809cd436935324ad4cb657a66a1c257df13a8dd52ee5db1b803ad24560b3"
score = 65
quality = 85
@@ -366518,11 +366924,11 @@ rule SIGNATURE_BASE_EXPL_SUSP_JS_POC_Dec25 : CVE_2025_55182 FILE
date = "2025-12-05"
modified = "2025-12-06"
reference = "https://github.com/msanft/CVE-2025-55182/blob/main/poc.py"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/react_pocs_indicators_dec25.yar#L89-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/react_pocs_indicators_dec25.yar#L89-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "142749ac6538d80a9c713eb19b763063e4d788e622f4938ecd0c1edbf51b3c74"
score = 70
- quality = 60
+ quality = 85
tags = "CVE-2025-55182, FILE"
strings:
@@ -366540,8 +366946,8 @@ rule SIGNATURE_BASE_EXPL_SUSP_JS_POC_RSC_Detector_Payloads_Dec25 : CVE_2025_5518
date = "2025-12-06"
modified = "2026-05-15"
reference = "https://github.com/mrknow001/RSC_Detector"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/react_pocs_indicators_dec25.yar#L106-L123"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/react_pocs_indicators_dec25.yar#L106-L123"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b51f4028662795ffcbf4c17c1b2cbad35a8fa64104aa5cfdaf24b13e9663eb09"
score = 70
quality = 85
@@ -366564,8 +366970,8 @@ rule SIGNATURE_BASE_EXPL_SUSP_JS_Exploitation_Payloads_Dec25 : CVE_2025_55182
date = "2025-12-06"
modified = "2026-05-15"
reference = "https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/react_pocs_indicators_dec25.yar#L125-L165"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/react_pocs_indicators_dec25.yar#L125-L165"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6ddad54b8869ff3eadc3040767ef4cac5a81132b74a5d16cfe479a8dddd52a65"
score = 70
quality = 60
@@ -366602,8 +367008,8 @@ rule SIGNATURE_BASE_Skeleton_Key_Patcher
date = "2015-01-13"
modified = "2023-12-05"
reference = "http://goo.gl/aAk3lN"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_skeletonkey.yar#L3-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_skeletonkey.yar#L3-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "451b77152e38a120bd8d8a832f0f7c003974113ead18aabfe043a332fb1f484c"
score = 70
quality = 85
@@ -366630,8 +367036,8 @@ rule SIGNATURE_BASE_Skeleton_Key_Injected_Code
date = "2015-01-13"
modified = "2023-12-05"
reference = "http://goo.gl/aAk3lN"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_skeletonkey.yar#L26-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_skeletonkey.yar#L26-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e87cb9a49d0df6f75ca1ae51f8255ea476b699e82d525d7eca06bfda3462d84b"
score = 70
quality = 85
@@ -366655,8 +367061,8 @@ rule SIGNATURE_BASE_Hdroot_Sample_Jul17_1 : FILE
date = "2017-07-07"
modified = "2023-12-05"
reference = "Winnti HDRoot VT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_hdroot.yar#L11-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_hdroot.yar#L11-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6d2ad82f455becc8c830d000633a370857928c584246a7f41fe722cc46c0d113"
logic_hash = "41127e6d70af4b095555285f3d5570fc4dbe2a7918664502057cdc4fed8fab33"
score = 75
@@ -366681,8 +367087,8 @@ rule SIGNATURE_BASE_Hdroot_Sample_Jul17_2 : FILE
date = "2017-07-07"
modified = "2023-12-05"
reference = "Winnti HDRoot VT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_hdroot.yar#L28-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_hdroot.yar#L28-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1c302ed9786fc600073cc6f3ed2e50e7c23785c94a2908f74f92971d978b704b"
hash = "3b7cfa40e26fb6b079b55ec030aba244a6429e263a3d9832e32ab09e7a3c4a9c"
hash = "71eddf71a94c5fd04c9f3ff0ca1eb6b1770df1a3a8f29689fb8588427b5c9e8e"
@@ -366725,8 +367131,8 @@ rule SIGNATURE_BASE_Unspecified_Malware_Jul17_1A : FILE
date = "2017-07-07"
modified = "2023-12-05"
reference = "Winnti HDRoot VT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_hdroot.yar#L66-L83"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_hdroot.yar#L66-L83"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e1c38142b6194237a4cd4603829aa6edb6436e7bba15e3e6b0c9e8c6b629b42b"
logic_hash = "e23af53be3e700055ea6536669065c131e7f674d45e43a389447c8c1f549dee5"
score = 75
@@ -366753,8 +367159,8 @@ rule SIGNATURE_BASE_MAL_Icedid_GZIP_LDR_202104 : FILE
date = "2021-04-12"
modified = "2023-01-27"
reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_icedid.yar#L14-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_icedid.yar#L14-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7a7cc6c7dcbf43bace6a1f259af38560327c34386517e719ad81068b2d9b6659"
score = 75
quality = 85
@@ -366785,8 +367191,8 @@ rule SIGNATURE_BASE_Connectwise_Screenconnect_Authentication_Bypass_Feb_2024_Exp
date = "2024-02-20"
modified = "2024-02-21"
reference = "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L3-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L3-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f6c7a3aa2ed98e754f9523c55eb035c7bc5f8aea96a6f86c729e9658d78710fb"
score = 75
quality = 85
@@ -366810,8 +367216,8 @@ rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Unused_Feb24 : FILE
date = "2024-02-23"
modified = "2024-04-24"
reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L20-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L20-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2433ad11ca1d9f970eb3c536a13f07e808c2a0b8b0dd625dffbe4947268ab8f5"
score = 65
quality = 85
@@ -366835,8 +367241,8 @@ rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Used_Feb24 : FILE
date = "2024-02-23"
modified = "2024-04-24"
reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L40-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L40-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "50967a07a9789f20ccbc882c3b9e3142f0c28068c0a58b9d8927d725d02bf289"
score = 75
quality = 85
@@ -366860,8 +367266,8 @@ rule SIGNATURE_BASE_SUSP_Screenconnect_Exploitation_Artefacts_Feb24 : SCRIPT
date = "2024-02-23"
modified = "2024-04-24"
reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L62-L103"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L62-L103"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6f0d5f878847da1afb0d7b83e84bd337cfa67c36da2cbb33af712ed4ffad490a"
score = 75
quality = 83
@@ -366909,8 +367315,8 @@ rule SIGNATURE_BASE_SUSP_Command_Line_Combos_Feb24_2 : SCRIPT FILE
date = "2024-02-23"
modified = "2024-04-24"
reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L105-L118"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L105-L118"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0cd7b4771aa8fd622e873c5cdc6689d24394e5faf026b36d5f228ac09f4e0441"
score = 75
quality = 85
@@ -366932,8 +367338,8 @@ rule SIGNATURE_BASE_SUSP_PS1_Combo_Transfersh_Feb24 : SCRIPT
date = "2024-02-23"
modified = "2024-04-24"
reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L120-L135"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L120-L135"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "64d4343ecdcbc4a28571557bec2f31c1ff73c2ecf63d0feaa0a71001bb9bf499"
score = 70
quality = 85
@@ -366957,8 +367363,8 @@ rule SIGNATURE_BASE_MAL_SUSP_RANSOM_Lockbit_Ransomnote_Feb24
date = "2024-02-23"
modified = "2024-04-24"
reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L137-L149"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L137-L149"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1fe07c33de1971b1f9430851dec4b8cd9f3ac7f087f0de18a2da4a390891b674"
score = 75
quality = 85
@@ -366979,8 +367385,8 @@ rule SIGNATURE_BASE_MAL_SUSP_RANSOM_Lazy_Ransomnote_Feb24
date = "2024-02-23"
modified = "2024-04-24"
reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L151-L163"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L151-L163"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c9416d05f0bd9aab9d6108380c1b5364f4c4e112b6e0726202f083eaacfdcf56"
score = 75
quality = 85
@@ -367001,8 +367407,8 @@ rule SIGNATURE_BASE_SUSP_MAL_Signingcert_Feb24_1 : CVE_2024_1708 CVE_2024_1709 F
date = "2024-02-23"
modified = "2024-04-24"
reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L166-L184"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L166-L184"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "37a39fc1feb4b14354c4d4b279ba77ba51e0d413f88e6ab991aad5dd6a9c231b"
hash = "e8c48250cf7293c95d9af1fb830bb8a5aaf9cfb192d8697d2da729867935c793"
logic_hash = "824efe1fa441322d891805df9a1637ebb44d18889572604acc125bf79a2d1083"
@@ -367028,8 +367434,8 @@ rule SIGNATURE_BASE_MAL_CS_Loader_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
date = "2024-02-23"
modified = "2024-04-24"
reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L186-L206"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L186-L206"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0a492d89ea2c05b1724a58dd05b7c4751e1ffdd2eab3a2f6a7ebe65bf3fdd6fe"
logic_hash = "ae0e25c2dda1b727978977c674e834cd659661c597d88395a6f46ad5a179e9f0"
score = 75
@@ -367052,8 +367458,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Indicators_Feb24 : CVE_2024_1708 CVE_2024
date = "2024-02-23"
modified = "2024-04-24"
reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L208-L228"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L208-L228"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0"
logic_hash = "e4cd6b1a1bc57bf25c71f6bc228f45e4a996f9d9d391aeb3dda9c7d7857610bc"
score = 75
@@ -367077,8 +367483,8 @@ rule SIGNATURE_BASE_MAL_MSI_Mpyutils_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
date = "2024-02-23"
modified = "2024-04-24"
reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L230-L247"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L230-L247"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8e51de4774d27ad31a83d5df060ba008148665ab9caf6bc889a5e3fba4d7e600"
logic_hash = "ba20db486e5d3c29c9702e10628fb3c0e55e52bbec74e3a86ed6511a6475b82f"
score = 70
@@ -367102,8 +367508,8 @@ rule SIGNATURE_BASE_MAL_Beacon_Unknown_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FIL
date = "2024-02-23"
modified = "2024-04-24"
reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L249-L268"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L249-L268"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6e8f83c88a66116e1a7eb10549542890d1910aee0000e3e70f6307aae21f9090"
hash = "b0adf3d58fa354dbaac6a2047b6e30bc07a5460f71db5f5975ba7b96de986243"
hash = "c0f7970bed203a5f8b2eca8929b4e80ba5c3276206da38c4e0a4445f648f3cec"
@@ -367129,8 +367535,8 @@ rule SIGNATURE_BASE_APT_MAL_CISA_10365227_03_Clientuploader_Dec21 : FILE
date = "2021-12-23"
modified = "2021-12-24"
reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stealer_cisa_ar22_277a.yar#L4-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stealer_cisa_ar22_277a.yar#L4-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "84164e1e8074c2565d3cd178babd93694ce54811641a77ffdc8d1084dd468afb"
logic_hash = "76f552b2416ae2426b73a321485f34a611c2a3c1ca35791bc9f1834072dc28be"
score = 80
@@ -367157,8 +367563,8 @@ rule SIGNATURE_BASE_APT_MAL_CISA_10365227_01_APPSTORAGE_Dec21 : APPSTORAGE FILE
date = "2021-12-23"
modified = "2021-12-24"
reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stealer_cisa_ar22_277a.yar#L25-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stealer_cisa_ar22_277a.yar#L25-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "157a0ffd18e05bfd90a4ec108e5458cbde01015e3407b3964732c9d4ceb71656"
hash = "30191b3badf3cdbc65d0ffeb68e0f26cef10a41037351b0f562ab52fce7432cc"
logic_hash = "6a46bc4efa1f22d9fc65d946dbaa7b94de6074e65c228373bb6001f152d5b603"
@@ -367187,8 +367593,8 @@ rule SIGNATURE_BASE_APT_MAL_CISA_10365227_02_Clientuploader_Dec21 : FILE
date = "2021-12-23"
modified = "2021-12-24"
reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_stealer_cisa_ar22_277a.yar#L48-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_stealer_cisa_ar22_277a.yar#L48-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3585c3136686d7d48e53c21be61bb2908d131cf81b826acf578b67bb9d8e9350"
logic_hash = "f9f82b4577568d0bd60bac0d3132ed7ffcb338f508a8689f3126f3d2440432ef"
score = 80
@@ -367215,8 +367621,8 @@ rule SIGNATURE_BASE_Ping_Command_In_EXE : FILE
date = "2016-11-03"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1ea24774471eade7b7c50f0eae520e2b30dbec693e162b83ab0074465f179372"
score = 60
quality = 85
@@ -367238,8 +367644,8 @@ rule SIGNATURE_BASE_Googlebot_Useragent : FILE
date = "2017-01-27"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L17-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L17-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fa6cc3625d3740b91d7f1193cea0bdb621ae9445e42300123b01e322f715b976"
score = 65
quality = 85
@@ -367262,11 +367668,11 @@ rule SIGNATURE_BASE_Gen_Net_Localgroup_Administrators_Add_Command : FILE
date = "2017-07-08"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L34-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L34-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "af4d7c8586022583e2019bbdc3638704e1d237b25e3c214f3bc2db64c58c8bd3"
score = 75
- quality = 60
+ quality = 85
tags = "FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
@@ -367285,8 +367691,8 @@ rule SIGNATURE_BASE_Suspicious_Script_Running_From_HTTP
date = "2017-08-20"
modified = "2025-03-21"
reference = "https://www.hybrid-analysis.com/sample/a112274e109c5819d54aa8de89b0e707b243f4929a83e77439e3ff01ed218a35?environmentId=100"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L48-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L48-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "49ead238b9153886ddbcfe37939628fd848283373e2807797d0849559ebecf6c"
score = 50
quality = 85
@@ -367311,8 +367717,8 @@ rule SIGNATURE_BASE_Reconcommands_In_File : FILE
date = "2017-12-11"
modified = "2025-03-21"
reference = "https://twitter.com/haroonmeer/status/939099379834658817"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L66-L86"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L66-L86"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "73b4bcf76f42a6bf9c3d9dfe3f4e754ce2856e03a47cfd35388d47290209e65d"
score = 40
quality = 85
@@ -367341,8 +367747,8 @@ rule SIGNATURE_BASE_VBS_Dropper_Script_Dec17_1 : FILE
date = "2018-01-01"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L88-L107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L88-L107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f3c55bd6bf382891263887e46a794329c78bff87b7685088911261fc3b3b133d"
score = 80
quality = 85
@@ -367369,8 +367775,8 @@ rule SIGNATURE_BASE_SUSP_PDB_Strings_Keylogger_Backdoor : HIGHVOL FILE
date = "2018-03-23"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L109-L130"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L109-L130"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9a842ff8cd8be98a2e37a81706a9c594e8bf1bcc6bd3cedfe4747cd52f6044f5"
score = 65
quality = 85
@@ -367399,8 +367805,8 @@ rule SIGNATURE_BASE_SUSP_Microsoft_Copyright_String_Anomaly_2 : FILE
date = "2018-05-11"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L132-L146"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L132-L146"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085"
logic_hash = "60bc5d8d0853f474b81d2274a65977a12a481e4b669b38ae47a325eeb60d2735"
score = 60
@@ -367423,8 +367829,8 @@ rule SIGNATURE_BASE_SUSP_LNK_File_Appdata_Roaming : FILE
date = "2018-05-16"
modified = "2025-03-21"
reference = "https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L148-L168"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L148-L168"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5e5c78d3fe3fcdbfb097f833fbb1e15ad1f79e63b330eaba754d8b5296b5165a"
score = 50
quality = 85
@@ -367449,8 +367855,8 @@ rule SIGNATURE_BASE_SUSP_LNK_File_Pathtraversal : FILE
date = "2018-05-16"
modified = "2025-03-21"
reference = "https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L170-L186"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L170-L186"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9935c454518abe7fd4ec4f09e36e4200ec7c9f3b3ad004e9b49d60c08f508236"
score = 40
quality = 85
@@ -367472,8 +367878,8 @@ rule SIGNATURE_BASE_SUSP_Script_Obfuscation_Char_Concat
date = "2018-10-04"
modified = "2025-03-21"
reference = "https://twitter.com/JaromirHorejsi/status/1047084277920411648"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L188-L200"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L188-L200"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b30cc10e915a23c7273f0838297e0d2c9f4fc0ac1f56100eef6479c9d036c12b"
logic_hash = "28b648e0e1c22fefa49a937f40bd4ed09c5d3894ff059979bad69e8bc98fcac2"
score = 65
@@ -367495,8 +367901,8 @@ rule SIGNATURE_BASE_SUSP_Powershell_IEX_Download_Combo
date = "2018-10-04"
modified = "2025-03-21"
reference = "https://twitter.com/JaromirHorejsi/status/1047084277920411648"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L202-L218"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L202-L218"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "13297f64a5f4dd9b08922c18ab100d3a3e6fdeab82f60a4653ab975b8ce393d5"
logic_hash = "0a1507859354e0e0d9284befcf777c4d3883496eb96524a246a1df4f3a247aa9"
score = 65
@@ -367521,8 +367927,8 @@ rule SIGNATURE_BASE_SUSP_Win32Dll_String : FILE
date = "2018-10-24"
modified = "2025-03-21"
reference = "https://medium.com/@Sebdraven/apt-sidewinder-changes-theirs-ttps-to-install-their-backdoor-f92604a2739"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L220-L232"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L220-L232"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7bd7cec82ee98feed5872325c2f8fd9f0ea3a2f6cd0cd32bcbe27dbbfd0d7da1"
logic_hash = "514596e078483920cedf0091cd769d8462acfd39956c3ed3e12d630b02ebb7cc"
score = 65
@@ -367544,8 +367950,8 @@ rule SIGNATURE_BASE_SUSP_Modified_Systemexefilename_In_File : FILE
date = "2018-12-11"
modified = "2025-03-21"
reference = "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L234-L248"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L234-L248"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5723f425e0c55c22c6b8bb74afb6b506943012c33b9ec1c928a71307a8c5889a"
hash = "f1f11830b60e6530b680291509ddd9b5a1e5f425550444ec964a08f5f0c1a44e"
logic_hash = "45c01024c4e6a3563cd27d8a78e2236d49aa795d24f322774a14b4c7289830c4"
@@ -367568,8 +367974,8 @@ rule SIGNATURE_BASE_SUSP_JAVA_Class_With_VBS_Content : FILE
date = "2019-01-03"
modified = "2025-03-20"
reference = "https://www.menlosecurity.com/blog/a-jar-full-of-problems-for-financial-services-companies"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L250-L275"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L250-L275"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e0112efb63f2b2ac3706109a233963c19750b4df0058cc5b9d3fa1f1280071eb"
logic_hash = "bf325bbb6a448f977e4e661e4296c4145de9a809c79cee8538d660ecaff76e94"
score = 70
@@ -367596,8 +368002,8 @@ rule SIGNATURE_BASE_SUSP_RAR_With_PDF_Script_Obfuscation : FILE
date = "2019-04-06"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L277-L293"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L277-L293"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b629b46b009a1c2306178e289ad0a3d9689d4b45c3d16804599f23c90c6bca5b"
logic_hash = "05e9fd7620a70a490548d4562c80497bcf888e493b8e1188e0a0e0c274e2a7e5"
score = 65
@@ -367623,8 +368029,8 @@ rule SIGNATURE_BASE_SUSP_Netsh_Portproxy_Command
date = "2019-04-20"
modified = "2025-03-21"
reference = "https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-interface-portproxy"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L295-L308"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L295-L308"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b33a03e336d0d02750a75efa1b9b6b2ab78b00174582a9b2cb09cd828baea09"
logic_hash = "dbf82a908e77886af1c31c51f5f6684015cbcb22bf28876c2e1b0dd1ea5bd2b4"
score = 65
@@ -367646,8 +368052,8 @@ rule SIGNATURE_BASE_SUSP_Dropperbackdoor_Keywords : FILE
date = "2019-04-24"
modified = "2025-03-21"
reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L310-L322"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L310-L322"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5"
logic_hash = "e83fa95bb2b9ac821d0a00af23834495066ad2cad38ef4f4dcc81aee75415d74"
score = 65
@@ -367669,12 +368075,12 @@ rule SIGNATURE_BASE_SUSP_SFX_Cmd : FILE
date = "2018-09-27"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L324-L336"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L324-L336"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "965129e5d0c439df97624347534bc24168935e7a71b9ff950c86faae3baec403"
logic_hash = "592de6a2165396c4ae8f494e26e56d0a759903b51167b1531b791897dce66868"
score = 65
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -367692,8 +368098,8 @@ rule SIGNATURE_BASE_SUSP_XMRIG_Reference : FILE
date = "2019-06-20"
modified = "2025-03-21"
reference = "https://twitter.com/itaitevet/status/1141677424045953024"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L338-L350"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L338-L350"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c1e6f5fc390a8ada0688885bba7ed90372915deba5a5e7e5b0cd17ec450ce240"
score = 70
quality = 85
@@ -367714,8 +368120,8 @@ rule SIGNATURE_BASE_SUSP_Just_EICAR : FILE
date = "2019-03-24"
modified = "2025-03-21"
reference = "http://2016.eicar.org/85-0-Download.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L352-L365"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L352-L365"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
logic_hash = "a48fc3542fb07131fe0a2e25277009d21b9ca7c9e112873249e5b9c31511af79"
score = 40
@@ -367737,8 +368143,8 @@ rule SIGNATURE_BASE_SUSP_PDB_Path_Keywords : FILE
date = "2019-10-04"
modified = "2025-03-21"
reference = "https://twitter.com/stvemillertime/status/1179832666285326337?s=20"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L367-L393"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L367-L393"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "274b4b40190b8f7e3d123fad63e2bb6b2114a3dbef062791d442109cac149b08"
score = 65
quality = 85
@@ -367774,8 +368180,8 @@ rule SIGNATURE_BASE_SUSP_Disable_ETW_Jun20_1
date = "2020-06-06"
modified = "2025-03-21"
reference = "https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L395-L413"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L395-L413"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "182ad2512bcfbcd92d13380113b32982eb367e458019f07038a12f494dfbebb6"
score = 65
quality = 85
@@ -367802,8 +368208,8 @@ rule SIGNATURE_BASE_SUSP_PE_Discord_Attachment_Oct21_1 : FILE
date = "2021-10-12"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L415-L429"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L415-L429"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4d84ec50738f4c7aca8e77c3aabdcd77f3071733a2245a58283f070f2b220599"
score = 70
quality = 85
@@ -367824,8 +368230,8 @@ rule SIGNATURE_BASE_SUSP_Encoded_Discord_Attachment_Oct21_1 : FILE
date = "2021-10-12"
modified = "2025-03-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_suspicious_strings.yar#L431-L456"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_suspicious_strings.yar#L431-L456"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1ea5a83e91b5c5b4b8a1d507c365bc1583394c97a28b7d7a576f085854676769"
score = 70
quality = 85
@@ -367854,8 +368260,8 @@ rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_1 : FILE
date = "2018-01-28"
modified = "2023-12-05"
reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_suckfly.yar#L14-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_suckfly.yar#L14-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ac7d7c676f58ebfa5def9b84553f00f283c61e4a310459178ea9e7164004e734"
logic_hash = "bf617259df00b16272caffa8f1ffcf8d29cb98cb6ab85ca52e0bb0706f0cd5b0"
score = 75
@@ -367880,8 +368286,8 @@ rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_2 : FILE
date = "2018-01-28"
modified = "2023-12-05"
reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_suckfly.yar#L31-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_suckfly.yar#L31-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b53a316a03b46758cb128e5045dab2717cb36e7b5eb1863ce2524d4f69bc2cab"
hash = "eaee2bf83cf90d35dab8a4711f7a5f2ebf9741007668f3746995f4564046fbdf"
logic_hash = "2e4f6a920e063113a9ff252869e1c2ebdf5a2495b4adb1edaf9500904234f362"
@@ -367916,8 +368322,8 @@ rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_3 : FILE
date = "2018-01-28"
modified = "2023-12-05"
reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_suckfly.yar#L61-L88"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_suckfly.yar#L61-L88"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c2022e1114b162e79e44d974fd310d53e1bbdd8cb4f217553c1227cafed78855"
hash = "47731c9d985ebc2bd7227fced3cc44c6d72e29b52f76fccbdaddd76cc3450706"
logic_hash = "4fddb55999bbbeecd92863219e878c840640e4d17008cb789a255528ef3fac9c"
@@ -367949,8 +368355,8 @@ rule SIGNATURE_BASE_Visualdiscovery_Lonovo_Superfish_SSL_Hijack : FILE
date = "2015-02-19"
modified = "2023-12-05"
reference = "https://twitter.com/4nc4p/status/568325493558272000"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/threat_lenovo_superfish.yar#L4-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/threat_lenovo_superfish.yar#L4-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "99af9cfc7ab47f847103b5497b746407dc566963"
hash = "f0b0cd0227ba302ac9ab4f30d837422c7ae66c46"
hash = "f12edf2598d8f0732009c5cd1df5d2c559455a0b"
@@ -367979,8 +368385,8 @@ rule SIGNATURE_BASE_Elise_Jan18_1 : FILE
date = "2018-01-24"
modified = "2023-12-05"
reference = "https://twitter.com/blu3_team/status/955971742329135105"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lotusblossom_elise.yar#L13-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lotusblossom_elise.yar#L13-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6dc2a49d58dc568944fef8285ad7a03b772b9bdf1fe4bddff3f1ade3862eae79"
logic_hash = "d43486db0d4263f91924da89f1922ad965ed91eadd07ae0705eecd371f31fa44"
score = 75
@@ -368005,8 +368411,8 @@ rule SIGNATURE_BASE_VULN_Confluence_Questions_Plugin_CVE_2022_26138_Jul22_1 : CV
date = "2022-07-21"
modified = "2023-12-05"
reference = "https://www.bleepingcomputer.com/news/security/atlassian-fixes-critical-confluence-hardcoded-credentials-flaw/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vul_confluence_questions_plugin_cve_2022_26138.yar#L2-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vul_confluence_questions_plugin_cve_2022_26138.yar#L2-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c164bd3d9ed1e155d51112e14340b814f6ea782604540c84a6e9efb5c6041156"
score = 50
quality = 85
@@ -368034,8 +368440,8 @@ rule SIGNATURE_BASE_Apt_Backspace : FILE
date = "2015-05-14"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_backspace.yar#L6-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_backspace.yar#L6-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99"
logic_hash = "6fa86ada5c965bd9c199c2a1cf9b691499a3d423da7db50c8987b6725c0c0f29"
score = 75
@@ -368059,8 +368465,8 @@ rule SIGNATURE_BASE_APT_MAL_DNS_Hijacking_Campaign_AA19_024A : FILE
date = "2019-01-25"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/AA19-024A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_aa19_024a.yar#L2-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_aa19_024a.yar#L2-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec"
hash = "45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff"
logic_hash = "8e9ec132df6cf6a89f6694682292feec0f3a762c2df6b1dc8180d9ab68e7183b"
@@ -368087,8 +368493,8 @@ rule SIGNATURE_BASE_Mal_Lockbit4_Rc4_Win_Feb24 : FILE
date = "2024-02-13"
modified = "2026-05-15"
reference = "https://0x0d4y.blog/lockbit4-0-evasion-tales/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lockbit4_rc4_win_feb24.yar#L1-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lockbit4_rc4_win_feb24.yar#L1-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "062311f136d83f64497fd81297360cd4"
logic_hash = "85e8087f875c45ce39b7014fc0737dc86f1e18d4643fdbb0a80d18feff774680"
score = 100
@@ -368114,8 +368520,8 @@ rule SIGNATURE_BASE_Deeppanda_Sl_Txt_Packed
date = "2015-02-08"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_deeppanda.yar#L3-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_deeppanda.yar#L3-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34"
logic_hash = "37f875dcb2c920278c2625085c97a9dcce1907198409595a10e6a3fbce767f35"
score = 75
@@ -368145,8 +368551,8 @@ rule SIGNATURE_BASE_Deeppanda_Lot1
date = "2015-02-08"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_deeppanda.yar#L24-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_deeppanda.yar#L24-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5d201a0fb0f4a96cefc5f73effb61acff9c818e1"
logic_hash = "92169a1288f30dc6008e1a8c9b2b700f878c90aa09634e36fea586e19657dbd1"
score = 75
@@ -368182,8 +368588,8 @@ rule SIGNATURE_BASE_Deeppanda_Htran_Exe
date = "2015-02-08"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_deeppanda.yar#L51-L70"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_deeppanda.yar#L51-L70"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38e21f0b87b3052b536408fdf59185f8b3d210b9"
logic_hash = "9ac5ddc53d3d5292acb3dcf68e66bc3f6ab4b8e61a71597dd84454adc516f95d"
score = 75
@@ -368213,8 +368619,8 @@ rule SIGNATURE_BASE_Deeppanda_Trojan_Kakfum
date = "2015-02-08"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_deeppanda.yar#L72-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_deeppanda.yar#L72-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ab58b6aa7dcc25d8f6e4b70a24e0ccede0d5f6129df02a9e61293c1d7d7640a2"
hash = "c6c3bb72896f8f0b9a5351614fd94e889864cf924b40a318c79560bbbcfa372f"
logic_hash = "0710edea973dce6f5feccf2e7e508cd5f65aa451e0bb5aca503778ffe2363401"
@@ -368243,8 +368649,8 @@ rule SIGNATURE_BASE_APT_Backdoor_SUNBURST_1
date = "2020-12-14"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_solarwinds_sunburst.yar#L6-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_solarwinds_sunburst.yar#L6-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1fc006dead2fd540717e00e468bf30f37bdb1d061a805e33683e4a77db7f9156"
score = 85
quality = 77
@@ -368273,8 +368679,8 @@ rule SIGNATURE_BASE_APT_Backdoor_SUNBURST_2
date = "2020-12-14"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_solarwinds_sunburst.yar#L28-L79"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_solarwinds_sunburst.yar#L28-L79"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2bf0697b110bca88f712cbccaf0d2ba614d6093d6d9595659aefe088848d3826"
score = 85
quality = 83
@@ -368334,8 +368740,8 @@ rule SIGNATURE_BASE_APT_Webshell_SUPERNOVA_1 : FILE
date = "2020-12-14"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_solarwinds_sunburst.yar#L80-L99"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_solarwinds_sunburst.yar#L80-L99"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8471e6b3675e7e9ccfe5b81ab4c599668f2de528f3b179a675f50aa1fd7814b2"
score = 85
quality = 81
@@ -368362,8 +368768,8 @@ rule SIGNATURE_BASE_APT_Webshell_SUPERNOVA_2 : FILE
date = "2020-12-14"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_solarwinds_sunburst.yar#L100-L118"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_solarwinds_sunburst.yar#L100-L118"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "96e344bd2ba3ee07784852db3e9935352762c2fa7b6be88f00cac10a90706ffc"
score = 85
quality = 83
@@ -368389,11 +368795,11 @@ rule SIGNATURE_BASE_APT_Hacktool_PS1_COSMICGALE_1
date = "2020-12-14"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_solarwinds_sunburst.yar#L119-L140"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_solarwinds_sunburst.yar#L119-L140"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c7b4d3c29d57b8db8d21e3a436c83617bc3fe14e66ccc1500b33a3774f09ee12"
score = 85
- quality = 40
+ quality = 65
tags = ""
strings:
@@ -368419,8 +368825,8 @@ rule SIGNATURE_BASE_APT_Dropper_Raw64_TEARDROP_1
date = "2020-12-14"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_solarwinds_sunburst.yar#L141-L156"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_solarwinds_sunburst.yar#L141-L156"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6ab5197e7a1a123055b361a2ef79f8a77a7935606fccc8f163ea5914c94cd14d"
score = 85
quality = 85
@@ -368443,8 +368849,8 @@ rule SIGNATURE_BASE_APT_Dropper_Win64_TEARDROP_1 : FILE
date = "2020-12-14"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_solarwinds_sunburst.yar#L157-L174"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_solarwinds_sunburst.yar#L157-L174"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a1fa9b9c700601d10cb77ec714b972f04308de615dfc519f680fc956227cc11d"
score = 70
quality = 85
@@ -368469,8 +368875,8 @@ rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1 : FILE
date = "2020-10-05"
modified = "2023-12-05"
reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_vhd_ransomware.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_vhd_ransomware.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
hash = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
hash = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"
@@ -368499,8 +368905,8 @@ rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2 : FILE
date = "2020-10-05"
modified = "2023-12-05"
reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_lazarus_vhd_ransomware.yar#L26-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_vhd_ransomware.yar#L26-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b"
hash = "73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79"
logic_hash = "cf28771a854b3bacc911375c09f6c6bc6ddebff95612a509890c56a5a14e8921"
@@ -368526,8 +368932,8 @@ rule SIGNATURE_BASE_EXT_HKTL_Nighthawk_RAT : FILE
date = "2022-11-22"
modified = "2025-07-01"
reference = "https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_nighthawk_c2.yar#L3-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_nighthawk_c2.yar#L3-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988"
hash = "9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8"
hash = "38881b87826f184cc91559555a3456ecf00128e01986a9df36a72d60fb179ccf"
@@ -368558,8 +368964,8 @@ rule SIGNATURE_BASE_HKTL_MAL_Nighthawk_Nov_2022_1 : NIGHTHAWK BEACON FILE
date = "2022-11-22"
modified = "2025-07-01"
reference = "https://web.archive.org/web/20221125224850/https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_nighthawk_c2.yar#L32-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_nighthawk_c2.yar#L32-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988"
hash = "9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8"
hash = "f3bba2bfd4ed48b5426e36eba3b7613973226983a784d24d7a20fcf9df0de74e"
@@ -368586,8 +368992,8 @@ rule SIGNATURE_BASE_Goldeneye_Ransomware_XLS : FILE
date = "2016-12-06"
modified = "2023-12-05"
reference = "https://goo.gl/jp2SkT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_goldeneye.yar#L10-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_goldeneye.yar#L10-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2320d4232ee80cc90bacd768ba52374a21d0773c39895b88cdcaa7782e16c441"
logic_hash = "827c1d1c0f9c3ebd77413de7e1db5e29d05f2ece6676c79a79f6c1ff2788f42b"
score = 75
@@ -368611,8 +369017,8 @@ rule SIGNATURE_BASE_Goldeneyeransomware_Dropper_Malformedzoomit : FILE
date = "2016-12-06"
modified = "2023-12-05"
reference = "https://goo.gl/jp2SkT"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_goldeneye.yar#L26-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_goldeneye.yar#L26-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b5ef16922e2c76b09edd71471dd837e89811c5e658406a8495c1364d0d9dc690"
logic_hash = "c18405a272c9210973e3184b8267306919cba8795b12d5982a9e3e8f748f9782"
score = 75
@@ -368636,8 +369042,8 @@ rule SIGNATURE_BASE_VUL_Tomcat_Catalina_CVE_2020_1938 : FILE
date = "2020-02-28"
modified = "2023-12-05"
reference = "https://www.chaitin.cn/en/ghostcat"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vul_cve_2020_1938.yar#L2-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vul_cve_2020_1938.yar#L2-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "902b469c8a31add2254e8d5ade6bc22f1bc0a2b10ea70f3131f0640f2900e667"
score = 50
quality = 85
@@ -368663,8 +369069,8 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_1 : FILE
date = "2016-12-14"
modified = "2023-12-05"
reference = "https://goo.gl/8abDE6"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_promethium_neodymium.yar#L10-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_promethium_neodymium.yar#L10-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e12031da58c0b08e8b610c3786ca2b66fcfea8ddc9ac558d08a29fd27e95a3e7"
logic_hash = "143e52eedc5c3be9bbf0f916b232de26e4ed5c7e81e3f77cae70e6af84d31de1"
score = 75
@@ -368691,8 +369097,8 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_2 : FILE
date = "2016-12-14"
modified = "2023-12-05"
reference = "https://goo.gl/8abDE6"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_promethium_neodymium.yar#L29-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_promethium_neodymium.yar#L29-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1aef507c385a234e8b10db12852ad1bd66a04730451547b2dcb26f7fae16e01f"
logic_hash = "2d97ee2698b6a09da7f8c6850583ec7493cc288368b98b20790dd8305521f894"
score = 75
@@ -368718,8 +369124,8 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_3 : FILE
date = "2016-12-14"
modified = "2023-12-05"
reference = "https://goo.gl/8abDE6"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_promethium_neodymium.yar#L47-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_promethium_neodymium.yar#L47-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f98ac11c78ad1b4c5c5c10a88857baf7af43acb9162e8077709db9d563bcf02"
logic_hash = "47595e07b59744f520cd9025bcec267384329b7687fd25842f5f7a8f4b360674"
score = 75
@@ -368745,8 +369151,8 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_4 : FILE
date = "2016-12-14"
modified = "2023-12-05"
reference = "https://goo.gl/8abDE6"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_promethium_neodymium.yar#L65-L85"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_promethium_neodymium.yar#L65-L85"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "15ededb19ec5ab6f03db1106d2ccdeeacacdb8cd708518d065cacb1b0d7e955d"
logic_hash = "0e8bb00133a94b29c482b9785048025a62e2706f3653c1915be7b702fbfe48d6"
score = 75
@@ -368776,8 +369182,8 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_5 : FILE
date = "2016-12-14"
modified = "2023-12-05"
reference = "https://goo.gl/8abDE6"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_promethium_neodymium.yar#L87-L105"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_promethium_neodymium.yar#L87-L105"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a8b7e3edaa18c6127e98741503c3a2a66b7720d2abd967c94b8a5f2e99575ac5"
logic_hash = "69433fae4d51f7fd7b6f5b683f9c751d0f0352b8ed805a8177085e635eb26260"
score = 75
@@ -368805,8 +369211,8 @@ rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_6 : FILE
date = "2016-12-14"
modified = "2023-12-05"
reference = "https://goo.gl/8abDE6"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_promethium_neodymium.yar#L107-L125"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_promethium_neodymium.yar#L107-L125"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dbd8cbbaf59d19cf7566042945e36409cd090bc711e339d3f2ec652bc26d6a03"
logic_hash = "6cfccb863c3ea8f3f60520b0df03eee8e3b754699aa339fea21489d34e29f47b"
score = 75
@@ -368834,8 +369240,8 @@ rule SIGNATURE_BASE_APT30_Generic_H : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L10-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L10-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2a4c8752f3e7fde0139421b8d5713b29c720685d"
hash = "4350e906d590dca5fcc90ed3215467524e0a4e3d"
logic_hash = "e4affe7dc01efc4d6c25aaae4679bc1f8fddd97794e351d30501eaeb8e1d1dea"
@@ -368861,8 +369267,8 @@ rule SIGNATURE_BASE_APT30_Sample_2 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L28-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L28-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0359ffbef6a752ee1a54447b26e272f4a5a35167"
logic_hash = "e34dbb90fc868b0619d3d2aa1b6176252836a6ae72e6f52b1eba632054f7c272"
score = 75
@@ -368889,8 +369295,8 @@ rule SIGNATURE_BASE_APT30_Sample_3 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L47-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L47-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d0320144e65c9af0052f8dee0419e8deed91b61b"
logic_hash = "ee61ec1fdf27fa21bcc235fce0ab8dc74968b39a747648ce828fb4826cf1d234"
score = 75
@@ -368917,8 +369323,8 @@ rule SIGNATURE_BASE_APT30_Generic_C : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L66-L88"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L66-L88"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8667f635fe089c5e2c666b3fe22eaf3ff8590a69"
hash = "0c4fcef3b583d0ffffc2b14b9297d3a4"
hash = "37aee58655f5859e60ece6b249107b87"
@@ -368950,8 +369356,8 @@ rule SIGNATURE_BASE_APT30_Sample_4 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L90-L108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L90-L108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "75367d8b506031df5923c2d8d7f1b9f643a123cd"
logic_hash = "ec9542acb583bd5812d561bea70e89e0fcddc1eaef14d3ea5b8ad29711ed17ae"
score = 75
@@ -368979,8 +369385,8 @@ rule SIGNATURE_BASE_APT30_Sample_5 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L110-L127"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L110-L127"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1a2dd2a0555dc746333e7c956c58f7c4cdbabd4b"
logic_hash = "3738076d97bf19404bad20c2419eae83dd2b65400d5bd135ffe73362c008de9b"
score = 75
@@ -369007,8 +369413,8 @@ rule SIGNATURE_BASE_APT30_Sample_6 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L129-L143"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L129-L143"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "00e69b059ad6b51b76bc476a115325449d10b4c0"
logic_hash = "139719139056f575967629f0153e0a05239bc26f61f6d4324cfb6a816518c3df"
score = 75
@@ -369032,8 +369438,8 @@ rule SIGNATURE_BASE_APT30_Sample_7 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L145-L163"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L145-L163"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "868d1f4c106a08bd2e5af4f23139f0e0cd798fba"
logic_hash = "f7922d795bc92714a9ef4861bc9c4ac9921a73749e3aa1d5f7dbc3c991fe7145"
score = 75
@@ -369061,8 +369467,8 @@ rule SIGNATURE_BASE_APT30_Generic_E : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L165-L183"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L165-L183"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1dbb584e19499e26398fb0a7aa2a01b7"
hash = "572c9cd4388699347c0b2edb7c6f5e25"
hash = "8ff473bedbcc77df2c49a91167b1abeb"
@@ -369090,8 +369496,8 @@ rule SIGNATURE_BASE_APT30_Sample_8 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L185-L201"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L185-L201"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9531e21652143b8b129ab8c023dc05fef2a17cc3"
logic_hash = "bff21d517e97d2b13dff2b5ebc9a5b82b8f7635943c89f992b41d269623cd498"
score = 75
@@ -369117,8 +369523,8 @@ rule SIGNATURE_BASE_APT30_Generic_B : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L203-L222"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L203-L222"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0fcb4ffe2eb391421ec876286c9ddb6c"
hash = "29395c528693b69233c1c12bef8a64b3"
hash = "4c6b21e98ca03e0ef0910e07cef45dac"
@@ -369147,8 +369553,8 @@ rule SIGNATURE_BASE_APT30_Generic_I : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L224-L240"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L224-L240"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fe211c7a081c1dac46e3935f7c614549"
hash = "8c9db773d387bf9b3f2b6a532e4c937c"
logic_hash = "e6f0edcbf6e0590c8b4a558142053d5938e86d13d65787f02336dc2a173d5963"
@@ -369174,8 +369580,8 @@ rule SIGNATURE_BASE_APT30_Sample_9 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L242-L263"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L242-L263"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "442bf8690401a2087a340ce4a48151c39101652f"
logic_hash = "0c5465bdafcbca02f855a0cba1fbb4c19d8d21b714dbe777b942dcd1a7acb257"
score = 75
@@ -369206,8 +369612,8 @@ rule SIGNATURE_BASE_APT30_Sample_10 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L264-L283"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L264-L283"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eb518cda3c4f4e6938aaaee07f1f7db8ee91c901"
logic_hash = "5a6bd8223fbce133bd11b903edfd7f8ff5a436e26a47c048a5ac606ad4a0b564"
score = 75
@@ -369236,8 +369642,8 @@ rule SIGNATURE_BASE_APT30_Sample_11 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L285-L312"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L285-L312"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "59066d5d1ee3ad918111ed6fcaf8513537ff49a6"
logic_hash = "5e86b53591caa7c783a946205a3d04f91c71294d844e6f6ee88c3bc78e603ea0"
score = 75
@@ -369274,8 +369680,8 @@ rule SIGNATURE_BASE_APT30_Sample_12 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L314-L329"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L314-L329"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b02b5720ff0f73f01eb2ba029a58b645c987c4bc"
logic_hash = "997c91267f956bd7d2a7edca9817ebc80bbf1eed944b3bc01cc8bb01927deb1e"
score = 75
@@ -369300,8 +369706,8 @@ rule SIGNATURE_BASE_APT30_Sample_13 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L331-L349"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L331-L349"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a359f705a833c4a4254443b87645fd579aa94bcf"
logic_hash = "cd5285e8b78493b64704cec21c13d0a017d66936aa8356cfea2aa77c6f87b9e7"
score = 75
@@ -369329,8 +369735,8 @@ rule SIGNATURE_BASE_APT30_Sample_14 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L351-L367"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L351-L367"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b0740175d20eab79a5d62cdbe0ee1a89212a8472"
logic_hash = "e5f352b1aa643b9508c01bbe921197ebd8992ec94036b869c55970f0177164d3"
score = 75
@@ -369356,8 +369762,8 @@ rule SIGNATURE_BASE_APT30_Sample_15 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L369-L387"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L369-L387"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a8576804a2bbe4e5d05d1718f90b6a4332df027"
logic_hash = "5179f39bdcb064f55479ad147a019dd0b3874783c6bad650e84cfd9d0430bb70"
score = 75
@@ -369385,8 +369791,8 @@ rule SIGNATURE_BASE_APT30_Sample_16 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L389-L407"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L389-L407"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "066d06ac08b48d3382d46bbeda6ad411b6d6130e"
logic_hash = "59ea90ac0590bd87a48fabf1a3fa7ece31560b980b738a34227937bbf82a1c55"
score = 75
@@ -369414,8 +369820,8 @@ rule SIGNATURE_BASE_APT30_Generic_A : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L409-L429"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L409-L429"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9f49aa1090fa478b9857e15695be4a89f8f3e594"
hash = "396116cfb51cee090822913942f6ccf81856c2fb"
hash = "fef9c3b4b35c226501f7d60816bb00331a904d5b"
@@ -369445,8 +369851,8 @@ rule SIGNATURE_BASE_APT30_Sample_17 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L431-L445"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L431-L445"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c3aa52ff1d19e8fc6704777caf7c5bd120056845"
logic_hash = "43913151325fbce993dbfec0acf64ca835b12270c47156ae81b0ce4f32c7bde1"
score = 75
@@ -369470,8 +369876,8 @@ rule SIGNATURE_BASE_APT30_Sample_18 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L446-L466"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L446-L466"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "355436a16d7a2eba8a284b63bb252a8bb1644751"
logic_hash = "d20f1d1b7b43defc36c7b1f99f14ed9e73e770b6f43d0ad92110cf9178b35b15"
score = 75
@@ -369501,8 +369907,8 @@ rule SIGNATURE_BASE_APT30_Generic_G : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L468-L489"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L468-L489"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1612b392d6145bfb0c43f8a48d78c75f"
hash = "53f1358cbc298da96ec56e9a08851b4b"
hash = "c2acc9fc9b0f050ec2103d3ba9cb11c0"
@@ -369533,8 +369939,8 @@ rule SIGNATURE_BASE_APT30_Sample_19 : FILE
date = "2015-04-03"
modified = "2023-01-06"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L491-L517"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L491-L517"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cfa438449715b61bffa20130df8af778ef011e15"
logic_hash = "9127ae31c5b818a2759f9d33c74c8631079539e7fa8e49e5514b016df2624065"
score = 75
@@ -369568,8 +369974,8 @@ rule SIGNATURE_BASE_APT30_Generic_E_V2 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L519-L535"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L519-L535"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eca53a9f6251ddf438508b28d8a483f91b99a3fd"
logic_hash = "25a7e5780f56b4f9cfb76494926c446a39a88bef2cda82b31e6de2b85c5edbda"
score = 75
@@ -369595,8 +370001,8 @@ rule SIGNATURE_BASE_APT30_Sample_20 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L537-L557"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L537-L557"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b1c37632e604a5d1f430c9351f87eb9e8ea911c0"
logic_hash = "f94cbd4b8e7ba302db9ac4ef3617bd68aa0aa1ee3cfc6dfee4621223bbdae3c5"
score = 75
@@ -369626,8 +370032,8 @@ rule SIGNATURE_BASE_APT30_Sample_21 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L559-L575"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L559-L575"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d315daa61126616a79a8582145777d8a1565c615"
logic_hash = "e3e431bb6915d99b8aa1915419b60ba47372005b9b4994a924746a91bad80310"
score = 75
@@ -369653,8 +370059,8 @@ rule SIGNATURE_BASE_APT30_Sample_22 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L577-L595"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L577-L595"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0d17a58c24753e5f8fd5276f62c8c7394d8e1481"
logic_hash = "88a45d248eba7b9776e2e7d345d2948e00a94a7e359acb89d1943be55ab342ad"
score = 75
@@ -369682,8 +370088,8 @@ rule SIGNATURE_BASE_APT30_Generic_F : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L597-L615"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L597-L615"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "09010917cd00dc8ddd21aeb066877aa2"
hash = "4c10a1efed25b828e4785d9526507fbc"
hash = "b7b282c9e3eca888cbdb5a856e07e8bd"
@@ -369711,8 +370117,8 @@ rule SIGNATURE_BASE_APT30_Sample_23 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L617-L637"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L617-L637"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9865e24aadb4480bd3c182e50e0e53316546fc01"
logic_hash = "64ff048b061431e0834ac40bfccb0d9e8ca60ffb022578ef910e6ffc511be6ed"
score = 75
@@ -369742,8 +370148,8 @@ rule SIGNATURE_BASE_APT30_Sample_24 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L639-L658"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L639-L658"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "572caa09f2b600daa941c60db1fc410bef8d1771"
logic_hash = "9d550fd0225f1c4e3b16ae53648644d7bb5c80e99e2a1a3d199e51c7219c2e94"
score = 75
@@ -369772,8 +370178,8 @@ rule SIGNATURE_BASE_APT30_Sample_25 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L660-L679"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L660-L679"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "44a21c8b3147fabc668fee968b62783aa9d90351"
logic_hash = "86945188f888762ae585463df7cfb6e5fed30d0fcfcca4e642aedf07a0193ae7"
score = 75
@@ -369802,8 +370208,8 @@ rule SIGNATURE_BASE_APT30_Sample_26 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L681-L700"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L681-L700"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e26588113417bf68cb0c479638c9cd99a48e846d"
logic_hash = "b585687c071dc2dddb888906f47b7af6bc7683e902d3afb42364896e800fac5c"
score = 75
@@ -369832,8 +370238,8 @@ rule SIGNATURE_BASE_APT30_Generic_D : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L702-L725"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L702-L725"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "35dfb55f419f476a54241f46e624a1a4"
hash = "4fffcbdd4804f6952e0daf2d67507946"
hash = "597805832d45d522c4882f21db800ecf"
@@ -369866,8 +370272,8 @@ rule SIGNATURE_BASE_APT30_Sample_27 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L727-L746"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L727-L746"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "959573261ca1d7e5ddcd19447475b2139ca24fe1"
logic_hash = "5ef0661c5c04f0f0923548509363971011194a16e4308fcfdea5db90e85518a4"
score = 75
@@ -369896,8 +370302,8 @@ rule SIGNATURE_BASE_APT30_Sample_28 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L748-L776"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L748-L776"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e62a63307deead5c9fcca6b9a2d51fb0"
hash = "5b590798da581c894d8a87964763aa8b"
logic_hash = "d246a188ad9ec69948bef6018bab1e7a244c76dcf511c3f9d16024ef7e369ae2"
@@ -369935,8 +370341,8 @@ rule SIGNATURE_BASE_APT30_Sample_29 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L778-L798"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L778-L798"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "44492c53715d7c79895904543843a321491cb23a"
logic_hash = "7a59118ba00413961e6fc4d54680373d033a38d698613f853f67137b85c123a7"
score = 75
@@ -369966,8 +370372,8 @@ rule SIGNATURE_BASE_APT30_Sample_30 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L800-L817"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L800-L817"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3b684fa40b4f096e99fbf535962c7da5cf0b4528"
logic_hash = "5ecfc8d53b768f624c8765f70708bfaae5396d7aa6b0335f7c656f4350649c5d"
score = 75
@@ -369994,8 +370400,8 @@ rule SIGNATURE_BASE_APT30_Sample_31 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L819-L836"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L819-L836"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8b4271167655787be1988574446125eae5043aca"
logic_hash = "003bfa9774d3e85829cc266d06417b86287986994995adfa7a2bd26c3648c07e"
score = 75
@@ -370022,8 +370428,8 @@ rule SIGNATURE_BASE_APT30_Generic_J : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L838-L869"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L838-L869"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "49aca228674651cba776be727bdb7e60"
hash = "5c7a6b3d1b85fad17333e02608844703"
hash = "649fa64127fef1305ba141dd58fb83a5"
@@ -370064,8 +370470,8 @@ rule SIGNATURE_BASE_APT30_Microfost : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L871-L885"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L871-L885"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "57169cb4b8ef7a0d7ebd7aa039d1a1efd6eb639e"
logic_hash = "1fe5be3a88859fd3d485adfba92cf117afedc739bd0a46c039124919c3b81361"
score = 75
@@ -370089,8 +370495,8 @@ rule SIGNATURE_BASE_APT30_Generic_K : FILE
date = "2015-04-03"
modified = "2023-01-06"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L887-L917"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L887-L917"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "142bc01ad412799a7f9ffed994069fecbd5a2f93"
logic_hash = "eed03bb4290eef0ad1cf362a157923aa1fb8faa9305b5aaba3563d0a4e65e1a5"
score = 75
@@ -370127,8 +370533,8 @@ rule SIGNATURE_BASE_APT30_Sample_33 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L919-L939"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L919-L939"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "72c568ee2dd75406858c0294ccfcf86ad0e390e4"
logic_hash = "295c2d9fcf1c3bab54650fd1d203dfb8c12269945aad8927066ef6f815abea69"
score = 75
@@ -370158,8 +370564,8 @@ rule SIGNATURE_BASE_APT30_Sample_34 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L941-L960"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L941-L960"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "216868edbcdd067bd2a9cce4f132d33ba9c0d818"
logic_hash = "2406f9613585669f88c389ea9729a089f6aef13fba46d60b713f51cd3a946b5d"
score = 75
@@ -370188,8 +370594,8 @@ rule SIGNATURE_BASE_APT30_Sample_35 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L962-L977"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L962-L977"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "df48a7cd6c4a8f78f5847bad3776abc0458499a6"
logic_hash = "a70d9471215ddcfe84a39b33f53c4114b205aa2cc95cd93081afe442ee2b8b42"
score = 75
@@ -370214,8 +370620,8 @@ rule SIGNATURE_BASE_APT30_Sample_1 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L979-L996"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L979-L996"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8cea83299af8f5ec6c278247e649c9d91d4cf3bc"
logic_hash = "5f20b60b8721d62731708630a3443741c956304c553f651572282336995f6d4f"
score = 75
@@ -370242,8 +370648,8 @@ rule SIGNATURE_BASE_APT30_Generic_1 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L998-L1031"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L998-L1031"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aaa5c64200ff0818c56ebe4c88bcc1143216c536"
hash = "cb4263cab467845dae9fae427e3bbeb31c6a14c2"
hash = "b69b95db8a55a050d6d6c0cba13d73975b8219ca"
@@ -370286,8 +370692,8 @@ rule SIGNATURE_BASE_APT30_Generic_2 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L1032-L1087"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L1032-L1087"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aba8b9fa213e5e2f1f0404d13fecc20ea8651b57"
hash = "7f11f5c9475240e5dd2eea7726c9229972cffc1f"
hash = "94d3f91d1e50ecea729617729013c3d143bf2c3e"
@@ -370352,8 +370758,8 @@ rule SIGNATURE_BASE_APT30_Generic_4 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L1110-L1140"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L1110-L1140"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bb390f99bfde234bbed59f6a0d962ba874b2396c"
hash = "b47e20ac5889700438dc241f28f4e224070810d2"
hash = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
@@ -370393,8 +370799,8 @@ rule SIGNATURE_BASE_APT30_Generic_5 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L1142-L1163"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L1142-L1163"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cb4833220c508182c0ccd4e0d5a867d6c4e675f8"
hash = "dfc9a87df2d585c479ab02602133934b055d156f"
hash = "bf59d5ff7d38ec5ffb91296e002e8742baf24db5"
@@ -370425,8 +370831,8 @@ rule SIGNATURE_BASE_APT30_Generic_6 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L1165-L1186"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L1165-L1186"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b9aafb575d3d1732cb8fdca5ea226cebf86ea3c9"
hash = "2c5e347083b77c9ead9e75d41e2fabe096460bba"
hash = "5d39a567b50c74c4a921b5f65713f78023099933"
@@ -370457,8 +370863,8 @@ rule SIGNATURE_BASE_APT30_Generic_7 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L1188-L1206"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L1188-L1206"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2415f661046fdbe3eea8cd276b6f13354019b1a6"
hash = "e814914079af78d9f1b71000fee3c29d31d9b586"
hash = "0263de239ccef669c47399856d481e3361408e90"
@@ -370486,8 +370892,8 @@ rule SIGNATURE_BASE_APT30_Generic_8 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L1207-L1232"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L1207-L1232"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b47e20ac5889700438dc241f28f4e224070810d2"
hash = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
hash = "ac96d7f5957aef09bd983465c497de24c6d17a92"
@@ -370522,8 +370928,8 @@ rule SIGNATURE_BASE_APT30_Generic_9 : FILE
date = "2015-04-13"
modified = "2023-12-05"
reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt30_backspace.yar#L1234-L1255"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt30_backspace.yar#L1234-L1255"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "00d9949832dc3533592c2ce06a403ef19deddce9"
hash = "27a2b981d4c0bb8c3628bfe990db4619ddfdff74"
hash = "05f66492c163ec2a24c6a87c7a43028c5f632437"
@@ -370554,8 +370960,8 @@ rule SIGNATURE_BASE_Crime_Win_Rat_Alienspy : FILE
date = "2015-04-04"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_alienspy_rat.yar#L2-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_alienspy_rat.yar#L2-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "075fa0567d3415fbab3514b8aa64cfcb"
hash = "818afea3040a887f191ee9d0579ac6ed"
hash = "973de705f2f01e82c00db92eaa27912c"
@@ -370606,8 +371012,8 @@ rule SIGNATURE_BASE_Reflectiveloader : FILE
date = "2017-07-17"
modified = "2021-03-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_loaders.yar#L14-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_loaders.yar#L14-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4d839674f8d8181b11af964a7c84a9eb8f07623500dd2695fca9ca3b15c247e2"
score = 70
quality = 85
@@ -370636,8 +371042,8 @@ rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_1 : FILE
date = "2017-08-20"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_loaders.yar#L53-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_loaders.yar#L53-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f2f85855914345eec629e6fc5333cf325a620531d1441313292924a88564e320"
logic_hash = "9ad012dda538d37242c92c6ed16a0fb1cd9252a2884387f8e7d9c80b041c8fea"
score = 75
@@ -370663,8 +371069,8 @@ rule SIGNATURE_BASE_DLL_Injector_Lynx : FILE
date = "2017-08-20"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_loaders.yar#L78-L100"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_loaders.yar#L78-L100"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d594f60e766e0c3261a599b385e3f686b159a992d19fa624fad8761776efa4f0"
logic_hash = "1904b152c42126abd87671747dc2733e2a5e2a01ab55346c131fb430fe5ba58e"
score = 75
@@ -370694,8 +371100,8 @@ rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_2 : FILE
date = "2017-08-20"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_loaders.yar#L102-L128"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_loaders.yar#L102-L128"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c2a7a2d0b05ad42386a2bedb780205b7c0af76fe9ee3d47bbe217562f627fcae"
hash = "b90831aaf8859e604283e5292158f08f100d4a2d4e1875ea1911750a6cb85fe0"
logic_hash = "f01b2cf754c3527d0d7fd44c28d3cdb9327762572b43a7d6f7667e5c2a26ab17"
@@ -370724,8 +371130,8 @@ rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_3 : FILE
date = "2017-08-20"
modified = "2022-12-21"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_loaders.yar#L130-L154"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_loaders.yar#L130-L154"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d10e4b3f1d00f4da391ac03872204dc6551d867684e0af2a4ef52055e771f474"
logic_hash = "4fbba94e6d3dc7b4976c90c0f95683c548f3c444bf5eaf0a7c55d96150978a67"
score = 75
@@ -370752,8 +371158,8 @@ rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_4 : FILE
date = "2017-08-20"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_loaders.yar#L156-L176"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_loaders.yar#L156-L176"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "205b881701d3026d7e296570533e5380e7aaccaa343d71b6fcc60802528bdb74"
hash = "f76151646a0b94024761812cde1097ae2c6d455c28356a3db1f7905d3d9d6718"
logic_hash = "b988ea586589dced18f2165eff431be897b3e96fce2d124f5f41d52b520ccd76"
@@ -370781,8 +371187,8 @@ rule SIGNATURE_BASE_Tscookie_RAT : FILE
date = "2018-03-06"
modified = "2023-12-05"
reference = "http://blog.jpcert.or.jp/2018/03/malware-tscooki-7aa0.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_tscookie_rat.yar#L13-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_tscookie_rat.yar#L13-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2bd13d63797864a70b775bd1994016f5052dc8fd1fd83ce1c13234b5d304330d"
logic_hash = "c6121c541a77219b17351787973a4bc06a8d941ebd5f9e5e1e14ad4740a3fe7b"
score = 75
@@ -370808,8 +371214,8 @@ rule SIGNATURE_BASE_SUSP_TINY_PE : FILE
date = "2019-10-23"
modified = "2023-12-05"
reference = "https://webserver2.tecgraf.puc-rio.br/~ismael/Cursos/YC++/apostilas/win32_xcoff_pe/tyne-example/Tiny%20PE.htm"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_file_anomalies.yar#L3-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_file_anomalies.yar#L3-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5eabfa8e0fd4d6d1376d263484fba985e7a4b05d68046be1f79c1dfdbbfff9e5"
score = 80
quality = 85
@@ -370830,8 +371236,8 @@ rule SIGNATURE_BASE_SUSP_GIF_Anomalies : FILE
date = "2020-07-02"
modified = "2023-12-05"
reference = "https://en.wikipedia.org/wiki/GIF"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_file_anomalies.yar#L17-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_file_anomalies.yar#L17-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "64d17c8de72600cd889a802fd002faaaf9a3a17f7fa157ae5b2b620b28e6c439"
score = 60
quality = 85
@@ -370850,8 +371256,8 @@ rule SIGNATURE_BASE_SUSP_Hxd_Icon_Anomaly_May23_1 : FILE
date = "2023-05-29"
modified = "2023-12-05"
reference = "https://www.linkedin.com/feed/update/urn:li:activity:7068631930040188929/?utm_source=share&utm_medium=member_ios"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_file_anomalies.yar#L32-L84"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_file_anomalies.yar#L32-L84"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a328687ac8b868fb78a49188b286a8951c6043a7ff6ff0c7a23c3f9b3ef15eb2"
score = 65
quality = 85
@@ -370891,8 +371297,8 @@ rule SIGNATURE_BASE_APT_MAL_Falsefont_Backdoor_Jan24 : FILE
date = "2024-01-11"
modified = "2024-04-24"
reference = "https://twitter.com/MsftSecIntel/status/1737895710169628824"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_peach_sandstorm.yar#L1-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_peach_sandstorm.yar#L1-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614"
logic_hash = "9a1b3779b63dd7fa8ddc84067dec09542518e9acebbf5d3b45cb75ec4add1158"
score = 80
@@ -370923,8 +371329,8 @@ rule SIGNATURE_BASE_Metasploit_Loader_Rsmudge : FILE
date = "2016-04-20"
modified = "2023-12-05"
reference = "https://github.com/rsmudge/metasploit-loader"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_loader_rsmudge.yar#L10-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_loader_rsmudge.yar#L10-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "afe34bfe2215b048915b1d55324f1679d598a0741123bc24274d4edc6e395a8d"
logic_hash = "50b1898e3087a5e0876b87179252c452af48e00bbef52297060d70acd90d0133"
score = 75
@@ -370951,14 +371357,14 @@ rule SIGNATURE_BASE_MAL_ZIP_Socgholish_Mar21_1 : ZIP JS SOCGHOLISH FILE
date = "2021-03-29"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_socgholish.yar#L1-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_socgholish.yar#L1-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4f6566c145be5046b6be6a43c64d0acae38cada5eb49b2f73135b3ac3d6ba770"
hash = "54f756fbf8c20c76af7c9f538ff861690800c622d1c9db26eb3afedc50835b09"
hash = "dfdbec1846b74238ba3cfb8c7580c64a0fa8b14b6ed2b0e0e951cc6a9202dd8d"
logic_hash = "6621b029f65720e468bd167fcd7429a1f7ba8975298ddbd913b13fbe9e117df2"
score = 75
- quality = 35
+ quality = 60
tags = "ZIP, JS, SOCGHOLISH, FILE"
strings:
@@ -370980,8 +371386,8 @@ rule SIGNATURE_BASE_EXT_MAL_JS_Socgholish_Mar21_1 : JS SOCGHOLISH FILE
date = "2021-03-29"
modified = "2023-01-02"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_socgholish.yar#L25-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_socgholish.yar#L25-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7ccbdcde5a9b30f8b2b866a5ca173063dec7bc92034e7cf10e3eebff017f3c23"
hash = "f6d738baea6802cbbb3ae63b39bf65fbd641a1f0d2f0c819a8c56f677b97bed1"
hash = "c7372ffaf831ad963c0a9348beeaadb5e814ceeb878a0cc7709473343d63a51c"
@@ -371014,8 +371420,8 @@ rule SIGNATURE_BASE_Socgholish_JS_22_02_2022 : FILE
date = "2022-02-22"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_socgholish.yar#L53-L72"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_socgholish.yar#L53-L72"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3e14d04da9cc38f371961f6115f37c30"
hash = "dffa20158dcc110366f939bd137515c3"
hash = "afee3af324951b1840c789540d5c8bff"
@@ -371043,8 +371449,8 @@ rule SIGNATURE_BASE_CVE_2017_8759_Mal_HTA : CVE_2017_8759 FILE
date = "2017-09-14"
modified = "2023-12-05"
reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2017_8759.yar#L11-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2017_8759.yar#L11-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fee2ab286eb542c08fdfef29fabf7796a0a91083a0ee29ebae219168528294b5"
logic_hash = "f98578104e411fcf75a46f8a0bc3e561c94d0ca4ad7c1aae2595d03a29efd74e"
score = 75
@@ -371067,8 +371473,8 @@ rule SIGNATURE_BASE_CVE_2017_8759_Mal_Doc : CVE_2017_8759 FILE
date = "2017-09-14"
modified = "2023-11-21"
reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2017_8759.yar#L26-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2017_8759.yar#L26-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6314c5696af4c4b24c3a92b0e92a064aaf04fd56673e830f4d339b8805cc9635"
logic_hash = "0c81feebef463fee41661ca951a39ee789db5d36acc8262ddb391609d8680108"
score = 75
@@ -371095,8 +371501,8 @@ rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Via_JS : FILE
date = "2017-09-14"
modified = "2023-12-05"
reference = "https://twitter.com/buffaloverflow/status/907728364278087680"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2017_8759.yar#L47-L61"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2017_8759.yar#L47-L61"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3c170479283fe859b9ecfba4834396aaf78b375472250a4b188bc913f69c97fd"
score = 60
quality = 81
@@ -371119,8 +371525,8 @@ rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Excel : CVE_2017_8759 FILE
date = "2017-09-15"
modified = "2023-12-05"
reference = "https://twitter.com/buffaloverflow/status/908455053345869825"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2017_8759.yar#L63-L76"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2017_8759.yar#L63-L76"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "adea595b251796e93cdc54cc59198d88a68e28d42899c90721f63f6813df24fe"
score = 60
quality = 83
@@ -371142,12 +371548,12 @@ rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Txt : CVE_2017_8759 FILE
date = "2017-09-14"
modified = "2023-12-05"
reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2017_8759.yar#L78-L92"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2017_8759.yar#L78-L92"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "840ad14e29144be06722aff4cc04b377364eeed0a82b49cc30712823838e2444"
logic_hash = "184179006ed2ac2ad76e09c53196805fcb1b7380dab1d5740b4469a89d6b0b32"
score = 75
- quality = 60
+ quality = 85
tags = "CVE-2017-8759, FILE"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
@@ -371167,8 +371573,8 @@ rule SIGNATURE_BASE_CVE_2017_8759_WSDL_In_RTF : CVE_2017_8759 FILE
date = "2017-09-15"
modified = "2023-12-05"
reference = "https://twitter.com/xdxdxdxdoa/status/908665278199996416"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2017_8759.yar#L94-L110"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2017_8759.yar#L94-L110"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "47adc7adfc55239792aef818648546adb1627e74690de0d811100cc49aab8c2f"
score = 75
quality = 85
@@ -371194,11 +371600,11 @@ rule SIGNATURE_BASE_LOG_APT_WEBSHELL_Solarwinds_SUNBURST_Report_Webshell_Dec20_2
date = "2020-12-21"
modified = "2023-12-05"
reference = "https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_solarwinds_susp_sunburst.yar#L21-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_solarwinds_susp_sunburst.yar#L21-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ec52e244a483ace0f6932b553b159b23b767c00d1f64a4711e5f359832e846f5"
score = 75
- quality = 60
+ quality = 85
tags = ""
strings:
@@ -371216,8 +371622,8 @@ rule SIGNATURE_BASE_MAL_Shellcode_Loader_Apr23
date = "2023-04-03"
modified = "2023-12-05"
reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_mal_gopuram_apr23.yar#L3-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_mal_gopuram_apr23.yar#L3-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad"
hash = "b56279136d816a11cf4db9fc1b249da04b3fa3aef4ba709b20cdfbe572394812"
logic_hash = "e4e423158757c80b5e4e77f6a343323a87798c6697cf6a832aa01a146712b250"
@@ -371242,8 +371648,8 @@ rule SIGNATURE_BASE_APT_MAL_Gopuram_Backdoor_Apr23 : FILE
date = "2023-02-24"
modified = "2023-12-05"
reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_mal_gopuram_apr23.yar#L20-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_mal_gopuram_apr23.yar#L20-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c"
hash = "97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7"
logic_hash = "aa3dd1f35d27d23eb775410cceae81d5b767dc0f1636aac67f2d2e988a3ed995"
@@ -371269,8 +371675,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_DLL_Apr23_1 : FILE
date = "2023-04-03"
modified = "2023-12-05"
reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_mal_gopuram_apr23.yar#L43-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_mal_gopuram_apr23.yar#L43-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "69dd140f45c3fa3aaa64c69f860cd3c74379dec37c46319d7805a29b637d4dbf"
hash = "bb1066c1ca53139dc5a2c1743339f4e6360d6fe4f2f3261d24fc28a12f3e2ab9"
hash = "dca33d6dacac0859ec2f3104485720fe2451e21eb06e676f4860ecc73a41e6f9"
@@ -371301,8 +371707,8 @@ rule SIGNATURE_BASE_APT_UNC4736_NK_MAL_TAXHAUL_3CX_Apr23_1 : FILE
date = "2023-03-04"
modified = "2023-12-05"
reference = "https://www.3cx.com/blog/news/mandiant-initial-results/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_mal_gopuram_apr23.yar#L77-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_mal_gopuram_apr23.yar#L77-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f67af611d0b3d96e4aaf7b3b5e49c1fb536e61a430b79ac0a0560ef3773ba140"
score = 80
quality = 85
@@ -371325,8 +371731,8 @@ rule SIGNATURE_BASE_WEBSHELL_H4Ntu_Shell_Powered_Tsoi_3
modified = "2025-03-21"
old_rule_name = "Webshell_h4ntu_shell_powered_by_tsoi_"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L32-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L32-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "06ed0b2398f8096f1bebf092d0526137"
logic_hash = "871e9a057ca3920fcebaec5c2555c2d936d813c0d8bb2a6a69726dee7a796ff8"
score = 70
@@ -371351,8 +371757,8 @@ rule SIGNATURE_BASE_WEBSHELL_H4Ntu_Shell_Powered_Tsoi : FILE
modified = "2025-03-21"
old_rule_name = "Webshell_h4ntu_shell__powered_by_tsoi_"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L49-L65"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L49-L65"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "06ed0b2398f8096f1bebf092d0526137"
logic_hash = "3d9b568a66f3e6933b385fed30921883dd7be17863670c648702ae3403b6e8a1"
score = 80
@@ -371375,8 +371781,8 @@ rule SIGNATURE_BASE_Webshell_PHP_Sql
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L67-L81"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L67-L81"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2cf20a207695bbc2311a998d1d795c35"
logic_hash = "83049c3c5bce88d239b59accb173e234c3169f59187de17b7e6c2a0aa58a552f"
score = 70
@@ -371400,8 +371806,8 @@ rule SIGNATURE_BASE_Webshell_PHP_A
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L82-L97"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L82-L97"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e3b461f7464d81f5022419d87315a90d"
logic_hash = "6bdd5fbe9b16f2d84b884239cf3b6453587933c6b0c4308508d10019b4f36e38"
score = 70
@@ -371426,8 +371832,8 @@ rule SIGNATURE_BASE_Webshell_Imhapftp_2
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L98-L112"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L98-L112"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12911b73bc6a5d313b494102abcf5c57"
logic_hash = "9099504870c1e466808060f11aea38472832846d24e3c84fdd69b7d26bfed69d"
score = 70
@@ -371451,8 +371857,8 @@ rule SIGNATURE_BASE_Webshell_Jspspyweb
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L113-L127"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L113-L127"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4e9be07e95fff820a9299f3fb4ace059"
logic_hash = "491d9c4efee27469f2a26f6fcb7f7c768eac60977e640096ea5f78ff346e7fbe"
score = 70
@@ -371476,8 +371882,8 @@ rule SIGNATURE_BASE_Webshell_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L128-L142"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L128-L142"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "49ad9117c96419c35987aaa7e2230f63"
logic_hash = "d3d27d80f5f3adbc050a59d0c25953ec5d634344b5d051a4abdf4eeed3b8b035"
score = 70
@@ -371501,8 +371907,8 @@ rule SIGNATURE_BASE_Webshell_Simattacker_Vrsion_1_0_0_Priv8_4_My_Friend
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L143-L157"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L143-L157"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "089ff24d978aeff2b4b2869f0c7d38a3"
logic_hash = "fc553942b06b305f7b0d5b072a8d4517b0e51229545440ea9c43e9be01d64efa"
score = 70
@@ -371526,8 +371932,8 @@ rule SIGNATURE_BASE_Webshell_Phpshell_2_1_Pwhash
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L158-L172"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L158-L172"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ba120abac165a5a30044428fac1970d8"
logic_hash = "616c0570550cdb9394b5675864d4eec3fa62390f880817406b2a3b63952b69f0"
score = 70
@@ -371551,8 +371957,8 @@ rule SIGNATURE_BASE_Webshell_Phpremoteview
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L173-L187"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L173-L187"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "29420106d9a81553ef0d1ca72b9934d9"
logic_hash = "2de48b8640c0f2089a4a0badb4429127cb61ac972459290041e20b959e4e0c05"
score = 70
@@ -371576,8 +371982,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_12302
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L188-L203"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L188-L203"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a3930518ea57d899457a62f372205f7f"
logic_hash = "0959a138abc791f17344e25e84b24888ddfe238981fc7e3ffd76c0390006ea46"
score = 70
@@ -371602,8 +372008,8 @@ rule SIGNATURE_BASE_Webshell_Caidao_Shell_Guo
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L204-L218"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L204-L218"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9e69a8f499c660ee0b4796af14dc08f0"
logic_hash = "efb7055f42dd6be41ea3983cacea1a70b83675c8ebcb88ae3b250066a29e94eb"
score = 70
@@ -371627,8 +372033,8 @@ rule SIGNATURE_BASE_Webshell_PHP_Redcod
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L219-L233"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L219-L233"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5c1c8120d82f46ff9d813fbe3354bac5"
logic_hash = "eddfd90d27793756bcc685ffe33b2dabc3bb28b9654c33a0f99359e8b6f13678"
score = 70
@@ -371652,8 +372058,8 @@ rule SIGNATURE_BASE_Webshell_Remview_Fix
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L234-L248"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L234-L248"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a24b7c492f5f00e2a19b0fa2eb9c3697"
logic_hash = "0b29ef74fb0786aefe99281360dc4fe27005eac345a36bc14259afa6fc555303"
score = 70
@@ -371677,8 +372083,8 @@ rule SIGNATURE_BASE_Webshell_Asp_Cmd
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L249-L264"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L249-L264"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "895ca846858c315a3ff8daa7c55b3119"
logic_hash = "8e72b54267c2f83b288cdd43ccd56ae4ab1f95c17f4dde077e637d951df54866"
score = 70
@@ -371703,8 +372109,8 @@ rule SIGNATURE_BASE_Webshell_Php_Sh_Server
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L265-L278"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L265-L278"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d87b019e74064aa90e2bb143e5e16cfa"
logic_hash = "9f4d940a381e7bd298a252f485d5f1d26fd191c27f6e86e8fa6028237592a8c3"
score = 50
@@ -371727,8 +372133,8 @@ rule SIGNATURE_BASE_Webshell_PH_Vayv_PH_Vayv
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L279-L293"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L279-L293"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "35fb37f3c806718545d97c6559abd262"
logic_hash = "8769400b7b6828849f27092d790d291721c7e1b39dfd2080de5da8e59dd25523"
score = 70
@@ -371752,8 +372158,8 @@ rule SIGNATURE_BASE_Webshell_Caidao_Shell_Ice
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L294-L307"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L294-L307"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6560b436d3d3bb75e2ef3f032151d139"
logic_hash = "d92cc9ac8630b40f23b9ff7cda5a237b4885d30de4b9b497be7512e7eb020a09"
score = 70
@@ -371776,8 +372182,8 @@ rule SIGNATURE_BASE_Webshell_Cihshell_Fix
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L308-L322"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L308-L322"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3823ac218032549b86ee7c26f10c4cb5"
logic_hash = "59ae76d6828d8c0ddcbafa19063e6dcf25c826386f46df2b8f9674b628365a2b"
score = 70
@@ -371801,8 +372207,8 @@ rule SIGNATURE_BASE_Webshell_Asp_Shell
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L323-L337"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L323-L337"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e63f5a96570e1faf4c7b8ca6df750237"
logic_hash = "5cc698e4ff23ca296b339589d12c24e67c99272e73445604a4552d3023e19636"
score = 70
@@ -371826,8 +372232,8 @@ rule SIGNATURE_BASE_Webshell_Private_I3Lue
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L338-L351"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L338-L351"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "13f5c7a035ecce5f9f380967cf9d4e92"
logic_hash = "274586f2c451eda45c3a52b615961dbba806f8d25e34cc358e661fcfd1143d08"
score = 70
@@ -371850,8 +372256,8 @@ rule SIGNATURE_BASE_Webshell_Php_Up
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L352-L367"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L352-L367"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7edefb8bd0876c41906f4b39b52cd0ef"
logic_hash = "22f444ce4068f46c0b57e566faca0c6377346e403de592b0e51869781fda31a9"
score = 70
@@ -371876,8 +372282,8 @@ rule SIGNATURE_BASE_Webshell_Mysql_Interface_V1_0
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L368-L381"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L368-L381"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a12fc0a3d31e2f89727b9678148cd487"
logic_hash = "baa938c4cfd2c46b1752d866e186d76a04c353617d8ec3e0d78a3c546b120d13"
score = 70
@@ -371900,8 +372306,8 @@ rule SIGNATURE_BASE_Webshell_Php_S_U
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L382-L395"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L382-L395"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "efc7ba1a4023bcf40f5e912f1dd85b5a"
logic_hash = "3c6904fa475784e737275fd47eabea077bed57e920071c68fa09f7defecbdb72"
score = 70
@@ -371924,8 +372330,8 @@ rule SIGNATURE_BASE_Webshell_Phpshell_2_1_Config
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L396-L409"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L396-L409"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bd83144a649c5cc21ac41b505a36a8f3"
logic_hash = "51d16bcaef5f6795ebcd1154dca79d5cf5a389948b0e59f4939c30fef877e816"
score = 70
@@ -371948,8 +372354,8 @@ rule SIGNATURE_BASE_Webshell_Asp_EFSO_2
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L410-L423"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L410-L423"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a341270f9ebd01320a7490c12cb2e64c"
logic_hash = "19bd00fabe0b4695129c180dd145e757e0b2c2a6dad751e8c889222c191e03ce"
score = 70
@@ -371972,8 +372378,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Up
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L424-L437"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L424-L437"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "515a5dd86fe48f673b72422cccf5a585"
logic_hash = "77c8121d000c45e44717689dec535fde7c9722005d1e4ff40d0b84abcf289f47"
score = 70
@@ -371996,8 +372402,8 @@ rule SIGNATURE_BASE_Webshell_Networkfilemanagerphp
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L438-L451"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L438-L451"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "acdbba993a5a4186fd864c5e4ea0ba4f"
logic_hash = "235e4062a9b9ebdf7dd0b8a2cb3b16ba7688a75b90d8c527344cf9605304838d"
score = 70
@@ -372020,8 +372426,8 @@ rule SIGNATURE_BASE_Webshell_Server_Variables
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L452-L466"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L452-L466"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "47fb8a647e441488b30f92b4d39003d7"
logic_hash = "2a85301f1d6e4c457ff0a1b2a08eb6f054905993a0667087f37b9a7352e38911"
score = 70
@@ -372045,8 +372451,8 @@ rule SIGNATURE_BASE_Webshell_Caidao_Shell_Ice_2
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L467-L480"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L467-L480"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1d6335247f58e0a5b03e17977888f5f2"
logic_hash = "57c3c369abd826d676290300d8df2d890b777fa1f0e1156654062159a4228db7"
score = 70
@@ -372069,8 +372475,8 @@ rule SIGNATURE_BASE_Webshell_Caidao_Shell_Mdb
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L481-L494"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L481-L494"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fbf3847acef4844f3a0d04230f6b9ff9"
logic_hash = "89f7692acd754992f9379b9b4661a01d6ab95cb85a3c2699928aa5ed3a3ac8c5"
score = 70
@@ -372093,8 +372499,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Guige
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L495-L508"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L495-L508"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2c9f2dafa06332957127e2c713aacdd2"
logic_hash = "9d71095b5c709dfdd8b5fcebcaa4493d9c93e841e85cda2e2255e0c15ea83659"
score = 70
@@ -372117,8 +372523,8 @@ rule SIGNATURE_BASE_Webshell_Phpspy2010
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L509-L524"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L509-L524"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "14ae0e4f5349924a5047fed9f3b105c5"
logic_hash = "b3acef196b30cf9afe24c81860bedff69fc5652c514aa36aba85d16b12bcc432"
score = 70
@@ -372143,8 +372549,8 @@ rule SIGNATURE_BASE_Webshell_Asp_Ice
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L525-L538"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L525-L538"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d141e011a92f48da72728c35f1934a2b"
logic_hash = "524419e802d3cb6ac310565af22ec28044984aa4b1b2ee1cfbd292afd071709c"
score = 70
@@ -372167,8 +372573,8 @@ rule SIGNATURE_BASE_Webshell_Drag_System
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L539-L552"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L539-L552"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "15ae237cf395fb24cf12bff141fb3f7c"
logic_hash = "8ea8d9d64521f47f1396e4f4d6c8f4a71fa1a643799ec408e1d2e0f255dc4996"
score = 70
@@ -372191,8 +372597,8 @@ rule SIGNATURE_BASE_Webshell_Darkblade1_3_Asp_Indexx
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L553-L566"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L553-L566"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b7f46693648f534c2ca78e3f21685707"
logic_hash = "57cfe09d53d42ee9d909a3894b8a3362209c1972c7d96ae5fdc61681c2998a89"
score = 70
@@ -372215,8 +372621,8 @@ rule SIGNATURE_BASE_Webshell_Phpshell3
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L567-L582"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L567-L582"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "76117b2ee4a7ac06832d50b2d04070b8"
logic_hash = "868b1b69fab3ec6fcfa15557075f313f4af0ec9cd15f41bb9dcc9bc26fc17f93"
score = 70
@@ -372241,8 +372647,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Hsxa
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L583-L596"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L583-L596"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d0e05f9c9b8e0b3fa11f57d9ab800380"
logic_hash = "7f79b66d87f638bc09ee576de4dc4a8c5b1da7c406d318eeff7a4221c35d2313"
score = 70
@@ -372265,8 +372671,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Utils
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L597-L611"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L597-L611"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9827ba2e8329075358b8e8a53e20d545"
logic_hash = "90a5b64e59306bdffc5a89f5d86a2dc7a17669021d863e2a5ecea13d65c19053"
score = 70
@@ -372290,8 +372696,8 @@ rule SIGNATURE_BASE_Webshell_Asp_01
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L612-L625"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L612-L625"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61a687b0bea0ef97224c7bd2df118b87"
logic_hash = "e057800013a9a8f4c3ecbe4e27c14e904700548e6ad9dc1f00313c7a3de7fd2d"
score = 50
@@ -372314,8 +372720,8 @@ rule SIGNATURE_BASE_Webshell_Asp_404
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L626-L639"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L626-L639"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d9fa1e8513dbf59fa5d130f389032a2d"
logic_hash = "3db951af36ed3d08bc10b4c3fc2e67481f005580fb76f66b6ec5789ed6e2efdb"
score = 70
@@ -372338,8 +372744,8 @@ rule SIGNATURE_BASE_Webshell_Webshell_Cnseay02_1
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L640-L653"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L640-L653"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "95fc76081a42c4f26912826cb1bd24b1"
logic_hash = "9950fb7c26dfb25665093dbcf5c4a9dcf65466783509a3caa11c2c96d177d855"
score = 70
@@ -372362,8 +372768,8 @@ rule SIGNATURE_BASE_Webshell_Php_Fbi
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L654-L667"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L654-L667"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1fb32f8e58c8deb168c06297a04a21f1"
logic_hash = "de8584ae83ee3e23f4ce00ccd73f75b4568d6a4544af45b83784a9a0c34d42e3"
score = 70
@@ -372386,8 +372792,8 @@ rule SIGNATURE_BASE_Webshell_B374Kphp_B374K
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L668-L684"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L668-L684"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bed7388976f8f1d90422e8795dff1ea6"
logic_hash = "1f0fc5e309dd67a11d6ba9b698fd9ca3c7e6616545c220de79aaa3b63f0ad931"
score = 70
@@ -372413,8 +372819,8 @@ rule SIGNATURE_BASE_Webshell_Cmd_Asp_5_1
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L685-L698"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L685-L698"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8baa99666bf3734cbdfdd10088e0cd9f"
logic_hash = "1ff4ae8c08cec4605594e97d6c077d4808d3a73c04ddf6a51952252dd2d01cf4"
score = 70
@@ -372437,8 +372843,8 @@ rule SIGNATURE_BASE_Webshell_Php_Dodo_Zip
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L699-L713"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L699-L713"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b7800364374077ce8864796240162ad5"
logic_hash = "bdeffafdedeadaba36c5c67f981c42d6111b954622780b930e9eeb9956c638b5"
score = 70
@@ -372462,8 +372868,8 @@ rule SIGNATURE_BASE_Webshell_Azrailphp_V1_0
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L714-L728"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L714-L728"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "26b2d3943395682e36da06ed493a3715"
logic_hash = "d0ccf9e37e378db4523d7918b30cff358115e7a4c36fad55a75f3aff218563c6"
score = 70
@@ -372487,8 +372893,8 @@ rule SIGNATURE_BASE_Webshell_Php_List
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L729-L744"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L729-L744"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "922b128ddd90e1dc2f73088956c548ed"
logic_hash = "007f9307493bca71dcbdcf6ba6c45bf36899e8f636ccbd09c26453cb0aea0847"
score = 70
@@ -372513,8 +372919,8 @@ rule SIGNATURE_BASE_Webshell_Ironshell
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L745-L759"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L745-L759"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8bfa2eeb8a3ff6afc619258e39fded56"
logic_hash = "7e4916010a33383cfc3cbbcd5d575ac2f3a579220b66bd07e3121f3db30da66d"
score = 70
@@ -372538,8 +372944,8 @@ rule SIGNATURE_BASE_Webshell_Caidao_Shell_404
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L760-L773"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L760-L773"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ee94952dc53d9a29bdf4ece54c7a7aa7"
logic_hash = "0743d18bc5066c96cca8cc0883971d3bc876e6c2fbb996e55b6930c715e07395"
score = 70
@@ -372562,8 +372968,8 @@ rule SIGNATURE_BASE_Webshell_ASP_Aspydrv
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L774-L787"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L774-L787"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "de0a58f7d1e200d0b2c801a94ebce330"
logic_hash = "a4a6205ace49778ddc421b0f0e65c576e2ffe40ce2ab84debb939d5324420405"
score = 70
@@ -372586,8 +372992,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Web
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L788-L801"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L788-L801"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4bc11e28f5dccd0c45a37f2b541b2e98"
logic_hash = "ed0ace0ba5f8a9e763353c42e3e3a39da10596e8517aad33e5c5080b44e4d61a"
score = 70
@@ -372610,8 +373016,8 @@ rule SIGNATURE_BASE_Webshell_Mysqlwebsh
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L802-L815"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L802-L815"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "babfa76d11943a22484b3837f105fada"
logic_hash = "365d19c086b3bbb98cbe1e1ed1e7522ce98dc2614a39c747717c277cebef33d2"
score = 70
@@ -372634,8 +373040,8 @@ rule SIGNATURE_BASE_Webshell_Jspshell
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L816-L830"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L816-L830"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0d5b5a17552254be6c1c8f1eb3a5fdc1"
logic_hash = "058ddd64b142cada7144b9befa81ada314b72e6f23524d98efcb10136c23ed33"
score = 70
@@ -372659,8 +373065,8 @@ rule SIGNATURE_BASE_Webshell_Dx_Dx
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L831-L845"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L831-L845"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
logic_hash = "c2eddf58b25caff79460ab9a87ac0573d483866a87c1b1ec0984afce2c22b29f"
score = 70
@@ -372684,8 +373090,8 @@ rule SIGNATURE_BASE_Webshell_Asp_Ntdaddy
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L846-L860"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L846-L860"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c5e6baa5d140f73b4e16a6cfde671c68"
logic_hash = "7237eb7233c6affcc1f67a764f704b7d7e1d13f71c64893286c6c99318cc7c3e"
score = 70
@@ -372709,8 +373115,8 @@ rule SIGNATURE_BASE_Webshell_Mysql_Web_Interface_Version_0_8
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L861-L874"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L861-L874"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "36d4f34d0a22080f47bb1cb94107c60f"
logic_hash = "680d4368804ad21e46dbe400563beca3ef724711b5432dccce1276ecadc04f2c"
score = 70
@@ -372733,8 +373139,8 @@ rule SIGNATURE_BASE_Webshell_Elmaliseker_2
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L875-L889"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L875-L889"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b32d1730d23a660fd6aa8e60c3dc549f"
logic_hash = "ca300cd142b3c8b820d3b5f5a56eeb834d9acb1d85916b932bd67fb4a25f4ed0"
score = 70
@@ -372758,8 +373164,8 @@ rule SIGNATURE_BASE_Webshell_ASP_Remexp
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L890-L904"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L890-L904"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aa1d8491f4e2894dbdb91eec1abc2244"
logic_hash = "7a3b35c4a16f26167180cea81f67de101edabb9b35479f7e5acae7f3fe07f304"
score = 70
@@ -372783,8 +373189,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_List1
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L905-L919"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L905-L919"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8d9e5afa77303c9c01ff34ea4e7f6ca6"
logic_hash = "61ecafe477d98c5eb6887a9ff50960fc28b84512d09a36c02588159b08b395a4"
score = 70
@@ -372808,8 +373214,8 @@ rule SIGNATURE_BASE_Webshell_Phpkit_1_0_Odd
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L920-L935"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L920-L935"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "594d1b1311bbef38a0eb3d6cbb1ab538"
logic_hash = "bf99d6a71b9ef72574d928a09f3a479f2f819287d78c9a5435e45752e76a59bf"
score = 70
@@ -372834,8 +373240,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_123
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L936-L951"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L936-L951"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c691f53e849676cac68a38d692467641"
logic_hash = "48925d3a302bf09ecb3f031301ca8afc722c7ef53b87efa27a3c4b58ee15217d"
score = 70
@@ -372860,8 +373266,8 @@ rule SIGNATURE_BASE_Webshell_Asp_1
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L952-L966"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L952-L966"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8991148adf5de3b8322ec5d78cb01bdb"
logic_hash = "9cae40c8fc3966942a8fc3ee0f5d07081ba2d1c1c3156144488ba64015d6838b"
score = 70
@@ -372885,8 +373291,8 @@ rule SIGNATURE_BASE_Webshell_ASP_Tool
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L967-L982"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L967-L982"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4ab68d38527d5834e9c1ff64407b34fb"
logic_hash = "62ba39bac09cb403a47678cd38c519642cc3c20f43c470b828ec448c42e9bb73"
score = 70
@@ -372911,8 +373317,8 @@ rule SIGNATURE_BASE_Webshell_Cmd_Win32
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L983-L997"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L983-L997"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cc4d4d6cc9a25984aa9a7583c7def174"
logic_hash = "b90ba15b7b2c557f7b2303695b7f1f737f63df06d712c89e0cfea51c7d37e21d"
score = 70
@@ -372936,8 +373342,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Jshell
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L998-L1015"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L998-L1015"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "124b22f38aaaf064cef14711b2602c06"
logic_hash = "dfe3ac097de4ca406ab7ec967fdc03d1e87c74f84fc675b58438a842d80cccda"
score = 70
@@ -372964,8 +373370,8 @@ rule SIGNATURE_BASE_Webshell_ASP_Zehir4
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1016-L1029"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1016-L1029"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7f4e12e159360743ec016273c3b9108c"
logic_hash = "aa3e07ee6369dd5f86f28a53c8e45391de718d4935021339a7b47829b5196f54"
score = 70
@@ -372988,8 +373394,8 @@ rule SIGNATURE_BASE_Webshell_Wsb_Idc
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1030-L1044"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1030-L1044"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7c5b1b30196c51f1accbffb80296395f"
logic_hash = "f274061f1a02ab65bc574a6586343f74262a463c5200cd2c231a752f54967404"
score = 70
@@ -373013,8 +373419,8 @@ rule SIGNATURE_BASE_Webshell_Cpg_143_Incl_Xpl
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1045-L1059"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1045-L1059"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5937b131b67d8e0afdbd589251a5e176"
logic_hash = "7c2ce25c33e167761d72331d7c4d4f7cd6029ee0caf6e2008df8b12894faaaf8"
score = 70
@@ -373038,8 +373444,8 @@ rule SIGNATURE_BASE_Webshell_Mumaasp_Com
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1060-L1073"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1060-L1073"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cce32b2e18f5357c85b6d20f564ebd5d"
logic_hash = "75e2a056782190e9914264b9e34002faea75a35ab0f97bf1e05dec15432d064c"
score = 70
@@ -373062,8 +373468,8 @@ rule SIGNATURE_BASE_Webshell_Php_404
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1074-L1087"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1074-L1087"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ced050df5ca42064056a7ad610a191b3"
logic_hash = "3fc928e6edda8fdc4220f57215db61b7fbf8de5b00423b219a173c8ecde40b79"
score = 70
@@ -373086,8 +373492,8 @@ rule SIGNATURE_BASE_Webshell_Webshell_Cnseay_X
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1088-L1101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1088-L1101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a0f9f7f5cd405a514a7f3be329f380e5"
logic_hash = "59cb8b8a5873b716a25096c7b12f09293a812b63f31fea07d919b9c4d2bc9a19"
score = 70
@@ -373110,8 +373516,8 @@ rule SIGNATURE_BASE_Webshell_Asp_Up
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1102-L1116"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1102-L1116"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f775e721cfe85019fe41c34f47c0d67c"
logic_hash = "dff2896d2226ade08e74147121a0e0036e8545dfff36b48b5a0771c9c7d537e9"
score = 70
@@ -373135,8 +373541,8 @@ rule SIGNATURE_BASE_Webshell_Phpkit_0_1A_Odd
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1117-L1133"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1117-L1133"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3c30399e7480c09276f412271f60ed01"
logic_hash = "745734658ed4000e1399531ae44125f8462ecd37388e6223cfa9bf91dbb52bbc"
score = 70
@@ -373162,8 +373568,8 @@ rule SIGNATURE_BASE_Webshell_ASP_Cmd
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1134-L1147"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1134-L1147"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "97af88b478422067f23b001dd06d56a9"
logic_hash = "c1353e43876e18f18638a558a29a12d6e82603641fedd81b042adca91fea0d18"
score = 70
@@ -373186,8 +373592,8 @@ rule SIGNATURE_BASE_Webshell_PHP_Shell_X3
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1148-L1163"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1148-L1163"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
logic_hash = "7361a7eecf345b9c1809294b6b081db8769805ec3e6c656adc4ac87261193683"
score = 70
@@ -373212,8 +373618,8 @@ rule SIGNATURE_BASE_Webshell_PHP_G00Nv13
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1164-L1178"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1164-L1178"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "35ad2533192fe8a1a76c3276140db820"
logic_hash = "dd9f03a7ad0d2b73f7a8602ab267e0e8e5cb1f9250f9a25c86ded3797df2f8d5"
score = 70
@@ -373237,8 +373643,8 @@ rule SIGNATURE_BASE_Webshell_Php_H6Ss
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1179-L1192"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1179-L1192"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "272dde9a4a7265d6c139287560328cd5"
logic_hash = "c4001be111ff271335dd65c15c59da979a8e202bcf58a7f10de7f03644472153"
score = 70
@@ -373261,8 +373667,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Zx
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1193-L1206"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1193-L1206"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "67627c264db1e54a4720bd6a64721674"
logic_hash = "d97df624801d0f24141dfe7074d290a56e639af7d867c907362ff4434c3eeac0"
score = 70
@@ -373285,8 +373691,8 @@ rule SIGNATURE_BASE_Webshell_Ani_Shell
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1207-L1222"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1207-L1222"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "889bfc9fbb8ee7832044fc575324d01a"
logic_hash = "c8caf8686c36a41b5aae093e88b8872350cf625c59a14389c5df93f284c8f05a"
score = 70
@@ -373311,8 +373717,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_K8Cmd
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1223-L1236"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1223-L1236"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b39544415e692a567455ff033a97a682"
logic_hash = "e523a5b1118c6f4d5798f130c00466c7945d27a6fbe0d4cb3a40b7f36da2a502"
score = 70
@@ -373335,8 +373741,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Cmd
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1238-L1251"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1238-L1251"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5391c4a8af1ede757ba9d28865e75853"
logic_hash = "e48d4e2d14a3605fd9dda03630820a0fb53d893cc4d283739fde11f9ab7d9d1e"
score = 70
@@ -373359,8 +373765,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_K81
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1253-L1267"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1253-L1267"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "41efc5c71b6885add9c1d516371bd6af"
logic_hash = "f9c6b5bec9313c6fd059055fa18332675838419bba3348bb852b50806f26ccb2"
score = 70
@@ -373384,8 +373790,8 @@ rule SIGNATURE_BASE_Webshell_ASP_Zehir
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1268-L1281"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1268-L1281"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0061d800aee63ccaf41d2d62ec15985d"
logic_hash = "90920258017cf189da128dce477e71f0040bc66aefa6f018f64db64d22f60ae5"
score = 70
@@ -373409,8 +373815,8 @@ rule SIGNATURE_BASE_Webshell_Worse_Linux_Shell_1
modified = "2026-05-15"
old_rule_name = "webshell_Worse_Linux_Shell"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1282-L1296"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1282-L1296"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8338c8d9eab10bd38a7116eb534b5fa2"
logic_hash = "a24e7ae7c722da7f265f032315b1e8e402c2fc4a2a54a685671a9e52124f6553"
score = 70
@@ -373433,8 +373839,8 @@ rule SIGNATURE_BASE_Webshell_Zacosmall
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1297-L1310"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1297-L1310"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5295ee8dc2f5fd416be442548d68f7a6"
logic_hash = "739d58e3ab6712c703e0cb0e0070afec3376844b77ed081a5d12407cabb62319"
score = 70
@@ -373457,8 +373863,8 @@ rule SIGNATURE_BASE_Webshell_Liz0Zim_Private_Safe_Mode_Command_Execuriton_Bypass
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1311-L1324"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1311-L1324"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
logic_hash = "9630fc0371193bfbd0bd4fb15856477e7739fc9f11ee539d119ee837b1a54502"
score = 70
@@ -373481,8 +373887,8 @@ rule SIGNATURE_BASE_Webshell_Redirect
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1325-L1338"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1325-L1338"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "97da83c6e3efbba98df270cc70beb8f8"
logic_hash = "b16026623fe7802db9823ad4a3dab051747eea6bd41ce72a0c8c6757bfa2c6f7"
score = 70
@@ -373505,8 +373911,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Cmdjsp
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1339-L1352"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1339-L1352"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b815611cc39f17f05a73444d699341d4"
logic_hash = "b4822e47a27c598be746ac71bf9b60dafe08d50c83a2dfee5e40ea384fcff21a"
score = 70
@@ -373529,8 +373935,8 @@ rule SIGNATURE_BASE_Webshell_Java_Shell
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1353-L1367"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1353-L1367"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "36403bc776eb12e8b7cc0eb47c8aac83"
logic_hash = "0d313ff81a36b456326df0054853c31d69710fc142fcfa65747691238af4e635"
score = 70
@@ -373554,8 +373960,8 @@ rule SIGNATURE_BASE_Webshell_Asp_1D
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1368-L1381"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1368-L1381"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fad7504ca8a55d4453e552621f81563c"
logic_hash = "85b17fde8fb535b64e5eabc887428d9b73adc5bc6741a3a387f235a8b0c6089a"
score = 70
@@ -373578,8 +373984,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Ixrbe
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1382-L1395"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1382-L1395"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e26e7e0ebc6e7662e1123452a939e2cd"
logic_hash = "8710d092b81c5de1e328ad6e57e5c4a25748cc92844198038c103dabc1e76e77"
score = 70
@@ -373602,8 +374008,8 @@ rule SIGNATURE_BASE_Webshell_PHP_G5
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1396-L1409"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1396-L1409"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "95b4a56140a650c74ed2ec36f08d757f"
logic_hash = "2edffbea5142ef146cec57cb88b473532f56ab3e95151c5648eaeabe6a75feda"
score = 70
@@ -373626,8 +374032,8 @@ rule SIGNATURE_BASE_Webshell_PHP_R57142
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1410-L1423"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1410-L1423"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0911b6e6b8f4bcb05599b2885a7fe8a8"
logic_hash = "3afa0463de3acb12480dba1b2ab9cd53fca88216ba54c5e044e48ebd84bf17bd"
score = 70
@@ -373650,8 +374056,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Tree
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1424-L1438"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1424-L1438"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bcdf7bbf7bbfa1ffa4f9a21957dbcdfa"
logic_hash = "180aa4572a42d23f3e44589f876356ec973fd64cdd53bac69936b93699888ac2"
score = 70
@@ -373675,8 +374081,8 @@ rule SIGNATURE_BASE_Webshell_C99Madshell_V_3_0_Smowu
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1439-L1453"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1439-L1453"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "74e1e7c7a6798f1663efb42882b85bee"
logic_hash = "d84a5c573b89790efdbe67a684feb7db88521027e86b7588f090696fd90cbc87"
score = 70
@@ -373700,8 +374106,8 @@ rule SIGNATURE_BASE_Webshell_Simple_Backdoor
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1454-L1469"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1454-L1469"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f091d1b9274c881f8e41b2f96e6b9936"
logic_hash = "252285e8a796757235d775427e5a73980d065c1221190545428910a77f46bb9a"
score = 70
@@ -373726,8 +374132,8 @@ rule SIGNATURE_BASE_Webshell_PHP_404
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1470-L1483"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1470-L1483"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "078c55ac475ab9e028f94f879f548bca"
logic_hash = "b0524ecddf990048e3e40f471c24075c0e87654c6fe40f17dc3ff43743402e24"
score = 70
@@ -373750,8 +374156,8 @@ rule SIGNATURE_BASE_Webshell_Macker_S_Private_Phpshell
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1484-L1499"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1484-L1499"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e24cbf0e294da9ac2117dc660d890bb9"
logic_hash = "4bccc1aca8698e601133436a55538c08e3e1fa113a0776c04590eaf4a10fd309"
score = 70
@@ -373776,8 +374182,8 @@ rule SIGNATURE_BASE_Webshell_Antichat_Shell_V1_3_2
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1500-L1513"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1500-L1513"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "40d0abceba125868be7f3f990f031521"
logic_hash = "d5a1dc31f442f8db7771ee64164436f6c562ef9f4a203a1e2006d37f9df91846"
score = 70
@@ -373800,8 +374206,8 @@ rule SIGNATURE_BASE_Webshell_Safe_Mode_Breaker
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1514-L1528"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1514-L1528"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5bd07ccb1111950a5b47327946bfa194"
logic_hash = "4adcefc05413a02653a2a405791345a1a76058a39f6e2b03765c4485f7c6b106"
score = 70
@@ -373825,8 +374231,8 @@ rule SIGNATURE_BASE_Webshell_Sst_Sheller
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1529-L1543"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1529-L1543"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d93c62a0a042252f7531d8632511ca56"
logic_hash = "4faac0b22fec809f2100bad200ba1f9fb9e16fab743e1b1cbfe0b80c6d2fee32"
score = 70
@@ -373850,8 +374256,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_List
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1544-L1559"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1544-L1559"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1ea290ff4259dcaeb680cec992738eda"
logic_hash = "5641bff0ec161fe72e502641b6138186d541ebfcbf499e0295a61f9f6f085654"
score = 70
@@ -373876,8 +374282,8 @@ rule SIGNATURE_BASE_Webshell_Phpjackal_V1_5
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1560-L1574"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1560-L1574"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d76dc20a4017191216a0315b7286056f"
logic_hash = "457bc71cb8e684dafb14b1c5d2faa4366cedce5eba9545493be2b1d49daf98b6"
score = 70
@@ -373901,8 +374307,8 @@ rule SIGNATURE_BASE_Webshell_Customize
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1575-L1588"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1575-L1588"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d55578eccad090f30f5d735b8ec530b1"
logic_hash = "462d97427793ef6e897b33f4fd02d452ad8cd11ddef21aa25d13efc981eb3afb"
score = 70
@@ -373925,8 +374331,8 @@ rule SIGNATURE_BASE_Webshell_S72_Shell_V1_1_Coding
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1589-L1602"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1589-L1602"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c2e8346a5515c81797af36e7e4a3828e"
logic_hash = "fd200d8aa347242546a1da311edc61ceebaec5f7d6b4fe2f49f069b36689f547"
score = 70
@@ -373949,8 +374355,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Sys3
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1603-L1618"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1603-L1618"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b3028a854d07674f4d8a9cf2fb6137ec"
logic_hash = "14b0ac1b1b8538b0c05dcd0a8b7129fdcad2e595ea00630bd55cee6dff596d4f"
score = 70
@@ -373975,8 +374381,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Guige02
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1619-L1633"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1619-L1633"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a3b8b2280c56eaab777d633535baf21d"
logic_hash = "c214e50b209970c03d389d97673901ec44b2727e5c7588e5e4d0a644cc691423"
score = 70
@@ -374000,8 +374406,8 @@ rule SIGNATURE_BASE_Webshell_Php_Ghost
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1634-L1649"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1634-L1649"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38dc8383da0859dca82cf0c943dbf16d"
logic_hash = "9a7635d313345e7b7cb7424726ed62015afd78412b504e406155f85c4cdf623f"
score = 70
@@ -374026,8 +374432,8 @@ rule SIGNATURE_BASE_Webshell_Winx_Shell
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1650-L1664"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1650-L1664"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17ab5086aef89d4951fe9b7c7a561dda"
logic_hash = "e6dd5178cafccca751dd3f2e36206acd214a65b2e0783a738a104b3dc680ca21"
score = 70
@@ -374051,8 +374457,8 @@ rule SIGNATURE_BASE_Webshell_Crystal_Crystal
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1665-L1679"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1665-L1679"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fdbf54d5bf3264eb1c4bff1fac548879"
logic_hash = "735332a2ec7df65cca4ca69e702c5893d302a01c7ee7b84d01a1e6ab9646de93"
score = 70
@@ -374076,8 +374482,8 @@ rule SIGNATURE_BASE_Webshell_R57_1_4_0
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1680-L1696"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1680-L1696"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "574f3303e131242568b0caf3de42f325"
logic_hash = "cb48621c572d529b8dc634e7b6360257ad4fce9664bfca7ee7c0101be42d2c24"
score = 70
@@ -374103,8 +374509,8 @@ rule SIGNATURE_BASE_Webshell_Asp_Ajn
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1698-L1712"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1698-L1712"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aaafafc5d286f0bff827a931f6378d04"
logic_hash = "0a6c9a210c0337d6b984bcf6cd7f14103a0f6f5d38a26c789519c2b1629aaede"
score = 70
@@ -374128,8 +374534,8 @@ rule SIGNATURE_BASE_Webshell_Php_Cmd
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1713-L1728"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1713-L1728"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c38ae5ba61fd84f6bbbab98d89d8a346"
logic_hash = "d9a0802f6fd7047ba5477f6bba61c4ac02cabfce06270fdbd8e8e68a693ccf68"
score = 70
@@ -374154,8 +374560,8 @@ rule SIGNATURE_BASE_Webshell_Asp_List
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1729-L1743"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1729-L1743"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1cfa493a165eb4b43e6d4cc0f2eab575"
logic_hash = "9c8bdeb5992015b26fbee418ed6e6b7c6b0901f26bddf9dc26706c0b63ea9c95"
score = 70
@@ -374179,8 +374585,8 @@ rule SIGNATURE_BASE_Webshell_PHP_Co
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1744-L1758"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1744-L1758"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "62199f5ac721a0cb9b28f465a513874c"
logic_hash = "3fab3e97d10b6c56fb7df8bcd520bda318fc127a620c5aafba09cb36ffd6a8df"
score = 70
@@ -374204,8 +374610,8 @@ rule SIGNATURE_BASE_Webshell_PHP_150
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1759-L1773"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1759-L1773"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "400c4b0bed5c90f048398e1d268ce4dc"
logic_hash = "139e3d6aa3cd2b6a9731a6cc14c921f9fd82ff7ca79d156f1ff6bc544897fb12"
score = 70
@@ -374229,8 +374635,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Cmdjsp_2
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1774-L1788"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1774-L1788"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b5ae3649f03784e2a5073fa4d160c8b"
logic_hash = "83be82e260adcff9d3d11344c363f6b5da331339ffe78e561cea9ab09b209030"
score = 70
@@ -374254,8 +374660,8 @@ rule SIGNATURE_BASE_Webshell_PHP_C37
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1789-L1803"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1789-L1803"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d01144c04e7a46870a8dd823eb2fe5c8"
logic_hash = "b93394f4e05cc96c31a8adcb0981aa8b069780893c469b41ece3d3ce92c42251"
score = 70
@@ -374279,8 +374685,8 @@ rule SIGNATURE_BASE_Webshell_PHP_B37
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1804-L1817"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1804-L1817"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0421445303cfd0ec6bc20b3846e30ff0"
logic_hash = "ae0cca5723a1e885c26ece5082c24f4c95f0262b8e7baf6db5efde5cfee2cc42"
score = 70
@@ -374303,8 +374709,8 @@ rule SIGNATURE_BASE_Webshell_Php_Backdoor
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1818-L1832"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1818-L1832"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
logic_hash = "1f754b4d29eb93316183cf904b375ded7ccdae1d2196fe05950c449ed0d690f4"
score = 70
@@ -374328,8 +374734,8 @@ rule SIGNATURE_BASE_Webshell_Asp_Dabao
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1833-L1847"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1833-L1847"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3919b959e3fa7e86d52c2b0a91588d5d"
logic_hash = "62cf46dc16a7365d196c2cb8ede8b1380a0877d134d3726d7c777096a4eda942"
score = 70
@@ -374353,8 +374759,8 @@ rule SIGNATURE_BASE_Webshell_Php_2
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1848-L1861"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1848-L1861"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "267c37c3a285a84f541066fc5b3c1747"
logic_hash = "bd485c825ae7ac11ff67d109d3c07fb405272a5919e00af39788d1a9c94e754d"
score = 70
@@ -374377,8 +374783,8 @@ rule SIGNATURE_BASE_Webshell_Asp_Cmdasp
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1862-L1876"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1862-L1876"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "57b51418a799d2d016be546f399c2e9b"
logic_hash = "4259419b4db8e6a83df6f7d258d41028f7f76b0fd2308eeadb4555066c5a2940"
score = 70
@@ -374402,8 +374808,8 @@ rule SIGNATURE_BASE_Webshell_Spjspshell
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1877-L1890"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1877-L1890"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d39d51154aaad4ba89947c459a729971"
logic_hash = "7926eadd3ffb21de73a63e7a28a525037bf88396ea369599b41ac8c0b0d112ad"
score = 70
@@ -374426,8 +374832,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Action
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1891-L1905"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1891-L1905"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5a7d931094f5570aaf5b7b3b06c3d8c0"
logic_hash = "5ea7d074d0fe98cf2514a65231013a374532d6b3aa2487bcc34d4285f558752a"
score = 70
@@ -374451,8 +374857,8 @@ rule SIGNATURE_BASE_Webshell_Inderxer
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1906-L1919"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1906-L1919"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9ea82afb8c7070817d4cdf686abe0300"
logic_hash = "915f2f38c1ca1321980ac66ebb95b0c46443e0ba64cc4b2014200db43439c85e"
score = 70
@@ -374475,8 +374881,8 @@ rule SIGNATURE_BASE_Webshell_Asp_Rader
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1920-L1934"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1920-L1934"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ad1a362e0a24c4475335e3e891a01731"
logic_hash = "b578f3e844cbb361f455e55353fad2f0134ede7c3c468cebad9ae265e6e768b8"
score = 70
@@ -374500,8 +374906,8 @@ rule SIGNATURE_BASE_Webshell_C99_Madnet_Smowu
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1935-L1953"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1935-L1953"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3aaa8cad47055ba53190020311b0fb83"
logic_hash = "5c4f76bdbe535a899e40c890eb1ea65e070c781fe5dd44cf13d4832cfd6d2e13"
score = 70
@@ -374529,8 +374935,8 @@ rule SIGNATURE_BASE_Webshell_Php_Moon
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1954-L1969"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1954-L1969"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2a2b1b783d3a2fa9a50b1496afa6e356"
logic_hash = "4e26dbef647caee19a8707a067c228ba96bd986369e4c87c68964ae42c85b09a"
score = 70
@@ -374555,8 +374961,8 @@ rule SIGNATURE_BASE_Webshell_Minupload
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1971-L1985"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1971-L1985"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ec905a1395d176c27f388d202375bdf9"
logic_hash = "53dea3ea0e2cf83907273fa7f64b21b40e9a5c8e4aa34e5d46d2762396fa89ce"
score = 70
@@ -374580,8 +374986,8 @@ rule SIGNATURE_BASE_Webshell_ELMALISEKER_Backd00R
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L1986-L2000"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L1986-L2000"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3aa403e0a42badb2c23d4a54ef43e2f4"
logic_hash = "c5eea930dc386c60e60f052c4945c8d6c0125d3500e60794e21d5ea04f226628"
score = 70
@@ -374605,8 +375011,8 @@ rule SIGNATURE_BASE_Webshell_PHP_Bug_1_
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2001-L2014"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2001-L2014"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "91c5fae02ab16d51fc5af9354ac2f015"
logic_hash = "12b957b7e0d0823721273ab71a19ee62d84a8dc5f584a46691f0e0aef996386e"
score = 70
@@ -374629,8 +375035,8 @@ rule SIGNATURE_BASE_Webshell_Caidao_Shell_Hkmjj
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2015-L2028"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2015-L2028"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e7b994fe9f878154ca18b7cde91ad2d0"
logic_hash = "9a25df170ed165fe6528e6b9374ae572bcd26cd2e1f4014c7aa4953122671fac"
score = 70
@@ -374653,8 +375059,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Asd
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2029-L2043"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2029-L2043"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a042c2ca64176410236fcc97484ec599"
logic_hash = "6620b796b55a67010cd3edebc2ec84c2657717722129ea46288d262cfd1c7e1c"
score = 70
@@ -374678,8 +375084,8 @@ rule SIGNATURE_BASE_Webshell_Metaslsoft
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2045-L2058"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2045-L2058"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aa328ed1476f4a10c0bcc2dde4461789"
logic_hash = "20d938fbe21bcf04f09c6450a9acd5db556e9c9f83149d3cdd098be7a905d5ca"
score = 70
@@ -374702,8 +375108,8 @@ rule SIGNATURE_BASE_Webshell_Asp_Ajan
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2059-L2072"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2059-L2072"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b6f468252407efc2318639da22b08af0"
logic_hash = "1817786725de61150f1b3ff57597c780323a7f4df1c046cfd473e1918decd7d2"
score = 70
@@ -374726,8 +375132,8 @@ rule SIGNATURE_BASE_Webshell_Config_Myxx_Zend
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2073-L2089"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2073-L2089"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d44df8b1543b837e57cc8f25a0a68d92"
hash = "e0354099bee243702eb11df8d0e046df"
hash = "591ca89a25f06cf01e4345f98a22845c"
@@ -374753,8 +375159,8 @@ rule SIGNATURE_BASE_Webshell_Browser_201_3_Ma_Download
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2090-L2109"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2090-L2109"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "37603e44ee6dc1c359feb68a0d566f76"
hash = "a7e25b8ac605753ed0c438db93f6c498"
hash = "fb8c6c3a69b93e5e7193036fd31a958d"
@@ -374783,8 +375189,8 @@ rule SIGNATURE_BASE_Webshell_Itsec_Itsecteam_Shell_Jhn
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2110-L2127"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2110-L2127"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ae9d2b50dc382f0571cd7492f079836"
hash = "bd6d3b2763c705a01cc2b3f105a25fa4"
hash = "40c6ecf77253e805ace85f119fe1cebb"
@@ -374811,8 +375217,8 @@ rule SIGNATURE_BASE_Webshell_Ghost_Source_Icesword_Silic
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2128-L2145"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2128-L2145"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cbf64a56306c1b5d98898468fc1fdbd8"
hash = "6e20b41c040efb453d57780025a292ae"
hash = "437d30c94f8eef92dc2f064de4998695"
@@ -374839,8 +375245,8 @@ rule SIGNATURE_BASE_Webshell_Jspspy_Jspspyjdk5_Jspspyjdk51_Luci_Jsp_Spy2009_M_Ma
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2146-L2189"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2146-L2189"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2eeb8bf151221373ee3fd89d58ed4d38"
hash = "059058a27a7b0059e2c2f007ad4675ef"
hash = "ae76c77fb7a234380cd0ebb6fe1bcddf"
@@ -374893,8 +375299,8 @@ rule SIGNATURE_BASE_Webshell_2_520_Job_Ma1_Ma4_2
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2190-L2210"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2190-L2210"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "64a3bf9142b045b9062b204db39d4d57"
hash = "9abd397c6498c41967b4dd327cf8b55a"
hash = "56c005690da2558690c4aa305a31ad37"
@@ -374924,8 +375330,8 @@ rule SIGNATURE_BASE_Webshell_000_403_807_A_C5_Config_Css_Dm_He1P_Jspspy_Jspspyjd
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2211-L2257"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2211-L2257"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2eeb8bf151221373ee3fd89d58ed4d38"
hash = "059058a27a7b0059e2c2f007ad4675ef"
hash = "ae76c77fb7a234380cd0ebb6fe1bcddf"
@@ -374981,8 +375387,8 @@ rule SIGNATURE_BASE_Webshell_Wso2_5_1_Wso2_5_Wso2
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2258-L2275"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2258-L2275"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dbeecd555a2ef80615f0894027ad75dc"
hash = "7c8e5d31aad28eb1f0a9a53145551e05"
hash = "cbc44fb78220958f81b739b493024688"
@@ -375009,8 +375415,8 @@ rule SIGNATURE_BASE_Webshell_000_403_C5_Querydong_Spyjsp2010_T00Ls
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2276-L2296"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2276-L2296"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2eeb8bf151221373ee3fd89d58ed4d38"
hash = "059058a27a7b0059e2c2f007ad4675ef"
hash = "8b457934da3821ba58b06a113e0d53d9"
@@ -375040,8 +375446,8 @@ rule SIGNATURE_BASE_Webshell_404_Data_Suiyue
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2297-L2313"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2297-L2313"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7066f4469c3ec20f4890535b5f299122"
hash = "9f54aa7b43797be9bab7d094f238b4ff"
hash = "c93d5bdf5cf62fe22e299d0f2b865ea7"
@@ -375067,8 +375473,8 @@ rule SIGNATURE_BASE_Webshell_R57Shell_R57Shell127_Sniper_SA_Shell_Egy_Spider_She
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2314-L2339"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2314-L2339"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ef43fef943e9df90ddb6257950b3538f"
hash = "ae025c886fbe7f9ed159f49593674832"
hash = "911195a9b7c010f61b66439d9048f400"
@@ -375103,8 +375509,8 @@ rule SIGNATURE_BASE_Webshell_807_A_Css_Dm_He1P_Jspspy_Xxx
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2340-L2378"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2340-L2378"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae76c77fb7a234380cd0ebb6fe1bcddf"
hash = "76037ebd781ad0eac363d56fc81f4b4f"
hash = "fc44f6b4387a2cb50e1a63c66a8cb81c"
@@ -375152,8 +375558,8 @@ rule SIGNATURE_BASE_Webshell_201_3_Ma_Download
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2379-L2398"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2379-L2398"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a7e25b8ac605753ed0c438db93f6c498"
hash = "fb8c6c3a69b93e5e7193036fd31a958d"
hash = "4cc68fa572e88b669bce606c7ace0ae9"
@@ -375182,8 +375588,8 @@ rule SIGNATURE_BASE_Webshell_Browser_201_3_400_In_Jfolder_Jfolder01_Jsp_Leo_Ma_W
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2399-L2426"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2399-L2426"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "37603e44ee6dc1c359feb68a0d566f76"
hash = "a7e25b8ac605753ed0c438db93f6c498"
hash = "fb8c6c3a69b93e5e7193036fd31a958d"
@@ -375220,8 +375626,8 @@ rule SIGNATURE_BASE_Webshell_Shell_Phpspy_2006_Arabicspy
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2427-L2444"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2427-L2444"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "791708057d8b429d91357d38edf43cc0"
hash = "40a1f840111996ff7200d18968e42cfe"
hash = "e0202adff532b28ef1ba206cf95962f2"
@@ -375248,8 +375654,8 @@ rule SIGNATURE_BASE_Webshell_In_Jfolder_Jfolder01_Jsp_Leo_Warn
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2445-L2465"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2445-L2465"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "793b3d0a740dbf355df3e6f68b8217a4"
hash = "8979594423b68489024447474d113894"
hash = "ec482fc969d182e5440521c913bab9bd"
@@ -375279,8 +375685,8 @@ rule SIGNATURE_BASE_Webshell_2_520_Icesword_Job_Ma1_Ma4_2
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2466-L2488"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2466-L2488"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "64a3bf9142b045b9062b204db39d4d57"
hash = "9abd397c6498c41967b4dd327cf8b55a"
hash = "077f4b1b6d705d223b6d644a4f3eebae"
@@ -375312,8 +375718,8 @@ rule SIGNATURE_BASE_Webshell_Phpspy_2005_Full_Phpspy_2005_Lite_PHPSPY
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2489-L2507"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2489-L2507"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b68bfafc6059fd26732fa07fb6f7f640"
hash = "42f211cec8032eb0881e87ebdb3d7224"
hash = "0712e3dc262b4e1f98ed25760b206836"
@@ -375341,8 +375747,8 @@ rule SIGNATURE_BASE_Webshell_Shell_Phpspy_2006_Arabicspy_Hkrkoz
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2508-L2525"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2508-L2525"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "791708057d8b429d91357d38edf43cc0"
hash = "40a1f840111996ff7200d18968e42cfe"
hash = "e0202adff532b28ef1ba206cf95962f2"
@@ -375369,8 +375775,8 @@ rule SIGNATURE_BASE_Webshell_C99_Shell_Ci_Biz_Was_Here_C100_V_Xxx
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2526-L2545"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2526-L2545"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61a92ce63369e2fa4919ef0ff7c51167"
hash = "f2fa878de03732fbf5c86d656467ff50"
hash = "27786d1e0b1046a1a7f67ee41c64bf4c"
@@ -375399,8 +375805,8 @@ rule SIGNATURE_BASE_Webshell_2008_2009Lite_2009Mssql
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2546-L2563"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2546-L2563"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3e4ba470d4c38765e4b16ed930facf2c"
hash = "3f4d454d27ecc0013e783ed921eeecde"
hash = "aa17b71bb93c6789911bd1c9df834ff9"
@@ -375427,8 +375833,8 @@ rule SIGNATURE_BASE_Webshell_Shell_Phpspy_2005_Full_Phpspy_2005_Lite_Phpspy_2006
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2564-L2585"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2564-L2585"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "791708057d8b429d91357d38edf43cc0"
hash = "b68bfafc6059fd26732fa07fb6f7f640"
hash = "42f211cec8032eb0881e87ebdb3d7224"
@@ -375459,8 +375865,8 @@ rule SIGNATURE_BASE_Webshell_807_Dm_Jspspyjdk5_M_Cofigrue
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2586-L2605"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2586-L2605"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae76c77fb7a234380cd0ebb6fe1bcddf"
hash = "14e9688c86b454ed48171a9d4f48ace8"
hash = "341298482cf90febebb8616426080d1d"
@@ -375489,8 +375895,8 @@ rule SIGNATURE_BASE_Webshell_Dive_Shell_1_0_Emperor_Hacking_Team_Xxx
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2606-L2623"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2606-L2623"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b5102bdc41a7bc439eea8f0010310a5"
hash = "f8a6d5306fb37414c5c772315a27832f"
hash = "37cb1db26b1b0161a4bf678a6b4565bd"
@@ -375517,8 +375923,8 @@ rule SIGNATURE_BASE_Webshell_404_Data_In_Jfolder_Jfolder01_Xxx
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2624-L2646"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2624-L2646"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7066f4469c3ec20f4890535b5f299122"
hash = "9f54aa7b43797be9bab7d094f238b4ff"
hash = "793b3d0a740dbf355df3e6f68b8217a4"
@@ -375550,8 +375956,8 @@ rule SIGNATURE_BASE_Webshell_Jsp_Reverse_Jsp_Reverse_Jspbd
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2647-L2665"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2647-L2665"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8b0e6779f25a17f0ffb3df14122ba594"
hash = "ea87f0c1f0535610becadf5a98aca2fc"
hash = "7d5e9732766cf5b8edca9b7ae2b6028f"
@@ -375579,8 +375985,8 @@ rule SIGNATURE_BASE_Webshell_400_In_Jfolder_Jfolder01_Jsp_Leo_Warn_Webshell_Nc
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2666-L2690"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2666-L2690"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "36331f2c81bad763528d0ae00edf55be"
hash = "793b3d0a740dbf355df3e6f68b8217a4"
hash = "8979594423b68489024447474d113894"
@@ -375614,8 +376020,8 @@ rule SIGNATURE_BASE_Webshell_2_520_Job_Jspwebshell_1_2_Ma1_Ma4_2
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2691-L2713"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2691-L2713"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "64a3bf9142b045b9062b204db39d4d57"
hash = "9abd397c6498c41967b4dd327cf8b55a"
hash = "56c005690da2558690c4aa305a31ad37"
@@ -375647,8 +376053,8 @@ rule SIGNATURE_BASE_Webshell_Shell_2008_2009Mssql_Phpspy_2005_Full_Phpspy_2006_A
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2714-L2738"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2714-L2738"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "791708057d8b429d91357d38edf43cc0"
hash = "3e4ba470d4c38765e4b16ed930facf2c"
hash = "aa17b71bb93c6789911bd1c9df834ff9"
@@ -375682,8 +376088,8 @@ rule SIGNATURE_BASE_Webshell_Gfs_Sh_R57Shell_R57Shell127_Sniper_SA_Xxx
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2739-L2764"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2739-L2764"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a2516ac6ee41a7cf931cbaef1134a9e4"
hash = "ef43fef943e9df90ddb6257950b3538f"
hash = "ae025c886fbe7f9ed159f49593674832"
@@ -375718,8 +376124,8 @@ rule SIGNATURE_BASE_Webshell_Itsec_Phpjackal_Itsecteam_Shell_Jhn
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2765-L2784"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2765-L2784"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ae9d2b50dc382f0571cd7492f079836"
hash = "e2830d3286001d1455479849aacbbb38"
hash = "bd6d3b2763c705a01cc2b3f105a25fa4"
@@ -375748,8 +376154,8 @@ rule SIGNATURE_BASE_Webshell_Shell_Ci_Biz_Was_Here_C100_V_Xxx
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2785-L2805"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2785-L2805"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f2fa878de03732fbf5c86d656467ff50"
hash = "27786d1e0b1046a1a7f67ee41c64bf4c"
hash = "68c0629d08b1664f5bcce7d7f5f71d22"
@@ -375779,8 +376185,8 @@ rule SIGNATURE_BASE_Webshell_NIX_REMOTE_WEB_SHELL_NIX_REMOTE_WEB_Xxx1
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2806-L2825"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2806-L2825"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b19e9de790cd2f4325f8c24b22af540"
hash = "f3ca29b7999643507081caab926e2e74"
hash = "527cf81f9272919bf872007e21c4bdda"
@@ -375809,8 +376215,8 @@ rule SIGNATURE_BASE_Webshell_C99_C99Shell_C99_W4Cking_Shell_Xxx
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2826-L2854"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2826-L2854"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61a92ce63369e2fa4919ef0ff7c51167"
hash = "d3f38a6dc54a73d304932d9227a739ec"
hash = "9c34adbc8fd8d908cbb341734830f971"
@@ -375848,8 +376254,8 @@ rule SIGNATURE_BASE_Webshell_2008_2009Mssql_Phpspy_2005_Full_Phpspy_2006_Arabics
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2855-L2877"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2855-L2877"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3e4ba470d4c38765e4b16ed930facf2c"
hash = "aa17b71bb93c6789911bd1c9df834ff9"
hash = "b68bfafc6059fd26732fa07fb6f7f640"
@@ -375881,8 +376287,8 @@ rule SIGNATURE_BASE_Webshell_C99_C66_C99_Shadows_Mod_C99Shell
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2878-L2900"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2878-L2900"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61a92ce63369e2fa4919ef0ff7c51167"
hash = "0f5b9238d281bc6ac13406bb24ac2a5b"
hash = "68c0629d08b1664f5bcce7d7f5f71d22"
@@ -375914,8 +376320,8 @@ rule SIGNATURE_BASE_Webshell_He1P_Jspspy_Nogfw_Ok_Style_1_Jspspy1
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2901-L2924"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2901-L2924"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b330a6c2d49124ef0729539761d6ef0b"
hash = "d71716df5042880ef84427acee8b121e"
hash = "344f9073576a066142b2023629539ebd"
@@ -375948,8 +376354,8 @@ rule SIGNATURE_BASE_Webshell_000_403_C5_Config_Myxx_Querydong_Spyjsp2010_Zend
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2925-L2948"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2925-L2948"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2eeb8bf151221373ee3fd89d58ed4d38"
hash = "059058a27a7b0059e2c2f007ad4675ef"
hash = "8b457934da3821ba58b06a113e0d53d9"
@@ -375982,8 +376388,8 @@ rule SIGNATURE_BASE_Webshell_C99_C99Shell_C99_C99Shell
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2949-L2967"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2949-L2967"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61a92ce63369e2fa4919ef0ff7c51167"
hash = "d3f38a6dc54a73d304932d9227a739ec"
hash = "157b4ac3c7ba3a36e546e81e9279eab5"
@@ -376011,8 +376417,8 @@ rule SIGNATURE_BASE_Webshell_R57Shell127_R57_Ifx_R57_Kartal_R57_Antichat
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2968-L2989"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2968-L2989"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae025c886fbe7f9ed159f49593674832"
hash = "513b7be8bd0595c377283a7c87b44b2e"
hash = "1d912c55b96e2efe8ca873d6040e3b30"
@@ -376043,8 +376449,8 @@ rule SIGNATURE_BASE_Webshell_NIX_REMOTE_WEB_SHELL_Nstview_Xxx
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L2990-L3009"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L2990-L3009"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b19e9de790cd2f4325f8c24b22af540"
hash = "4745d510fed4378e4b1730f56f25e569"
hash = "f3ca29b7999643507081caab926e2e74"
@@ -376073,8 +376479,8 @@ rule SIGNATURE_BASE_Webshell_000_403_807_A_C5_Config_Css_Dm_He1P_Xxx
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3010-L3060"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3010-L3060"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2eeb8bf151221373ee3fd89d58ed4d38"
hash = "059058a27a7b0059e2c2f007ad4675ef"
hash = "ae76c77fb7a234380cd0ebb6fe1bcddf"
@@ -376134,8 +376540,8 @@ rule SIGNATURE_BASE_Webshell_2_520_Icesword_Job_Ma1
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3061-L3081"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3061-L3081"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "64a3bf9142b045b9062b204db39d4d57"
hash = "9abd397c6498c41967b4dd327cf8b55a"
hash = "077f4b1b6d705d223b6d644a4f3eebae"
@@ -376165,8 +376571,8 @@ rule SIGNATURE_BASE_Webshell_404_Data_In_Jfolder_Jfolder01_Jsp_Suiyue_Warn
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3082-L3106"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3082-L3106"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7066f4469c3ec20f4890535b5f299122"
hash = "9f54aa7b43797be9bab7d094f238b4ff"
hash = "793b3d0a740dbf355df3e6f68b8217a4"
@@ -376200,8 +376606,8 @@ rule SIGNATURE_BASE_Webshell_Phpspy_2005_Full_Phpspy_2005_Lite_Phpspy_2006_PHPSP
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3108-L3128"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3108-L3128"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b68bfafc6059fd26732fa07fb6f7f640"
hash = "42f211cec8032eb0881e87ebdb3d7224"
hash = "40a1f840111996ff7200d18968e42cfe"
@@ -376231,8 +376637,8 @@ rule SIGNATURE_BASE_Webshell_C99_Locus7S_C99_W4Cking_Xxx
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3129-L3158"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3129-L3158"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38fd7e45f9c11a37463c3ded1c76af4c"
hash = "9c34adbc8fd8d908cbb341734830f971"
hash = "ef43fef943e9df90ddb6257950b3538f"
@@ -376271,8 +376677,8 @@ rule SIGNATURE_BASE_Webshell_Browser_201_3_Ma_Ma2_Download
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3159-L3180"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3159-L3180"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "37603e44ee6dc1c359feb68a0d566f76"
hash = "a7e25b8ac605753ed0c438db93f6c498"
hash = "fb8c6c3a69b93e5e7193036fd31a958d"
@@ -376303,8 +376709,8 @@ rule SIGNATURE_BASE_Webshell_000_403_C5_Querydong_Spyjsp2010
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3181-L3202"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3181-L3202"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2eeb8bf151221373ee3fd89d58ed4d38"
hash = "059058a27a7b0059e2c2f007ad4675ef"
hash = "8b457934da3821ba58b06a113e0d53d9"
@@ -376335,8 +376741,8 @@ rule SIGNATURE_BASE_Webshell_R57Shell127_R57_Kartal_R57
date = "2014-01-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3203-L3221"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3203-L3221"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae025c886fbe7f9ed159f49593674832"
hash = "1d912c55b96e2efe8ca873d6040e3b30"
hash = "4108f28a9792b50d95f95b9e5314fa1e"
@@ -376364,8 +376770,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Con2
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3223-L3237"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3223-L3237"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d3584159ab299d546bd77c9654932ae3"
logic_hash = "c681b04a1ee4d6af3275b6d772ef35f8bc888a5fcaf3b84f29f77c264e8ad9b9"
score = 70
@@ -376389,8 +376795,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Make2
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3238-L3251"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3238-L3251"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9af195491101e0816a263c106e4c145e"
logic_hash = "7c94c925b5fd7fbc37428c21a9ea3c5a73f4fa0a20a1f5d03f0d5a990bd6f45a"
score = 50
@@ -376413,8 +376819,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Aaa
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3252-L3267"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3252-L3267"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "68483788ab171a155db5266310c852b2"
logic_hash = "3c5b9dd86dc790b03a8540b2fb3a717c5ad17d34f366a319faa127479387eed9"
score = 70
@@ -376439,8 +376845,8 @@ rule SIGNATURE_BASE_Webshell_Expdoor_Com_ASP
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3268-L3285"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3268-L3285"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "caef01bb8906d909f24d1fa109ea18a7"
logic_hash = "838edb9d718b5e1a8be155c4569b4a291b37337e71b435c2b1cd6bcaa53c0dea"
score = 70
@@ -376467,8 +376873,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Php2
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3286-L3299"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3286-L3299"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fbf2e76e6f897f6f42b896c855069276"
logic_hash = "0350df076a25af77fbd8d5db2b38438a10cd5b9237b23b2f64c6360607b41982"
score = 70
@@ -376491,8 +376897,8 @@ rule SIGNATURE_BASE_Webshell_Bypass_Iisuser_P
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3300-L3313"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3300-L3313"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "924d294400a64fa888a79316fb3ccd90"
logic_hash = "60d0609291e5def26ce949c903ac767db4157b4f9cf4eee315c69ee7a8d8e77b"
score = 70
@@ -376515,8 +376921,8 @@ rule SIGNATURE_BASE_Webshell_Sig_404Super
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3314-L3332"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3314-L3332"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7ed63176226f83d36dce47ce82507b28"
logic_hash = "01ecffc6bca2acf1ea4f4d965f3513f7b08ee3d5abbda29d53081f2931ecf9e9"
score = 70
@@ -376544,8 +376950,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_JSP
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3333-L3348"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3333-L3348"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "495f1a0a4c82f986f4bdf51ae1898ee7"
logic_hash = "bcb2f5d16ff3cc1454bf4653defe037e02a9228a5b7cf7428b1a577f4207c3c8"
score = 70
@@ -376570,8 +376976,8 @@ rule SIGNATURE_BASE_Webshell_Webshell_123
date = "2014-03-28"
modified = "2023-01-27"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3349-L3366"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3349-L3366"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2782bb170acaed3829ea9a04f0ac7218"
logic_hash = "1caccadf2bd7d265f9b5026c82acc31ade95313d57382651004db8b5e361312d"
score = 70
@@ -376597,8 +377003,8 @@ rule SIGNATURE_BASE_Webshell_Dev_Core
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3367-L3385"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3367-L3385"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "55ad9309b006884f660c41e53150fc2e"
logic_hash = "b3c7a9bdaa7e5bf76df9ffba94157777c32199edeaa1c8745e9400d138abc267"
score = 70
@@ -376626,8 +377032,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Php
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3386-L3403"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3386-L3403"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b0e842bdf83396c3ef8c71ff94e64167"
logic_hash = "a943f3b0d1d56194e250c7cf3e05b2bfec7b29f91ef56085d645efa3fe8995c9"
score = 70
@@ -376654,8 +377060,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Pppp
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3404-L3419"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3404-L3419"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cf01cb6e09ee594545693c5d327bdd50"
logic_hash = "bd09fc2ec88bea83b16e63afafa3d5f74f119a81046a663322f5b396b48da135"
score = 70
@@ -376680,8 +377086,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Code
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3420-L3437"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3420-L3437"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a444014c134ff24c0be5a05c02b81a79"
logic_hash = "5ae053a9afc1f720c56304c434cd89861e1df4060b7d813921e7f85978227020"
score = 70
@@ -376708,8 +377114,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Jspyyy
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3438-L3451"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3438-L3451"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b291bf3ccc9dac8b5c7e1739b8fa742e"
logic_hash = "0afe45556aa7b562672cc4b609cf001aaa617b03028322abac6524f666b069e1"
score = 70
@@ -376732,8 +377138,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Xxxx
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3452-L3465"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3452-L3465"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5bcba70b2137375225d8eedcde2c0ebb"
logic_hash = "e14cc1eaf357389ca58193c77ce2f54774aebb42be9df15f12415df356c7ed42"
score = 70
@@ -376756,8 +377162,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Jjjsp3
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3466-L3479"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3466-L3479"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "949ffee1e07a1269df7c69b9722d293e"
logic_hash = "44889540effa2f71889e7f6d0c5d12486e256d83b9230c4902d56f6a59b7939b"
score = 70
@@ -376780,8 +377186,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_PHP1
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3480-L3495"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3480-L3495"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "14c7281fdaf2ae004ca5fec8753ce3cb"
logic_hash = "1c5eb355455c7fbd2b74d91f78e1d77f460dfeb4fe0ee65f18aa1453337b67a0"
score = 70
@@ -376806,8 +377212,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Jjjsp2
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3496-L3512"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3496-L3512"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5a9fec45236768069c99f0bfd566d754"
logic_hash = "47dca67c7a01035996d032cb3871da5532aea81ab6570c93c4a6b148fd95e9f9"
score = 70
@@ -376833,8 +377239,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Radhat
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3513-L3526"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3513-L3526"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "72cb5ef226834ed791144abaa0acdfd4"
logic_hash = "28d4d380b25da05a3be439bad72725fa49c947535dfeb5c24994a849c0592b81"
score = 70
@@ -376857,8 +377263,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Asp1
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3527-L3541"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3527-L3541"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b63e708cd58ae1ec85cf784060b69cad"
logic_hash = "6c76c5388825e29d333096d4cfa3782b7776f31b206a0ed5a8809428d698778b"
score = 70
@@ -376882,8 +377288,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Php6
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3542-L3557"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3542-L3557"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ea75280224a735f1e445d244acdfeb7b"
logic_hash = "495dc6c6769b8605ea946c012ad0ebb54685e7e91afd383027640753d90c6b3f"
score = 70
@@ -376908,8 +377314,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Xxx
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3558-L3571"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3558-L3571"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0e71428fe68b39b70adb6aeedf260ca0"
logic_hash = "837ed266af8a65ac683be39c32509df34bc8041b336a71c12700ca73bf210b4d"
score = 70
@@ -376932,8 +377338,8 @@ rule SIGNATURE_BASE_Webshell_Getpostphp
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3572-L3585"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3572-L3585"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "20ede5b8182d952728d594e6f2bb5c76"
logic_hash = "e75f66200593c3fdaadf1881235847f6c3f3caadcb7ffe13e8b01bce5f922702"
score = 70
@@ -376956,8 +377362,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Php5
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3586-L3599"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3586-L3599"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cf2ab009cbd2576a806bfefb74906fdf"
logic_hash = "280be378bc6cf52ef9454083180015ed00f9d0bc936620a4105c34c3a3002383"
score = 70
@@ -376980,8 +377386,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_PHP
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3600-L3617"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3600-L3617"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a524e7ae8d71e37d2fd3e5fbdab405ea"
logic_hash = "706f835f63e153f907ae8a5a48f1dc4b9d3b8511b21b7155bc045b0ebdc893fc"
score = 70
@@ -377008,8 +377414,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_New_Asp
date = "2014-03-28"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3618-L3633"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3618-L3633"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "32c87744ea404d0ea0debd55915010b7"
logic_hash = "dd2e9f753e8fa781c28c2d5bb9336bb3f39ed8a496bd89eb54bc1812ef512ab5"
score = 70
@@ -377034,8 +377440,8 @@ rule SIGNATURE_BASE_Perlbot_Pl
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3637-L3648"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3637-L3648"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7e4deb9884ffffa5d82c22f8dc533a45"
logic_hash = "784980d620e71fb0cf5aed9ef8bd171a8f50d850bc782645575070b75c42e426"
score = 75
@@ -377058,8 +377464,8 @@ rule SIGNATURE_BASE_Php_Backdoor_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3649-L3661"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3649-L3661"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
logic_hash = "acab82b40760b45d49da51953f78c69166955de54918634c9bfe394208cdbb56"
score = 75
@@ -377083,8 +377489,8 @@ rule SIGNATURE_BASE_Liz0Zim_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3662-L3674"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3662-L3674"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
logic_hash = "a0606dad4474579354709fe6306d15427afc4dec8ad6760a0ee9e91c86c23e4d"
score = 75
@@ -377108,8 +377514,8 @@ rule SIGNATURE_BASE_Nshell__1__Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3675-L3686"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3675-L3686"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "973fc89694097a41e684b43a21b1b099"
logic_hash = "53c7cd24c4eddbded1b4c16fd2758bdf66c0bbe396e487a56d56fc053cf3cc1a"
score = 75
@@ -377132,8 +377538,8 @@ rule SIGNATURE_BASE_Shankar_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3687-L3699"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3687-L3699"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6eb9db6a3974e511b7951b8f7e7136bb"
logic_hash = "58b365206c18b8394cf1e03b71b8e47be10bc933bc2c05b7b03b7dad94f6d6b8"
score = 75
@@ -377157,8 +377563,8 @@ rule SIGNATURE_BASE_Casus15_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3700-L3712"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3700-L3712"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5e2ede2d1c4fa1fcc3cbfe0c005d7b13"
logic_hash = "6ee7a07163d33ca329d3be2084406629711db14db4605e8413ee963eb0f9d5a7"
score = 75
@@ -377182,8 +377588,8 @@ rule SIGNATURE_BASE_Small_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3713-L3725"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3713-L3725"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fcee6226d09d150bfa5f103bee61fbde"
logic_hash = "e0444aa604e8956d423037b70b9476f5653503055d0f1bc875d43de144ce5c44"
score = 75
@@ -377207,8 +377613,8 @@ rule SIGNATURE_BASE_Shellbot_Pl
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3726-L3740"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3726-L3740"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b2a883bc3c03a35cfd020dd2ace4bab8"
logic_hash = "5db224e4fe8608bb53f044ca6c0361dc66cadd58c6d4ea5ab4f8ae14ebde0e6e"
score = 75
@@ -377234,8 +377640,8 @@ rule SIGNATURE_BASE_Fuckphpshell_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3741-L3754"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3741-L3754"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "554e50c1265bb0934fcc8247ec3b9052"
logic_hash = "0c993960b4ca880b818c7b7ba726479ed1c64c46ef8ca82d3c990d69ebe43f42"
score = 75
@@ -377260,8 +377666,8 @@ rule SIGNATURE_BASE_Ngh_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3755-L3769"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3755-L3769"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c372b725419cdfd3f8a6371cfeebc2fd"
logic_hash = "c794b216bafdaecf5bd138cc8c7552efbb8c3c571a441489d02a19793a4c294f"
score = 75
@@ -377287,8 +377693,8 @@ rule SIGNATURE_BASE_Jsp_Reverse_Jsp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3770-L3782"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3770-L3782"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8b0e6779f25a17f0ffb3df14122ba594"
logic_hash = "bdd2db4c032b25faaaf3a3a8e769000013f643ecfcb8b0374165a244ad2162a6"
score = 75
@@ -377312,8 +377718,8 @@ rule SIGNATURE_BASE_Tool_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3783-L3796"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3783-L3796"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8febea6ca6051ae5e2ad4c78f4b9c1f2"
logic_hash = "d6bd782302b2c614fc572babb3825c0e1fcd0de5841ca8541ca27580ccc274d4"
score = 75
@@ -377338,8 +377744,8 @@ rule SIGNATURE_BASE_NT_Addy_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3797-L3809"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3797-L3809"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2e0d1bae844c9a8e6e351297d77a1fec"
logic_hash = "0fc61d5e276786b8be822712cdcfc81146998e535532e44d3da92e0668713a48"
score = 75
@@ -377363,8 +377769,8 @@ rule SIGNATURE_BASE_Simattacker___Vrsion_1_0_0___Priv8_4_My_Friend_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3810-L3822"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3810-L3822"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "089ff24d978aeff2b4b2869f0c7d38a3"
logic_hash = "46bc4063d06b4af3e4e61e1e998d489e974e76f17363c9777b8afc39ff21f698"
score = 75
@@ -377388,8 +377794,8 @@ rule SIGNATURE_BASE_Remexp_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3823-L3835"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3823-L3835"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aa1d8491f4e2894dbdb91eec1abc2244"
logic_hash = "c7da9908a0252e95b47dbc8fbb36aeac1661dc464123aaca036bd51047a31584"
score = 75
@@ -377413,8 +377819,8 @@ rule SIGNATURE_BASE_Phvayvv_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3836-L3848"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3836-L3848"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "35fb37f3c806718545d97c6559abd262"
logic_hash = "503a69a7e2c30cc82eba430082627bb93c459a95f675b968126bf4524c598863"
score = 75
@@ -377438,8 +377844,8 @@ rule SIGNATURE_BASE_Klasvayv_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3849-L3862"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3849-L3862"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b3e64bf8462fc3d008a3d1012da64ef"
logic_hash = "eb1b11e02b075a4e7d28b77cf91ad596a85e4c697a36304ee177d46735965e75"
score = 75
@@ -377464,8 +377870,8 @@ rule SIGNATURE_BASE_R57Shell_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3863-L3876"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3863-L3876"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d28445de424594a5f14d0fe2a7c4e94f"
logic_hash = "658eec4f3c463ec1a480bcb7ba995b8d81d1fb846832e569751d9f505f0fa87e"
score = 75
@@ -377490,8 +377896,8 @@ rule SIGNATURE_BASE_Rst_Sql_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3877-L3890"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3877-L3890"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0961641a4ab2b8cb4d2beca593a92010"
logic_hash = "d15cf69d9ad8683d2ac1ff09b08b0b26ecaf35df8e45bbd5c3a02c393f88cb34"
score = 75
@@ -377516,8 +377922,8 @@ rule SIGNATURE_BASE_Wh_Bindshell_Py
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3891-L3903"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3891-L3903"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fab20902862736e24aaae275af5e049c"
logic_hash = "e38a4f5c23371705f9bbf2db8e65d68074554edc1022576166e76d40e06bc039"
score = 75
@@ -377541,8 +377947,8 @@ rule SIGNATURE_BASE_Lurm_Safemod_On_Cgi
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3904-L3916"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3904-L3916"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5ea4f901ce1abdf20870c214b3231db3"
logic_hash = "d308ad6cda92fa437b9a4c46cd1b97fb0138aa8d0010256bda56a64ced1c7875"
score = 75
@@ -377566,8 +377972,8 @@ rule SIGNATURE_BASE_C99Madshell_V2_0_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3917-L3927"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3917-L3927"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d27292895da9afa5b60b9d3014f39294"
logic_hash = "07922511d9dfdd32f6b1f47479fca2063b773024a20dcab6f5cf4d56d66c3397"
score = 75
@@ -377589,8 +377995,8 @@ rule SIGNATURE_BASE_Backupsql_Php_Often_With_C99Shell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3928-L3939"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3928-L3939"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ab1a06ab1a1fe94e3f3b7f80eedbc12f"
logic_hash = "7c64e3d4e5815859c51f05cb376f72ea266b31193f3f4588526005e167ebabad"
score = 75
@@ -377613,8 +378019,8 @@ rule SIGNATURE_BASE_Uploader_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3940-L3952"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3940-L3952"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b53b67bb3b004a8681e1458dd1895d0"
logic_hash = "6e6ffc4cad2a956cb2b6667928bac5996cf95cd36f43ba789144c46726471f07"
score = 75
@@ -377638,8 +378044,8 @@ rule SIGNATURE_BASE_Telnet_Pl
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3953-L3964"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3953-L3964"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dd9dba14383064e219e29396e242c1ec"
logic_hash = "2d1abc52fc70ce664a19e49e6fa4175bc8d8785dee332d5273323479d9628a8c"
score = 75
@@ -377662,8 +378068,8 @@ rule SIGNATURE_BASE_W3D_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3965-L3977"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3965-L3977"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "987f66b29bfb209a0b4f097f84f57c3b"
logic_hash = "33f948a1ae4474daddd788df84fa8baabf4390ec242cad9a6a51dac0152d3b75"
score = 75
@@ -377687,8 +378093,8 @@ rule SIGNATURE_BASE_Webshell_Cgi
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3978-L3989"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3978-L3989"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bc486c2e00b5fc3e4e783557a2441e6f"
logic_hash = "8908ced96284de6b6d5ae693ba54c49a6333bbe5780d951cbacc91b4dde027df"
score = 75
@@ -377711,8 +378117,8 @@ rule SIGNATURE_BASE_Winx_Shell_Html
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L3990-L4002"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L3990-L4002"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17ab5086aef89d4951fe9b7c7a561dda"
logic_hash = "4248f807d66990946523ba7b92d795c2c40429182389d9bf3f4a972e246b50c6"
score = 75
@@ -377736,8 +378142,8 @@ rule SIGNATURE_BASE_Dx_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4003-L4015"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4003-L4015"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
logic_hash = "ab43ddcf317eb4db890ca9750dc6bbc19b06b806339a67c82216df02bc2e8446"
score = 75
@@ -377761,8 +378167,8 @@ rule SIGNATURE_BASE_Csh_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4016-L4029"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4016-L4029"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "194a9d3f3eac8bc56d9a7c55c016af96"
logic_hash = "2a74e06a9fd59d7a577041b49403738904239fb011f9bfe2fb665165991b9c98"
score = 75
@@ -377787,8 +378193,8 @@ rule SIGNATURE_BASE_Phpinj_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4030-L4042"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4030-L4042"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d7a4b0df45d34888d5a09f745e85733f"
logic_hash = "5d39fd31cdaae7765267ce8a35a2fdcf86e7f0de40d4f303fb0f219c0fc04e40"
score = 75
@@ -377812,8 +378218,8 @@ rule SIGNATURE_BASE_Sig_2008_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4043-L4056"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4043-L4056"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3e4ba470d4c38765e4b16ed930facf2c"
logic_hash = "a437dc3dc836e93c7a691f7a000c4a4ae574ba95b3a216394ba42538beb9c0f7"
score = 75
@@ -377838,8 +378244,8 @@ rule SIGNATURE_BASE_Ak74Shell_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4057-L4069"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4057-L4069"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7f83adcb4c1111653d30c6427a94f66f"
logic_hash = "64eb7e72679fc9ee81af6f46d0ab604357710716b93b1ddfaebc5596c968fce8"
score = 75
@@ -377863,8 +378269,8 @@ rule SIGNATURE_BASE_Rem_View_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4070-L4082"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4070-L4082"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "29420106d9a81553ef0d1ca72b9934d9"
logic_hash = "bcd5c86e793748ffe0ce4415ee68101e8183e1f97477b49843938d254f08695a"
score = 75
@@ -377888,8 +378294,8 @@ rule SIGNATURE_BASE_Java_Shell_Js
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4083-L4095"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4083-L4095"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "36403bc776eb12e8b7cc0eb47c8aac83"
logic_hash = "f312298ac30ab57b21222a529b1566b9a66909806e4bc88120ac3992cfd3c6fb"
score = 75
@@ -377913,8 +378319,8 @@ rule SIGNATURE_BASE_STNC_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4096-L4109"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4096-L4109"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2e56cfd5b5014cbbf1c1e3f082531815"
logic_hash = "b4118dc45ac109bde1cafda24cc103370db57c1993690f450cff828c1633af3c"
score = 75
@@ -377939,8 +378345,8 @@ rule SIGNATURE_BASE_Azrailphp_V1_0_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4110-L4122"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4110-L4122"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "26b2d3943395682e36da06ed493a3715"
logic_hash = "4385f294e59b644fe86d8380db4f7926924eb744ad80735b78ef778d2f7e8ae0"
score = 75
@@ -377964,8 +378370,8 @@ rule SIGNATURE_BASE_Moroccan_Spamers_Ma_Edition_By_Ghost_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4123-L4135"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4123-L4135"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d1b7b311a7ffffebf51437d7cd97dc65"
logic_hash = "e755e4ea467861e5217d532b161bf4c582ff71aa1e4720dfa4b75d6e8d7629d8"
score = 75
@@ -377989,8 +378395,8 @@ rule SIGNATURE_BASE_Zacosmall_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4136-L4148"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4136-L4148"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5295ee8dc2f5fd416be442548d68f7a6"
logic_hash = "5a2125fc447344f8cc708503d9e4dd82f9b873e40ded497ef9e01974d08bf043"
score = 75
@@ -378014,8 +378420,8 @@ rule SIGNATURE_BASE_Cmdasp_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4149-L4162"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4149-L4162"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "64f24f09ec6efaa904e2492dffc518b9"
logic_hash = "95dc25ecd47b43edbd7e7e36966377aa09da769aff2bc1c33a7df87989611bfa"
score = 75
@@ -378040,8 +378446,8 @@ rule SIGNATURE_BASE_Simple_Backdoor_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4163-L4175"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4163-L4175"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f091d1b9274c881f8e41b2f96e6b9936"
logic_hash = "e2e98580b59727313de298fab0009704f621b1b6556220d5065118d960f7a068"
score = 75
@@ -378065,8 +378471,8 @@ rule SIGNATURE_BASE_Mysql_Shell_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4176-L4188"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4176-L4188"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d42aec2891214cace99b3eb9f3e21a63"
logic_hash = "dbd825e1056c41efaf80c0495ba7b6cf1c88403b997ea7ac1378512a19f7ed8a"
score = 75
@@ -378090,8 +378496,8 @@ rule SIGNATURE_BASE_Dive_Shell_1_0___Emperor_Hacking_Team_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4189-L4202"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4189-L4202"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b5102bdc41a7bc439eea8f0010310a5"
logic_hash = "bd51b625359799178ad3c8e02ba5bb5fca89e6e14769b86dd35c2b8a1049599f"
score = 75
@@ -378116,8 +378522,8 @@ rule SIGNATURE_BASE_Asmodeus_V0_1_Pl
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4203-L4216"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4203-L4216"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0978b672db0657103c79505df69cb4bb"
logic_hash = "be0130c9d2a5d29e6ef8749b0058c96c2ca1ecb9823fd14a8a2c82978cf3d104"
score = 75
@@ -378142,8 +378548,8 @@ rule SIGNATURE_BASE_Backup_Php_Often_With_C99Shell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4217-L4229"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4217-L4229"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aeee3bae226ad57baf4be8745c3f6094"
logic_hash = "e27d00ebfbac2565568b9a97552a331db91b4e9aa318febb048937f5c3a1a1ba"
score = 75
@@ -378167,8 +378573,8 @@ rule SIGNATURE_BASE_Reader_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4230-L4242"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4230-L4242"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ad1a362e0a24c4475335e3e891a01731"
logic_hash = "ec0dc3b050d84e852e0c18bd00961f109d3506fa7f2e8656448bd5edd28d9305"
score = 75
@@ -378192,8 +378598,8 @@ rule SIGNATURE_BASE_Phpshell17_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4243-L4255"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4243-L4255"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9a928d741d12ea08a624ee9ed5a8c39d"
logic_hash = "a9306747a5c9756f393c61562ed4a601c75c3a9491ad19a7b7dbae1fbd505e9a"
score = 75
@@ -378217,8 +378623,8 @@ rule SIGNATURE_BASE_Myshell_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4256-L4268"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4256-L4268"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "62783d1db52d05b1b6ae2403a7044490"
logic_hash = "dd7b0fa637a8317986de0c2312b4b552f1110fb5a64590a9a21c854e5985fbb6"
score = 75
@@ -378242,8 +378648,8 @@ rule SIGNATURE_BASE_Simshell_1_0___Simorgh_Security_MGZ_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4269-L4282"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4269-L4282"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "37cb1db26b1b0161a4bf678a6b4565bd"
logic_hash = "590a1572877fafcd4425a04c12cd56194f03a63b7acad93c39d4b16dc5a1902d"
score = 75
@@ -378268,8 +378674,8 @@ rule SIGNATURE_BASE_Jspshall_Jsp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4283-L4295"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4283-L4295"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "efe0f6edaa512c4e1fdca4eeda77b7ee"
logic_hash = "94c458d3f38ba21348b0202e2b81bbbc3859e97d64f101a9ea7ec6f036e38bc5"
score = 75
@@ -378293,8 +378699,8 @@ rule SIGNATURE_BASE_Webshell_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4296-L4307"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4296-L4307"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e425241b928e992bde43dd65180a4894"
logic_hash = "7b0f4f4afde7dcb44c9d877a72c961f3666278ce28a24ae8068cfbc32639e307"
score = 75
@@ -378317,8 +378723,8 @@ rule SIGNATURE_BASE_Rootshell_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4308-L4321"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4308-L4321"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "265f3319075536030e59ba2f9ef3eac6"
logic_hash = "f836dd1825dc84212d32a034c0dde45d60ccd1eb667018abb60d671b61192666"
score = 75
@@ -378343,8 +378749,8 @@ rule SIGNATURE_BASE_Connectback2_Pl
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4322-L4334"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4322-L4334"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "473b7d226ea6ebaacc24504bd740822e"
logic_hash = "7316c93f12dbbf6d0235601d8be88c199e37955507925222d00041d0ceaf01c7"
score = 75
@@ -378368,8 +378774,8 @@ rule SIGNATURE_BASE_Defacekeeper_0_2_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4335-L4347"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4335-L4347"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "713c54c3da3031bc614a8a55dccd7e7f"
logic_hash = "0ee3fed3441e9561867508e324d7a6b1808a8923513bf1c9b82f8238224c994c"
score = 75
@@ -378393,8 +378799,8 @@ rule SIGNATURE_BASE_Shells_PHP_Wso
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4348-L4359"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4348-L4359"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "33e2891c13b78328da9062fbfcf898b6"
logic_hash = "31ef69228b66b30300006f63b1e4d6e92c2512caca4bd915d418b48564b39c47"
score = 75
@@ -378417,8 +378823,8 @@ rule SIGNATURE_BASE_Backdoor1_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4360-L4372"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4360-L4372"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e1adda1f866367f52de001257b4d6c98"
logic_hash = "7c8840dc91c16b9fa19fee16e0159a7f13db23c96596e18da0cdab07931ce35b"
score = 75
@@ -378442,8 +378848,8 @@ rule SIGNATURE_BASE_Elmaliseker_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4373-L4386"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4373-L4386"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b32d1730d23a660fd6aa8e60c3dc549f"
logic_hash = "969f0f12449375a9ebbb8a68fd4b3db395927416d5cceccdb7f2c64310430880"
score = 75
@@ -378468,8 +378874,8 @@ rule SIGNATURE_BASE_Indexer_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4387-L4398"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4387-L4398"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9ea82afb8c7070817d4cdf686abe0300"
logic_hash = "0a51f15bfb4289dcb70e1e0b96d100be12901ebf26ed9c0e543eda5f4aa91f1c"
score = 75
@@ -378492,8 +378898,8 @@ rule SIGNATURE_BASE_Dxshell_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4399-L4410"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4399-L4410"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "33a2b31810178f4c2e71fbdeb4899244"
logic_hash = "821f9295eba6119ad08349e769d1909cd7836b4e35795915e94095cf715dc6e5"
score = 75
@@ -378516,8 +378922,8 @@ rule SIGNATURE_BASE_S72_Shell_V1_1_Coding_Html
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4411-L4423"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4411-L4423"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c2e8346a5515c81797af36e7e4a3828e"
logic_hash = "aef8840b72e5c435c11150007d6b3af2943126fefdc6df343d0f73755340e260"
score = 75
@@ -378541,8 +378947,8 @@ rule SIGNATURE_BASE_Kacak_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4424-L4437"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4424-L4437"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "907d95d46785db21331a0324972dda8c"
logic_hash = "8542a3985dff2d1eb42f4d2c9f30405a4817a8e30075225c518ec52381f1f7df"
score = 75
@@ -378567,8 +378973,8 @@ rule SIGNATURE_BASE_PHP_Backdoor_Connect_Pl_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4438-L4450"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4438-L4450"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "57fcd9560dac244aeaf95fd606621900"
logic_hash = "b141546f45767884f9c8b1cc4c09ea25f90c0f3a3633bfeecad78b60e7f20306"
score = 75
@@ -378592,8 +378998,8 @@ rule SIGNATURE_BASE_Antichat_Socks5_Server_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4451-L4463"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4451-L4463"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cbe9eafbc4d86842a61a54d98e5b61f1"
logic_hash = "d6b203561f95f431b3d2c241011ae08c05619d45c5900a28137481c029e8297e"
score = 75
@@ -378617,8 +379023,8 @@ rule SIGNATURE_BASE_Antichat_Shell_V1_3_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4464-L4476"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4464-L4476"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "40d0abceba125868be7f3f990f031521"
logic_hash = "566c324f3bf44ce9f32ddad82a8d3daa87a8a75b5ca0c8286bc912a8ae4ac8e9"
score = 75
@@ -378642,8 +379048,8 @@ rule SIGNATURE_BASE_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4477-L4489"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4477-L4489"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "49ad9117c96419c35987aaa7e2230f63"
logic_hash = "d6d2a3999f2e8ceb70f57697c0a845edbbcfce0aba151ec6a0ac23f55265cd47"
score = 75
@@ -378667,8 +379073,8 @@ rule SIGNATURE_BASE_Mysql_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4490-L4502"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4490-L4502"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12bbdf6ef403720442a47a3cc730d034"
logic_hash = "60e235310f378698ffcc3ae6a07ab5dd94a660ca4b1504cc878d9741f751d5d1"
score = 75
@@ -378692,8 +379098,8 @@ rule SIGNATURE_BASE_Worse_Linux_Shell_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4503-L4514"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4503-L4514"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8338c8d9eab10bd38a7116eb534b5fa2"
logic_hash = "47801296b700e85f9e08857eb06f845ef8ed3f88b7d0de34d4b7c47cef6cc7fb"
score = 75
@@ -378716,8 +379122,8 @@ rule SIGNATURE_BASE_Cyberlords_Sql_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4515-L4528"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4515-L4528"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "03b06b4183cb9947ccda2c3d636406d4"
logic_hash = "b3286f9fd86c90c5afc79801b6d65c9ae52ee1c37da93ff15461d84f37ef8019"
score = 75
@@ -378742,8 +379148,8 @@ rule SIGNATURE_BASE_Cmd_Asp_5_1_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4529-L4540"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4529-L4540"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8baa99666bf3734cbdfdd10088e0cd9f"
logic_hash = "a41c83da1a65e67b6f4ac6ad7cc8702486957ab0c7dda658d071e603338c324b"
score = 75
@@ -378766,8 +379172,8 @@ rule SIGNATURE_BASE_Pws_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4541-L4553"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4541-L4553"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ecdc6c20f62f99fa265ec9257b7bf2ce"
logic_hash = "98dae8aab5bfd58f4264e318f5a5b5900b38687386f9d7f09c31da0f51d57bc0"
score = 75
@@ -378791,8 +379197,8 @@ rule SIGNATURE_BASE_PHP_Shell_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4554-L4565"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4554-L4565"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
logic_hash = "2d5b6e08bfe9e1551dab12b01189dadc924c097427c996684bab96c48d528395"
score = 75
@@ -378815,8 +379221,8 @@ rule SIGNATURE_BASE_Ayyildiz_Tim___AYT__Shell_V_2_1_Biz_Html
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4566-L4579"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4566-L4579"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8a8c8bb153bd1ee097559041f2e5cf0a"
logic_hash = "9e2d56b49df65a2c13e15f97ec91cdbb6852d86e86f921d7c8a4db82cbea12f5"
score = 75
@@ -378841,8 +379247,8 @@ rule SIGNATURE_BASE_EFSO_2_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4580-L4591"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4580-L4591"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b5fde9682fd63415ae211d53c6bfaa4d"
logic_hash = "15e5419854bcbb08f28fff1e266cca7a004f01ec0a5c313c107ec17c3aa7ffee"
score = 75
@@ -378865,8 +379271,8 @@ rule SIGNATURE_BASE_Lamashell_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4592-L4604"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4592-L4604"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "de9abc2e38420cad729648e93dfc6687"
logic_hash = "5e156c3057338fa7b306b91dd979851dd56b8b698cfe99e1d7b6d096a4c580e7"
score = 75
@@ -378890,8 +379296,8 @@ rule SIGNATURE_BASE_Ajax_PHP_Command_Shell_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4605-L4617"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4605-L4617"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "93d1a2e13a3368a2472043bd6331afe9"
logic_hash = "37cba26018f3d37194a143871012a61a7bcee6775d2cf5f93a52b779010d3260"
score = 75
@@ -378915,8 +379321,8 @@ rule SIGNATURE_BASE_Jspwebshell_1_2_Jsp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4618-L4631"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4618-L4631"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70a0ee2624e5bbe5525ccadc467519f6"
logic_hash = "32b3ddb00f89a3540118fe8ce5fc070556b00030dcf2b21245d38ae66e6cbc14"
score = 75
@@ -378941,8 +379347,8 @@ rule SIGNATURE_BASE_Sincap_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4632-L4644"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4632-L4644"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b68b90ff6012a103e57d141ed38a7ee9"
logic_hash = "e708a7dcb26ff7d0208c1f092e14e701f2ae94c4ffca019f13064bbe04ef74d7"
score = 75
@@ -378966,8 +379372,8 @@ rule SIGNATURE_BASE_Test_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4645-L4657"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4645-L4657"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "77e331abd03b6915c6c6c7fe999fcb50"
logic_hash = "575a2eeadc8113d779057f98e978ed4f8914546117b57944bf65f1d6d84c9521"
score = 50
@@ -378991,8 +379397,8 @@ rule SIGNATURE_BASE_Phyton_Shell_Py
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4658-L4671"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4658-L4671"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "92b3c897090867c65cc169ab037a0f55"
logic_hash = "ac16a95cd1fb09c93b315e3cd7d57c1ebec322b641f515854fb73a61393dd365"
score = 75
@@ -379017,8 +379423,8 @@ rule SIGNATURE_BASE_Mysql_Tool_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4672-L4684"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4672-L4684"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5fbe4d8edeb2769eda5f4add9bab901e"
logic_hash = "9f49bd6c56c919f678ecada82ff3d801c82c98a8abdee85cda1ec7e5b6756012"
score = 75
@@ -379042,8 +379448,8 @@ rule SIGNATURE_BASE_Zehir_4_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4685-L4696"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4685-L4696"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7f4e12e159360743ec016273c3b9108c"
logic_hash = "69063d866daf1709df81fa22d76177bf8d552e19725a94db4a1b2fca79387faf"
score = 75
@@ -379066,8 +379472,8 @@ rule SIGNATURE_BASE_Sh_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4697-L4708"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4697-L4708"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "330af9337ae51d0bac175ba7076d6299"
logic_hash = "b0c3307d451e5d7dadece114e2888503a46038e2edb2ff32bf566ce47b300e76"
score = 75
@@ -379090,8 +379496,8 @@ rule SIGNATURE_BASE_Phpbackdoor15_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4709-L4721"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4709-L4721"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0fdb401a49fc2e481e3dfd697078334b"
logic_hash = "cdd105f36593e8326ca32bf7cf1fba6fb754e7305c91fe6c078323db8f59b23c"
score = 75
@@ -379115,8 +379521,8 @@ rule SIGNATURE_BASE_Phpjackal_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4722-L4733"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4722-L4733"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ab230817bcc99acb9bdc0ec6d264d76f"
logic_hash = "6e2ff262aecd08e5feaa274a7fd128d75565d6cc03341da7cbeb2949070705e5"
score = 75
@@ -379139,8 +379545,8 @@ rule SIGNATURE_BASE_Sql_Php_Php : FILE
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4734-L4747"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4734-L4747"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8334249cbb969f2d33d678fec2b680c5"
logic_hash = "016ea01e9b53add0799f5c105fb3d54e6ee07d01c950772a618b2a780f14254f"
score = 75
@@ -379164,8 +379570,8 @@ rule SIGNATURE_BASE_Cgi_Python_Py
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4748-L4760"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4748-L4760"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0a15f473e2232b89dae1075e1afdac97"
logic_hash = "37c6c7db32a52c8a83ff85f0a50c6fa71e833b9e6d20b1f95e9512fe8bbd0aee"
score = 75
@@ -379189,8 +379595,8 @@ rule SIGNATURE_BASE_Ru24_Post_Sh_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4761-L4773"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4761-L4773"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5b334d494564393f419af745dc1eeec7"
logic_hash = "e81e5345bbe07ca85c94a3d8411f0dd3c418689ccae7115c098f718f9093b3bf"
score = 75
@@ -379214,8 +379620,8 @@ rule SIGNATURE_BASE_Dtool_Pro_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4774-L4786"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4774-L4786"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "366ad973a3f327dfbfb915b0faaea5a6"
logic_hash = "e8f8b4ca2ab4607e700e897671fd230280763a70897b8ccfc31b3bcb7f2a1f4a"
score = 75
@@ -379239,8 +379645,8 @@ rule SIGNATURE_BASE_Telnetd_Pl
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4787-L4801"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4787-L4801"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5f61136afd17eb025109304bd8d6d414"
logic_hash = "faf21758b311fa4c2d11cd60169e6c9a67282cf739b73664456691361a480419"
score = 75
@@ -379266,8 +379672,8 @@ rule SIGNATURE_BASE_Php_Include_W_Shell_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4802-L4813"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4802-L4813"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4e913f159e33867be729631a7ca46850"
logic_hash = "a63910d97b7ef447b2cadb7de12943d3dbb6eada27d3097b8acf58d9b65b6f60"
score = 75
@@ -379290,8 +379696,8 @@ rule SIGNATURE_BASE_Safe0Ver_Shell__Safe_Mod_Bypass_By_Evilc0Der_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4814-L4826"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4814-L4826"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6163b30600f1e80d2bb5afaa753490b6"
logic_hash = "46f6bb38f1175e02b03047c06a7aed968b1c1ce2e28cc4b88e15703040e91592"
score = 75
@@ -379315,8 +379721,8 @@ rule SIGNATURE_BASE_Shell_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4827-L4839"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4827-L4839"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1a95f0163b6dea771da1694de13a3d8d"
logic_hash = "dbd08e71dc512f8dcf009150fb4448cd3608291ef9078c7e6b86e6f8d820bd94"
score = 75
@@ -379340,8 +379746,8 @@ rule SIGNATURE_BASE_Telnet_Cgi
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4840-L4852"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4840-L4852"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dee697481383052980c20c48de1598d1"
logic_hash = "689c1d43c64aa7469989686c60fc9ab46acde42fdf3c1157bae1e2b8373c845f"
score = 75
@@ -379365,8 +379771,8 @@ rule SIGNATURE_BASE_Ironshell_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4853-L4867"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4853-L4867"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8bfa2eeb8a3ff6afc619258e39fded56"
logic_hash = "23574299ee2bb33c3f71102adf71ac8f09b6f8ece5f798beacb9b2432d297ee7"
score = 75
@@ -379392,8 +379798,8 @@ rule SIGNATURE_BASE_Backdoorfr_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4868-L4879"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4868-L4879"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "91e4afc7444ed258640e85bcaf0fecfc"
logic_hash = "40a6fb41a65fd35acb7cdc36fdda90f5dc54b641adc3ba9eaae29c5e46622206"
score = 75
@@ -379416,8 +379822,8 @@ rule SIGNATURE_BASE_Aspydrv_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4880-L4893"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4880-L4893"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1c01f8a88baee39aa1cebec644bbcb99"
logic_hash = "64912d7521d4bff33b5f3a78525bf4ed94246f5933753bed7ca02bedffc85f0f"
score = 60
@@ -379441,8 +379847,8 @@ rule SIGNATURE_BASE_Cmdjsp_Jsp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4894-L4907"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4894-L4907"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b815611cc39f17f05a73444d699341d4"
logic_hash = "8b0e425c7d71ea2c536192ff186665e7f0fbdbc0e0d195d7107ac57cf9bd1773"
score = 75
@@ -379467,8 +379873,8 @@ rule SIGNATURE_BASE_H4Ntu_Shell__Powered_By_Tsoi_
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4908-L4919"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4908-L4919"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "06ed0b2398f8096f1bebf092d0526137"
logic_hash = "32c620a4ed3f7a8640928e2211516978c12cfbdedb7d96e923303740407b5a1c"
score = 75
@@ -379491,8 +379897,8 @@ rule SIGNATURE_BASE_Ajan_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4920-L4932"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4920-L4932"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b6f468252407efc2318639da22b08af0"
logic_hash = "13988af864a62ca04501288d4f2d830815ab453b14cef6795fe993db1dd1a9ef"
score = 75
@@ -379516,8 +379922,8 @@ rule SIGNATURE_BASE_PHANTASMA_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4933-L4946"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4933-L4946"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "52779a27fa377ae404761a7ce76a5da7"
logic_hash = "d4a2a1bcc1ff3264b35f2b05d7de664b56807977f2a793fd87206f046a185d3b"
score = 75
@@ -379542,8 +379948,8 @@ rule SIGNATURE_BASE_Mysql_Web_Interface_Version_0_8_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4947-L4960"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4947-L4960"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "36d4f34d0a22080f47bb1cb94107c60f"
logic_hash = "f0a20870a3240948e3ef1ad61685b00c5fc90d6098b87af9ac43ab44ccd13c9e"
score = 75
@@ -379568,8 +379974,8 @@ rule SIGNATURE_BASE_Simple_Cmd_Html
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4961-L4974"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4961-L4974"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c6381412df74dbf3bcd5a2b31522b544"
logic_hash = "56b5b9e5518fa8a4be8c48735e997a538b0e534ad8fd72c1419dc0e8353bbc00"
score = 75
@@ -379594,8 +380000,8 @@ rule SIGNATURE_BASE__1_C2007_Php_Php_C100_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4975-L4989"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4975-L4989"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "44542e5c3e9790815c49d5f9beffbbf2"
hash = "d089e7168373a0634e1ac18c0ee00085"
hash = "38fd7e45f9c11a37463c3ded1c76af4c"
@@ -379621,8 +380027,8 @@ rule SIGNATURE_BASE__Nst_Php_Php_Img_Php_Php_Nstview_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L4990-L5005"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L4990-L5005"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ddaf9f1986d17284de83a17fe5f9fd94"
hash = "17a07bb84e137b8aa60f87cd6bfab748"
hash = "4745d510fed4378e4b1730f56f25e569"
@@ -379649,8 +380055,8 @@ rule SIGNATURE_BASE__Network_Php_Php_Xinfo_Php_Php_Nfm_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5006-L5020"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5006-L5020"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "acdbba993a5a4186fd864c5e4ea0ba4f"
hash = "2601b6fc1579f263d2f3960ce775df70"
hash = "401fbae5f10283051c39e640b77e4c26"
@@ -379676,8 +380082,8 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_Specials
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5021-L5036"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5021-L5036"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a3f9f2aa47c2e940695f3dba6a7bb2"
hash = "3ca5886cd54d495dc95793579611f59a"
hash = "9c5bb5e3a46ec28039e8986324e42792"
@@ -379704,8 +380110,8 @@ rule SIGNATURE_BASE__R577_Php_Php_Sniper_SA_Shell_Php_R57_Php_Php_R57_Shell_Php_
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5037-L5054"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5037-L5054"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0714f80f35c1fddef1f8938b8d42a4c8"
hash = "911195a9b7c010f61b66439d9048f400"
hash = "eddf7a8fde1e50a7f2a817ef7cece24f"
@@ -379734,8 +380140,8 @@ rule SIGNATURE_BASE__C99Shell_V1_0_Php_Php_C99Php_Sses_Php_Php_Ctt_Sh_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5055-L5071"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5055-L5071"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d8ae5819a0a2349ec552cbcf3a62c975"
hash = "9e9ae0332ada9c3797d6cee92c2ede62"
hash = "6cd50a14ea0da0df6a246a60c8f6f9c9"
@@ -379763,8 +380169,8 @@ rule SIGNATURE_BASE__R577_Php_Php_Spy_Php_Php_S_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5072-L5086"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5072-L5086"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0714f80f35c1fddef1f8938b8d42a4c8"
hash = "eed14de3907c9aa2550d95550d1a2d5f"
hash = "817671e1bdc85e04cc3440bbd9288800"
@@ -379790,8 +380196,8 @@ rule SIGNATURE_BASE_Webshell_C99_Generic
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5087-L5107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5087-L5107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a3f9f2aa47c2e940695f3dba6a7bb2"
hash = "3ca5886cd54d495dc95793579611f59a"
hash = "9c5bb5e3a46ec28039e8986324e42792"
@@ -379823,8 +380229,8 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_C99Shell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5108-L5125"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5108-L5125"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a3f9f2aa47c2e940695f3dba6a7bb2"
hash = "3ca5886cd54d495dc95793579611f59a"
hash = "9c5bb5e3a46ec28039e8986324e42792"
@@ -379853,8 +380259,8 @@ rule SIGNATURE_BASE__W_Php_Php_Wacking_Php_Php_Specialshell_99_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5126-L5140"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5126-L5140"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a3f9f2aa47c2e940695f3dba6a7bb2"
hash = "9c5bb5e3a46ec28039e8986324e42792"
hash = "09609851caa129e40b0d56e90dfc476c"
@@ -379880,8 +380286,8 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_Sses_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5141-L5157"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5141-L5157"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a3f9f2aa47c2e940695f3dba6a7bb2"
hash = "3ca5886cd54d495dc95793579611f59a"
hash = "9c5bb5e3a46ec28039e8986324e42792"
@@ -379909,8 +380315,8 @@ rule SIGNATURE_BASE__R577_Php_Php_Sniper_SA_Shell_Php_R57_Php_Php_Spy_Php_Php_S_
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5158-L5174"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5158-L5174"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0714f80f35c1fddef1f8938b8d42a4c8"
hash = "911195a9b7c010f61b66439d9048f400"
hash = "eddf7a8fde1e50a7f2a817ef7cece24f"
@@ -379938,8 +380344,8 @@ rule SIGNATURE_BASE__R577_Php_Php_Sniper_SA_Shell_Php_R57_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5175-L5190"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5175-L5190"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0714f80f35c1fddef1f8938b8d42a4c8"
hash = "911195a9b7c010f61b66439d9048f400"
hash = "eddf7a8fde1e50a7f2a817ef7cece24f"
@@ -379966,8 +380372,8 @@ rule SIGNATURE_BASE__R577_Php_Php_R57_Shell_Php_Php_Spy_Php_Php_S_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5191-L5207"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5191-L5207"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0714f80f35c1fddef1f8938b8d42a4c8"
hash = "8023394542cddf8aee5dec6072ed02b5"
hash = "eed14de3907c9aa2550d95550d1a2d5f"
@@ -379995,8 +380401,8 @@ rule SIGNATURE_BASE__Wacking_Php_Php_1_Specialshell_99_Php_Php_C100_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5208-L5224"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5208-L5224"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9c5bb5e3a46ec28039e8986324e42792"
hash = "44542e5c3e9790815c49d5f9beffbbf2"
hash = "09609851caa129e40b0d56e90dfc476c"
@@ -380024,8 +380430,8 @@ rule SIGNATURE_BASE__R577_Php_Php_R57_Php_Php_R57_Shell_Php_Php_Spy_Php_Php_S_Ph
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5225-L5242"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5225-L5242"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0714f80f35c1fddef1f8938b8d42a4c8"
hash = "eddf7a8fde1e50a7f2a817ef7cece24f"
hash = "8023394542cddf8aee5dec6072ed02b5"
@@ -380054,8 +380460,8 @@ rule SIGNATURE_BASE__W_Php_Php_Wacking_Php_Php_Sses_Php_Php_Specialshell_99_Php_
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5243-L5259"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5243-L5259"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a3f9f2aa47c2e940695f3dba6a7bb2"
hash = "9c5bb5e3a46ec28039e8986324e42792"
hash = "6cd50a14ea0da0df6a246a60c8f6f9c9"
@@ -380083,8 +380489,8 @@ rule SIGNATURE_BASE_Multiple_Php_Webshells
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5261-L5282"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5261-L5282"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0714f80f35c1fddef1f8938b8d42a4c8"
hash = "911195a9b7c010f61b66439d9048f400"
hash = "be0f67f3e995517d18859ed57b4b4389"
@@ -380117,8 +380523,8 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5283-L5298"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5283-L5298"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a3f9f2aa47c2e940695f3dba6a7bb2"
hash = "3ca5886cd54d495dc95793579611f59a"
hash = "9c5bb5e3a46ec28039e8986324e42792"
@@ -380145,8 +380551,8 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_C99Shell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5299-L5316"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5299-L5316"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a3f9f2aa47c2e940695f3dba6a7bb2"
hash = "3ca5886cd54d495dc95793579611f59a"
hash = "9c5bb5e3a46ec28039e8986324e42792"
@@ -380175,8 +380581,8 @@ rule SIGNATURE_BASE__GFS_Web_Shell_Ver_3_1_7___Priv8_Php_Nshell_Php_Php_Gfs_Sh_P
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5317-L5332"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5317-L5332"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "be0f67f3e995517d18859ed57b4b4389"
hash = "4a44d82da21438e32d4f514ab35c26b6"
hash = "f618f41f7ebeb5e5076986a66593afd1"
@@ -380203,8 +380609,8 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_C99Shell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5333-L5351"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5333-L5351"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a3f9f2aa47c2e940695f3dba6a7bb2"
hash = "3ca5886cd54d495dc95793579611f59a"
hash = "9c5bb5e3a46ec28039e8986324e42792"
@@ -380234,8 +380640,8 @@ rule SIGNATURE_BASE__W_Php_Php_Wacking_Php_Php_C99Shell_V1_0_Php_Php_C99Php_Spec
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5352-L5368"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5352-L5368"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a3f9f2aa47c2e940695f3dba6a7bb2"
hash = "9c5bb5e3a46ec28039e8986324e42792"
hash = "d8ae5819a0a2349ec552cbcf3a62c975"
@@ -380263,8 +380669,8 @@ rule SIGNATURE_BASE__Antichat_Php_Php_Fatalshell_Php_Php_A_Gedit_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5369-L5385"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5369-L5385"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "128e90b5e2df97e21e96d8e268cde7e3"
hash = "b15583f4eaad10a25ef53ab451a4a26d"
hash = "ab9c6b24ca15f4a1b7086cad78ff0f78"
@@ -380292,8 +380698,8 @@ rule SIGNATURE_BASE__C99Shell_V1_0_Php_Php_C99Php_Sses_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5386-L5399"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5386-L5399"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d8ae5819a0a2349ec552cbcf3a62c975"
hash = "9e9ae0332ada9c3797d6cee92c2ede62"
hash = "6cd50a14ea0da0df6a246a60c8f6f9c9"
@@ -380318,8 +380724,8 @@ rule SIGNATURE_BASE__Crystal_Php_Nshell_Php_Php_Load_Shell_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5400-L5415"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5400-L5415"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fdbf54d5bf3264eb1c4bff1fac548879"
hash = "4a44d82da21438e32d4f514ab35c26b6"
hash = "0c5d227f4aa76785e4760cdcff78a661"
@@ -380346,8 +380752,8 @@ rule SIGNATURE_BASE__Nst_Php_Php_Cybershell_Php_Php_Img_Php_Php_Nstview_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5416-L5432"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5416-L5432"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ddaf9f1986d17284de83a17fe5f9fd94"
hash = "ef8828e0bc0641a655de3932199c0527"
hash = "17a07bb84e137b8aa60f87cd6bfab748"
@@ -380375,8 +380781,8 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_Dc3_Secu
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5433-L5449"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5433-L5449"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a3f9f2aa47c2e940695f3dba6a7bb2"
hash = "3ca5886cd54d495dc95793579611f59a"
hash = "9c5bb5e3a46ec28039e8986324e42792"
@@ -380404,8 +380810,8 @@ rule SIGNATURE_BASE__C99Shell_V1_0_Php_Php_C99Php_1_C2007_Php_Php_C100_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5450-L5465"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5450-L5465"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d8ae5819a0a2349ec552cbcf3a62c975"
hash = "9e9ae0332ada9c3797d6cee92c2ede62"
hash = "44542e5c3e9790815c49d5f9beffbbf2"
@@ -380432,8 +380838,8 @@ rule SIGNATURE_BASE_Multiple_Php_Webshells_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5466-L5486"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5466-L5486"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a3f9f2aa47c2e940695f3dba6a7bb2"
hash = "3ca5886cd54d495dc95793579611f59a"
hash = "9c5bb5e3a46ec28039e8986324e42792"
@@ -380465,8 +380871,8 @@ rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_1_Specia
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5487-L5505"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5487-L5505"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a3f9f2aa47c2e940695f3dba6a7bb2"
hash = "3ca5886cd54d495dc95793579611f59a"
hash = "9c5bb5e3a46ec28039e8986324e42792"
@@ -380496,8 +380902,8 @@ rule SIGNATURE_BASE__R577_Php_Php_R57_Php_Php_Spy_Php_Php_S_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5506-L5522"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5506-L5522"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0714f80f35c1fddef1f8938b8d42a4c8"
hash = "eddf7a8fde1e50a7f2a817ef7cece24f"
hash = "eed14de3907c9aa2550d95550d1a2d5f"
@@ -380525,8 +380931,8 @@ rule SIGNATURE_BASE__Nixrem_Php_Php_C99Shell_V1_0_Php_Php_C99Php_NIX_REMOTE_WEB_
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5523-L5540"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5523-L5540"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "40a3e86a63d3d7f063a86aab5b5f92c6"
hash = "d8ae5819a0a2349ec552cbcf3a62c975"
hash = "9e9ae0332ada9c3797d6cee92c2ede62"
@@ -380555,8 +380961,8 @@ rule SIGNATURE_BASE_Darksecurityteam_Webshell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5544-L5556"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5544-L5556"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
logic_hash = "0c58ed8845cb04d785322b280647d424e1028a3be7e92b2493fd907fae36b16d"
score = 50
@@ -380579,8 +380985,8 @@ rule SIGNATURE_BASE_PHP_Cloaked_Webshell_Superfetchexec
date = "2016-02-15"
modified = "2026-05-15"
reference = "http://goo.gl/xFvioC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5558-L5570"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5558-L5570"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "320b85b1ad39a90578f53c69838b6264af1e6a71c509aefc0986c7f0c77fdae9"
score = 50
quality = 85
@@ -380602,8 +381008,8 @@ rule SIGNATURE_BASE_Webshell_Remexp_Asp_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5574-L5589"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5574-L5589"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d9919dcf94a70d5180650de8b81669fa1c10c5a2"
logic_hash = "b3cfa44898629ffa20630436ae10a94ad72f0e793d61e1157a4de649aa048fe2"
score = 75
@@ -380630,8 +381036,8 @@ rule SIGNATURE_BASE_Webshell_Dc3_Security_Crew_Shell_Priv
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5590-L5606"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5590-L5606"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b2a4a7174ca170b4e3a8cdf4814c92695134c8a"
logic_hash = "f93a5d87d4a490844de578067dc0b7bac6b01ceb9130cd7c70a227566e18f16c"
score = 75
@@ -380659,8 +381065,8 @@ rule SIGNATURE_BASE_Webshell_Simattacker
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5607-L5625"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5607-L5625"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "258297b62aeaf4650ce04642ad5f19be25ec29c9"
logic_hash = "323b68f1d31df647775ad16a85b9f90bce4eac89188160a1e4853f8fec680160"
score = 75
@@ -380690,8 +381096,8 @@ rule SIGNATURE_BASE_Webshell_Dtool_Pro
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5626-L5644"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5626-L5644"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e2ee1c7ba7b05994f65710b7bbf935954f2c3353"
logic_hash = "da744efb521415fb8817c0982d8d538e1e38b1c0995f43716611df37bf371c38"
score = 75
@@ -380722,8 +381128,8 @@ rule SIGNATURE_BASE_Webshell_Ironshell_4
modified = "2026-05-15"
old_rule_name = "WebShell_ironshell"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5645-L5664"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5645-L5664"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d47b8ba98ea8061404defc6b3a30839c4444a262"
logic_hash = "1810071f261ad7390532b07ef24115726f236131aa8ffd29adbde9ebe5085e9d"
score = 75
@@ -380753,8 +381159,8 @@ rule SIGNATURE_BASE_Webshell_Indexer_Asp_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5665-L5681"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5665-L5681"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e9a7aa5eb1fb228117dc85298c7d3ecd8e288a2d"
logic_hash = "c576925c95b5bd2549e8039a1fc6ac228bfab5ddee8c4e12264ea78e9828ba5c"
score = 75
@@ -380782,8 +381188,8 @@ rule SIGNATURE_BASE_Webshell_Toolaspshell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5682-L5695"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5682-L5695"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "11d236b0d1c2da30828ffd2f393dd4c6a1022e3f"
logic_hash = "cb46d3170a9c144a22ef8c91b381495a471d2aa178a4a123eb9a1e32e1db7683"
score = 75
@@ -380808,8 +381214,8 @@ rule SIGNATURE_BASE_Webshell_B374K_Mini_Shell_Php_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5696-L5709"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5696-L5709"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "afb88635fbdd9ebe86b650cc220d3012a8c35143"
logic_hash = "553bd775d9662f9410d9ab946ccffe4b2ee92e367bcc6345fa595527653280cf"
score = 75
@@ -380834,8 +381240,8 @@ rule SIGNATURE_BASE_Webshell_Sincap_1_0
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5710-L5725"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5710-L5725"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b72635ff1410fa40c4e15513ae3a496d54f971c"
logic_hash = "0cb8851285bd55b0b613ec4c46ab88142e2cbba7e527ad510b008cfb342af221"
score = 75
@@ -380862,8 +381268,8 @@ rule SIGNATURE_BASE_Webshell_B374K_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5726-L5741"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5726-L5741"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "04c99efd187cf29dc4e5603c51be44170987bce2"
logic_hash = "f44ecdcf327cf417a90a91c8d23f6137b80c2006bea2ca2e214f2bfdf5793771"
score = 75
@@ -380890,8 +381296,8 @@ rule SIGNATURE_BASE_Webshell_Simattacker___Vrsion_1_0_0___Priv8_4_My_Friend
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5742-L5759"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5742-L5759"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6454cc5ab73143d72cf0025a81bd1fe710351b44"
logic_hash = "63ebb0c673a5aee05d2d9d571ebf63942d826b5148a5f7ed587ba1efbb0dc923"
score = 75
@@ -380921,8 +381327,8 @@ rule SIGNATURE_BASE_WEBSHELL_H4Ntu_Shell_Powered_Tsoi_2 : FILE
modified = "2025-03-21"
old_rule_name = "WebShell_h4ntu_shell__powered_by_tsoi_"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5761-L5777"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5761-L5777"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cbca8cd000e705357e2a7e0cf8262678706f18f9"
logic_hash = "c731f2f430e61277ec6c8e292aa50a31eea46fe67eb455811b3fbe9e8967a8c1"
score = 75
@@ -380947,8 +381353,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Myshell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5779-L5797"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5779-L5797"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "42e283c594c4d061f80a18f5ade0717d3fb2f76d"
logic_hash = "2c39ffecb44ce2f936ba3563c6086d8b2ed75aec3b57b45e2a1f5e7321ac9a3f"
score = 75
@@ -380978,8 +381384,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Pws
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5798-L5814"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5798-L5814"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a405f1c179a84ff8ac09a42177a2bcd8a1a481b"
logic_hash = "4b2eeb80200cc5dffa80cddc74f1902c0e8a5d2313d9a20d02eeb99ccb668ec0"
score = 75
@@ -381007,8 +381413,8 @@ rule SIGNATURE_BASE_Webshell_Reader_Asp_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5815-L5829"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5815-L5829"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70656f3495e2b3ad391a77d5208eec0fb9e2d931"
logic_hash = "6ffda38584b6cdec818af8e09c62bb4a46f40230ffd5c1a68993a91c37f67680"
score = 75
@@ -381035,8 +381441,8 @@ rule SIGNATURE_BASE_Webshell_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2_3
modified = "2026-05-15"
old_rule_name = "WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5830-L5847"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5830-L5847"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "db076b7c80d2a5279cab2578aa19cb18aea92832"
logic_hash = "6840af0d9f99277277edce93deb54e9a319c8938169701c89fdeb65207590951"
score = 75
@@ -381065,8 +381471,8 @@ rule SIGNATURE_BASE_Webshell_Liz0Zim_Private_Safe_Mode_Command_Execuriton_Bypass
modified = "2026-05-15"
old_rule_name = "WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5848-L5864"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5848-L5864"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b2b797707e09c12ff5e632af84b394ad41a46fa4"
logic_hash = "92bfac3516a448bbb3e78cf8950c6e816bf35d0ae2f3d32bc9b9b2836309999b"
score = 75
@@ -381094,8 +381500,8 @@ rule SIGNATURE_BASE_Webshell_PHP_Backdoor_2
modified = "2026-05-15"
old_rule_name = "WebShell_php_backdoor"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5865-L5881"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5865-L5881"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b190c03af4f3fb52adc20eb0f5d4d151020c74fe"
logic_hash = "4228bcbfff5d7756615347196270f7916843e2aceacc7298610070b8b923381b"
score = 75
@@ -381123,8 +381529,8 @@ rule SIGNATURE_BASE_Webshell_Worse_Linux_Shell_2
modified = "2026-05-15"
old_rule_name = "WebShell_Worse_Linux_Shell"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5882-L5899"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5882-L5899"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "64623ab1246bc8f7d256b25f244eb2b41f543e96"
logic_hash = "6480c524213583511253ea1d37820994bba8a86f58a3775d4a9e4325725289d8"
score = 75
@@ -381152,8 +381558,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Phpinj
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5900-L5917"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5900-L5917"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "75116bee1ab122861b155cc1ce45a112c28b9596"
logic_hash = "271efaa8f370376f971d3d59256658b341599ac554cc216e09401e44b16bdede"
score = 75
@@ -381182,8 +381588,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_NGH
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5918-L5935"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5918-L5935"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c05b5deecfc6de972aa4652cb66da89cfb3e1645"
logic_hash = "572b026545b012951136bdb9b1101e38f27bc3321b895799bc853ea1190877f9"
score = 75
@@ -381212,8 +381618,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Matamu
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5936-L5952"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5936-L5952"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d477aae6bd2f288b578dbf05c1c46b3aaa474733"
logic_hash = "c0101dab5fe7c3a2652b2e23e1ef0274364137895a402a0367c6b5474c0e8a1f"
score = 75
@@ -381241,8 +381647,8 @@ rule SIGNATURE_BASE_Webshell_Ru24_Post_Sh
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5953-L5968"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5953-L5968"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d2c18766a1cd4dda928c12ff7b519578ccec0769"
logic_hash = "6cf15a67c311979d32edfb443701cef34ee32d7a672314fc7b60b262b6b2c402"
score = 75
@@ -381269,8 +381675,8 @@ rule SIGNATURE_BASE_Webshell_Hiddens_Shell_V1
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5969-L5980"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5969-L5980"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1674bd40eb98b48427c547bf9143aa7fbe2f4a59"
logic_hash = "b76400c320e6294b0c831fbbb8e08a9d2097fbb027065f9c4b496d4b005ba016"
score = 75
@@ -381293,8 +381699,8 @@ rule SIGNATURE_BASE_Webshell_C99_Madnet
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5981-L5996"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5981-L5996"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17613df393d0a99fd5bea18b2d4707f566cff219"
logic_hash = "cd4048f28405f106302643656ae5f8a257aaec0184a8057a9dffbda9bb857027"
score = 75
@@ -381321,8 +381727,8 @@ rule SIGNATURE_BASE_Webshell_C99_Locus7S
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L5997-L6012"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L5997-L6012"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d413d4700daed07561c9f95e1468fb80238fbf3c"
logic_hash = "5ecfc5f6da471bd3037228c0bc762d50762933af3cf6674210c7b2017a45a646"
score = 75
@@ -381349,8 +381755,8 @@ rule SIGNATURE_BASE_Webshell_Jspwebshell_1_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6013-L6029"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6013-L6029"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0bed4a1966117dd872ac9e8dceceb54024a030fa"
logic_hash = "13e696c1c671d7fda832c84f150e3f41ed55bf888c4bebfeb06ea68d6be65527"
score = 75
@@ -381378,8 +381784,8 @@ rule SIGNATURE_BASE_Webshell_Safe0Ver
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6030-L6047"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6030-L6047"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "366639526d92bd38ff7218b8539ac0f154190eb8"
logic_hash = "ae5de63b79804cf8c99bc5ea0c8862cf05e4085451d2b516cf95565bf32f3876"
score = 75
@@ -381408,8 +381814,8 @@ rule SIGNATURE_BASE_Webshell_Uploader
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6048-L6059"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6048-L6059"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e216c5863a23fde8a449c31660fd413d77cce0b7"
logic_hash = "c4b915f60a952131caa2c4f5bb2eea85ef25f27cabb8ad36a6bb928433558954"
score = 75
@@ -381432,8 +381838,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Kral
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6060-L6076"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6060-L6076"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4cd1d1a2fd448cecc605970e3a89f3c2e5c80dfc"
logic_hash = "0aded226f4e54c0169b9fbda91458f581ea47f9f8bda61a350b5e6f8b60931f3"
score = 75
@@ -381461,8 +381867,8 @@ rule SIGNATURE_BASE_Webshell_Cgitelnet
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6077-L6091"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6077-L6091"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "72e5f0e4cd438e47b6454de297267770a36cbeb3"
logic_hash = "e9b7096d5a19c9d5423bbfe125ae0347853919ab092efa98f0687a5d0cf68953"
score = 75
@@ -381489,8 +381895,8 @@ rule SIGNATURE_BASE_Webshell_Simple_Backdoor_2
modified = "2026-05-15"
old_rule_name = "WebShell_simple_backdoor"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6092-L6112"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6092-L6112"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "edcd5157a68fa00723a506ca86d6cbb8884ef512"
logic_hash = "655e445e51ec0f1bdce006a72acf3bce95941a349c279c14768760fa9f6f9d76"
score = 75
@@ -381521,8 +381927,8 @@ rule SIGNATURE_BASE_Webshell_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6113-L6127"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6113-L6127"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8fdd4e0e87c044177e9e1c97084eb5b18e2f1c25"
logic_hash = "fbe1f77e00fbc4e58cbad564e2d96c0381765ac799dfdf6cc2580428c68f97a5"
score = 75
@@ -381548,8 +381954,8 @@ rule SIGNATURE_BASE_Webshell_Ntdaddy_V1_9
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6128-L6142"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6128-L6142"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "79519aa407fff72b7510c6a63c877f2e07d7554b"
logic_hash = "fdf8b4bb4980e588ad5ccee2d047660980d39f38617f887c5762dcdb0b858267"
score = 75
@@ -381575,8 +381981,8 @@ rule SIGNATURE_BASE_Webshell_Lamashell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6143-L6159"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6143-L6159"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b71181e0d899b2b07bc55aebb27da6706ea1b560"
logic_hash = "e58dbd6b9c65a139828890a3fadfad9031580fe189066489d266d37d7078ad98"
score = 75
@@ -381604,8 +382010,8 @@ rule SIGNATURE_BASE_Webshell_Simple_PHP_Backdoor_By_DK
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6160-L6175"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6160-L6175"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "03f6215548ed370bec0332199be7c4f68105274e"
logic_hash = "1f65f759ec4045c521085aad84d0aea4dcfcf26eac4357751cf1dde6886d1718"
score = 75
@@ -381632,8 +382038,8 @@ rule SIGNATURE_BASE_Webshell_Moroccan_Spamers_Ma_Edition_By_Ghost
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6176-L6189"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6176-L6189"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "31e5473920a2cc445d246bc5820037d8fe383201"
logic_hash = "0e3d2d97665b8849d121d63a22baf7393047a814dde3753e395418c1868b59be"
score = 75
@@ -381658,8 +382064,8 @@ rule SIGNATURE_BASE_Webshell_C99Madshell_V__2_0_Madnet_Edition
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6190-L6205"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6190-L6205"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f99f8228eb12746847f54bad45084f19d1a7e111"
logic_hash = "7cf825a604783ebc74b1dca53aaff5c886957c562e11276f2acce5ff1f6ab991"
score = 75
@@ -381686,8 +382092,8 @@ rule SIGNATURE_BASE_Webshell_Cmdasp_Asp_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6206-L6225"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6206-L6225"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cb18e1ac11e37e236e244b96c2af2d313feda696"
logic_hash = "0fd9c7e83ad9ddf5cf88f1d1573324d9f24ae03a1951446fe11c116fd0cf4932"
score = 75
@@ -381718,8 +382124,8 @@ rule SIGNATURE_BASE_Webshell_NCC_Shell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6226-L6242"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6226-L6242"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "64d4495875a809b2730bd93bec2e33902ea80a53"
logic_hash = "c58edc548b7804be25f6956e9407cc9f8c74dfd8651f601a87ba639284e612d9"
score = 75
@@ -381747,8 +382153,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_README
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6243-L6255"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6243-L6255"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ef2c567b4782c994db48de0168deb29c812f7204"
logic_hash = "aa8a9be74bbac08518d5ba442aa6fa37d3f1b255df48b49ccb9842f5728a49d5"
score = 75
@@ -381772,8 +382178,8 @@ rule SIGNATURE_BASE_Webshell_Backupsql
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6256-L6271"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6256-L6271"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "863e017545ec8e16a0df5f420f2d708631020dd4"
logic_hash = "0126bfad6eb3861e8322ac3e11b4fd95bc8b88597d916e66c6646d7d5529c1d5"
score = 75
@@ -381800,8 +382206,8 @@ rule SIGNATURE_BASE_Webshell_AK_74_Security_Team_Web_Shell_Beta_Version
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6272-L6285"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6272-L6285"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c90b0ba575f432ecc08f8f292f3013b5532fe2c4"
logic_hash = "4fbf8f5cab8593fd88e5a430b849e61d7d663c13700f459aa516c5b337d5438b"
score = 75
@@ -381826,8 +382232,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Cpanel
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6286-L6302"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6286-L6302"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "433dab17106b175c7cf73f4f094e835d453c0874"
logic_hash = "e4dc90c52648f1e5b7dc2d77dcb94feb774ec9e3c156c923c54a9e8f537bbf07"
score = 75
@@ -381855,8 +382261,8 @@ rule SIGNATURE_BASE_Webshell_Accept_Language
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6303-L6314"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6303-L6314"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "180b13576f8a5407ab3325671b63750adbcb62c9"
logic_hash = "6d45071722268f5b39b1486a7dce883ecefb2b3c9993357b7b58bd603ff1c40d"
score = 75
@@ -381879,8 +382285,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_529
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6315-L6332"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6315-L6332"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ba3fb2995528307487dff7d5b624d9f4c94c75d3"
logic_hash = "f46b84d51077f157c83cd01534dfe7f9cd0d9ef04ad9935ced22d2abc873c171"
score = 75
@@ -381909,8 +382315,8 @@ rule SIGNATURE_BASE_Webshell_STNC_Webshell_V0_8
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6333-L6346"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6333-L6346"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "52068c9dff65f1caae8f4c60d0225708612bb8bc"
logic_hash = "c2067a1b78c441aa05366b612090e0df895c621843038cc9e65beb6719c0cb9a"
score = 75
@@ -381935,8 +382341,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Tryag
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6347-L6362"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6347-L6362"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "42d837e9ab764e95ed11b8bd6c29699d13fe4c41"
logic_hash = "2af3bbe8d1940e60843f3f5d40c9c6550e76df21568c374f7a871f73aeefae44"
score = 75
@@ -381963,8 +382369,8 @@ rule SIGNATURE_BASE_Webshell_Dc3_Security_Crew_Shell_Priv_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6363-L6378"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6363-L6378"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9077eb05f4ce19c31c93c2421430dd3068a37f17"
logic_hash = "52dc0449c205ff9105e2dedc3cb4858f83a2efc7bae579656a26da493dc59500"
score = 75
@@ -381991,8 +382397,8 @@ rule SIGNATURE_BASE_Webshell_Qsd_Php_Backdoor
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6379-L6393"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6379-L6393"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4856bce45fc5b3f938d8125f7cdd35a8bbae380f"
logic_hash = "3ef7b67cd60370a99fdfa6fd614f71ee314af27c9d983383dde8f03a127a28b3"
score = 75
@@ -382018,8 +382424,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Spygrup
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6394-L6408"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6394-L6408"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12f9105332f5dc5d6360a26706cd79afa07fe004"
logic_hash = "5981f8cc1a98f799b1573cf73297383f995acf1c40f0227ac10302dc4d6fd6cc"
score = 75
@@ -382045,8 +382451,8 @@ rule SIGNATURE_BASE_Webshell_Web_Shell__C_Shankar
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6409-L6423"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6409-L6423"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3dd4f25bd132beb59d2ae0c813373c9ea20e1b7a"
logic_hash = "9d320eed18a5d76a87cee4ea0fa9caf08f096f7eeaab55420540aa082b596e0f"
score = 75
@@ -382072,8 +382478,8 @@ rule SIGNATURE_BASE_Webshell_Ayyildiz_Tim___AYT__Shell_V_2_1_Biz
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6424-L6438"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6424-L6438"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5fe8c1d01dc5bc70372a8a04410faf8fcde3cb68"
logic_hash = "2d096baad162c0e3e01732007a3be2804155e614a8fa4cd2d5dd3a7ac808fb49"
score = 75
@@ -382099,8 +382505,8 @@ rule SIGNATURE_BASE_Webshell_Gamma_Web_Shell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6439-L6453"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6439-L6453"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
logic_hash = "1de868c4948a95272d288aeba3ac38b84bf6b33ede6b3b600b32530c85586404"
score = 75
@@ -382126,8 +382532,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Aspydrv
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6454-L6469"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6454-L6469"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3d8996b625025dc549d73cdb3e5fa678ab35d32a"
logic_hash = "314fd671b163b9904cc78cb3a5858f5b1e3dfae9d520d5ebc545a7abd922e9f7"
score = 75
@@ -382154,8 +382560,8 @@ rule SIGNATURE_BASE_Webshell_Jspwebshell_1_2_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6470-L6485"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6470-L6485"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "184fc72b51d1429c44a4c8de43081e00967cf86b"
logic_hash = "41d937fce969a850a2e4e07eb168becc96a036317a78d620e812707be9466dfc"
score = 75
@@ -382182,8 +382588,8 @@ rule SIGNATURE_BASE_Webshell_G00Nshell_V1_3
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6486-L6501"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6486-L6501"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70fe072e120249c9e2f0a8e9019f984aea84a504"
logic_hash = "2ecb3ce2aa43a99552fb26e610c35bdb04f4ff0dc75c867e4327d6e27eed0177"
score = 75
@@ -382211,8 +382617,8 @@ rule SIGNATURE_BASE_Webshell_Winx_Shell_2
modified = "2026-05-15"
old_rule_name = "WebShell_WinX_Shell"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6502-L6518"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6502-L6518"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a94d65c168344ad9fa406d219bdf60150c02010e"
logic_hash = "f953c297763e41d197ce186dc818b656951dfa8c855c5063fc4abb54eeefc7bb"
score = 75
@@ -382239,8 +382645,8 @@ rule SIGNATURE_BASE_Webshell_PHANTASMA
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6519-L6533"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6519-L6533"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cd12d42abf854cd34ff9e93a80d464620af6d75e"
logic_hash = "355be62807182f9a53bac20a6dead8f0a3bee83b6bdc4566502c157f16076b9b"
score = 75
@@ -382266,8 +382672,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Cw
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6534-L6550"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6534-L6550"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e65e0670ef6edf0a3581be6fe5ddeeffd22014bf"
logic_hash = "52bfb14f4d5d3df787ce7782cbbee25ea1556758eed48e3001c8a3f35a541526"
score = 75
@@ -382295,8 +382701,8 @@ rule SIGNATURE_BASE_Webshell_Php_Include_W_Shell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6551-L6564"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6551-L6564"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1a7f4868691410830ad954360950e37c582b0292"
logic_hash = "2be144060d4fdaee38214dc2eba80c2a6fd3699060d274e66356fd5a08c9be4b"
score = 75
@@ -382321,8 +382727,8 @@ rule SIGNATURE_BASE_Webshell_Mysql_Tool
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6565-L6577"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6565-L6577"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c9cf8cafcd4e65d1b57fdee5eef98f0f2de74474"
logic_hash = "611636b3fa9a3163574b18cf8eacebea9733a1ad381261387f79a532b003e8fd"
score = 75
@@ -382346,8 +382752,8 @@ rule SIGNATURE_BASE_Webshell_Phpspy_Ver_2006
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6578-L6592"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6578-L6592"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "34a89e0ab896c3518d9a474b71ee636ca595625d"
logic_hash = "69bd2c387b0e676168116f3b3c3c081e08fd555cc6bc9a94b9c8ef97f194b09f"
score = 75
@@ -382373,8 +382779,8 @@ rule SIGNATURE_BASE_Webshell_Zyklonshell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6593-L6607"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6593-L6607"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3fa7e6f3566427196ac47551392e2386a038d61c"
logic_hash = "5d49f2599781836156f6bbb0c50cfcffdb2ca51c7cb688abbc6245d7f856ad01"
score = 75
@@ -382401,8 +382807,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Myshell_2
modified = "2026-05-15"
old_rule_name = "WebShell_php_webshells_myshell"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6608-L6623"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6608-L6623"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5bd52749872d1083e7be076a5e65ffcde210e524"
logic_hash = "7765e43189d6ec0cda0b58d00cfd7fc8cec89287dbac7487083b6ce1ce55f306"
score = 75
@@ -382428,8 +382834,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Lolipop
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6624-L6637"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6624-L6637"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "86f23baabb90c93465e6851e40104ded5a5164cb"
logic_hash = "8b0dcf76a244f80d4bee0c62189df55c1f8d71cf0900cd8ebb5916f5fe972bed"
score = 75
@@ -382454,8 +382860,8 @@ rule SIGNATURE_BASE_Webshell_Simple_Cmd
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6638-L6652"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6638-L6652"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "466a8caf03cdebe07aa16ad490e54744f82e32c2"
logic_hash = "82a65f4bbdcd2fc626aa9f36fe530d19aa19a48389e970c26e525597818914ee"
score = 75
@@ -382481,8 +382887,8 @@ rule SIGNATURE_BASE_Webshell_Go_Shell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6653-L6668"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6653-L6668"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3dd85981bec33de42c04c53d081c230b5fc0e94f"
logic_hash = "f2fcefb9a0536c80fa74ceb002e113f95de53d1f56e22c81b542c395dd11071d"
score = 75
@@ -382510,8 +382916,8 @@ rule SIGNATURE_BASE_Webshell_Azrailphp_V1_0_2
modified = "2026-05-15"
old_rule_name = "WebShell_aZRaiLPhp_v1_0"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6669-L6684"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6669-L6684"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a2c609d1a8c8ba3d706d1d70bef69e63f239782b"
logic_hash = "8309338bb327cc14ae5970bd921b3dba68353d55be31b9dbbc5374ded24ed563"
score = 75
@@ -382537,8 +382943,8 @@ rule SIGNATURE_BASE_Webshell_Webshells_Zehir4
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6685-L6698"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6685-L6698"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "788928ae87551f286d189e163e55410acbb90a64"
logic_hash = "36b6940ffecd9be190cce62252ec7d87f1c0bc0d19b4442df63f4404eb316364"
score = 55
@@ -382562,8 +382968,8 @@ rule SIGNATURE_BASE_Webshell_Zehir4_Asp_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6699-L6712"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6699-L6712"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1d9b78b5b14b821139541cc0deb4cbbd994ce157"
logic_hash = "dfaf685ac3b364143bfbe289b05f066b09f01622fec3e9157f4b4791f7567619"
score = 75
@@ -382588,8 +382994,8 @@ rule SIGNATURE_BASE_Webshell_Php_Webshells_Lostdc
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6713-L6728"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6713-L6728"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d54fe07ea53a8929620c50e3a3f8fb69fdeb1cde"
logic_hash = "e3cd28f4a72f5a8a92c728fe76a7159c28256e87daf4c1dd10190a57263f5b45"
score = 75
@@ -382616,8 +383022,8 @@ rule SIGNATURE_BASE_Webshell_Casus_1_5
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6729-L6742"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6729-L6742"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7eee8882ad9b940407acc0146db018c302696341"
logic_hash = "0dbaa39bd33047d24e5bc9716108c5581da3f54e93d90f9c550b3d84de1ebfe2"
score = 75
@@ -382642,8 +383048,8 @@ rule SIGNATURE_BASE_Webshell_Ftpsearch
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6743-L6757"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6743-L6757"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c945f597552ccb8c0309ad6d2831c8cabdf4e2d6"
logic_hash = "6b32553be4fdf26776e3cbb8a5d4d011d88f2bd50949b65934df72b89065aeec"
score = 75
@@ -382669,8 +383075,8 @@ rule SIGNATURE_BASE_Webshell__Cyber_Shell_Cybershell_Cyber_Shell__V_1_0_
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6758-L6775"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6758-L6775"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
hash = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
hash = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
@@ -382699,8 +383105,8 @@ rule SIGNATURE_BASE_Webshell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_Sold
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6776-L6796"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6776-L6796"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fa11deaee821ca3de7ad1caafa2a585ee1bc8d82"
hash = "c0a4ba3e834fb63e0a220a43caaf55c654f97429"
hash = "16fa789b20409c1f2ffec74484a30d0491904064"
@@ -382732,8 +383138,8 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_7
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6797-L6815"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6797-L6815"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "de98f890790756f226f597489844eb3e53a867a9"
hash = "128988c8ef5294d51c908690d27f69dffad4e42e"
hash = "fd64f2bf77df8bcf4d161ec125fa5c3695fe1267"
@@ -382763,8 +383169,8 @@ rule SIGNATURE_BASE_Webshell__Small_Web_Shell_By_Zaco_Small_Zaco_Zacosmall
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6816-L6834"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6816-L6834"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b148ead15d34a55771894424ace2a92983351dda"
hash = "e4ba288f6d46dc77b403adf7d411a280601c635b"
hash = "e5713d6d231c844011e9a74175a77e8eb835c856"
@@ -382794,8 +383200,8 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_8
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6835-L6854"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6835-L6854"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fc1ae242b926d70e32cdb08bbe92628bc5bd7f99"
hash = "9ad55629c4576e5a31dd845012d13a08f1c1f14e"
hash = "c4aa2cf665c784553740c3702c3bfcb5d7af65a3"
@@ -382826,8 +383232,8 @@ rule SIGNATURE_BASE_Webshell__PH_Vayv_Phvayv_PH_Vayv_Klasvayv_Asp_Php
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6855-L6873"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6855-L6873"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b51962a1ffa460ec793317571fc2f46042fd13ee"
hash = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
hash = "4003ae289e3ae036755976f8d2407c9381ff5653"
@@ -382857,8 +383263,8 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_9
date = "2014-04-06"
modified = "2022-12-06"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6875-L6895"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6875-L6895"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "89f2a7007a2cd411e0a7abd2ff5218d212b84d18"
hash = "2266178ad4eb72c2386c0a4d536e5d82bb7ed6a2"
hash = "0daed818cac548324ad0c5905476deef9523ad73"
@@ -382886,8 +383292,8 @@ rule SIGNATURE_BASE_Webshell__PH_Vayv_Phvayv_PH_Vayv
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6897-L6913"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6897-L6913"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b51962a1ffa460ec793317571fc2f46042fd13ee"
hash = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
hash = "4003ae289e3ae036755976f8d2407c9381ff5653"
@@ -382915,8 +383321,8 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_1
date = "2014-04-06"
modified = "2022-12-06"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6915-L6934"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6915-L6934"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3b086b9b53cf9d25ff0d30b1d41bb2f45c7cda2b"
hash = "2558e728184b8efcdb57cfab918d95b06d45de04"
hash = "203a8021192531d454efbc98a3bbb8cabe09c85c"
@@ -382944,8 +383350,8 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6936-L6955"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6936-L6955"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "335a0851304acedc3f117782b61479bbc0fd655a"
hash = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
hash = "36d8782d749638fdcaeed540d183dd3c8edc6791"
@@ -382976,8 +383382,8 @@ rule SIGNATURE_BASE_Webshell__Crystalshell_V_1_Erne_Stres
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6956-L6977"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6956-L6977"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "335a0851304acedc3f117782b61479bbc0fd655a"
hash = "6eb4ab630bd25bec577b39fb8a657350bf425687"
hash = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
@@ -383010,8 +383416,8 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_3
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6978-L6997"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6978-L6997"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d829e87b3ce34460088c7775a60bded64e530cd4"
hash = "d710c95d9f18ec7c76d9349a28dd59c3605c02be"
hash = "f044d44e559af22a1a7f9db72de1206f392b8976"
@@ -383042,8 +383448,8 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_4
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L6998-L7020"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L6998-L7020"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "335a0851304acedc3f117782b61479bbc0fd655a"
hash = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
hash = "86bc40772de71b1e7234d23cab355e1ff80c474d"
@@ -383077,8 +383483,8 @@ rule SIGNATURE_BASE_Webshell_GFS
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7022-L7038"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7022-L7038"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c2f1ef6b11aaec255d4dd31efad18a3869a2a42c"
hash = "34f6640985b07009dbd06cd70983451aa4fe9822"
hash = "d25ef72bdae3b3cb0fc0fdd81cfa58b215812a50"
@@ -383106,8 +383512,8 @@ rule SIGNATURE_BASE_Webshell__Crystalshell_V_1_Sosyete_Stres
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7039-L7059"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7039-L7059"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "335a0851304acedc3f117782b61479bbc0fd655a"
hash = "e32405e776e87e45735c187c577d3a4f98a64059"
hash = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
@@ -383139,8 +383545,8 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_10
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7060-L7080"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7060-L7080"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
hash = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
hash = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
@@ -383172,8 +383578,8 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_11
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7081-L7103"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7081-L7103"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "31a82cbee8dffaf8eb7b73841f3f3e8e9b3e78cf"
hash = "838c7191cb10d5bb0fc7460b4ad0c18c326764c6"
hash = "8dfcd919d8ddc89335307a7b2d5d467b1fd67351"
@@ -383207,8 +383613,8 @@ rule SIGNATURE_BASE_Webshell__Findsock_Php_Findsock_Shell_Php_Reverse_Shell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7104-L7118"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7104-L7118"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5622c9841d76617bfc3cd4cab1932d8349b7044f"
hash = "4a20f36035bbae8e342aab0418134e750b881d05"
hash = "40dbdc0bdf5218af50741ba011c5286a723fa9bf"
@@ -383234,8 +383640,8 @@ rule SIGNATURE_BASE_Webshell_Generic_PHP_6
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7119-L7140"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7119-L7140"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1a08f5260c4a2614636dfc108091927799776b13"
hash = "335a0851304acedc3f117782b61479bbc0fd655a"
hash = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
@@ -383268,8 +383674,8 @@ rule SIGNATURE_BASE_Unpack_Injectt
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7142-L7155"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7142-L7155"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8a5d2158a566c87edc999771e12d42c5"
logic_hash = "d8e9ed4f2604617bd6410f36ab827affa3cc6729ba996d0d9cd9c8eb0fd96533"
score = 75
@@ -383294,8 +383700,8 @@ rule SIGNATURE_BASE_Hytop_Devpack_Fso
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7156-L7168"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7156-L7168"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b37f3cde1a08890bd822a182c3a881f6"
logic_hash = "9d071c1e2e0725091a2abe24759e6e71d78e29caa76b4fff77c44e3bb381b1a2"
score = 75
@@ -383319,8 +383725,8 @@ rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Ssh
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7169-L7180"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7169-L7180"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1aa5307790d72941589079989b4f900e"
logic_hash = "40c5a5d1d714947454f4aa9f7ed09d777cb60c23933201ac8eaf0d49452af8c6"
score = 75
@@ -383343,8 +383749,8 @@ rule SIGNATURE_BASE_Debug_Bdoor
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7181-L7193"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7181-L7193"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e4e8e31dd44beb9320922c5f49739955"
logic_hash = "ed8caeb96a6fc48fe23d5db078bbb8ba5aec3c5d4ee382cbc6bc4e01630f1460"
score = 75
@@ -383368,8 +383774,8 @@ rule SIGNATURE_BASE_Bin_Client
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7194-L7208"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7194-L7208"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5f91a5b46d155cacf0cc6673a2a5461b"
logic_hash = "28ce9aa136b5d41bb580e6b5b8580d3ccbb7eeec31007e68241d23c5a0f40d40"
score = 75
@@ -383395,8 +383801,8 @@ rule SIGNATURE_BASE_Zxshell2_0_Rar_Folder_Zxshell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7209-L7221"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7209-L7221"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "246ce44502d2f6002d720d350e26c288"
logic_hash = "72eaf90551144eccb7329e0a0e05bcc955ea2bfdb37aa87e9cae7b5f5a26bea0"
score = 75
@@ -383420,8 +383826,8 @@ rule SIGNATURE_BASE_Rkntload
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7222-L7240"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7222-L7240"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "262317c95ced56224f136ba532b8b34f"
logic_hash = "ab767a7016318633055a85195ca2bab08a8c68222d46018aaf8772ab27a373c4"
score = 75
@@ -383451,8 +383857,8 @@ rule SIGNATURE_BASE_Binder2_Binder2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7241-L7257"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7241-L7257"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d594e90ad23ae0bc0b65b59189c12f11"
logic_hash = "fbe56b7d37fc7863fcf55761c0b5b671d661a713ac95f90d65b79eee9a447a9b"
score = 75
@@ -383480,8 +383886,8 @@ rule SIGNATURE_BASE_Thelast_Orice2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7258-L7270"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7258-L7270"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aa63ffb27bde8d03d00dda04421237ae"
logic_hash = "075f3377a9b90c6c1ba74682415b9c0832a839afe647fa6d3c85d4e987618405"
score = 75
@@ -383505,8 +383911,8 @@ rule SIGNATURE_BASE_FSO_S_Sincap
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7271-L7283"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7271-L7283"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc5c2c2392b84a1529abd92e98e9aa5b"
logic_hash = "705030e93248f5ea6744f78bd7a1816aaa9772880059286b8d686e05b193d4a0"
score = 75
@@ -383530,8 +383936,8 @@ rule SIGNATURE_BASE_Phpshell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7284-L7295"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7284-L7295"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "539baa0d39a9cf3c64d65ee7a8738620"
logic_hash = "95b3cedac370bf9b06092035a738722f3ec97e6cbafe3d4f742429a865576ad8"
score = 75
@@ -383554,8 +383960,8 @@ rule SIGNATURE_BASE_Hytop_Devpack_Config
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7296-L7309"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7296-L7309"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b41d0e64e64a685178a3155195921d61"
logic_hash = "b2806c30db413bca518943352f233c9d2915356a41eceed5e352b88ee34fbbd3"
score = 75
@@ -383580,8 +383986,8 @@ rule SIGNATURE_BASE_Sendmail
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7310-L7322"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7310-L7322"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "75b86f4a21d8adefaf34b3a94629bd17"
logic_hash = "bcca9a9380d2695bc277afc9fa72c24cb26ac44c6fbcc87113b017cfe190bdab"
score = 75
@@ -383605,8 +384011,8 @@ rule SIGNATURE_BASE_FSO_S_Zehir4
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7323-L7334"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7323-L7334"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5b496a61363d304532bcf52ee21f5d55"
logic_hash = "6bcfb1ee40403394bf996ecbe1bb17f9afa0c3ba9e1906881b94bbc785b4a510"
score = 75
@@ -383629,8 +384035,8 @@ rule SIGNATURE_BASE_Hkshell_Hkshell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7335-L7348"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7335-L7348"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "168cab58cee59dc4706b3be988312580"
logic_hash = "bee4d4c957ede41c771d690d52ac2fd3655238cc1fc106d30fb2721084b38aa1"
score = 75
@@ -383655,8 +384061,8 @@ rule SIGNATURE_BASE_Imhapftp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7349-L7360"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7349-L7360"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "12911b73bc6a5d313b494102abcf5c57"
logic_hash = "c24bb80a0ae4284b4303450e9103c5dda30c41b41f323641ac1175461f741ced"
score = 75
@@ -383679,8 +384085,8 @@ rule SIGNATURE_BASE_Unpack_Tback
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7361-L7372"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7361-L7372"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a9d1007823bf96fb163ab38726b48464"
logic_hash = "0fb43766c305f4235cc0987f411fdc3b3674723687f0b63d346429f4a7b5b87f"
score = 75
@@ -383703,8 +384109,8 @@ rule SIGNATURE_BASE_Darkspy105
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7373-L7384"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7373-L7384"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f0b85e7bec90dba829a3ede1ab7d8722"
logic_hash = "0f1c9dba4525f9c30f309500652ed6af647ddf492f483e101fc23c891e15fc85"
score = 75
@@ -383727,8 +384133,8 @@ rule SIGNATURE_BASE_Editserver_EXE
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7385-L7398"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7385-L7398"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f945de25e0eba3bdaf1455b3a62b9832"
logic_hash = "d440669b0c0bf575cf9dea946edf55f724300a4c765e90c631fc1eee062bf006"
score = 75
@@ -383753,8 +384159,8 @@ rule SIGNATURE_BASE_FSO_S_Reader
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7399-L7410"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7399-L7410"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b598c8b662f2a1f6cc61f291fb0a6fa2"
logic_hash = "89a948f8da66173965884cd525615c8eeb91cf98a4984c05be7472034bb72f76"
score = 75
@@ -383777,8 +384183,8 @@ rule SIGNATURE_BASE_ASP_Cmdasp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7411-L7424"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7411-L7424"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "79d4f3425f7a89befb0ef3bafe5e332f"
logic_hash = "84c3148fe74b1afaa6e3bbff0aca8df1f1775759a36a673cc13d35ef7658929c"
score = 75
@@ -383803,8 +384209,8 @@ rule SIGNATURE_BASE_KA_Ushell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7425-L7437"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7425-L7437"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "685f5d4f7f6751eaefc2695071569aab"
logic_hash = "58d25e19e2e14a909b4b623a85dfd8c62974121d3b23574d1e94b62385e42b45"
score = 75
@@ -383828,8 +384234,8 @@ rule SIGNATURE_BASE_PHP_Backdoor_V1
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7438-L7451"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7438-L7451"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0506ba90759d11d78befd21cabf41f3d"
logic_hash = "396ae1ee34a06ab4863f4f54257a9020b8747fb99dff15372f0aa54fa4598e43"
score = 75
@@ -383853,8 +384259,8 @@ rule SIGNATURE_BASE_Svchostdll
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7452-L7471"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7452-L7471"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0f6756c8cb0b454c452055f189e4c3f4"
logic_hash = "4a7a7bb7d827c2e7801f8c33b292bb3d312428fc4ae79f07e103f456984c3b83"
score = 75
@@ -383885,8 +384291,8 @@ rule SIGNATURE_BASE_Hytop_Devpack_Server
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7472-L7483"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7472-L7483"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1d38526a215df13c7373da4635541b43"
logic_hash = "66b8513a532f64af535c948da28674795ae6495b9844165c3b039bf61c25eb46"
score = 75
@@ -383909,8 +384315,8 @@ rule SIGNATURE_BASE_Vanquish
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7484-L7497"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7484-L7497"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "684450adde37a93e8bb362994efc898c"
logic_hash = "223c59d06a9389f380fa29959c54e53a17b53080f704189ae519b9527b2c6384"
score = 75
@@ -383935,8 +384341,8 @@ rule SIGNATURE_BASE_Winshell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7498-L7517"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7498-L7517"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3144410a37dd4c29d004a814a294ea26"
logic_hash = "addbfa598039af09c0e4c50138fcfabd16c35c5516259cf9595cf49855da518d"
score = 75
@@ -383967,8 +384373,8 @@ rule SIGNATURE_BASE_FSO_S_Remview
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7518-L7531"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7518-L7531"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b4a09911a5b23e00b55abe546ded691c"
logic_hash = "19719e8c9215ec9ba9fab55b604907e0a6d0a0507a5662926acff1e9dc03440e"
score = 75
@@ -383993,8 +384399,8 @@ rule SIGNATURE_BASE_Saphpshell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7532-L7543"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7532-L7543"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d7bba8def713512ddda14baf9cd6889a"
logic_hash = "24d558292a709bb29334b1acdc53cdb6c5bc6803caec527edcacd6a19f6dc7c9"
score = 75
@@ -384017,8 +384423,8 @@ rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006Z
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7544-L7556"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7544-L7556"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fd1b6129abd4ab177fed135e3b665488"
logic_hash = "4b427132541cd26ee47c387a98f6f46f86808f9a775068e1d114c9ef4abca9f6"
score = 75
@@ -384042,8 +384448,8 @@ rule SIGNATURE_BASE_Admin_Ad
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7557-L7569"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7557-L7569"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e6819b8f8ff2f1073f7d46a0b192f43b"
logic_hash = "0febd10979a959af73332a8e064a510e949109abf863b5fd0fef19b635968d1d"
score = 75
@@ -384067,8 +384473,8 @@ rule SIGNATURE_BASE_FSO_S_Casus15
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7570-L7581"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7570-L7581"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8d155b4239d922367af5d0a1b89533a3"
logic_hash = "58921290952f23ff5b828d8c92c818ebd91b726cdbbc9137b0f55a0e5ca90636"
score = 75
@@ -384091,8 +384497,8 @@ rule SIGNATURE_BASE_BIN_Client
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7582-L7598"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7582-L7598"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9f0a74ec81bc2f26f16c5c172b80eca7"
logic_hash = "e1277f6b7adc2e832a3aad96c7e44796596d2e61eb9247977da3c3569777e0b2"
score = 75
@@ -384120,8 +384526,8 @@ rule SIGNATURE_BASE_Shelltools_G0T_Root_Uptime
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7599-L7614"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7599-L7614"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d1f56102bc5d3e2e37ab3ffa392073b9"
logic_hash = "5d91dda859a63a965250bd4d76565c6adf18e4ee306be3b91965e5d35bc521e8"
score = 75
@@ -384148,8 +384554,8 @@ rule SIGNATURE_BASE_Simple_PHP_Backdoor
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7615-L7628"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7615-L7628"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a401132363eecc3a1040774bec9cb24f"
logic_hash = "9739217c23f583452fbf1d7a8e20b2f1379ebf430e0a4fd73ad62e88d544670a"
score = 75
@@ -384174,8 +384580,8 @@ rule SIGNATURE_BASE_Sig_2005Gray
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7629-L7643"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7629-L7643"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "75dbe3d3b70a5678225d3e2d78b604cc"
logic_hash = "927ed5cdaa14b6cd63a6ca7d7bec6635b69fa19d88808890e7d198fb7a0b57b4"
score = 75
@@ -384201,8 +384607,8 @@ rule SIGNATURE_BASE_Dllinjection
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7644-L7655"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7644-L7655"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a7b92283a5102886ab8aee2bc5c8d718"
logic_hash = "6e01ae1cc8a91a5e0d22bdf477aa72bf0116dbe31752a069b1e34d8a09ec6213"
score = 75
@@ -384225,8 +384631,8 @@ rule SIGNATURE_BASE_Mithril_V1_45_Mithril
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7656-L7668"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7656-L7668"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f1484f882dc381dde6eaa0b80ef64a07"
logic_hash = "a3e74bfb34762553eccaddd745d9e17dc3a5a25201e4bc9e2ea9a49342295c78"
score = 75
@@ -384250,8 +384656,8 @@ rule SIGNATURE_BASE_Hkshell_Hkrmv
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7669-L7681"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7669-L7681"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bd3a0b7a6b5536f8d96f50956560e9bf"
logic_hash = "f1da0778456272e6d93633a564018bdf0fa74f1db1c9e963a03a59c69c752b6e"
score = 75
@@ -384276,8 +384682,8 @@ rule SIGNATURE_BASE_WEBSHELL_PHP_1
modified = "2026-05-15"
old_rule_name = "phpshell"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7682-L7696"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7682-L7696"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1dccb1ea9f24ffbd085571c88585517b"
logic_hash = "eed450ae6668bbee01ea2689e9864f10a66714ec4c91afabb12609ad4ebdac8c"
score = 75
@@ -384302,8 +384708,8 @@ rule SIGNATURE_BASE_FSO_S_Cmd
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7697-L7709"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7697-L7709"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cbe8e365d41dd3cd8e462ca434cf385f"
logic_hash = "43f3379a57210f0e3b70575313115a7ba3d71359de7c5ac9a6a178b93af3545e"
score = 75
@@ -384327,8 +384733,8 @@ rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Phpft
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7710-L7722"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7710-L7722"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "60ef80175fcc6a879ca57c54226646b1"
logic_hash = "741536acafdc4da618d69bdae2f0a3e8c004a4027cc76c796158ee111c006414"
score = 75
@@ -384352,8 +384758,8 @@ rule SIGNATURE_BASE_FSO_S_Indexer
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7723-L7734"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7723-L7734"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "135fc50f85228691b401848caef3be9e"
logic_hash = "a1bfba9c24819f5c1574aa179d853a6cc2fcf58c7b9a14eeab2639248178549c"
score = 75
@@ -384376,8 +384782,8 @@ rule SIGNATURE_BASE_R57Shell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7735-L7746"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7735-L7746"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8023394542cddf8aee5dec6072ed02b5"
logic_hash = "40ff6bceb3f9bd95fbf5e75681fadadaa64243007e10fcc86bb909282b8161c5"
score = 75
@@ -384400,8 +384806,8 @@ rule SIGNATURE_BASE_Bdcli100
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7747-L7759"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7747-L7759"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b12163ac53789fb4f62e4f17a8c2e028"
logic_hash = "48c70413c71d5a84f8cea48c77935b7cc26d9e1348d7ab257de4540d69f0f817"
score = 75
@@ -384425,8 +384831,8 @@ rule SIGNATURE_BASE_Hytop_Devpack_2005Red
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7760-L7773"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7760-L7773"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d8ccda2214b3f6eabd4502a050eb8fe8"
logic_hash = "716b6faa8d1216f592d63b658cdd65d7be0226bf746b5fdf1827bdf881562711"
score = 75
@@ -384451,8 +384857,8 @@ rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006X2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7774-L7786"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7774-L7786"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cc5bf9fc56d404ebbc492855393d7620"
logic_hash = "0df587ccaf41d11c6be90ef631ce8b21f95f08fa8f71e62463c378455b312f4a"
score = 75
@@ -384476,8 +384882,8 @@ rule SIGNATURE_BASE_Rdrbs084
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7787-L7799"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7787-L7799"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ed30327b255816bdd7590bf891aa0020"
logic_hash = "8a743d62723c4a5f863f986edd4b149728680b40d6a4b9a99b093d62ccb70cf8"
score = 75
@@ -384501,8 +384907,8 @@ rule SIGNATURE_BASE_Hytop_Caseswitch_2005
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7800-L7818"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7800-L7818"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8bf667ee9e21366bc0bd3491cb614f41"
logic_hash = "0ecf28b5abb918cd1d8f38b76019dddf19dff5dbb114f16ef6ec9b46cb590a46"
score = 75
@@ -384532,8 +384938,8 @@ rule SIGNATURE_BASE_Ebayid_Index3
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7819-L7830"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7819-L7830"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0412b1e37f41ea0d002e4ed11608905f"
logic_hash = "47660cb71d6787683e51aa14fc0f4a9d6f1c59517b77bfe4135098a0020ded11"
score = 75
@@ -384556,8 +384962,8 @@ rule SIGNATURE_BASE_FSO_S_Phvayv
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7831-L7842"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7831-L7842"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "205ecda66c443083403efb1e5c7f7878"
logic_hash = "d0482607f7d9cf6c89963cb9b1f943fa0b80636e857e0fb044cd9a0b3f974deb"
score = 75
@@ -384580,8 +384986,8 @@ rule SIGNATURE_BASE_Byshell063_Ntboot
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7843-L7857"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7843-L7857"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "99b5f49db6d6d9a9faeffb29fd8e6d8c"
logic_hash = "2fdc930eacb87d02ebe69a2b64df4103bd0f3417a76f1b2922b3d4cd4c0dffe9"
score = 75
@@ -384607,8 +385013,8 @@ rule SIGNATURE_BASE_FSO_S_Casus15_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7858-L7869"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7858-L7869"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8d155b4239d922367af5d0a1b89533a3"
logic_hash = "45820e0398cca8e75fc4acf6863d962a817afd95a4592acd4ac4a50029684220"
score = 75
@@ -384631,8 +385037,8 @@ rule SIGNATURE_BASE_Installer
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7870-L7882"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7870-L7882"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a507919ae701cf7e42fa441d3ad95f8f"
logic_hash = "73c1032313155ceb752fe2f94c8d242833127fe0443d7e3044fa1de2b2b7742b"
score = 75
@@ -384656,8 +385062,8 @@ rule SIGNATURE_BASE_FSO_S_Remview_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7883-L7895"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7883-L7895"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b4a09911a5b23e00b55abe546ded691c"
logic_hash = "0a682431f7044e9a49c8dd4842a22c521e2a07d5df045b0a12449e3b3206716b"
score = 75
@@ -384681,8 +385087,8 @@ rule SIGNATURE_BASE_Felikspack3___PHP_Shells_R57
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7896-L7907"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7896-L7907"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "903908b77a266b855262cdbce81c3f72"
logic_hash = "8d0f3b2009594d4aa413c4794dca12e3c66a19974cc6d0b47cc3f5e2572a4c57"
score = 75
@@ -384705,8 +385111,8 @@ rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006X
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7908-L7920"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7908-L7920"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cf3ee0d869dd36e775dfcaa788db8e4b"
logic_hash = "b71cf90900c7eae4caef57564292ca497a2c6c77e3de2994ba9e4cecae7f2697"
score = 75
@@ -384730,8 +385136,8 @@ rule SIGNATURE_BASE_FSO_S_Phvayv_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7921-L7932"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7921-L7932"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "205ecda66c443083403efb1e5c7f7878"
logic_hash = "11418a11692412ccb309983bdadd9bda2b27b692c3282eb0386094e76c7ba1e0"
score = 75
@@ -384754,8 +385160,8 @@ rule SIGNATURE_BASE_Elmaliseker
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7933-L7945"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7933-L7945"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ccf48af0c8c09bbd038e610a49c9862e"
logic_hash = "54c0b8e74a9b10fe54901c0595600af1dfc54abd3f710fc20ca87ca92236bb49"
score = 75
@@ -384779,8 +385185,8 @@ rule SIGNATURE_BASE_Shelltools_G0T_Root_Resolve
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7946-L7963"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7946-L7963"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "69bf9aa296238610a0e05f99b5540297"
logic_hash = "39d8ac274e94f13b5eb197be5827a95ac09df70793bd584c96b81983a565c1ce"
score = 75
@@ -384809,8 +385215,8 @@ rule SIGNATURE_BASE_FSO_S_Remexp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7964-L7977"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7964-L7977"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b69670ecdbb40012c73686cd22696eeb"
logic_hash = "b9b966a89ab097494d7af90775bf124f1310c77145be67fa57ebdacd0164e3d0"
score = 75
@@ -384835,8 +385241,8 @@ rule SIGNATURE_BASE_FSO_S_Tool
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7978-L7989"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7978-L7989"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3a1e1e889fdd974a130a6a767b42655b"
logic_hash = "a3449aca3124aa4d920d78e5e674ddd9d8a181b0ce0143032352a69dfdbcad2d"
score = 75
@@ -384859,8 +385265,8 @@ rule SIGNATURE_BASE_Felikspack3___PHP_Shells_2005
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L7990-L8002"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L7990-L8002"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "97f2552c2fafc0b2eb467ee29cc803c8"
logic_hash = "4d04174b23c9057acf2618c01cd702eaaec2d3508a8c25dd87fdd320c076a3b1"
score = 75
@@ -384884,8 +385290,8 @@ rule SIGNATURE_BASE_Byloader
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8003-L8018"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8003-L8018"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0f0d6dc26055653f5844ded906ce52df"
logic_hash = "66c900e4bc771fb23d7623e57ad51edaa95696c2e31554720582f3e33a1b2e25"
score = 75
@@ -384912,8 +385318,8 @@ rule SIGNATURE_BASE_Shelltools_G0T_Root_Fport
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8019-L8031"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8019-L8031"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dbb75488aa2fa22ba6950aead1ef30d5"
logic_hash = "b9dc66e249c0577839cc3748f129c343d2ccb7327b92a2a67e4467782d10a25e"
score = 75
@@ -384937,8 +385343,8 @@ rule SIGNATURE_BASE_Backdoor__Fr_
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8032-L8043"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8032-L8043"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a79cac2cf86e073a832aaf29a664f4be"
logic_hash = "6c16c200712015eed71aeb119e46bad5f93445a8f719d98ef31f9012cb3551ae"
score = 75
@@ -384961,8 +385367,8 @@ rule SIGNATURE_BASE_FSO_S_Ntdaddy
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8044-L8055"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8044-L8055"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f6262f3ad9f73b8d3e7d9ea5ec07a357"
logic_hash = "4df6f53ee9bfc0214e69dd858878026e962b90573ed48a5ffdd5523538e8f3bf"
score = 75
@@ -384985,8 +385391,8 @@ rule SIGNATURE_BASE_Nstview_Nstview
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8056-L8067"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8056-L8067"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3871888a0c1ac4270104918231029a56"
logic_hash = "2b25e22d86a672af0b8957f1b0336ed80e09f3389f5045c230af2372db0e3415"
score = 75
@@ -385009,8 +385415,8 @@ rule SIGNATURE_BASE_Hytop_Devpack_Upload
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8068-L8079"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8068-L8079"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b09852bda534627949f0259828c967de"
logic_hash = "312020a72a37adb0111ac6d61810c8e476be39dc6456e80e83cd6a680e8ea051"
score = 75
@@ -385033,8 +385439,8 @@ rule SIGNATURE_BASE_Passwordreminder
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8080-L8091"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8080-L8091"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ea49d754dc609e8bfa4c0f95d14ef9bf"
logic_hash = "f3da5381f5e352c541654d2af918ca8cea8049d137078670dd0538a4d13f676e"
score = 75
@@ -385057,8 +385463,8 @@ rule SIGNATURE_BASE_Pack_Injectt
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8092-L8107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8092-L8107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "983b74ccd57f6195a0584cdfb27d55e8"
logic_hash = "9f66b7b429ed585888c0fb4943bb12262247b3af8d85bc67309b27752171e66a"
score = 75
@@ -385085,8 +385491,8 @@ rule SIGNATURE_BASE_FSO_S_Remexp_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8108-L8120"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8108-L8120"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b69670ecdbb40012c73686cd22696eeb"
logic_hash = "e31e25a7c2b2e970a379a61d2dac335bd37cac48328eee9f3966ff5c77ef6f18"
score = 75
@@ -385110,8 +385516,8 @@ rule SIGNATURE_BASE_FSO_S_C99
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8121-L8132"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8121-L8132"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5f9ba02eb081bba2b2434c603af454d0"
logic_hash = "de769299bbd8b895b84db757fcc037b807f7caaa624c06e9d330934a968b2381"
score = 75
@@ -385134,8 +385540,8 @@ rule SIGNATURE_BASE_Rknt_Zip_Folder_Rknt
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8133-L8150"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8133-L8150"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5f97386dfde148942b7584aeb6512b85"
logic_hash = "59de8a40a7081ee5fbea9f413590237c1da9985f2352b32571529baf38c93ddb"
score = 75
@@ -385164,8 +385570,8 @@ rule SIGNATURE_BASE_Dbgntboot
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8151-L8163"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8151-L8163"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4d87543d4d7f73c1529c9f8066b475ab"
logic_hash = "10f86f18aff4995928efb3c8000eca166fe37e6006de7938139cad718ff7653f"
score = 75
@@ -385189,8 +385595,8 @@ rule SIGNATURE_BASE_PHP_Shell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8164-L8176"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8164-L8176"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "45e8a00567f8a34ab1cccc86b4bc74b9"
logic_hash = "a62061b2fa851f5798158198e26f188408f3f37dca69a85ca155777c0b8407ee"
score = 75
@@ -385214,8 +385620,8 @@ rule SIGNATURE_BASE_Hxdef100
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8177-L8190"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8177-L8190"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "55cc1769cef44910bd91b7b73dee1f6c"
logic_hash = "a2002dcddad7ffdbe9614723163016f9357347bb704640d3933ce4513c37d474"
score = 75
@@ -385240,8 +385646,8 @@ rule SIGNATURE_BASE_Rdrbs100
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8191-L8203"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8191-L8203"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7c752bcd6da796d80a6830c61a632bff"
logic_hash = "8a427ef9e0ecd0c810913203aaef43647964f33658dfdca8195fce6f0545f8f4"
score = 75
@@ -385265,8 +385671,8 @@ rule SIGNATURE_BASE_Mithril_Mithril
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8204-L8222"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8204-L8222"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "017191562d72ab0ca551eb89256650bd"
logic_hash = "5d19eb4132a0401d226c9cffc927b2838e9c69428746296b55a488d097759587"
score = 75
@@ -385296,8 +385702,8 @@ rule SIGNATURE_BASE_Hxdef100_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8223-L8236"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8223-L8236"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b393e2e13b9c57fb501b7cd7ad96b25"
logic_hash = "d44131f6c1bfdc36079f474832a79a361dfad96d1b84f7004d682150c93eccc5"
score = 75
@@ -385322,8 +385728,8 @@ rule SIGNATURE_BASE_Release_Dlltest
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8237-L8257"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8237-L8257"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "76a59fc3242a2819307bb9d593bef2e0"
logic_hash = "ba759ae1bbde357085b2b2dfda0780b5a239a44b4e999244e8eceed246090ce3"
score = 50
@@ -385355,8 +385761,8 @@ rule SIGNATURE_BASE_Webadmin
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8258-L8269"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8258-L8269"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3a90de401b30e5b590362ba2dde30937"
logic_hash = "6e215c3d8b8357b839416ee6951f7739387bb94aa1284ea7e827ae2205221294"
score = 75
@@ -385379,8 +385785,8 @@ rule SIGNATURE_BASE_Commands
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8270-L8282"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8270-L8282"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "174486fe844cb388e2ae3494ac2d1ec2"
logic_hash = "5251ee090934c8f99a8a2ffef2605593943306937dc56a135a47f1da7e732587"
score = 75
@@ -385404,8 +385810,8 @@ rule SIGNATURE_BASE_Hkdoordll
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8283-L8294"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8283-L8294"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b715c009d47686c0e62d0981efce2552"
logic_hash = "a3c4d262b59cdf82390c0457810505e9e7a18c9b26ba4524bc368fd2141ec306"
score = 75
@@ -385428,8 +385834,8 @@ rule SIGNATURE_BASE_R57Shell_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8295-L8306"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8295-L8306"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8023394542cddf8aee5dec6072ed02b5"
logic_hash = "5319426928d33b62527efb561c2b7a226a5a473735f501b267e6b3b174972085"
score = 75
@@ -385452,8 +385858,8 @@ rule SIGNATURE_BASE_Mithril_V1_45_Dlltest
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8307-L8320"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8307-L8320"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b9e518aaa62b15079ff6edb412b21e9"
logic_hash = "cf1e2ca39ae6b726792bbbaf0f1dd90788a4bb9ba5e3d50c22d75f2b3d4e9e7d"
score = 50
@@ -385478,8 +385884,8 @@ rule SIGNATURE_BASE_Dbgiis6Cli
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8321-L8333"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8321-L8333"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3044dceb632b636563f66fee3aaaf8f3"
logic_hash = "f6de3c9b8fbcca230540d1b41659ab02c9548df69f53fa9d5730ac7bb7dfe88a"
score = 75
@@ -385503,8 +385909,8 @@ rule SIGNATURE_BASE_Remview_2003_04_22
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8334-L8345"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8334-L8345"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17d3e4e39fbca857344a7650f7ea55e3"
logic_hash = "2957f6ec7a022ac04759724276f6928625708346903597b0765b5e81207fc6b9"
score = 75
@@ -385527,8 +385933,8 @@ rule SIGNATURE_BASE_FSO_S_Test
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8346-L8358"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8346-L8358"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "82cf7b48da8286e644f575b039a99c26"
logic_hash = "62613bead716717f116290b1c9eca9aa63eadd280050811e30a54e5d186af2fc"
score = 50
@@ -385552,8 +385958,8 @@ rule SIGNATURE_BASE_Debug_Cress
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8359-L8371"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8359-L8371"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "36a416186fe010574c9be68002a7286a"
logic_hash = "670e236e72d3cb52ea5dba865749baee58a70f8d100db1dd8eddfe3183339181"
score = 75
@@ -385577,8 +385983,8 @@ rule SIGNATURE_BASE_Webshell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8372-L8387"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8372-L8387"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f2f8c02921f29368234bfb4d4622ad19"
logic_hash = "e3fdce426d2f6e88d8e9412a3026ea05d027af934763eafe0188602458c2289d"
score = 75
@@ -385605,8 +386011,8 @@ rule SIGNATURE_BASE_FSO_S_EFSO_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8388-L8400"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8388-L8400"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a341270f9ebd01320a7490c12cb2e64c"
logic_hash = "462c713e5d4fb6d0db91b14bfacdca73f780559ba2dad80988c356ee1a3d369d"
score = 75
@@ -385630,8 +386036,8 @@ rule SIGNATURE_BASE_Thelast_Index3
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8401-L8412"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8401-L8412"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cceff6dc247aaa25512bad22120a14b4"
logic_hash = "3700141ca2cf53f49618e2d4cab8866efccdce843921f1733b3d6260b8feea68"
score = 75
@@ -385654,8 +386060,8 @@ rule SIGNATURE_BASE_Adjustcr
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8413-L8427"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8413-L8427"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17037fa684ef4c90a25ec5674dac2eb6"
logic_hash = "d2a86083ff5cb34a0453f812e2d316c63342e529f00099a8869fa7e0a43321ef"
score = 75
@@ -385681,8 +386087,8 @@ rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Xishell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8428-L8439"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8428-L8439"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "997c8437c0621b4b753a546a53a88674"
logic_hash = "13393bc72477ab9a4ebc16b409de8ed73e086cc41f25f34315d11401b63c2471"
score = 75
@@ -385705,8 +386111,8 @@ rule SIGNATURE_BASE_Hytop_Apppack_2005
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8440-L8451"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8440-L8451"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
logic_hash = "0de4800291132efca24b40bebcc895d6873110214c8cbf8384317208e0d9db82"
score = 75
@@ -385729,8 +386135,8 @@ rule SIGNATURE_BASE_Xssshell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8452-L8463"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8452-L8463"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8fc0ffc5e5fbe85f7706ffc45b3f79b4"
logic_hash = "6b0e602b523f58ec61850b4ba2e69da4fe4bf2833fb45e529785a398445db127"
score = 75
@@ -385753,8 +386159,8 @@ rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Usr
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8464-L8475"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8464-L8475"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ade3357520325af50c9098dc8a21a024"
logic_hash = "f5fd4a4c1b531b23b09505d302dc27d7ba2eb733fcf313c04ba9085b090f7cbe"
score = 75
@@ -385777,8 +386183,8 @@ rule SIGNATURE_BASE_FSO_S_Phpinj
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8476-L8487"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8476-L8487"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dd39d17e9baca0363cc1c3664e608929"
logic_hash = "de4ac200f5426ec4c6fef21d5fbc37281811569a3e71a9bcb6fa51d13eb600a4"
score = 75
@@ -385801,8 +386207,8 @@ rule SIGNATURE_BASE_Xssshell_Db
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8488-L8499"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8488-L8499"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cb62e2ec40addd4b9930a9e270f5b318"
logic_hash = "3fdbaa17c12abef8576bf859065d90f4b6e80c187af734b71b26a1bd5d073e86"
score = 75
@@ -385825,8 +386231,8 @@ rule SIGNATURE_BASE_PHP_Sh
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8500-L8511"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8500-L8511"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1e9e879d49eb0634871e9b36f99fe528"
logic_hash = "da0b572f116cc5c55e8d7469f222896d602d09be4761a0e2139fc8ce67ac4050"
score = 75
@@ -385849,8 +386255,8 @@ rule SIGNATURE_BASE_Xssshell_Default
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8512-L8523"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8512-L8523"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d156782ae5e0b3724de3227b42fcaf2f"
logic_hash = "6a8772a8a6399c3266abcc22a3c55eda70ec9703346398f5f1768bbd35974f8c"
score = 75
@@ -385873,8 +386279,8 @@ rule SIGNATURE_BASE_Editserver_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8524-L8537"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8524-L8537"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5c1f25a4d206c83cdfb006b3eb4c09ba"
logic_hash = "c581936928ce0f1061feb5665c743f14f12a9f875e360f40cc064f3047b23adf"
score = 75
@@ -385899,8 +386305,8 @@ rule SIGNATURE_BASE_By064Cli
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8538-L8550"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8538-L8550"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "10e0dff366968b770ae929505d2a9885"
logic_hash = "51efd5c510efc6657ae175af47b09437ae70eb0237d88ffdf3cdae365d0ec7be"
score = 75
@@ -385924,8 +386330,8 @@ rule SIGNATURE_BASE_Mithril_Dlltest
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8551-L8563"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8551-L8563"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a8d25d794d8f08cd4de0c3d6bf389e6d"
logic_hash = "c8c8d1b75ed4eb4bc66a762e53aa6b3ab439e96ef464a8b9ffa4dff887986465"
score = 50
@@ -385949,8 +386355,8 @@ rule SIGNATURE_BASE_Peek_A_Boo
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8564-L8580"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8564-L8580"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aca339f60d41fdcba83773be5d646776"
logic_hash = "b103c1b873dd0df9626d72a1127fbadc821777a05012a080423263a2083c398b"
score = 75
@@ -385978,8 +386384,8 @@ rule SIGNATURE_BASE_Fmlibraryv3
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8581-L8592"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8581-L8592"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c34c248fed6d5a20d8203924a2088acc"
logic_hash = "a7dc83db26cdda757f626c42022c17bb2764074a3cc5f87b4a3aaa991fac5dc2"
score = 75
@@ -386002,8 +386408,8 @@ rule SIGNATURE_BASE_Debug_Dlltest_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8593-L8605"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8593-L8605"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b9e518aaa62b15079ff6edb412b21e9"
logic_hash = "bf260ce0f8d4728920679573cd77927b44db28ba6102923707af8d1ad7d0ef2d"
score = 50
@@ -386027,8 +386433,8 @@ rule SIGNATURE_BASE_Connector
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8606-L8618"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8606-L8618"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3ba1827fca7be37c8296cd60be9dc884"
logic_hash = "b8cadb7aa23a8cdef10e7b1eb05586d6c3e7c398958a80861b6f1ccd4edf1eca"
score = 75
@@ -386052,8 +386458,8 @@ rule SIGNATURE_BASE_Shelltools_G0T_Root_Hiderun
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8619-L8631"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8619-L8631"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "45436d9bfd8ff94b71eeaeb280025afe"
logic_hash = "3a6dea2314800b28e92b59595c8b79c64e66dc66ebfa8f89c2f4028b574b9a91"
score = 75
@@ -386077,8 +386483,8 @@ rule SIGNATURE_BASE_PHP_Shell_V1_7
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8632-L8643"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8632-L8643"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b5978501c7112584532b4ca6fb77cba5"
logic_hash = "e03904177309de9ce1afa0b12bf70913b106650c3db5807f9d4ccb91fb2ade77"
score = 75
@@ -386101,8 +386507,8 @@ rule SIGNATURE_BASE_Xssshell_Save
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8644-L8656"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8644-L8656"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "865da1b3974e940936fe38e8e1964980"
logic_hash = "c53034c6ebc4f01c4573e688f548e71dae944913797b12eb8f22a5ef0a368ccf"
score = 75
@@ -386126,8 +386532,8 @@ rule SIGNATURE_BASE_Screencap
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8657-L8670"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8657-L8670"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "51139091dea7a9418a50f2712ea72aa6"
logic_hash = "9be7ec97ef8e9b8838f7931a8fcf8d85b1543a202a7bf34fab9791fc47889cb9"
score = 75
@@ -386152,8 +386558,8 @@ rule SIGNATURE_BASE_FSO_S_Phpinj_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8671-L8682"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8671-L8682"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dd39d17e9baca0363cc1c3664e608929"
logic_hash = "12af5182b94f01ac4fbdee92c007556aaa7f196aca116575803cedd84b81f3b0"
score = 75
@@ -386176,8 +386582,8 @@ rule SIGNATURE_BASE_Zxshell2_0_Rar_Folder_Zxrecv
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8683-L8700"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8683-L8700"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5d3d12a39f41d51341ef4cb7ce69d30f"
logic_hash = "7eef63e45f6902e4f2d5f854b2794df3101a2ef145e2d627263db429c2b728d7"
score = 75
@@ -386206,8 +386612,8 @@ rule SIGNATURE_BASE_FSO_S_Ajan
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8701-L8712"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8701-L8712"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "22194f8c44524f80254e1b5aec67b03e"
logic_hash = "a7766caae5845ce43cff2212c25fea9a78979d10c79d8c40290b5c1471b101cd"
score = 75
@@ -386230,8 +386636,8 @@ rule SIGNATURE_BASE_C99Shell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8713-L8724"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8713-L8724"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "90b86a9c63e2cd346fe07cea23fbfc56"
logic_hash = "a0fcc43a80ac4d059aea36da8b4b5a81c99a54f7c66c521697805ae890d66fe8"
score = 75
@@ -386254,8 +386660,8 @@ rule SIGNATURE_BASE_Phpspy_2005_Full
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8725-L8736"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8725-L8736"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d1c69bb152645438440e6c903bac16b2"
logic_hash = "8561161726a49374a9bc3389fef593e5d68dc437552e06736a235412183bef45"
score = 75
@@ -386278,8 +386684,8 @@ rule SIGNATURE_BASE_FSO_S_Zehir4_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8737-L8748"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8737-L8748"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5b496a61363d304532bcf52ee21f5d55"
logic_hash = "bb10f2e28bb375366b9140c06bb242cd13fdb69e67ce72ecae0e50270566f116"
score = 75
@@ -386302,8 +386708,8 @@ rule SIGNATURE_BASE_FSO_S_Indexer_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8749-L8760"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8749-L8760"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "135fc50f85228691b401848caef3be9e"
logic_hash = "8cf4c8fb1e985adbed2cf20578fcfc14240f6d9fe6062bbe3fe2f895f58bc172"
score = 75
@@ -386326,8 +386732,8 @@ rule SIGNATURE_BASE_Hytop_Devpack_2005
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8761-L8774"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8761-L8774"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
logic_hash = "b312cddff4c5292cc51acc39448c815fede3c9356d7d225c3a08c7124712b3f8"
score = 75
@@ -386352,8 +386758,8 @@ rule SIGNATURE_BASE__Root_040_Zip_Folder_Deploy
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8775-L8788"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8775-L8788"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2c9f9c58999256c73a5ebdb10a9be269"
logic_hash = "9852b105e6a28f5500fc6739b196dd14b9b0b69b1077be4063735380b0699abb"
score = 75
@@ -386377,8 +386783,8 @@ rule SIGNATURE_BASE_By063Cli
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8789-L8801"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8789-L8801"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "49ce26eb97fd13b6d92a5e5d169db859"
logic_hash = "c89159b73232bc8fd7430b3330009f4b3eb25b9511515bc9b4cd433f7a67f30e"
score = 75
@@ -386402,8 +386808,8 @@ rule SIGNATURE_BASE_Icyfox007V1_10_Rar_Folder_Asp
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8802-L8813"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8802-L8813"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2c412400b146b7b98d6e7755f7159bb9"
logic_hash = "3cc36668f0a2a6807b59c7da0b6e504b519a616ab63fb9f606eba5dc4a9e7e2f"
score = 75
@@ -386426,8 +386832,8 @@ rule SIGNATURE_BASE_Byshell063_Ntboot_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8815-L8826"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8815-L8826"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cb9eb5a6ff327f4d6c46aacbbe9dda9d"
logic_hash = "25df29000bb410c0ba1fec78920124f6eedbc2585541536239522d2b116270ab"
score = 75
@@ -386450,8 +386856,8 @@ rule SIGNATURE_BASE_U_Uay
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8827-L8839"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8827-L8839"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "abbc7b31a24475e4c5d82fc4c2b8c7c4"
logic_hash = "45e8938ce34fd5a253cee3867aa8c4429c6bf3fcc91098ed9df3f95656bc5f8f"
score = 75
@@ -386475,8 +386881,8 @@ rule SIGNATURE_BASE_Bin_Wuaus
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8840-L8856"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8840-L8856"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "46a365992bec7377b48a2263c49e4e7d"
logic_hash = "0509ca39662430c3ababf65ca3a6e9af95250163980829d90eddf5341168c864"
score = 75
@@ -386504,8 +386910,8 @@ rule SIGNATURE_BASE_Pwreveal
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8857-L8871"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8857-L8871"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b4e8447826a45b76ca45ba151a97ad50"
logic_hash = "01c9582897c65e608d49a151fe9ade97b9a031d7d10f5fd4b4d0c2a3fd83e7b6"
score = 75
@@ -386531,8 +386937,8 @@ rule SIGNATURE_BASE_Shelltools_G0T_Root_Xwhois
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8872-L8886"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8872-L8886"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0bc98bd576c80d921a3460f8be8816b4"
logic_hash = "75ee56dae5fde75ae4dc4bba835a96016781b747f3cff0dc6d52e665463a6070"
score = 75
@@ -386558,8 +386964,8 @@ rule SIGNATURE_BASE_Vanquish_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8887-L8898"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8887-L8898"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2dcb9055785a2ee01567f52b5a62b071"
logic_hash = "428dc4e6d8bcc888e6f99f69ee9f211aa029d3486b99b9716d09709dc391d9a2"
score = 75
@@ -386582,8 +386988,8 @@ rule SIGNATURE_BASE_Down_Rar_Folder_Down
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8899-L8910"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8899-L8910"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "db47d7a12b3584a2e340567178886e71"
logic_hash = "bc666d6333d49a2b01553e1946fc304195193b9be92e26805474e64da61455da"
score = 75
@@ -386606,8 +387012,8 @@ rule SIGNATURE_BASE_Cmdshell
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8911-L8922"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8911-L8922"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8a9fef43209b5d2d4b81dfbb45182036"
logic_hash = "5e7c7537b355b162d58b8bce570b1f94a8e6b479856685a245ffaed8f9482680"
score = 75
@@ -386630,8 +387036,8 @@ rule SIGNATURE_BASE_Zxshell2_0_Rar_Folder_Nc
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8923-L8937"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8923-L8937"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2cd1bf15ae84c5f6917ddb128827ae8b"
logic_hash = "6106758aedb33f8983f387a58fcd815c47f793cd2a7ea3b0ebed13dd1d5b6e83"
score = 75
@@ -386657,8 +387063,8 @@ rule SIGNATURE_BASE_Portlessinst
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8938-L8951"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8938-L8951"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "74213856fc61475443a91cd84e2a6c2f"
logic_hash = "72ca80de2ad2048d1fcbbffeebd0e4fd7d9d47d6736360674e6a85ef9943abe8"
score = 75
@@ -386683,8 +387089,8 @@ rule SIGNATURE_BASE_Setupbdoor
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8952-L8963"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8952-L8963"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "41f89e20398368e742eda4a3b45716b6"
logic_hash = "b4b6a0e4b9f8975d769d340a420af37dbc344d32c72447a8c56b05e985e6d806"
score = 75
@@ -386707,8 +387113,8 @@ rule SIGNATURE_BASE_Phpshell_3
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8964-L8976"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8964-L8976"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e8693a2d4a2ffea4df03bb678df3dc6d"
logic_hash = "b86fa40fd7bbcae86926182882faa226530e44c20bc611b8433a7da7f012106c"
score = 75
@@ -386732,8 +387138,8 @@ rule SIGNATURE_BASE_BIN_Server
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8977-L8993"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8977-L8993"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1d5aa9cbf1429bb5b8bf600335916dcd"
logic_hash = "34f9d78e0f61717fae2945e7a833c2c6d59e28035ee95da2c5d32b4e196bc957"
score = 75
@@ -386761,8 +387167,8 @@ rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L8994-L9005"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L8994-L9005"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c19d6f4e069188f19b08fa94d44bc283"
logic_hash = "536232bbdd21bddb88eefe06a82927abcdd3ed10404c052957896960a6d10932"
score = 75
@@ -386785,8 +387191,8 @@ rule SIGNATURE_BASE_R57Shell_3
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9006-L9017"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9006-L9017"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "87995a49f275b6b75abe2521e03ac2c0"
logic_hash = "0fdca080c7ce57b7bd818a968840aebf3c5c74f188ed062fec794bfadb4e75b0"
score = 75
@@ -386809,8 +387215,8 @@ rule SIGNATURE_BASE_Hdconfig
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9018-L9033"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9018-L9033"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7d60e552fdca57642fd30462416347bd"
logic_hash = "9001f79db15548cf3ca931d0043d078db7d900ab26093afbf5cd44d0a85800f4"
score = 60
@@ -386837,8 +387243,8 @@ rule SIGNATURE_BASE_FSO_S_Ajan_2
date = "2016-02-15"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9034-L9046"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9034-L9046"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "22194f8c44524f80254e1b5aec67b03e"
logic_hash = "0ac31ee735c94289932369dfba5b408cbf71cc23fd48ce3e09dc7ce640a0d733"
score = 75
@@ -386862,8 +387268,8 @@ rule SIGNATURE_BASE_Webshell_And_Exploit_CN_APT_HK : WEBSHELL
date = "2014-10-10"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9048-L9063"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9048-L9063"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ec3f1e985585e1bf77a46e971a20cd127064a64467761a5a570548dd63ec57e2"
score = 50
quality = 85
@@ -386887,8 +387293,8 @@ rule SIGNATURE_BASE_JSP_Browser_APT_Webshell
date = "2014-10-10"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9065-L9079"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9065-L9079"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a352bf394f1b4f70218650758db39225a5a505656299405ccd077592d29480a7"
score = 60
quality = 85
@@ -386912,8 +387318,8 @@ rule SIGNATURE_BASE_JSP_Jfigueiredo_APT_Webshell
date = "2014-12-10"
modified = "2026-05-15"
reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/Browser.jsp"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9081-L9094"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9081-L9094"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7efaca469d09ce7ecba4ed38cb0b07d1b9fc4f45172d2ffb6f5d3259c000fdc5"
score = 60
quality = 85
@@ -386935,8 +387341,8 @@ rule SIGNATURE_BASE_JSP_Jfigueiredo_APT_Webshell_2
date = "2014-12-10"
modified = "2026-05-15"
reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9096-L9111"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9096-L9111"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f7fa5872d8eb4ba1d0b26d966d7650d70b1a10c56945d5a5340b8e1cb5d0f5f0"
score = 60
quality = 85
@@ -386960,8 +387366,8 @@ rule SIGNATURE_BASE_Webshell_Insomnia
date = "2014-12-09"
modified = "2026-05-15"
reference = "http://www.darknet.org.uk/2014/12/insomniashell-asp-net-reverse-shell-bind-shell/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9113-L9134"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9113-L9134"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e0cfb2ffaa1491aeaf7d3b4ee840f72d42919d22"
logic_hash = "d170c60f94092a38ba4af92283debd059eef2e4c683fd7737ffd60d1a2581d9c"
score = 80
@@ -386991,8 +387397,8 @@ rule SIGNATURE_BASE_Hawkeye_PHP_Panel : FILE
date = "2014-12-14"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9136-L9151"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9136-L9151"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e29b6df4e3aa3892b10e68218320ac76cecb5a1bbe6c48f2276014b972cbbdd8"
score = 60
quality = 85
@@ -387017,8 +387423,8 @@ rule SIGNATURE_BASE_Soaksoak_Infected_Wordpress
date = "2014-12-15"
modified = "2026-05-15"
reference = "http://goo.gl/1GzWUX"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9153-L9168"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9153-L9168"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4cba18a0d14be2795d71a1973265a1742beda57636f64c1974001ecf70e3e91d"
score = 60
quality = 85
@@ -387042,8 +387448,8 @@ rule SIGNATURE_BASE_Pastebin_Webshell
date = "2015-01-13"
modified = "2026-05-15"
reference = "http://goo.gl/7dbyZs"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9170-L9192"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9170-L9192"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e71429e9280c37a90ee77be888ae743a86521d3632afc4eeec480b82a22a1445"
score = 70
quality = 85
@@ -387072,8 +387478,8 @@ rule SIGNATURE_BASE_Aspxspy2
date = "2015-01-24"
modified = "2026-05-15"
reference = "not set"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9194-L9220"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9194-L9220"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5642387d92139bfe9ae11bfef6bfe0081dcea197"
logic_hash = "59c88f8e2542dcde4bf5123147ea2c1ca408925ca966f3f34a4692a3ba7a0935"
score = 75
@@ -387109,8 +387515,8 @@ rule SIGNATURE_BASE_Webshell_27_9_C66_C99 : FILE
date = "2016-01-11"
modified = "2026-05-15"
reference = "https://github.com/nikicat/web-malware-collection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9231-L9256"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9231-L9256"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
hash = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
hash = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
@@ -387144,8 +387550,8 @@ rule SIGNATURE_BASE_Webshell_Acid_Antisecshell_3 : FILE
date = "2016-01-11"
modified = "2026-05-15"
reference = "https://github.com/nikicat/web-malware-collection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9258-L9290"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9258-L9290"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
hash = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
hash = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
@@ -387186,8 +387592,8 @@ rule SIGNATURE_BASE_Webshell_C99_4 : FILE
date = "2016-01-11"
modified = "2026-05-15"
reference = "https://github.com/nikicat/web-malware-collection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9292-L9323"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9292-L9323"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
hash = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
hash = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
@@ -387227,8 +387633,8 @@ rule SIGNATURE_BASE_Webshell_R57Shell_2 : FILE
date = "2016-01-11"
modified = "2026-05-15"
reference = "https://github.com/nikicat/web-malware-collection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9325-L9352"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9325-L9352"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
hash = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
hash = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
@@ -387264,8 +387670,8 @@ rule SIGNATURE_BASE_Webshell_27_9_Acid_C99_Locus7S : FILE
date = "2016-01-11"
modified = "2026-05-15"
reference = "https://github.com/nikicat/web-malware-collection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9354-L9376"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9354-L9376"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
hash = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
hash = "960feb502f913adff6b322bc9815543e5888bbf9058ba0eb46ceb1773ea67668"
@@ -387296,8 +387702,8 @@ rule SIGNATURE_BASE_Webshell_Backdoor_PHP_Agent_R57_Mod_Bizzz_Shell_R57 : FILE
date = "2016-01-11"
modified = "2026-05-15"
reference = "https://github.com/nikicat/web-malware-collection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9378-L9403"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9378-L9403"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
hash = "f51a5c5775d9cca0b137ddb28ff3831f4f394b7af6f6a868797b0df3dcdb01ba"
hash = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
@@ -387331,8 +387737,8 @@ rule SIGNATURE_BASE_Webshell_C100 : FILE
date = "2016-01-11"
modified = "2026-05-15"
reference = "https://github.com/nikicat/web-malware-collection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9405-L9429"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9405-L9429"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
hash = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
hash = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
@@ -387365,8 +387771,8 @@ rule SIGNATURE_BASE_Webshell_Acidpoison : FILE
date = "2016-01-11"
modified = "2026-05-15"
reference = "https://github.com/nikicat/web-malware-collection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9431-L9454"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9431-L9454"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
hash = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
hash = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
@@ -387398,8 +387804,8 @@ rule SIGNATURE_BASE_Webshell_Acid_Fatalisticz_Fx_Fx_P0Ison_Sh3Ll_X0Rg_Byp4Ss_256
date = "2016-01-11"
modified = "2026-05-15"
reference = "https://github.com/nikicat/web-malware-collection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9456-L9475"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9456-L9475"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
hash = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
hash = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
@@ -387427,8 +387833,8 @@ rule SIGNATURE_BASE_Webshell_Ayyildiz : FILE
date = "2016-01-11"
modified = "2026-05-15"
reference = "https://github.com/nikicat/web-malware-collection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9477-L9496"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9477-L9496"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0e25aec0a9131e8c7bd7d5004c5c5ffad0e3297f386675bccc07f6ea527dded5"
hash = "9c43aada0d5429f8c47595f79a7cdd5d4eb2ba5c559fb5da5a518a6c8c7c330a"
hash = "2ebf3e5f5dde4a27bbd60e15c464e08245a35d15cc370b4be6b011aa7a46eaca"
@@ -387456,8 +387862,8 @@ rule SIGNATURE_BASE_Webshell_Zehir : FILE
date = "2016-01-11"
modified = "2026-05-15"
reference = "https://github.com/nikicat/web-malware-collection"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9498-L9517"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9498-L9517"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "16e1e886576d0c70af0f96e3ccedfd2e72b8b7640f817c08a82b95ff5d4b1218"
hash = "0c5f8a2ed62d10986a2dd39f52886c0900a18c03d6d279207b8de8e2ed14adf6"
hash = "cb9d5427a83a0fc887e49f07f20849985bd2c3850f272ae1e059a08ac411ff66"
@@ -387485,8 +387891,8 @@ rule SIGNATURE_BASE_Uploadshell_98038F1Efa4203432349Badabad76D44337319A6 : FILE
date = "2016-09-10"
modified = "2026-05-15"
reference = "https://github.com/bartblaze/PHP-backdoors"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9528-L9543"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9528-L9543"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "506a6ab6c49e904b4adc1f969c91e4f1a7dde164be549c6440e766de36c93215"
logic_hash = "68f0de84a387a9af1a32dd8d38c66b002e16e1c954a51e6bc307580180faedbf"
score = 75
@@ -387511,8 +387917,8 @@ rule SIGNATURE_BASE_Dkshell_F0772Be3C95802A2D1E7A4A3F5A45Dcdef6997F3 : FILE
date = "2016-09-10"
modified = "2026-05-15"
reference = "https://github.com/bartblaze/PHP-backdoors"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9545-L9559"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9545-L9559"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7ea49d5c29f1242f81f2393b514798ff7caccb50d46c60bdfcf61db00043473b"
logic_hash = "81b0a08d1b9d3640e656a5cd08b79c0a2f940a2db5c2d939d19509f993514e86"
score = 75
@@ -387536,8 +387942,8 @@ rule SIGNATURE_BASE_Unknown_8Af033424F9590A15472A23Cc3236E68070B952E : FILE
date = "2016-09-10"
modified = "2026-05-15"
reference = "https://github.com/bartblaze/PHP-backdoors"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9561-L9576"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9561-L9576"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3382b5eaaa9ad651ab4793e807032650667f9d64356676a16ae3e9b02740ccf3"
logic_hash = "d7dc9a2a5e0800b5061cb2101d7cda023a6e637f1e7b14054fdb6a0b2cec6084"
score = 75
@@ -387562,8 +387968,8 @@ rule SIGNATURE_BASE_Dkshell_4000Bd83451F0D8501A9Dfad60Dce39E55Ae167D : FILE
date = "2016-09-10"
modified = "2026-05-15"
reference = "https://github.com/bartblaze/PHP-backdoors"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9578-L9596"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9578-L9596"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "51a16b09520a3e063adf10ff5192015729a5de1add8341a43da5326e626315bd"
logic_hash = "26d586e32d1b0b7800b4b61f592dadc3dd0583628e4cd3fa4e24e02067077da5"
score = 75
@@ -387590,8 +387996,8 @@ rule SIGNATURE_BASE_Webshell_5786D7D9F4B0Df731D79Ed927Fb5A124195Fc901 : FILE
date = "2016-09-10"
modified = "2026-05-15"
reference = "https://github.com/bartblaze/PHP-backdoors"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9598-L9612"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9598-L9612"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b1733cbb0eb3d440c4174cc67ca693ba92308ded5fc1069ed650c3c78b1da4bc"
logic_hash = "348ccdf997965fbea791d835f1dd4e2c16d37a17ff4195e585fa4226f18faad6"
score = 75
@@ -387615,8 +388021,8 @@ rule SIGNATURE_BASE_Webshell_E8Eaf8Da94012E866E51547Cd63Bb996379690Bf : FILE
date = "2016-09-10"
modified = "2026-05-15"
reference = "https://github.com/bartblaze/PHP-backdoors"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9614-L9629"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9614-L9629"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "027544baa10259939780e97dc908bd43f0fb940510119fc4cce0883f3dd88275"
logic_hash = "044491f0b07ef606aa76e70a07d161565f9cecf73e8f9f8db63cacc1c475b056"
score = 75
@@ -387641,8 +388047,8 @@ rule SIGNATURE_BASE_Unknown_0F06C5D1B32F4994C3B3Abf8Bb76D5468F105167 : FILE
date = "2016-09-10"
modified = "2026-05-15"
reference = "https://github.com/bartblaze/PHP-backdoors"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9631-L9646"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9631-L9646"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6362372850ac7455fa9461ed0483032a1886543f213a431f81a2ac76d383b47e"
logic_hash = "6f4bdf8aecd527335c29a8e964c7d8688c3e77419595d3fd10a6cf3704711816"
score = 75
@@ -387667,8 +388073,8 @@ rule SIGNATURE_BASE_Wsoshell_0Bbebaf46F87718Caba581163D4Beed56Ddf73A7 : FILE
date = "2016-09-10"
modified = "2026-05-15"
reference = "https://github.com/bartblaze/PHP-backdoors"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9648-L9662"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9648-L9662"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d053086907aed21fbb6019bf9e644d2bae61c63563c4c3b948d755db3e78f395"
logic_hash = "bf5090fb909fea690c8a2af3cca35136eda3b9773976189158c25fb8877cc266"
score = 75
@@ -387692,8 +388098,8 @@ rule SIGNATURE_BASE_Webshell_Generic_1609_A : FILE
date = "2016-09-10"
modified = "2026-05-15"
reference = "https://github.com/bartblaze/PHP-backdoors"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9664-L9679"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9664-L9679"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c817a490cfd4d6377c15c9ac9bcfa136f4a45ff5b40c74f15216c030f657d035"
hash = "69b9d55ea2eb4a0d9cfe3b21b0c112c31ea197d1cb00493d1dddc78b90c5745e"
logic_hash = "e5a4bba3a7b1c712203fcc8b85e4089b0ff18a26e96f5a04529616dbfb9de651"
@@ -387718,8 +388124,8 @@ rule SIGNATURE_BASE_Nishang_Webshell : FILE
date = "2016-09-11"
modified = "2026-05-15"
reference = "https://github.com/samratashok/nishang"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9681-L9696"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9681-L9696"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b8a3c8e80a4e41e556e2d65df4126d84723ded6ca623302afc4cc328bded346c"
score = 75
quality = 85
@@ -387744,8 +388150,8 @@ rule SIGNATURE_BASE_PHP_Webshell_1_Feb17 : FILE
date = "2017-02-28"
modified = "2026-05-15"
reference = "https://isc.sans.edu/diary/Analysis+of+a+Simple+PHP+Backdoor/22127"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9708-L9729"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9708-L9729"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c8576b20ec3f81b3ef0aa5a508c94e07d591d68767cb4598ad10778b4305915d"
score = 75
quality = 85
@@ -387773,8 +388179,8 @@ rule SIGNATURE_BASE_Webshell_Tiny_JSP_2 : FILE
date = "2015-12-05"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9731-L9743"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9731-L9743"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6fd514df9d53293a8cfd4b9c807f993558e39979592aa221f18cd76079c00fb7"
score = 100
quality = 85
@@ -387796,8 +388202,8 @@ rule SIGNATURE_BASE_Wordpress_Config_Webshell_Preprend : FILE
date = "2017-06-25"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9755-L9777"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9755-L9777"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "97d7b85fa191380fe8b26ea60c8735a8f7179acc3a496ff0fc0dc5eefde2fe8a"
score = 65
quality = 85
@@ -387822,8 +388228,8 @@ rule SIGNATURE_BASE_PAS_Webshell_Encoded : FILE
date = "2017-07-11"
modified = "2026-05-15"
reference = "http://blog.talosintelligence.com/2017/07/the-medoc-connection.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9788-L9823"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9788-L9823"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "59f4f8caa60c2367b46f6af1aefa62e03e228b382ff58be3a27dad527a685eca"
score = 80
quality = 85
@@ -387855,8 +388261,8 @@ rule SIGNATURE_BASE_ALFA_SHELL : FILE
date = "2017-09-21"
modified = "2026-05-15"
reference = "Internal Research - APT33"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9835-L9853"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9835-L9853"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a39d8823d54c55e60a7395772e50d116408804c1a5368391a1e5871dbdc83547"
logic_hash = "651568b2b95c9e5c2b60fb3245e5afe4290235979e3df15bad96ccd08ae234ef"
score = 75
@@ -387884,8 +388290,8 @@ rule SIGNATURE_BASE_Webshell_FOPO_Obfuscation_APT_ON_Nov17_1 : FILE
date = "2017-11-17"
modified = "2026-05-15"
reference = "Internal Research - ON"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9855-L9874"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9855-L9874"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ed6e2e0027d3f564f5ce438984dc8a54577df822ce56ce079c60c99a91d5ffb1"
logic_hash = "3c5bc3ee0218d4ce6902e49d7f938264ecd158f1f458e2fcef878f06f003ed08"
score = 75
@@ -387910,8 +388316,8 @@ rule SIGNATURE_BASE_Webshell_Jexboss_JSP_1 : FILE
date = "2018-11-08"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9876-L9893"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9876-L9893"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "41e0fb374e5d30b2e2a362a2718a5bf16e73127e22f0dfc89fdb17acbe89efdf"
logic_hash = "f540bbc88bffd0c961837416bd5166fd3cb54b6124ffffbf1cd60e49ab01bd30"
score = 75
@@ -387937,8 +388343,8 @@ rule SIGNATURE_BASE_Webshell_Jexboss_WAR_1 : FILE
date = "2018-11-08"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9895-L9918"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9895-L9918"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6271775ab144ce9bb9138bf054b149b5813d3beb96338993c6de35330f566092"
hash = "6f14a63c3034d3762da8b3ad4592a8209a0c88beebcb9f9bd11b40e879f74eaf"
logic_hash = "ee9cb22496d2e36d215caa9c7e295b41cb8434322a0097bbc3d1a365dce0c156"
@@ -387971,8 +388377,8 @@ rule SIGNATURE_BASE_Webshell_Tinyasp : FILE
date = "2019-01-09"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9920-L9931"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9920-L9931"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1f29905348e136b66d4ff6c1494d6008ea13f9551ad5aa9b991893a31b37e452"
logic_hash = "d8b7db89ea623d5bcf14476779df727827cfc752d4c6ba4208445fd7305e6943"
score = 75
@@ -387994,8 +388400,8 @@ rule SIGNATURE_BASE_WEBSHELL_ASPX_Mar21_1 : FILE
date = "2021-03-12"
modified = "2025-11-03"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/thor-webshells.yar#L9933-L9959"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/thor-webshells.yar#L9933-L9959"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "10b6e82125a2ddf3cc31a238e0d0c71a64f902e0d77171766713affede03174d"
hash = "170bee832df176aac0a3c6c7d5aa3fee413b4572030a24c994a97e70f6648ffc"
hash = "31c4d1fc81c052e269866deff324dffb215e7d481a47a2b6357a572a3e685d90"
@@ -388028,8 +388434,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf : FILE
date = "2017-02-09"
modified = "2022-08-18"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L10-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L10-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "320a01ec4e023fb5fbbaef963a2b57229e4f918847e5a49c7a3f631cb556e96c"
logic_hash = "4f0eab53a135242c7891b8c88e937a854c945a10000ca4cbf7b21f4596dca410"
score = 75
@@ -388051,8 +388457,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_2
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L25-L40"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L25-L40"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e52f98466b92ee9629d564453af6f27bd3645e00a9e2da518f5a64a33ccf8eb5"
logic_hash = "8f803a5d71a084e1ea453638bdeaa2dd590a1912be652b74b065d9afd332ffa2"
score = 75
@@ -388077,8 +388483,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_Psh
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L42-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L42-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5cc6c7f1aa75df8979be4a16e36cece40340c6e192ce527771bdd6463253e46f"
logic_hash = "2e6015e8c91ccd8647e78220d10c2d704867369d962b734bb4522a1213be2f2d"
score = 75
@@ -388103,8 +388509,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_Exe
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L59-L77"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L59-L77"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "321537007ea5052a43ffa46a6976075cee6a4902af0c98b9fd711b9f572c20fd"
logic_hash = "3baa242e90dd845e022785101ebc2d5c0d84007d20aef6a2bb6a9a8c6280d4eb"
score = 75
@@ -388132,8 +388538,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_3
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L79-L102"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L79-L102"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "335cfb85e11e7fb20cddc87e743b9e777dc4ab4e18a39c2a2da1aa61efdbd054"
logic_hash = "d1aeb97c19365f996dc1bc0fd6e01342878967be25d3e042158eba986af28b4a"
score = 75
@@ -388166,8 +388572,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_4
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L104-L121"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L104-L121"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "26b3e572ba1574164b76c6d5213ab02e4170168ae2bcd2f477f246d37dbe84ef"
logic_hash = "8e84ef13aa72c7c35520b3534b908c7d00240915ab02f8216a2cef6440c322a2"
score = 75
@@ -388194,8 +388600,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_Exe_2
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L123-L139"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L123-L139"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3a2f7a654c1100e64d8d3b4cd39165fba3b101bbcce6dd0f70dae863da338401"
logic_hash = "bd82f496ade1a62e0aee8c8c90cee84377cb90adf11c87652082e74c8c85e568"
score = 75
@@ -388221,8 +388627,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_5
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L141-L156"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L141-L156"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a6c66dfc998bf5838993e40026e1f400acd018bde8d4c01ef2e2e8fba507065"
logic_hash = "cb602670329391b091f87818a0f5defaa8f688f7921978510739b96ca63a2f12"
score = 75
@@ -388247,8 +388653,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_6
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L158-L177"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L158-L177"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8d6f55c6715c4a2023087c3d0d7abfa21e31a629393e4dc179d31bb25b166b3f"
logic_hash = "b9498828a55477049922e50329d0c38ee34b8484562113a2686669ccbb8b3318"
score = 75
@@ -388277,8 +388683,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_7
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L179-L194"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L179-L194"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "425beff61a01e2f60773be3fcb74bdfc7c66099fe40b9209745029b3c19b5f2f"
logic_hash = "167d295de5ffc9c88cf72f086fef4514f08cc3b9dd2d93b3ec36acffd6430370"
score = 75
@@ -388303,8 +388709,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_8
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L196-L215"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L196-L215"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "519717e01f0cb3f460ef88cd70c3de8c7f00fb7c564260bd2908e97d11fde87f"
logic_hash = "d2b26276843cdfef2d1458ee6c3e2ecea962d1cd42bc21b86ebd03599bebcbc6"
score = 75
@@ -388333,8 +388739,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_Cmd
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L217-L230"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L217-L230"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9f41932afc9b6b4938ee7a2559067f4df34a5c8eae73558a3959dd677cb5867f"
logic_hash = "ea44b3d00733eb7d4f924ccaece5265fcd90a462acb954a134b5355ecb0621e5"
score = 75
@@ -388357,8 +388763,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_9 : FILE
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L232-L252"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L232-L252"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81"
logic_hash = "b5761b51b79f83c48deafaf3786cb90ef493ab0448cd67b86655cecb0160a627"
score = 75
@@ -388385,8 +388791,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_10 : FILE
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L254-L269"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L254-L269"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3cd74fa28323c0d64f45507675ac08fb09bae4dd6b7e11f2832a4fbc70bb7082"
logic_hash = "c772fdc40e110ef1287da680dc4ef1718b86856abab4d814ec7bc2ee1e7808ee"
score = 75
@@ -388411,8 +388817,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_Svc : FILE
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L271-L285"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L271-L285"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b02c9c10577ee0c7590d3dadc525c494122747a628a7bf714879b8e94ae5ea1"
logic_hash = "21c6aa2333335a5822328fb5176ca37060eb401640ed5cc340aefb63685078f4"
score = 75
@@ -388436,8 +388842,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_11
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L287-L302"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L287-L302"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d1daf7bc41580322333a893133d103f7d67f5cd8a3e0f919471061d41cf710b6"
logic_hash = "f003989a99315b42c0c73beaa2928d0187fe92a4bf329912d64fac9f8fc9358c"
score = 75
@@ -388462,8 +388868,8 @@ rule SIGNATURE_BASE_Msfpayloads_Msf_Ref
date = "2017-02-09"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L304-L323"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L304-L323"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87"
logic_hash = "ed6e408575b88ff67479ac1b1a2f37c5fad3ec200a446700840ad4245386bfc4"
score = 75
@@ -388492,8 +388898,8 @@ rule SIGNATURE_BASE_MAL_Metasploit_Framework_UA : FILE
date = "2018-08-16"
modified = "2023-12-05"
reference = "https://github.com/rapid7/metasploit-framework/commit/12a6d67be48527f5d3987e40cac2a0cbb4ab6ce7"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L325-L339"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L325-L339"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1743e1bd4176ffb62a1a0503a0d76033752f8bd34f6f09db85c2979c04bbdd29"
logic_hash = "986fea99735b93aed9dbf72582c009e11a1e7ba19b256902f93312474ef34b4a"
score = 65
@@ -388516,8 +388922,8 @@ rule SIGNATURE_BASE_HKTL_Meterpreter_Inmemory
date = "2020-06-29"
modified = "2023-04-21"
reference = "https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_metasploit_payloads.yar#L341-L363"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_metasploit_payloads.yar#L341-L363"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4b39dbcb276842a1306205cf2e51ce86b6d2aa21353d277df15f4ea3b3d97678"
score = 85
quality = 85
@@ -388545,8 +388951,8 @@ rule SIGNATURE_BASE_MAL_BACKORDER_LOADER_WIN_Go_Jan23 : LOADER GOLANG BACKORDER
date = "2025-01-23"
modified = "2025-03-20"
reference = "EclecticIQ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_win_go_backorder_loader.yar#L1-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_win_go_backorder_loader.yar#L1-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70c91ffdc866920a634b31bf4a070fb3c3f947fc9de22b783d6f47a097fec2d8"
logic_hash = "9e79ec9e58e02b7660383ff20957b95bc3c61ed3badc9af3d5829ebe5bf6bd7b"
score = 80
@@ -388576,8 +388982,8 @@ rule SIGNATURE_BASE_Rtf_Cve2017_11882_Ole : MALICIOUS EXPLOIT CVE_2017_11882
date = "2017-11-23"
modified = "2025-06-03"
reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2017_11882.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2017_11882.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "51cf2a6c0c1a29abca9fd13cb22421da"
logic_hash = "6856d3c78cc06899d2bc1f876dce6b718513ebad80f37d7b5914a14d1da5064c"
score = 60
@@ -388601,8 +389007,8 @@ rule SIGNATURE_BASE_Rtf_Cve2017_11882 : MALICIOUS EXPLOIT CVE_2017_1182
date = "2017-11-23"
modified = "2025-06-03"
reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2017_11882.yar#L20-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2017_11882.yar#L20-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "51cf2a6c0c1a29abca9fd13cb22421da"
logic_hash = "37a65f086d393aae3dc88b3dd2520fff6e96b92fd6ae1be0a110f4eb826ae12d"
score = 60
@@ -388630,11 +389036,11 @@ rule SIGNATURE_BASE_Packager_Cve2017_11882 : CVE_2017_11882 FILE
date = "2017-11-23"
modified = "2025-06-03"
reference = "https://github.com/rxwx/CVE-2017-11882/blob/master/packager_exec_CVE-2017-11882.py"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2017_11882.yar#L41-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2017_11882.yar#L41-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "94e0c70e8140bb7fa3d184447617b534a8b9a24cdad535e6818be9662f0b9144"
score = 60
- quality = 54
+ quality = 79
tags = "CVE-2017-11882, FILE"
strings:
@@ -388655,8 +389061,8 @@ rule SIGNATURE_BASE_CVE_2017_11882_RTF : CVE_2017_11882 FILE
date = "2018-02-13"
modified = "2025-06-03"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2017_11882.yar#L58-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2017_11882.yar#L58-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "729fa8215a24990371369158d4582cc0ba9387eb0e7221860bf7216046c447cb"
score = 60
quality = 85
@@ -388684,8 +389090,8 @@ rule SIGNATURE_BASE_EXP_Potential_CVE_2017_11882 : FILE
date = "2025-06-03"
modified = "2025-06-03"
reference = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-cobalt-strike-payload-exploiting-cve-2017-11882.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2017_11882.yar#L82-L108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2017_11882.yar#L82-L108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a6e91e5b9807c94d32bac8a21c2c009320d16830155aae129a7fc2c67d393141"
score = 75
quality = 60
@@ -388719,8 +389125,8 @@ rule SIGNATURE_BASE_Gen_Unicorn_Obfuscated_Powershell : FILE
date = "2018-04-03"
modified = "2023-12-05"
reference = "https://github.com/trustedsec/unicorn/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_unicorn_obfuscated_powershell.yar#L1-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_unicorn_obfuscated_powershell.yar#L1-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b93d2fe6a671a6a967f31d5b3a0a16d4f93abcaf25188a2bbdc0894087adb10d"
hash = "1afb9795cb489abce39f685a420147a2875303a07c32bf7eec398125300a460b"
logic_hash = "cb0044d5ee146213c96161d52880ce6c20d5884d57620c73f359673d4ae4b76b"
@@ -388747,8 +389153,8 @@ rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Phpass_May21 : FILE
date = "2022-05-24"
modified = "2023-12-05"
reference = "https://twitter.com/s0md3v/status/1529005758540808192"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vul_backdoor_antitheftweb.yar#L2-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vul_backdoor_antitheftweb.yar#L2-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d9669dadc698c6fa63d61857f9ada16a9303aa8bf4139bec75104f2e9f00a36a"
score = 75
quality = 85
@@ -388769,8 +389175,8 @@ rule SIGNATURE_BASE_VULN_Python_Hack_Backdoored_Ctx_May21 : FILE
date = "2022-05-24"
modified = "2023-12-05"
reference = "https://twitter.com/s0md3v/status/1529005758540808192"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vul_backdoor_antitheftweb.yar#L16-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vul_backdoor_antitheftweb.yar#L16-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4fdfd4e647c106cef2a3b2503473f9b68259cae45f89e5b6c9272d04a1dfaeb0"
hash = "b40297af54e3f99b02e105f013265fd8d0a1b1e1f7f0b05bcb5dbdc9125b3bb5"
hash = "b7644fa1e0872780690ce050c98aa2407c093473031ab5f7a8ce35c0d2fc077e"
@@ -388794,8 +389200,8 @@ rule SIGNATURE_BASE_EXP_Drivecrypt_1 : FILE
date = "2018-08-21"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vul_drivecrypt.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vul_drivecrypt.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0dd09bc97c768abb84d0fb6d1ae7d789f1f83bfb2ce93ff9ff3c538dc1effa33"
logic_hash = "1959f2e4838e40f2abc26ee16b03089088c96cafb101125bdc346f69fe76d7a4"
score = 75
@@ -388820,8 +389226,8 @@ rule SIGNATURE_BASE_EXP_Drivecrypt_X64Passldr : FILE
date = "2018-08-21"
modified = "2023-01-06"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vul_drivecrypt.yar#L19-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vul_drivecrypt.yar#L19-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c828304c83619e2cb9dab80305e5286aba91742dc550e1469d91812af27101a1"
logic_hash = "573cd96f7f82788a3884cd4b4d91c739a890835c3ed1b3933af48ba5756cc5a6"
score = 75
@@ -388849,8 +389255,8 @@ rule SIGNATURE_BASE_SUSP_LNX_SH_Cryptominer_Indicators_Dec20_1 : FILE
date = "2020-12-31"
modified = "2023-12-05"
reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_crypto_miner.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_crypto_miner.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3298dbd985c341d57e3219e80839ec5028585d0b0a737c994363443f4439d7a5"
logic_hash = "4acd1b77307dbf23f95f7a2024209bee714c6931182aff16455ea6b7e4a6f287"
score = 65
@@ -388875,8 +389281,8 @@ rule SIGNATURE_BASE_PUA_WIN_XMRIG_Cryptocoin_Miner_Dec20 : FILE
date = "2020-12-31"
modified = "2023-12-05"
reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_crypto_miner.yar#L19-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_crypto_miner.yar#L19-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b6154d25b3aa3098f2cee790f5de5a727fc3549865a7aa2196579fe39a86de09"
logic_hash = "c39aee669a98bcc9d07821aef248096e45a6c54ab22b8b98c0a393b445f3934e"
score = 75
@@ -388900,8 +389306,8 @@ rule SIGNATURE_BASE_Git_CVE_2017_9800_Poc : CVE_2017_9800 FILE
date = "2017-08-11"
modified = "2023-12-05"
reference = "https://twitter.com/mzbat/status/895811803325898753"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2017_9800.yar#L2-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2017_9800.yar#L2-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1cfd0c5cb255d3ca63917c41c092df70d68b04f5d210a66abd5e35e509ff4beb"
score = 60
quality = 85
@@ -388925,8 +389331,8 @@ rule SIGNATURE_BASE_MAL_CRIME_Suspicious_Hex_String_Jun21_1 : CRIME PE FILE
date = "2021-06-04"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_crime_unknown.yar#L1-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_crime_unknown.yar#L1-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "37d60eb2daea90a9ba275e16115848c95e6ad87d20e4a94ab21bd5c5875a0a34"
hash = "3380c8c56d1216fe112cbc8f1d329b59e2cd2944575fe403df5e5108ca21fc69"
hash = "cd283d89b1b5e9d2875987025009b5cf6b137e3441d06712f49e22e963e39888"
@@ -388952,8 +389358,8 @@ rule SIGNATURE_BASE_MAL_CRIME_Unknown_LNK_Jun21_1 : LNK POWERSHELL FILE
date = "2021-06-04"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_crime_unknown.yar#L18-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_crime_unknown.yar#L18-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8fc7f25da954adcb8f91d5b0e1967e4a90ca132b280aa6ae73e150b55d301942"
hash = "f5da192f4e4dfb6b728aee1821d10bec6d68fb21266ce32b688e8cae7898a522"
hash = "183a9b3c04d16a1822c788d7a6e78943790ee2cdeea12a38e540281091316e45"
@@ -388979,8 +389385,8 @@ rule SIGNATURE_BASE_MAL_CRIME_Unknown_ISO_Jun21_1 : ISO POWERSHELL LNK FILE
date = "2021-06-04"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_crime_unknown.yar#L35-L50"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_crime_unknown.yar#L35-L50"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "425dbed047dd2ce760d0848ebf7ad04b1ca360f111d557fc7bf657ae89f86d36"
hash = "f6944b6bca627e219d9c5065f214f95eb2226897a3b823b645d0fd78c281b149"
hash = "14d70a8bdd64e9a936c2dc9caa6d4506794505e0e3870e3a25d9d59bcafb046e"
@@ -389006,8 +389412,8 @@ rule SIGNATURE_BASE_Gifcloaked_Webshell_A : FILE
date = "2018-03-12"
modified = "2026-05-15"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/yara_mixed_ext_vars.yar#L176-L197"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/yara_mixed_ext_vars.yar#L176-L197"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
logic_hash = "0c4570373d50c40745cd0523dcf8c34ee3cae1c298982b3a39d4a33e054aa779"
score = 60
@@ -389037,8 +389443,8 @@ rule SIGNATURE_BASE_HKTL_Reverse_Connect_TCP_PTY_Shell : FILE
date = "2019-10-19"
modified = "2023-12-05"
reference = "https://github.com/infodox/python-pty-shells/blob/master/tcp_pty_backconnect.py"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_python_pty_shell.yar#L1-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_python_pty_shell.yar#L1-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cae9833292d3013774bdc689d4471fd38e4a80d2d407adf9fa99bc8cde3319bf"
logic_hash = "6b92077f9ff775ae3f8166f47a32aaa872fcbf7fcefc3789e5411388aac5403a"
score = 75
@@ -389063,8 +389469,8 @@ rule SIGNATURE_BASE_Enigmapacker_Rare : FILE
date = "2017-04-27"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_enigma_protector.yar#L8-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_enigma_protector.yar#L8-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "77be6e80a4cfecaf50d94ee35ddc786ba1374f9fe50546f1a3382883cb14cec9"
logic_hash = "a001b563db1b75581432d42a435683f24e244b6b354f83409b5b9d6d0314d63a"
score = 60
@@ -389088,8 +389494,8 @@ rule SIGNATURE_BASE_Enigma_Protected_Malware_May17_Rhxfiles : FILE
date = "2017-05-02"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_enigma_protector.yar#L25-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_enigma_protector.yar#L25-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2187d6bd1794bf7b6199962d8a8677f19e4382a124c30933d01aba93cc1f0f15"
logic_hash = "838ab7dddda798d2f5c79fc5417693f8489195b3024c43d9ad1aab05fcfd71eb"
score = 75
@@ -389113,8 +389519,8 @@ rule SIGNATURE_BASE_Enigma_Protected_Malware : FILE
date = "2017-02-03"
modified = "2023-12-05"
reference = "https://goo.gl/OEVQ9w"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_enigma_protector.yar#L41-L55"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_enigma_protector.yar#L41-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d4616f9706403a0d5a2f9a8726230a4693e4c95c58df5c753ccc684f1d3542e2"
logic_hash = "1a254d4d593b73d16d1cfbd73d7d4b2732a080cb98d70972de0826433b004152"
score = 75
@@ -389138,8 +389544,8 @@ rule SIGNATURE_BASE_MAL_CMD_Script_Obfuscated_Feb19_1 : FILE
date = "2019-03-01"
modified = "2023-12-05"
reference = "https://twitter.com/DbgShell/status/1101076457189793793"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cmd_script_obfuscated.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cmd_script_obfuscated.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "deed88c554c8f9bef4078e9f0c85323c645a52052671b94de039b438a8cff382"
logic_hash = "71c8831686796c921674ec293b5bdf2c42ae9069b258c85c9e0ca6a7f972daf8"
score = 75
@@ -389162,8 +389568,8 @@ rule SIGNATURE_BASE_SUSP_LNX_ARCH_PKGBUILD_NPM_Dependency_Jun26 : FILE
date = "2026-06-15"
modified = "2026-06-15"
reference = "https://aur.archlinux.org/cgit/aur.git/commit/?h=python-django-js-asset&id=af09b1cf1b59"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_aur_packages.yar#L1-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_aur_packages.yar#L1-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "56bed7736d44219215fd912b229c7f765b737db4f6cde256ce264e795310c648"
hash = "1359814fda7f5ef63f04348439bfb011d7abc0381be6fbb404b04b359d63b61b"
hash = "3e1f297ab4d261fcad14a865a54d049d75d897d549d03371a5c4bbbc6e10e5cd"
@@ -389189,8 +389595,8 @@ rule SIGNATURE_BASE_SUSP_LNX_ARCH_SRCINFO_NPM_Dependency_Jun26 : FILE
date = "2026-06-15"
modified = "2026-06-15"
reference = "https://aur.archlinux.org/cgit/aur.git/commit/?h=hearthstone-linux-gui-bin&id=ecf810ac853e7149abd4e0c793b2517e9737edb8"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_aur_packages.yar#L26-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_aur_packages.yar#L26-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2ee28d5866fdb46e439678ad92729b1cd71d2d871135d8d56a27cf6a6b49e649"
logic_hash = "5351a3bb9f6f9d24fc15ec0c14dc7136b766f3ae8c5705f608909f0049d6429a"
score = 60
@@ -389213,8 +389619,8 @@ rule SIGNATURE_BASE_SUSP_LNX_ARCH_Install_Hook_Jun26 : FILE
date = "2026-06-15"
modified = "2026-06-15"
reference = "https://aur.archlinux.org/cgit/aur.git/commit/?h=python-django-js-asset&id=af09b1cf1b59"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_aur_packages.yar#L43-L70"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_aur_packages.yar#L43-L70"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "47c076099e6715ffb0bd357b6832175741e77b88972033cd1f9b55b6ff7e5519"
hash = "ef735bca8cb2acafe70831e33ed468a3046a61147af694000761970415c7eef1"
logic_hash = "b9850b02ef5df3834c072d267d3449617e28f71ec9120a9e64f24d46e57b9a0f"
@@ -389245,8 +389651,8 @@ rule SIGNATURE_BASE_SUSP_LNX_ARCH_ALPM_Hook_Jun26 : FILE
date = "2026-06-15"
modified = "2026-06-15"
reference = "https://aur.archlinux.org/cgit/aur.git/commit/?h=hearthstone-linux-gui-bin&id=ecf810ac853e7149abd4e0c793b2517e9737edb8"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_aur_packages.yar#L72-L88"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_aur_packages.yar#L72-L88"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ba332432f87e68d7fa8c784c60c39ba0d3e2ac06fd8855e82ea49329e2684529"
logic_hash = "b588d68867424799dcc7fd47d1fa3d3a89475290344a0b26e2ebca43e91076a7"
score = 70
@@ -389271,8 +389677,8 @@ rule SIGNATURE_BASE_KINS_Dropper
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/arPhm3"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_kins_dropper.yar#L1-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_kins_dropper.yar#L1-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cdab93f823e13e0c3104de8e05cb1572f83fb5294f359698092d73fc7983955b"
score = 75
quality = 85
@@ -389305,11 +389711,11 @@ rule SIGNATURE_BASE_KINS_DLL_Zeus
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/arPhm3"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_kins_dropper.yar#L28-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_kins_dropper.yar#L28-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "bd1ebe7976d1f93856b4f8d1d62d8fff68ce6234204da9fbdc233ddbef56864d"
score = 75
- quality = 60
+ quality = 85
tags = ""
strings:
@@ -389335,8 +389741,8 @@ rule SIGNATURE_BASE_APT_UNC2447_MAL_SOMBRAT_May21_1 : FILE
date = "2021-05-01"
modified = "2023-01-07"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc2447_sombrat.yar#L2-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2447_sombrat.yar#L2-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61e286c62e556ac79b01c17357176e58efb67d86c5d17407e128094c3151f7f9"
hash = "99baffcd7a6b939b72c99af7c1e88523a50053ab966a079d9bf268aff884426e"
logic_hash = "6f2572745cbd68c5f2be5c64b160d2513938daba6da57523012491acc63cfee4"
@@ -389372,8 +389778,8 @@ rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_1 : FILE
date = "2021-05-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc2447_sombrat.yar#L38-L72"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2447_sombrat.yar#L38-L72"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851"
hash = "0e5f7737704c8f25b2b8157561be54a463057cd4d79c7e016c30a1cf6590a85c"
hash = "52dace403e8f9b4f7ea20c0c3565fa11b6953b404a7d49d63af237a57b36fd2a"
@@ -389413,8 +389819,8 @@ rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_2 : FILE
date = "2021-05-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc2447_sombrat.yar#L74-L99"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2447_sombrat.yar#L74-L99"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768"
hash = "3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9"
hash = "501487b025f25ddf1ca32deb57a2b4db43ccf6635c1edc74b9cff54ce0e5bcfe"
@@ -389445,8 +389851,8 @@ rule SIGNATURE_BASE_APT_UNC2447_PS1_WARPRISM_May21_1 : FILE
date = "2021-05-01"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc2447_sombrat.yar#L101-L119"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2447_sombrat.yar#L101-L119"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80"
hash = "63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806"
hash = "b41a303a4caa71fa260dd601a796033d8bfebcaa6bd9dfd7ad956fac5229a735"
@@ -389473,8 +389879,8 @@ rule SIGNATURE_BASE_APT_UNC2447_BAT_Runner_May21_1 : FILE
date = "2021-05-01"
modified = "2023-01-07"
reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc2447_sombrat.yar#L121-L135"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2447_sombrat.yar#L121-L135"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ccacf4658ae778d02e4e55cd161b5a0772eb8b8eee62fed34e2d8f11db2cc4bc"
logic_hash = "f9872327f648e4421aa40ca3ce55df5d3eb5e8c5bc718ff62a3d4adac79217eb"
score = 75
@@ -389497,8 +389903,8 @@ rule SIGNATURE_BASE_Pirpi_1609_A : FILE
date = "2016-09-08"
modified = "2023-12-05"
reference = "http://goo.gl/igxLyF"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_pirpi.yar#L10-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_pirpi.yar#L10-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2a5a0bc350e774bd784fc25090518626b65a3ce10c7401f44a1616ea2ae32f4c"
hash = "8caa179ec20b6e3938d17132980e0b9fe8ef753a70052f7e857b339427eb0f78"
logic_hash = "470745d0dd44c161ed6ec474f85531a3aca8ebb0adb98b902cb0b7465ca07d8b"
@@ -389538,8 +389944,8 @@ rule SIGNATURE_BASE_Pirpi_1609_B : FILE
date = "2016-09-08"
modified = "2023-12-05"
reference = "http://goo.gl/igxLyF"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_pirpi.yar#L45-L65"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_pirpi.yar#L45-L65"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "498b98c02e19f4b03dc6a3a8b6ff8761ef2c0fedda846ced4b6f1c87b52468e7"
logic_hash = "4dafff80fb7bfcffccf96d991245c13b3208fd4f5a21488d7d6885758ef05078"
score = 75
@@ -389569,8 +389975,8 @@ rule SIGNATURE_BASE_CN_Tools_Xbat : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktool_scripts.yar#L10-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktool_scripts.yar#L10-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a7005acda381a09803b860f04d4cae3fdb65d594"
logic_hash = "c6dae76bbda7b43eef348c61e1330405923baf724f1aa5d2b51132dde89248fe"
score = 75
@@ -389594,8 +390000,8 @@ rule SIGNATURE_BASE_CN_Tools_Temp : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktool_scripts.yar#L26-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktool_scripts.yar#L26-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c3327ef63b0ed64c4906e9940ef877c76ebaff58"
logic_hash = "05fd1cb3f7c8b96ccf824013c130a0b21f43724463f8658e23239d009be7f4fe"
score = 75
@@ -389621,8 +390027,8 @@ rule SIGNATURE_BASE_CN_Tools_Srss : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktool_scripts.yar#L44-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktool_scripts.yar#L44-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "092ab0797947692a247fe80b100fb4df0f9c37a0"
logic_hash = "e01fd60adc32be26b0940ecc127a17bfcfe2ebfcf6cefea76ba6adc61d3c18d4"
score = 75
@@ -389646,8 +390052,8 @@ rule SIGNATURE_BASE_Dll_Unreg : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktool_scripts.yar#L60-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktool_scripts.yar#L60-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d5e24ba86781c332d0c99dea62f42b14e893d17e"
logic_hash = "0e534e475a5b4338aa53bea09325dd63a3d451a13b46a70b5208cabd2deecabe"
score = 75
@@ -389671,8 +390077,8 @@ rule SIGNATURE_BASE_Dll_Reg : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktool_scripts.yar#L76-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktool_scripts.yar#L76-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cb8a92fe256a3e5b869f9564ecd1aa9c5c886e3f"
logic_hash = "db2032d5689f9fcfc446d5ebe8a6d28c6dbd8bcd1d93769ec969d76f8add4f9d"
score = 75
@@ -389696,8 +390102,8 @@ rule SIGNATURE_BASE_Sbin_Squid : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktool_scripts.yar#L92-L108"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktool_scripts.yar#L92-L108"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8b795a8085c3e6f3d764ebcfe6d59e26fdb91969"
logic_hash = "c440bcfda55f926354ea5e462fe1e6a0e9e9585bb1c1539c0aa0588405a46105"
score = 75
@@ -389723,8 +390129,8 @@ rule SIGNATURE_BASE_Sql1433_Creck : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktool_scripts.yar#L110-L125"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktool_scripts.yar#L110-L125"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "189c11a3b268789a3fbcfac3bd4e03cbfde87b1d"
logic_hash = "2d9ff5f130d625450e7de41832695839f0427a6186569280a224f20e89fe1d8a"
score = 75
@@ -389749,8 +390155,8 @@ rule SIGNATURE_BASE_Sql1433_Start : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktool_scripts.yar#L127-L145"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktool_scripts.yar#L127-L145"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bd4be10f4c3a982647b2da1a8fb2e19de34eaf01"
logic_hash = "b7dfc2b04e838fa3a71487287a50e183443eb62b69cd23494294f231b43baf2f"
score = 75
@@ -389778,8 +390184,8 @@ rule SIGNATURE_BASE_Fourelementsword_Config_File
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_four_element_sword.yar#L11-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_four_element_sword.yar#L11-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f05cd0353817bf6c2cab396181464c31c352d6dea07e2d688def261dd6542b27"
logic_hash = "680e50998093e63a4e3c7d5338ac149efef83cdb41ceb4ce0245e8bd2ab99b84"
score = 75
@@ -389806,8 +390212,8 @@ rule SIGNATURE_BASE_Fourelementsword_T9000 : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_four_element_sword.yar#L30-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_four_element_sword.yar#L30-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
logic_hash = "1c7b063cbe9d44a9d194a180570f8313460f61560ac2cda5d66e048934170faa"
score = 75
@@ -389835,8 +390241,8 @@ rule SIGNATURE_BASE_Fourelementsword_32DLL : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_four_element_sword.yar#L51-L68"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_four_element_sword.yar#L51-L68"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a200c4df99887991c638fe625d07a4a3fc2bdc887112437752b3df5c8da79b6"
logic_hash = "b44870975f126b8603db04b97b748f7a5a75675ffe57037f613c11d6048200b1"
score = 75
@@ -389862,8 +390268,8 @@ rule SIGNATURE_BASE_Fourelementsword_Keyainst_EXE : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_four_element_sword.yar#L70-L87"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_four_element_sword.yar#L70-L87"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cf717a646a015ee72f965488f8df2dd3c36c4714ccc755c295645fe8d150d082"
logic_hash = "1491de3241a81cce4d80d6dc23886f1d8bf316112c48652a8138aa4cbadbb174"
score = 75
@@ -389889,8 +390295,8 @@ rule SIGNATURE_BASE_Fourelementsword_Elevatedll_2 : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_four_element_sword.yar#L89-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_four_element_sword.yar#L89-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9c23febc49c7b17387767844356d38d5578727ee1150956164883cf555fe7f95"
logic_hash = "d5fcb2bacfa0a1f78bfbd3fa7ba3084da9a60f1b8b7880c83d8f225312c179b4"
score = 75
@@ -389915,8 +390321,8 @@ rule SIGNATURE_BASE_Fourelementsword_Fslapi_Dll_Gui : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_four_element_sword.yar#L106-L121"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_four_element_sword.yar#L106-L121"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
logic_hash = "909b187f864a240268d0ffcef904b85cd1eaad97dd3a3a808aad58968fbb76c2"
score = 75
@@ -389941,8 +390347,8 @@ rule SIGNATURE_BASE_Fourelementsword_Powershell_Start
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_four_element_sword.yar#L123-L137"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_four_element_sword.yar#L123-L137"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b6053e784c5762fdb9931f9064ba6e52c26c2d4b09efd6ff13ca87bbb33c692"
logic_hash = "7b1986845d97dcd11c8baddb0b49350ad30c6fff98840275befef4ad0b906b54"
score = 75
@@ -389966,8 +390372,8 @@ rule SIGNATURE_BASE_Fourelementsword_Resn32Dll
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_four_element_sword.yar#L139-L154"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_four_element_sword.yar#L139-L154"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bf1b00b7430899d33795ef3405142e880ef8dcbda8aab0b19d80875a14ed852f"
logic_hash = "9658ae3d1267993551cfb939f75f3d78de18cbeb2f524c2576b849103f3cacdc"
score = 75
@@ -389992,8 +390398,8 @@ rule SIGNATURE_BASE_Fourelementsword_Elevatedll : FILE
date = "2016-04-18"
modified = "2023-12-05"
reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_four_element_sword.yar#L158-L179"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_four_element_sword.yar#L158-L179"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3dfc94605daf51ebd7bbccbb3a9049999f8d555db0999a6a7e6265a7e458cab9"
hash = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
logic_hash = "d110bae02f00d14c5a71ecf5991e9fc38b29d8056d1e551dc36376875d2e1333"
@@ -390022,8 +390428,8 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwareqwerty_20121
date = "2015-01-18"
modified = "2023-12-05"
reference = "http://www.spiegel.de/media/media-35668.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_querty_fiveeyes.yar#L3-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_querty_fiveeyes.yar#L3-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8263fb58350f3b1d3c4220a602421232d5e40726"
logic_hash = "e2660abf4959bc57bcf9d95d974cd20718d5d27f371109cb4526cee208544530"
score = 75
@@ -390056,8 +390462,8 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20123_Sys
date = "2015-01-18"
modified = "2023-12-05"
reference = "http://www.spiegel.de/media/media-35668.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_querty_fiveeyes.yar#L28-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_querty_fiveeyes.yar#L28-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a0f0087bd1f8234d5e847363d7e15be8a3e6f099"
logic_hash = "881af0e2ff8fad2bca2ae05ad63b5185356181685daafa7a1b9992a1de017c9e"
score = 75
@@ -390084,8 +390490,8 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20123_Cmddef
date = "2015-01-18"
modified = "2023-12-05"
reference = "http://www.spiegel.de/media/media-35668.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_querty_fiveeyes.yar#L47-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_querty_fiveeyes.yar#L47-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7b08fc77629f6caaf8cc4bb5f91be6b53e19a3cd"
logic_hash = "84776764caa79ad68f2dd0d2f890821c75f2efba7c46d674110ba870a40a372a"
score = 75
@@ -390128,8 +390534,8 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20121_Dll
date = "2015-01-18"
modified = "2023-12-05"
reference = "http://www.spiegel.de/media/media-35668.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_querty_fiveeyes.yar#L82-L96"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_querty_fiveeyes.yar#L82-L96"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "89504d91c5539a366e153894c1bc17277116342b"
logic_hash = "e735a7c26652cbf2bccac80a14568a3582b254ae25e2db56a46c09a714650611"
score = 75
@@ -390153,8 +390559,8 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwareqwerty_20123
date = "2015-01-18"
modified = "2023-12-05"
reference = "http://www.spiegel.de/media/media-35668.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_querty_fiveeyes.yar#L97-L121"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_querty_fiveeyes.yar#L97-L121"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9"
logic_hash = "918462399af78b16a8214ceb1d39db554e3136efd4bc643353f0727e4a162516"
score = 75
@@ -390188,8 +390594,8 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20120_Dll
date = "2015-01-18"
modified = "2023-12-05"
reference = "http://www.spiegel.de/media/media-35668.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_querty_fiveeyes.yar#L123-L156"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_querty_fiveeyes.yar#L123-L156"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6811bfa3b8cda5147440918f83c40237183dbd25"
logic_hash = "fc3aac33c84d3b4a981c2d1a9358c54dc5ceca2017dbf2e2a51e1b6970b90796"
score = 75
@@ -390232,8 +390638,8 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20120_Cmddef
date = "2015-01-18"
modified = "2023-12-05"
reference = "http://www.spiegel.de/media/media-35668.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_querty_fiveeyes.yar#L158-L191"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_querty_fiveeyes.yar#L158-L191"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cda9ceaf0a39d6b8211ce96307302a53dfbd71ea"
logic_hash = "9c336a09adb5fdf3149e5d0ad716cb854f95effa4ce4dfe3e75f43031e4903ff"
score = 75
@@ -390276,8 +390682,8 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwareqwerty_20120
date = "2015-01-18"
modified = "2023-12-05"
reference = "http://www.spiegel.de/media/media-35668.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_querty_fiveeyes.yar#L193-L216"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_querty_fiveeyes.yar#L193-L216"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "597082f05bfd3225587d480c30f54a7a1326a892"
logic_hash = "7d2617e0ee41ea475608757594cba8ae93f2dbb09b5d01d1fa3324b32ebb8aa0"
score = 75
@@ -390310,8 +390716,8 @@ rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20121_Cmddef
date = "2015-01-18"
modified = "2023-12-05"
reference = "http://www.spiegel.de/media/media-35668.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_querty_fiveeyes.yar#L218-L251"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_querty_fiveeyes.yar#L218-L251"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907"
logic_hash = "d73f0e964bd57ed3a2cd782ac204a2b82a9b334e33d64dc61e6414654d7c38d3"
score = 75
@@ -390354,8 +390760,8 @@ rule SIGNATURE_BASE_HKTL_Bruteratel_Badger_Indicators_Oct22_4 : FILE
date = "2022-10-12"
modified = "2023-12-05"
reference = "https://twitter.com/embee_research/status/1580030310778953728"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/hktl_bruteratel_c4_badger.yar#L2-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_bruteratel_c4_badger.yar#L2-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9af05225f462c8d4ec1fb14dc06bb789f76b0d818cb82c3dfcd5abc693727f33"
score = 75
quality = 85
@@ -390379,8 +390785,8 @@ rule SIGNATURE_BASE_APT_APT28_Cannon_Trojan_Nov18_1 : FILE
date = "2018-11-20"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_cannon.yar#L2-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_cannon.yar#L2-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61a1f3b4fb4dbd2877c91e81db4b1af8395547eab199bf920e9dd11a1127221e"
logic_hash = "de8c7bf80fe6209d00955c375b769a3aca138759335abb11f5086f85a4a9c367"
score = 75
@@ -390419,8 +390825,8 @@ rule SIGNATURE_BASE_Scarcruft_Malware_Feb18_1 : FILE
date = "2018-02-03"
modified = "2023-12-05"
reference = "https://twitter.com/craiu/status/959477129795731458"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_scarcruft.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_scarcruft.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fa1ed130518a2096bd731dce917512d560160e271ad8f0ccd57fbedd478a5502"
score = 90
quality = 85
@@ -390442,8 +390848,8 @@ rule SIGNATURE_BASE_MSIL_SUSP_OBFUSC_Xorstringsnet : FILE
date = "2023-03-26"
modified = "2023-12-05"
reference = "https://github.com/dr4k0nia/yara-rules"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_net_xorstrings.yar#L2-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_net_xorstrings.yar#L2-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6d023a80bd8f5709721c3ace8a7230b847ca4bd2a1aff502a25333ffc8bf75ca"
score = 75
quality = 85
@@ -390472,12 +390878,12 @@ rule SIGNATURE_BASE_SUSP_Vulndriver_HP_Hardware_Diagnostics_Etdsupp_May23 : FILE
date = "2023-05-12"
modified = "2023-12-05"
reference = "https://github.com/alfarom256/HPHardwareDiagnostics-PoC/tree/main/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_vulndriver_hp_hardware_diagnostics_etdsupp_may23.yar#L1-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_vulndriver_hp_hardware_diagnostics_etdsupp_may23.yar#L1-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
logic_hash = "bb50f591e49b1b0b08ccbe4ca5cb3685d8f358e51e6d6f77677bc05701f6b301"
score = 65
- quality = 60
+ quality = 85
tags = "FILE"
strings:
@@ -390497,8 +390903,8 @@ rule SIGNATURE_BASE_Redsails_EXE : FILE
date = "2017-10-02"
modified = "2023-12-05"
reference = "https://github.com/BeetleChunks/redsails"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_redsails.yar#L11-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_redsails.yar#L11-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a7861d25b0c038d77838ecbd5ea5674650ad4f5faf7432a6f3cfeb427433fac"
logic_hash = "fe9232989fb29686f11ee8cd59090fb6602301b00ff12d4a0dff8279a1718086"
score = 75
@@ -390522,8 +390928,8 @@ rule SIGNATURE_BASE_Redsails_PY
date = "2017-10-02"
modified = "2023-12-05"
reference = "https://github.com/BeetleChunks/redsails"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_redsails.yar#L27-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_redsails.yar#L27-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6ebedff41992b9536fe9b1b704a29c8c1d1550b00e14055e3c6376f75e462661"
hash = "5ec20cb99030f48ba512cbc7998b943bebe49396b20cf578c26debbf14176e5e"
logic_hash = "4c5426a427e2c25cf9e44ae5f9ec477c9ab11f611d9a0db444c36e7cae176562"
@@ -390551,8 +390957,8 @@ rule SIGNATURE_BASE_IMPLANT_1_V1 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L12-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L12-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4df04daf70da482877874c530a3ad76fddebec2946931b60f98aa6c4e31f21ae"
score = 85
quality = 85
@@ -390575,8 +390981,8 @@ rule SIGNATURE_BASE_IMPLANT_1_V2 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L28-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L28-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c9bdf38303fadee3e2cfc99b70942a92ab382817a28401e8c8ab8035384c97c1"
score = 85
quality = 85
@@ -390600,8 +391006,8 @@ rule SIGNATURE_BASE_IMPLANT_1_V3 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L45-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L45-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e418620b45bc11804eae24db3cba8421758c214fc9f660a17761bbf3395ad744"
score = 85
quality = 85
@@ -390622,8 +391028,8 @@ rule SIGNATURE_BASE_IMPLANT_1_V4 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L60-L73"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L60-L73"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "eb8e4ed38e2e4d3991543c526c7dc458eec78c517d2c5eaa06a3a3cfb48d770f"
score = 85
quality = 85
@@ -390645,8 +391051,8 @@ rule SIGNATURE_BASE_IMPLANT_1_V5 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L75-L91"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L75-L91"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e9660dfe76bfe1eb17b434f2ddef4975495e952396212c41550d932dbb8e8205"
score = 85
quality = 85
@@ -390670,8 +391076,8 @@ rule SIGNATURE_BASE_IMPLANT_1_V7 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L112-L124"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L112-L124"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ff8443460e1818fd63e4dcf678bb592940b32978a70ab1633ebaa61c590d3916"
score = 85
quality = 85
@@ -390692,8 +391098,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V1 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L126-L138"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L126-L138"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6708239ea43fd36a7c9431cd2c6c185c0d406d65c4a31374c5e96bdc3e53de43"
score = 85
quality = 85
@@ -390714,8 +391120,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V3 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L140-L155"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L140-L155"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ebfedcec6f22d802a9980ad533f21e90b77fe929a813850be1b25304d3973c3b"
score = 85
quality = 85
@@ -390739,8 +391145,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V5 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L157-L171"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L157-L171"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b0929b808f62e3c59c0afbe959ebf67a3a985e0a0a72bcb112c9693a98351555"
score = 85
quality = 85
@@ -390763,8 +391169,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V6 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L173-L186"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L173-L186"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "93ce725a8af03d6f08eafe99ff3984e03a434b1f0071c6dbe560bafc3eefb576"
score = 85
quality = 85
@@ -390786,8 +391192,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V7 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L188-L208"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L188-L208"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dd65443065f044a2956ae51140423dab202effff5f12dd686f6c4fd54d8a4a0b"
score = 85
quality = 85
@@ -390816,8 +391222,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V9 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L210-L236"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L210-L236"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5947dbb08c9d0851b7993e5ccf177f97dcb330d4b390833843f69932c921ce7a"
score = 85
quality = 85
@@ -390851,8 +391257,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V10 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L238-L251"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L238-L251"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "62d47c1076b05bc9a531ef6e48f17f730932826b4b0f311887e3b14c639b937d"
score = 85
quality = 85
@@ -390874,8 +391280,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V11 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L253-L267"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L253-L267"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "72b9e4de0389df3a14f92660e91749dea4d31905eb7391163c3503bc953d661f"
score = 85
quality = 85
@@ -390898,8 +391304,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V14 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L269-L293"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L269-L293"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4abb1e1c68ced667f04a69c58c89187f9ccc0633c5dc5f396ba8d210bf405f93"
score = 85
quality = 85
@@ -390932,8 +391338,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V15 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L295-L310"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L295-L310"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fac61e80803941193c41ecf8b3fcbee21b5cc41542989ecd93542c32e87da983"
score = 85
quality = 85
@@ -390956,8 +391362,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V16 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L312-L329"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L312-L329"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "638cb66e5ff52ac5a1df0954969e7c54a3b25518228e4f8f344aafe6760985d2"
score = 85
quality = 85
@@ -390982,8 +391388,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V17 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L331-L347"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L331-L347"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ea2793e6ce9e9d97e70a9452a38eb4d5ddbcc275af6ae7f5d094dc77e112d278"
score = 85
quality = 85
@@ -391008,8 +391414,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V18 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L349-L376"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L349-L376"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d982b3b1407e140f586772ce409e47bd29e567af41e466cd94d0983c93aab917"
score = 85
quality = 85
@@ -391044,8 +391450,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V19 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L378-L404"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L378-L404"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "42bee6ddf0b13774efb6712135c3e0b4eae6364120f8973272820f5f669671d1"
score = 85
quality = 85
@@ -391079,8 +391485,8 @@ rule SIGNATURE_BASE_IMPLANT_2_V20 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L406-L423"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L406-L423"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "72c62a764c5c7c19a07957fd6fbfcffd689900cc2759d408d239fe08a3b76b9c"
score = 85
quality = 85
@@ -391105,8 +391511,8 @@ rule SIGNATURE_BASE_IMPLANT_3_V1
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L425-L442"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L425-L442"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4c7b6c76bc10784abf96cc71b34ffc9a9de569fd536505528752221d22b26629"
score = 85
quality = 85
@@ -391132,8 +391538,8 @@ rule SIGNATURE_BASE_IMPLANT_3_V2 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L444-L464"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L444-L464"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0a658888dcc7b7f4620f08449c6ec492756750e64f15b048f7cdee7de4fc0479"
score = 85
quality = 85
@@ -391161,8 +391567,8 @@ rule SIGNATURE_BASE_IMPLANT_3_V3 : FILE
date = "2017-02-10"
modified = "2021-03-15"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L466-L485"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L466-L485"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "313f837b90bcf09455427e4411acb5406f4dae9d69373d8d2c0cfc014e27ee96"
score = 65
quality = 85
@@ -391186,8 +391592,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V1 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L487-L503"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L487-L503"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "51135d9fe62f5fd1fb7ef6c386dcdd86525dd469064662c2314cfee6e952d6ec"
score = 85
quality = 85
@@ -391212,8 +391618,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V2 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L505-L520"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L505-L520"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dd4edd238cdc3d376c1d5bcea6c8df57f4ef03369c0ca22107241812e0a1bb94"
score = 85
quality = 85
@@ -391236,8 +391642,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V3_Alternativerule : HIGHVOL FILE
date = "2017-02-12"
modified = "2025-07-01"
reference = "US CERT Grizzly Steppe Report"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L788-L803"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L788-L803"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2244fe9c5d038edcb5406b45361613cf3909c491e47debef35329060b00c985a"
logic_hash = "35468f7699b96fcaaaa032eef7dae34ec314e9c652f9f8b2e8ca7343fb5cec50"
score = 75
@@ -391262,8 +391668,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V4 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L807-L822"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L807-L822"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "49c912f29f5ffbd90366a510285ef3f06c804af86829808c175c8be519ce01c4"
score = 85
quality = 85
@@ -391287,8 +391693,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V5 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L824-L838"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L824-L838"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9d4233ccf148919d0ad0be726b9dfa9e26a9afcebb7b26fa4db4c3da8c46d13e"
score = 85
quality = 85
@@ -391309,8 +391715,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V7 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L859-L881"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L859-L881"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "27ae70d384488660c1f80040503d3eb6541112fd6332edc5820bc6718d76b847"
score = 85
quality = 85
@@ -391341,8 +391747,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V8
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L883-L911"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L883-L911"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dd072702c59822587d7ede0bc59c5672fbaa9a05595940781554fadb32e109f7"
score = 85
quality = 85
@@ -391379,8 +391785,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V9
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L913-L933"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L913-L933"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c0e48bf0839965f9bda9cc475aba5b4934c27c426a8fa4423fb24aa9d792e2e4"
score = 85
quality = 77
@@ -391409,8 +391815,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V10 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L935-L966"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L935-L966"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f22fd45eb77ff1a8202f4bd0d0c43787c8184300e96aff021e13371ae7bd5553"
score = 85
quality = 81
@@ -391450,8 +391856,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V11 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L968-L985"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L968-L985"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7bdeddc4334ed6557175b5eefc78d69283d6c91f98970bd0cfe6365b3ab477f4"
score = 85
quality = 85
@@ -391476,8 +391882,8 @@ rule SIGNATURE_BASE_IMPLANT_4_V13 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1011-L1032"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1011-L1032"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "576c07c44105d2a38ca715d366f68058b2b3118f25e91d2d3e2d20e932fc9453"
score = 85
quality = 85
@@ -391506,8 +391912,8 @@ rule SIGNATURE_BASE_IMPLANT_5_V1
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1034-L1051"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1034-L1051"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d94192d408036bf02052dc5145b78fea61323810b2abdbba64c65e1f6387ea42"
score = 85
quality = 85
@@ -391533,8 +391939,8 @@ rule SIGNATURE_BASE_IMPLANT_5_V2
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1053-L1192"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1053-L1192"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "43e3df19ecd2068636b92c7a5c0399b22f8fa478e3e1562f392e78c5a268a1e5"
score = 85
quality = 60
@@ -391682,8 +392088,8 @@ rule SIGNATURE_BASE_IMPLANT_5_V3
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1194-L1207"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1194-L1207"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "aec1314858732d30b62a033e85eea50b3375e4f5b0e1818a941979d5be672297"
score = 85
quality = 85
@@ -391705,8 +392111,8 @@ rule SIGNATURE_BASE_IMPLANT_5_V4
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1209-L1225"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1209-L1225"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "98a08860453496d9629f62c64fed50a24b8378dcfa39b8b654610c2ac9084fa8"
score = 85
quality = 85
@@ -391731,8 +392137,8 @@ rule SIGNATURE_BASE_IMPLANT_6_V1 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1227-L1243"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1227-L1243"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c60402a029034545df302485c14e9485f806f2bc7d5fd759e84d1ecba9854837"
score = 85
quality = 85
@@ -391755,8 +392161,8 @@ rule SIGNATURE_BASE_IMPLANT_6_V2 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1245-L1258"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1245-L1258"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7e81e8bcc305b9b7166db85d81278c96edf232bf60040ef15a2376f204ca3046"
score = 85
quality = 85
@@ -391777,8 +392183,8 @@ rule SIGNATURE_BASE_IMPLANT_6_V3 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1260-L1275"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1260-L1275"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "833a6a3a4ff8ca43d4cf8053bfd1da49df96d9833dd3fe0f3ffbf6ce6c114681"
score = 85
quality = 85
@@ -391801,8 +392207,8 @@ rule SIGNATURE_BASE_IMPLANT_6_V4 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1277-L1291"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1277-L1291"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f5388668e148223bc94680ea84e83b0f2896ccf433523d171c8f46d7069f9a4b"
score = 85
quality = 85
@@ -391824,8 +392230,8 @@ rule SIGNATURE_BASE_IMPLANT_6_V5 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1293-L1327"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1293-L1327"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b3ba650818ddbc58ce272ae4851ae3151a8cf1c9cc6f8e234a50b52c95d951fe"
score = 85
quality = 85
@@ -391867,8 +392273,8 @@ rule SIGNATURE_BASE_IMPLANT_6_V6 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1329-L1343"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1329-L1343"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "77b5f95cd897c82c200ee6fa3970824adccfd7c56639d92361095f919781d731"
score = 85
quality = 85
@@ -391890,8 +392296,8 @@ rule SIGNATURE_BASE_IMPLANT_7_V1 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1368-L1381"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1368-L1381"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "996f81fe006e0ab15adab46275fdb60251e6c6616da33df600fadfc2684c24af"
score = 85
quality = 85
@@ -391913,8 +392319,8 @@ rule SIGNATURE_BASE_IMPLANT_8_V1 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1383-L1411"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1383-L1411"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "437bda331405f9203747ffbfb107ec26e33973ebfc9f02e153697f7b8c22ad4f"
score = 65
quality = 85
@@ -391945,8 +392351,8 @@ rule SIGNATURE_BASE_IMPLANT_9_V1 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1431-L1448"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1431-L1448"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "1166ef923d39952f4131a693c58b8bab5dcbe87f6a6b548a706d1fa10a82e22c"
score = 85
quality = 85
@@ -391971,8 +392377,8 @@ rule SIGNATURE_BASE_IMPLANT_10_V2 : FILE
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1469-L1482"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1469-L1482"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dc201d25b1d6cf8f88ae3bee18057902c4d64316aa9debc9248b0d8aa7f6d170"
score = 85
quality = 85
@@ -391994,8 +392400,8 @@ rule SIGNATURE_BASE_Unidentified_Malware_Two
date = "2017-02-10"
modified = "2025-07-01"
reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_grizzlybear_uscert.yar#L1521-L1543"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_grizzlybear_uscert.yar#L1521-L1543"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cd9adfb9e27e4d6b27498cc029e15132343f036cca60210528720a533fe20d9a"
score = 85
quality = 85
@@ -392024,8 +392430,8 @@ rule SIGNATURE_BASE_SUSP_LNX_Byteencoder_Jan25 : FILE
date = "2025-01-23"
modified = "2025-03-20"
reference = "https://www.securityweek.com/newly-discovered-turla-malware-targets-linux-systems/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/seaspy_backdoor_jan25.yar#L1-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/seaspy_backdoor_jan25.yar#L1-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3e0312ce8d0c1e5c192dbb93cac4770a1205c56dc9d02a0510c7e10a15251de5"
hash = "301d58a6a1819466e77209dbf8ca635cbee3b45516e5ee228fea50ae4a27b7d5"
hash = "957c0c135b50d1c209840ec7ead60912a5ccefd2873bf5722cb85354cea4eb37"
@@ -392053,8 +392459,8 @@ rule SIGNATURE_BASE_SUSP_LNX_Stackstring_Technique_Jan25 : FILE
date = "2025-01-23"
modified = "2025-03-20"
reference = "https://www.securityweek.com/newly-discovered-turla-malware-targets-linux-systems/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/seaspy_backdoor_jan25.yar#L24-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/seaspy_backdoor_jan25.yar#L24-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0e65a80c6331a0e8d7df05ac217a8a7fe03b88f1d304f2ff0a26b92ed89153f3"
hash = "3e0312ce8d0c1e5c192dbb93cac4770a1205c56dc9d02a0510c7e10a15251de5"
hash = "301d58a6a1819466e77209dbf8ca635cbee3b45516e5ee228fea50ae4a27b7d5"
@@ -392082,8 +392488,8 @@ rule SIGNATURE_BASE_Trojandownloader : FILE
date = "2015-02-11"
modified = "2023-12-05"
reference = "http://goo.gl/wJ8V1I"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_malware_generic.yar#L4-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_malware_generic.yar#L4-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5b8d4280ff6fc9c8e1b9593cbaeb04a29e64a81e"
logic_hash = "4911098beea1d348d41d6a38c03b343bb7b8a8090ba664fd4b0747045127c686"
score = 60
@@ -392127,8 +392533,8 @@ rule SIGNATURE_BASE_Ismdoor_Jul17_A2 : FILE
date = "2017-08-01"
modified = "2023-12-05"
reference = "https://twitter.com/Voulnet/status/892104753295110145"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_malware_generic.yar#L54-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_malware_generic.yar#L54-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "be72c89efef5e59c4f815d2fce0da5a6fac8c90b86ee0e424868d4ae5e550a59"
hash = "ea1be14eb474c9f70e498c764aaafc8b34173c80cac9a8b89156e9390bd87ba8"
logic_hash = "7944f690be190927c905d3b3c6e26765504af9fcfb445cf70c8899af115d5001"
@@ -392155,8 +392561,8 @@ rule SIGNATURE_BASE_Unknown_Malware_Sample_Jul17_2 : FILE
date = "2017-08-01"
modified = "2023-12-05"
reference = "https://goo.gl/iqH8CK"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_malware_generic.yar#L73-L89"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_malware_generic.yar#L73-L89"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3530d480db082af1823a7eb236203aca24dc3685f08c301466909f0794508a52"
logic_hash = "966e14331fa89f2cdb5593a0c10227264085ee127deed28341e395ba6845e19d"
score = 75
@@ -392182,8 +392588,8 @@ rule SIGNATURE_BASE_MAL_Unspecified_Jan18_1 : FILE
date = "2018-01-19"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_malware_generic.yar#L91-L110"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_malware_generic.yar#L91-L110"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f87879b29ff83616e9c9044bd5fb847cf5d2efdd2f01fc284d1a6ce7d464a417"
logic_hash = "cd4f7247473e04c348b49970ee3a6fd01415f005ac6dc7a79fbf937a693a80f4"
score = 75
@@ -392212,8 +392618,8 @@ rule SIGNATURE_BASE_APT28_Hospitalitymalware_Document : FILE
date = "2017-10-02"
modified = "2023-12-05"
reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_hospitality.yar#L3-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_hospitality.yar#L3-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "33c69e03e00c90dc0b673cdb042f8f979552086414bda9c9f17f3785214b05af"
score = 75
quality = 85
@@ -392237,8 +392643,8 @@ rule SIGNATURE_BASE_APT28_Hospitalitymalware_Mvtband_File
date = "2017-10-02"
modified = "2023-12-05"
reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_hospitality.yar#L20-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_hospitality.yar#L20-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d5da333444e7c9f023d9c6d8d1dec617859efdb26f9f6bc41e22ef27d2e3059a"
score = 75
quality = 85
@@ -392261,8 +392667,8 @@ rule SIGNATURE_BASE_Malware_Sakula_Xorloop : FILE
date = "2016-06-13"
modified = "2023-01-27"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sakula.yar#L1-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sakula.yar#L1-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fc6497fe708dbda9355139721b6181e7"
logic_hash = "b3c3131693e18ce2cf26786a93b61d39d90703d8c827de1340f85377fe7b59de"
score = 75
@@ -392285,8 +392691,8 @@ rule SIGNATURE_BASE_Malware_Sakula_Memory
date = "2016-06-13"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sakula.yar#L20-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sakula.yar#L20-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b3852b9e7f2b8954be447121bb6b65c3"
logic_hash = "ba6d93a1fc5fd81748eb462fc55b681987126ba853ddb677a5f1f9b74ba5cde8"
score = 75
@@ -392317,8 +392723,8 @@ rule SIGNATURE_BASE_Malware_Sakula_Shellcode
date = "2016-06-13"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sakula.yar#L47-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sakula.yar#L47-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0e84d91cd1bb0455ac7d2ca78583510388f39cebd95523c5f6f173a50e0c1951"
score = 75
quality = 85
@@ -392341,8 +392747,8 @@ rule SIGNATURE_BASE_MAL_Floxif_Generic : FILE
date = "2018-05-11"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_floxif_flystudio.yar#L3-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_floxif_flystudio.yar#L3-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085"
logic_hash = "1996f717100d9f1abc2ed3f1e9d0c55daec09654c0f99987ddaea9e9f0d17008"
score = 80
@@ -392363,8 +392769,8 @@ rule SIGNATURE_BASE_MAL_CN_Flystudio_May18_1 : FILE
date = "2018-05-11"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_floxif_flystudio.yar#L21-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_floxif_flystudio.yar#L21-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b85147366890598518d4f277d44506eef871fd7fc6050d8f8e68889cae066d9e"
logic_hash = "8d03f02a270d8664175b65398c01ec4f0ea182437b31847f9bf4181edb0c36bb"
score = 75
@@ -392388,8 +392794,8 @@ rule SIGNATURE_BASE_MAL_Prolock_Malware : FILE
date = "2020-05-17"
modified = "2023-12-05"
reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Prolock.Malware.yar"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_prolock.yar#L1-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_prolock.yar#L1-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a6ded68af5a6e5cc8c1adee029347ec72da3b10a439d98f79f4b15801abd7af0"
hash = "dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178"
logic_hash = "da8a0ec683475019daddd4acdd00d4c36eedacad3deef2be4220b86cbf5f9df0"
@@ -392417,8 +392823,8 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_1 : FILE
date = "2018-10-17"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_greyenergy.yar#L12-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_greyenergy.yar#L12-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6c52a5850a57bea43a0a52ff0e2d2179653b97ae5406e884aee63e1cf340f58b"
logic_hash = "0cbdc156b7080608c1071feeb4826a70bb259c55139d74d019465c4bb5244260"
score = 75
@@ -392443,8 +392849,8 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_2 : FILE
date = "2018-10-17"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_greyenergy.yar#L31-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_greyenergy.yar#L31-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c6a54912f77a39c8f909a66a940350dcd8474c7a1d0e215a878349f1b038c58a"
logic_hash = "600bc5b423ef3281bfc7ad7ab479aa1208b0144b0f4afd8c2d14f17b5e2c600b"
score = 75
@@ -392467,8 +392873,8 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_3 : FILE
date = "2018-10-17"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_greyenergy.yar#L46-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_greyenergy.yar#L46-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0db5e5b68dc4b8089197de9c1e345056f45c006b7b487f7d8d57b49ae385bad0"
logic_hash = "f4851f5381a4d8dea488d50ff11048052826c51428f8610bc5d3480ed254d32f"
score = 75
@@ -392493,8 +392899,8 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_4 : FILE
date = "2018-10-17"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_greyenergy.yar#L62-L82"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_greyenergy.yar#L62-L82"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6974b8acf6a8f7684673b01753c3a8248a1c491900cccf771db744ca0442f96a"
hash = "165a7853ef51e96ce3f88bb33f928925b24ca5336e49845fc5fc556812092740"
hash = "4470e40f63443aa27187a36bbb0c2f4def42b589b61433630df842b6e365ae3d"
@@ -392521,8 +392927,8 @@ rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_5 : FILE
date = "2018-10-17"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_greyenergy.yar#L84-L97"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_greyenergy.yar#L84-L97"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "037723bdb9100d19bf15c5c21b649db5f3f61e421e76abe9db86105f1e75847b"
hash = "b602ce32b7647705d68aedbaaf4485f1a68253f8f8132bd5d5f77284a6c2d8bb"
logic_hash = "3ced67c514d54324b41a4a4a92c1d3138e75380f3129b39ae92c1895c267acb2"
@@ -392546,8 +392952,8 @@ rule SIGNATURE_BASE_Datper_Backdoor : FILE
date = "2017-08-21"
modified = "2023-12-05"
reference = "http://blog.jpcert.or.jp/2017/08/detecting-datper-malware-from-proxy-logs.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_tick_datper.yar#L13-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_tick_datper.yar#L13-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849"
hash = "331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b"
hash = "90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2"
@@ -392580,8 +392986,8 @@ rule SIGNATURE_BASE_SUSP_ELF_LNX_UPX_Compressed_File : FILE
date = "2018-12-12"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_elf_file_anomalies.yar#L2-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_elf_file_anomalies.yar#L2-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4"
logic_hash = "0d310de1ab68bd6da9ae057c7edea0d6b24d408f85ec40c2306f1ac8a2bc2f55"
score = 40
@@ -392606,8 +393012,8 @@ rule SIGNATURE_BASE_APT_NK_MAL_Keylogger_Unknown_Nov19_1 : FILE
date = "2019-11-06"
modified = "2023-12-05"
reference = "https://twitter.com/CNMF_VirusAlert/status/1192131508007505921"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_nk_gen.yar#L2-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nk_gen.yar#L2-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30"
hash = "618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6"
logic_hash = "a3b5c82cb8aa09e3c1b955bb175046e86f96da1f187eb46df83caaaf9e1370b2"
@@ -392650,8 +393056,8 @@ rule SIGNATURE_BASE_Shadowpad_Nssock2 : FILE
date = "2017-08-15"
modified = "2023-12-05"
reference = "https://securelist.com/shadowpad-in-corporate-networks/81432/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_shadowpad.yar#L13-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_shadowpad.yar#L13-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
hash = "c45116a22cf5695b618fcdf1002619e8544ba015d06b2e1dbf47982600c7545f"
hash = "696be784c67896b9239a8af0a167add72b1becd3ef98d03e99207a3d5734f6eb"
@@ -392676,8 +393082,8 @@ rule SIGNATURE_BASE_Sofacy_Jun16_Sample1 : FILE
date = "2016-06-14"
modified = "2023-12-05"
reference = "http://goo.gl/mzAa97"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_jun16.yar#L10-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_jun16.yar#L10-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "be1cfa10fcf2668ae01b98579b345ebe87dab77b6b1581c368d1aba9fd2f10a0"
logic_hash = "761cec3d04e6b5273cfb450000023ed10ea73d17648c0af7660f4ef2b37fc31c"
score = 85
@@ -392701,8 +393107,8 @@ rule SIGNATURE_BASE_Sofacy_Jun16_Sample2 : FILE
date = "2016-06-14"
modified = "2023-12-05"
reference = "http://goo.gl/mzAa97"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_jun16.yar#L27-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_jun16.yar#L27-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b"
hash = "69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261"
hash = "aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632"
@@ -392732,8 +393138,8 @@ rule SIGNATURE_BASE_Sofacy_Jun16_Sample3 : FILE
date = "2016-06-14"
modified = "2023-12-05"
reference = "http://goo.gl/mzAa97"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sofacy_jun16.yar#L51-L65"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sofacy_jun16.yar#L51-L65"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785"
logic_hash = "bdc6fcc30ebd7a966391747e4156a6d94dc9187e8b8898de4c441540ec4e637e"
score = 85
@@ -392756,8 +393162,8 @@ rule SIGNATURE_BASE_Cloudduke_Malware : FILE
date = "2015-07-22"
modified = "2023-12-05"
reference = "https://www.f-secure.com/weblog/archives/00002822.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cloudduke.yar#L10-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cloudduke.yar#L10-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
hash = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
hash = "1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7"
@@ -392793,8 +393199,8 @@ rule SIGNATURE_BASE_SFXRAR_Acrotray : FILE
date = "2015-07-22"
modified = "2023-12-05"
reference = "https://www.f-secure.com/weblog/archives/00002822.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cloudduke.yar#L42-L61"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cloudduke.yar#L42-L61"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "51e713c7247f978f5836133dd0b8f9fb229e6594763adda59951556e1df5ee57"
hash = "5d695ff02202808805da942e484caa7c1dc68e6d9c3d77dc383cfa0617e61e48"
hash = "56531cc133e7a760b238aadc5b7a622cd11c835a3e6b78079d825d417fb02198"
@@ -392822,8 +393228,8 @@ rule SIGNATURE_BASE_WEBSHELL_APT_PHP_DEWMODE_UNC2546_Feb21_1 : FILE
date = "2021-02-22"
modified = "2023-12-05"
reference = "https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc2546_dewmode.yar#L2-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2546_dewmode.yar#L2-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2e0df09fa37eabcae645302d9865913b818ee0993199a6d904728f3093ff48c7"
hash = "5fa2b9546770241da7305356d6427847598288290866837626f621d794692c1b"
logic_hash = "86ce185f6350eb7485bce5bd31d91085fed25aa8ce78813e1c3c3dffbaae58ff"
@@ -392853,8 +393259,8 @@ rule SIGNATURE_BASE_APT_KE3CHANG_TMPFILE : APT KE3CHANG TMPFILE FILE
date = "2020-06-18"
modified = "2023-12-05"
reference = "https://app.any.run/tasks/a96f4f9d-c27d-490b-b5d3-e3be0a1c93e9/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ke3chang.yar#L1-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ke3chang.yar#L1-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4ef11e84d5203c0c425d1a76d4bf579883d40577c2e781cdccc2cc4c8a8d346f"
logic_hash = "75c97fe2eeb82e09f52e98d76bd529824f171da4c802b5febc1036314d8145f0"
score = 75
@@ -392882,8 +393288,8 @@ rule SIGNATURE_BASE_APT_MAL_Ke3Chang_Ketrican_Jun20_1 : FILE
date = "2020-06-18"
modified = "2023-12-05"
reference = "BfV Cyber-Brief Nr. 01/2020"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ke3chang.yar#L23-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ke3chang.yar#L23-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "02ea0bc17875ab403c05b50205389065283c59e01de55e68cee4cf340ecea046"
hash = "f3efa600b2fa1c3c85f904a300fec56104d2caaabbb39a50a28f60e0fdb1df39"
logic_hash = "a2806de18432dbab24f08c7c2863fd694c91192cf7df4388dfeb87b237f22257"
@@ -392909,8 +393315,8 @@ rule SIGNATURE_BASE_SUSP_Scheduledtasks_Nimbus_Manticore_Persistence_May26 : FIL
date = "2026-05-27"
modified = "2026-06-01"
reference = "https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt35_malware_may26.yar#L1-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt35_malware_may26.yar#L1-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dc4c82625db0dd8db2098387f227ade773d31747b259b3ffc2c366c47d9b0d20"
score = 75
quality = 85
@@ -392933,8 +393339,8 @@ rule SIGNATURE_BASE_MAL_APT_Nimbus_Manticore_Stager_May26 : FILE
date = "2026-05-20"
modified = "2026-06-01"
reference = "https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt35_malware_may26.yar#L18-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt35_malware_may26.yar#L18-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eee657ffdb2af8ed6412221e7d5fbf4f5742f2ac2c88f43f12db46af0697de71"
logic_hash = "b6ea20370c929a61e628f078ed74c45bd3c7278d3e9c499dbcb9af3f33f23c78"
score = 80
@@ -392965,8 +393371,8 @@ rule SIGNATURE_BASE_MAL_APT_Nimbus_Manticore_Agent_May26 : FILE
date = "2026-05-28"
modified = "2026-06-01"
reference = "https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt35_malware_may26.yar#L49-L69"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt35_malware_may26.yar#L49-L69"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dfa1e3137a032ee8561a1cd5e1a0f71a10bebb36aef7c336c878638a9c1239ee"
logic_hash = "d4aef73f6fc9ad3e03a05e8ecda01bb7faf83ae40d7393b41a5f619c70a45136"
score = 80
@@ -392992,8 +393398,8 @@ rule SIGNATURE_BASE_SUSP_Nimbus_Manticore_PDF_Indicators_May26
date = "2026-05-25"
modified = "2026-06-01"
reference = "https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt35_malware_may26.yar#L71-L83"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt35_malware_may26.yar#L71-L83"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "620c51f4376cb79f0109c21971c28661418ae50b119585e3ffdb8011189fcb7b"
logic_hash = "4479c844cae60f0cabdb8b57e6de9961d4b9d5e9afdc43793fd936e0bed6899a"
score = 70
@@ -393015,8 +393421,8 @@ rule SIGNATURE_BASE_MAL_G_APT_Backdoor_BRICKSTORM_3 : FILE
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_brickstorm_sep25.yar#L1-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_brickstorm_sep25.yar#L1-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "931eacd7e5250d29903924c31f41b7e5"
logic_hash = "168bc2bdfff6a135f4ec89f8cf79051e6dcd242b314e3238553d67929995a9ea"
score = 75
@@ -393042,8 +393448,8 @@ rule SIGNATURE_BASE_MAL_G_Backdoor_BRICKSTORM_2 : FILE
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_brickstorm_sep25.yar#L20-L53"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_brickstorm_sep25.yar#L20-L53"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "afea32d3c817473ec0dbc20177daa4070f847c23295318fa093fc3a96a15e764"
score = 75
quality = 85
@@ -393076,8 +393482,8 @@ rule SIGNATURE_BASE_MAL_G_APT_Backdoor_BRICKSTORM_1 : FILE
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_brickstorm_sep25.yar#L55-L81"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_brickstorm_sep25.yar#L55-L81"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4645f2f6800bc654d5fa812237896b00"
logic_hash = "ffaeca48c96445044844779f28c46a5c6029ba96191d3faafbc8f3864c29e21b"
score = 75
@@ -393112,8 +393518,8 @@ rule SIGNATURE_BASE_MAL_G_APT_Backdoor_BRICKSTORM_2 : FILE
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_brickstorm_sep25.yar#L83-L96"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_brickstorm_sep25.yar#L83-L96"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "db989caa2a80481e58e6d65068e1814cf7366e3bdfc347e9019fb2bc980c74fa"
score = 75
quality = 85
@@ -393135,8 +393541,8 @@ rule SIGNATURE_BASE_WEBSHELL_G_APT_Backdoorwebshell_SLAYSTYLE_1 : FILE
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_brickstorm_sep25.yar#L98-L117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_brickstorm_sep25.yar#L98-L117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7a56238218e60a69049f5d9c756df4fb6f0de772fbc437a14c5db7192f971be6"
score = 75
quality = 83
@@ -393162,8 +393568,8 @@ rule SIGNATURE_BASE_WEBSHELL_G_APT_Backdoorwebshell_SLAYSTYLE_2 : FILE
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_brickstorm_sep25.yar#L119-L135"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_brickstorm_sep25.yar#L119-L135"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d2d1003f77a2066b48df1c27feab79c0a1951ebb62c3198de8366bcfee42e30a"
score = 75
quality = 85
@@ -393188,8 +393594,8 @@ rule SIGNATURE_BASE_MAL_G_Backdoor_BRICKSTEAL_1 : FILE
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_brickstorm_sep25.yar#L137-L153"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_brickstorm_sep25.yar#L137-L153"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "27413b63eae84d95cf0ca920e9ac1daba200281ecc32cc9922c0e7850c7f0571"
score = 75
quality = 85
@@ -393214,8 +393620,8 @@ rule SIGNATURE_BASE_MAL_G_Dropper_BRICKSTEAL_1
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_brickstorm_sep25.yar#L155-L173"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_brickstorm_sep25.yar#L155-L173"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5ed68f17ba8ac0c7ba02f9111f083244181332c71ed43b4cd5582baee493c98d"
score = 75
quality = 85
@@ -393242,8 +393648,8 @@ rule SIGNATURE_BASE_MAL_G_Dropper_BRICKSTEAL_2
date = "2025-09-25"
modified = "2026-05-15"
reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_brickstorm_sep25.yar#L175-L193"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_brickstorm_sep25.yar#L175-L193"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e1bdcc59259b2bf476b873a9f94b9296efc7720d83fba04f6569217019ae3af8"
score = 75
quality = 85
@@ -393270,8 +393676,8 @@ rule SIGNATURE_BASE_Microcin_Sample_1 : FILE
date = "2017-09-26"
modified = "2023-12-05"
reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_microcin.yar#L13-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_microcin.yar#L13-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "49816eefcd341d7a9c1715e1f89143862d4775ba4f9730397a1e8529f5f5e200"
hash = "a73f8f76a30ad5ab03dd503cc63de3a150e6ab75440c1060d75addceb4270f46"
hash = "9dd9bb13c2698159eb78a0ecb4e8692fd96ca4ecb50eef194fa7479cb65efb7c"
@@ -393300,8 +393706,8 @@ rule SIGNATURE_BASE_Microcin_Sample_2 : FILE
date = "2017-09-26"
modified = "2023-12-05"
reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_microcin.yar#L38-L52"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_microcin.yar#L38-L52"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8a7d04229722539f2480270851184d75b26c375a77b468d8cbad6dbdb0c99271"
logic_hash = "99feb3e1672f69c4cf41a100e9ba64421fd75c3554306a1bf1475da6f1e14ed1"
score = 75
@@ -393325,8 +393731,8 @@ rule SIGNATURE_BASE_Microcin_Sample_3 : FILE
date = "2017-09-26"
modified = "2023-12-05"
reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_microcin.yar#L54-L68"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_microcin.yar#L54-L68"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4f74a3b67c5ed6f38f08786f1601214412249fe128f12c51525135710d681e1d"
logic_hash = "bf1227460f1fc4a7bede853b0d4f15b520db870ac7ce2e6684dc195ea6322e82"
score = 75
@@ -393350,8 +393756,8 @@ rule SIGNATURE_BASE_Microcin_Sample_4 : FILE
date = "2017-09-26"
modified = "2023-12-05"
reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_microcin.yar#L70-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_microcin.yar#L70-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "92c01d5af922bdaacb6b0b2dfbe29e5cc58c45cbee5133932a499561dab616b8"
logic_hash = "1293fbd1a6b440168bb1d7b250df0c8a1a7f99a7fb603a6abec7fe7ba20cf4f5"
score = 75
@@ -393380,8 +393786,8 @@ rule SIGNATURE_BASE_Microcin_Sample_5 : FILE
date = "2017-09-26"
modified = "2023-12-05"
reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_microcin.yar#L92-L110"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_microcin.yar#L92-L110"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b9c51397e79d5a5fd37647bc4e4ee63018ac3ab9d050b02190403eb717b1366e"
logic_hash = "18b9b80ad3c27f32c71197f33e5e99742662cf5cf4ed5f83d574d44ba63f8b5f"
score = 75
@@ -393409,8 +393815,8 @@ rule SIGNATURE_BASE_Microcin_Sample_6 : FILE
date = "2017-09-26"
modified = "2023-12-05"
reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_microcin.yar#L112-L128"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_microcin.yar#L112-L128"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cbd43e70dc55e94140099722d7b91b07a3997722d4a539ecc4015f37ea14a26e"
hash = "871ab24fd6ae15783dd9df5010d794b6121c4316b11f30a55f23ba37eef4b87a"
logic_hash = "280fb17b5ed5ff1c8018e426969f75e18589eabeb2a20e0e623f206e72e8958d"
@@ -393436,8 +393842,8 @@ rule SIGNATURE_BASE_SUSP_RAR_Single_Doc_File : FILE
date = "2020-07-11"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_hunting_susp_rar.yar#L3-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_hunting_susp_rar.yar#L3-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "bfc8c60c86e65e041976dac9d15c486ad99da930849bd697c869eec0a2626c38"
score = 40
quality = 85
@@ -393458,8 +393864,8 @@ rule SIGNATURE_BASE_HKTL_Cobaltstrike_Sleepmask_Jul22
date = "2022-07-04"
modified = "2023-12-05"
reference = "https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cobaltstrike.yar#L3-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cobaltstrike.yar#L3-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "233b3cb441f45f400c0261589aac31dd1fcd9c4e3a86a6aaa46c60849063b34b"
score = 80
quality = 85
@@ -393480,8 +393886,8 @@ rule SIGNATURE_BASE_Apt_CN_Tetrisplugins_JS : FILE
date = "2020-09-06"
modified = "2026-08-03"
reference = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_tetris.yar#L34-L111"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_tetris.yar#L34-L111"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "fa77d622584e79c86139b9c0f0b8ff46fc10461d0776e46c93490b6bb667afcf"
score = 75
quality = 60
@@ -393542,8 +393948,8 @@ rule SIGNATURE_BASE_MAL_Backdoor_SPAREPART_Sleepgenerator
date = "2022-12-14"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_ru_sparepart_dec22.yar#L2-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_ru_sparepart_dec22.yar#L2-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f9cd5b145e372553dded92628db038d8"
logic_hash = "41a9fdb2ba7aefcaf6ef2477b598e98b9045ef17ce9bfe46f3169d0b2e0dd289"
score = 50
@@ -393571,8 +393977,8 @@ rule SIGNATURE_BASE_MAL_Backdoor_SPAREPART_Struct : FILE
date = "2022-12-14"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_ru_sparepart_dec22.yar#L22-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_ru_sparepart_dec22.yar#L22-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f9cd5b145e372553dded92628db038d8"
logic_hash = "807c7404146c08995440987aef78ecde11224f7d6cad1a0d22269b2bf46a44e5"
score = 50
@@ -393596,8 +394002,8 @@ rule SIGNATURE_BASE_MAL_Crime_Win32_Loader_Guloader_1_Experimental : FILE
date = "2020-05-04"
modified = "2023-12-05"
reference = "https://twitter.com/VK_Intel/status/1257206565146370050"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_guloader.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_guloader.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "03b7e0251b1c08798ce310cc4c11adfaa3071409d608c91c30d5fc7e28a079de"
score = 50
quality = 85
@@ -393620,8 +394026,8 @@ rule SIGNATURE_BASE_ONHAT_Proxy_Hacktool : FILE
date = "2016-05-12"
modified = "2023-12-05"
reference = "https://goo.gl/p32Ozf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_onhat_proxy.yar#L8-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_onhat_proxy.yar#L8-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "30b2de0a802a65b4db3a14593126301e6949c1249e68056158b2cc74798bac97"
hash = "94bda24559713c7b8be91368c5016fc7679121fea5d565d3d11b2bb5d5529340"
hash = "a26e75fec3b9f7d5a1c3d0ce1e89e4b0befb7a601da0c69a4cf96301921771dd"
@@ -393653,8 +394059,8 @@ rule SIGNATURE_BASE_Gen_Python_Encoded_Adware : FILE
date = "2018-03-07"
modified = "2023-01-06"
reference = "https://twitter.com/JohnLaTwC/status/949048002466914304"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_python_encoded_adware.yar#L1-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_python_encoded_adware.yar#L1-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5d7239be779367e69d2e63ffd9dc6e2a1f79c4e5c6c725e8c5e59a44c0ab2fff"
logic_hash = "256b289cfe83384c02aacf9c7e790898ba34988c9be149b39e63791c319bfc4a"
score = 75
@@ -393678,11 +394084,11 @@ rule SIGNATURE_BASE_Pos_Malware_Malumpos
date = "2015-05-25"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_malumpos.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_malumpos.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ece32e51a12adf0d68420c8d98efbe7df27b9061ddfe4dcedf151f9f06287eee"
score = 75
- quality = 60
+ quality = 85
tags = ""
sample_filtype = "exe"
@@ -393705,8 +394111,8 @@ rule SIGNATURE_BASE_ATM_Malware_Loup_1 : FILE
date = "2020-08-17"
modified = "2023-12-05"
reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_atm_loup.yar#L3-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_atm_loup.yar#L3-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
logic_hash = "5068c3f27cf821f512fb9a473d2bd45066d550f30fbc26f0cbebbe103e6f4ccb"
score = 75
@@ -393730,8 +394136,8 @@ rule SIGNATURE_BASE_Irontiger_Aspxspy : HIGHVOL
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L1-L13"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L1-L13"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6b5830d3fd6aa346b27788cd4abd581b4724fecc4e880b14dd7b1dd27ef1eea3"
score = 75
quality = 85
@@ -393753,8 +394159,8 @@ rule SIGNATURE_BASE_Irontiger_Changeport_Toolkit_Driversinstall : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L15-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L15-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2ae32596da4f98a0ec2556c2cd87fc7a0f85c37ce96c7163664f2e8cc3ec498d"
score = 75
quality = 85
@@ -393778,8 +394184,8 @@ rule SIGNATURE_BASE_Irontiger_Changeport_Toolkit_Changeportexe : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L31-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L31-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b5a5a1cff372d97bfa281d297b6230279cd1526c5df636efe4dec3aa3d923edf"
score = 75
quality = 85
@@ -393804,8 +394210,8 @@ rule SIGNATURE_BASE_Irontiger_Dllshellexc2010 : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L48-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L48-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b75477f01627ac05013c5e4ccb1d58a6bb25bfbe83ad0cec392140d44637a028"
score = 75
quality = 85
@@ -393830,8 +394236,8 @@ rule SIGNATURE_BASE_Irontiger_Dnstunnel : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L65-L84"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L65-L84"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "84b7dec3a89fe309149c7a3141279755adafbf793521c7b9b4031827f1020d7d"
score = 75
quality = 85
@@ -393860,8 +394266,8 @@ rule SIGNATURE_BASE_Irontiger_EFH3_Encoder : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L86-L99"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L86-L99"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e620222f815a6c915e372c11d28c480179fd2abdb139ed6984ca5a7a61b8088c"
score = 75
quality = 85
@@ -393884,8 +394290,8 @@ rule SIGNATURE_BASE_Irontiger_Getpassword_X64 : FILE
date = "2023-01-06"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L101-L119"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L101-L119"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2adabc629fcd4bc89a015874376daf51b2a367bb13ec25e917e5d899080d8a74"
score = 75
quality = 85
@@ -393912,8 +394318,8 @@ rule SIGNATURE_BASE_Irontiger_Gtalk_Trojan : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L121-L135"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L121-L135"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9b6139d34ad91db2e418668be9ca947442ff614a241f0c1aa61f8334af5421c0"
score = 75
quality = 85
@@ -393937,8 +394343,8 @@ rule SIGNATURE_BASE_Irontiger_HTTP_SOCKS_Proxy_Soexe : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L137-L152"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L137-L152"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f262751727de3d47a8d7cdc1f8ba8d92f4f60e22bc4e897bd5e53a8f2c118c95"
score = 75
quality = 85
@@ -393963,8 +394369,8 @@ rule SIGNATURE_BASE_Irontiger_Nbddos_Gh0Stvariant_Dropper : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L154-L169"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L154-L169"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e877c52d5cb0067388e9a138f48dcf7d3bd6d7d491eea6acffb2527ba0a906c7"
score = 75
quality = 85
@@ -393989,8 +394395,8 @@ rule SIGNATURE_BASE_Irontiger_Plugx_Dosemulator : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L171-L185"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L171-L185"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "502adc142b0f7a2980b4b851f2360086cec855b5e9851a6e9afbaba1846d11ed"
score = 75
quality = 85
@@ -394014,8 +394420,8 @@ rule SIGNATURE_BASE_Irontiger_Plugx_Fastproxy : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L187-L203"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L187-L203"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6659595f65b445d2bd69b13b8d01c2dd78b5c055fa39f810a61646d9408df2ff"
score = 75
quality = 85
@@ -394041,8 +394447,8 @@ rule SIGNATURE_BASE_Irontiger_Plugx_Server : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L205-L225"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L205-L225"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "14b3f3b75cf6d042934e6916c99fe41d54065d59be6eb30b3cecc799997ac9d4"
score = 75
quality = 85
@@ -394072,8 +394478,8 @@ rule SIGNATURE_BASE_Irontiger_Readpwd86 : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L227-L240"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L227-L240"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c188b033aee6b7e811c125af545aa7851cd45ba02e057ee93967fa98d1c13947"
score = 75
quality = 85
@@ -394096,8 +394502,8 @@ rule SIGNATURE_BASE_Irontiger_Ring_Gh0Stvariant : FILE
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L242-L257"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L242-L257"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6df729e3b472d3930f5bc4a1b5b8736567df43b78bec3401f5d41bf7ba30d93b"
score = 75
quality = 85
@@ -394122,8 +394528,8 @@ rule SIGNATURE_BASE_Irontiger_Wmiexec
date = "2016-02-15"
modified = "2023-12-05"
reference = "http://goo.gl/T5fSJC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_irontiger_trendmicro.yar#L259-L276"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_irontiger_trendmicro.yar#L259-L276"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7988b993345e13b64e5f02ecd2679fc484b063a4cd2f18b52d00d2dfa34d82cb"
score = 75
quality = 85
@@ -394151,8 +394557,8 @@ rule SIGNATURE_BASE_ATM_Malware_Dispenserxfs_1 : FILE
date = "2019-02-27"
modified = "2023-01-06"
reference = "https://twitter.com/r3c0nst/status/1100775857306652673"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_atm_dispenserxfs.yar#L4-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_atm_dispenserxfs.yar#L4-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3c7331b29f7cd8c40f99e235664f86361ba99c9ca0092c1cfb6faf367764303e"
score = 80
quality = 85
@@ -394177,8 +394583,8 @@ rule SIGNATURE_BASE_MAL_NPM_Supplychain_Attack_Mar26 : FILE
date = "2026-03-31"
modified = "2026-05-15"
reference = "https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_npm_supply_chain_mar26.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_npm_supply_chain_mar26.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5e3e89c7351f385e36bb70286866a62957cc1aaab195539edb8c7bb62968a137"
logic_hash = "e0f0f5ca19f95b90d4483c6de8d4eb770e3ea8d6ee189e6c7c5bff4a74dedd57"
score = 80
@@ -394201,8 +394607,8 @@ rule SIGNATURE_BASE_SUSP_JS_Dropper_Mar26 : FILE
date = "2026-03-31"
modified = "2026-05-15"
reference = "https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_npm_supply_chain_mar26.yar#L19-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_npm_supply_chain_mar26.yar#L19-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09"
logic_hash = "9dad4bef8cf31a91240dbbc438eff2640389424db9f75be2d897d745133785ee"
score = 70
@@ -394230,8 +394636,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Tools_Back : FILE
date = "2017-07-23"
modified = "2022-12-21"
reference = "http://www.clearskysec.com/tulip"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wilted_tulip.yar#L13-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wilted_tulip.yar#L13-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b7faeaa6163e05ad33b310a8fdc696ccf1660c425fa2a962c3909eada5f2c265"
logic_hash = "3a23491cbb24177c027695d8f677c4a72ed0404c4c38356eec4b92f2d06be2ee"
score = 75
@@ -394256,8 +394662,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Tools_Clrlg : FILE
date = "2017-07-23"
modified = "2023-12-05"
reference = "http://www.clearskysec.com/tulip"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wilted_tulip.yar#L31-L45"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wilted_tulip.yar#L31-L45"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b33fd3420bffa92cadbe90497b3036b5816f2157100bf1d9a3b6c946108148bf"
logic_hash = "003f711ac6f2308f2bdc638da7c654686e7402db7b3837120168e5a99b774537"
score = 75
@@ -394281,8 +394687,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Powershell
date = "2017-07-23"
modified = "2023-12-05"
reference = "http://www.clearskysec.com/tulip"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wilted_tulip.yar#L47-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wilted_tulip.yar#L47-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e5ee1f45cbfdb54b02180e158c3c1f080d89bce6a7d1fe99dd0ff09d47a36787"
logic_hash = "57d28f7b79cc14b8bbc2d7c9b2c16ab0f94a4b160cf7cb1d4641fe1c77e06811"
score = 75
@@ -394305,8 +394711,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Vminst : FILE
date = "2017-07-23"
modified = "2023-12-05"
reference = "http://www.clearskysec.com/tulip"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wilted_tulip.yar#L62-L88"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wilted_tulip.yar#L62-L88"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "930118fdf1e6fbffff579e65e1810c8d91d4067cbbce798c5401cf05d7b4c911"
logic_hash = "a4559c2f4de60537827d167453751a92c0030ae6ce095a2d64df777e93d4b87a"
score = 75
@@ -394339,8 +394745,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Windows_UM_Task
date = "2017-07-23"
modified = "2023-12-05"
reference = "http://www.clearskysec.com/tulip"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wilted_tulip.yar#L90-L107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wilted_tulip.yar#L90-L107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4c2fc21a4aab7686877ddd35d74a917f6156e48117920d45a3d2f21fb74fedd3"
logic_hash = "cfc2d231b6be798172e5d7ffc525842c7eed6d78a145c401136452c46f21e3b2"
score = 75
@@ -394366,8 +394772,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Windowstask
date = "2017-07-23"
modified = "2023-12-05"
reference = "http://www.clearskysec.com/tulip"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wilted_tulip.yar#L109-L128"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wilted_tulip.yar#L109-L128"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c3cbe88b82cd0ea46868fb4f2e8ed226f3419fc6d4d6b5f7561e70f4cd33822c"
hash = "340cbbffbb7685133fc318fa20e4620ddf15e56c0e65d4cf1b2d606790d4425d"
hash = "b6f515b3f713b70b808fc6578232901ffdeadeb419c9c4219fbfba417bba9f01"
@@ -394396,8 +394802,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Tdtess : FILE
date = "2017-07-23"
modified = "2023-12-05"
reference = "http://www.clearskysec.com/tulip"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wilted_tulip.yar#L130-L147"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wilted_tulip.yar#L130-L147"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3fd28b9d1f26bd0cee16a167184c9f4a22fd829454fd89349f2962548f70dc34"
logic_hash = "ffd10e06b3a8f3054747443b863070e8726589fc795f816832dbf73c0c34e080"
score = 75
@@ -394423,8 +394829,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Silverlightmsi : FILE
date = "2017-07-23"
modified = "2023-12-05"
reference = "http://www.clearskysec.com/tulip"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wilted_tulip.yar#L149-L165"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wilted_tulip.yar#L149-L165"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c75906dbc3078ff81092f6a799c31afc79b1dece29db696b2ecf27951a86a1b2"
logic_hash = "716db8f8e7d71c7f3deaeb9ac8e141c9bf374e5dae992e8e2623070c81089953"
score = 75
@@ -394451,8 +394857,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Matryoshka_Injector : FILE
date = "2017-07-23"
modified = "2023-12-05"
reference = "http://www.clearskysec.com/tulip"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wilted_tulip.yar#L167-L189"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wilted_tulip.yar#L167-L189"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c41e97b3b22a3f0264f10af2e71e3db44e53c6633d0d690ac4d2f8f5005708ed"
hash = "b93b5d6716a4f8eee450d9f374d0294d1800784bc99c6934246570e4baffe509"
logic_hash = "e02d26882c85b77bd97629fce20bd027e1f5f7e28ae0c43c9ea7a4b1e5d02cd1"
@@ -394477,8 +394883,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Zpp : FILE
date = "2017-07-23"
modified = "2022-12-21"
reference = "http://www.clearskysec.com/tulip"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wilted_tulip.yar#L191-L215"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wilted_tulip.yar#L191-L215"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "10ec585dc1304436821a11e35473c0710e844ba18727b302c6bd7f8ebac574bb"
hash = "7d046a3ed15035ea197235980a72d133863c372cc27545af652e1b2389c23918"
hash = "6d6816e0b9c24e904bc7c5fea5951d53465c478cc159ab900d975baf8a0921cf"
@@ -394510,8 +394916,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Netsrv_Netsrvs : FILE
date = "2017-07-23"
modified = "2023-12-05"
reference = "http://www.clearskysec.com/tulip"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wilted_tulip.yar#L217-L242"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wilted_tulip.yar#L217-L242"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a062cb4364125427b54375d51e9e9afb0baeb09b05a600937f70c9d6d365f4e5"
hash = "afa563221aac89f96c383f9f9f4ef81d82c69419f124a80b7f4a8c437d83ce77"
hash = "acf24620e544f79e55fd8ae6022e040257b60b33cf474c37f2877c39fbf2308a"
@@ -394546,8 +394952,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Reflectiveloader : FILE
date = "2017-07-23"
modified = "2023-12-05"
reference = "http://www.clearskysec.com/tulip"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wilted_tulip.yar#L244-L268"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wilted_tulip.yar#L244-L268"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904"
hash = "1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a"
hash = "a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f"
@@ -394579,8 +394985,8 @@ rule SIGNATURE_BASE_Wiltedtulip_Matryoshka_RAT : FILE
date = "2017-07-23"
modified = "2023-12-05"
reference = "http://www.clearskysec.com/tulip"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_wilted_tulip.yar#L270-L289"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_wilted_tulip.yar#L270-L289"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6f208473df0d31987a4999eeea04d24b069fdb6a8245150aa91dfdc063cd64ab"
hash = "6cc1f4ecd28b833c978c8e21a20a002459b4a6c21a4fbaad637111aa9d5b1a32"
logic_hash = "9e878d9e3dc3f2050e52a046038f4f855b5b777948d928e0bc6d7a98fc0a7119"
@@ -394609,8 +395015,8 @@ rule SIGNATURE_BASE_Scanbox_Malware_Generic
date = "2015-02-28"
modified = "2023-12-05"
reference = "http://goo.gl/WXUQcP"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_scanbox_deeppanda.yar#L2-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_scanbox_deeppanda.yar#L2-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9"
hash = "d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d"
hash = "3fe208273288fc4d8db1bf20078d550e321d9bc5b9ab80c93d79d2cb05cbf8c2"
@@ -394643,8 +395049,8 @@ rule SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Polyvice_Jan23_1 : FILE
date = "2023-01-12"
modified = "2023-01-13"
reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ransom_vicesociety_dec22.yar#L2-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ransom_vicesociety_dec22.yar#L2-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "326a159fc2e7f29ca1a4c9a64d45b76a4a072bc39ba864c49d804229c5f6d796"
hash = "8c8cb887b081e0d92856fb68a7df0dabf0b26ed8f0a6c8ed22d785e596ce87f4"
hash = "9d9e949ecd72d7a7c4ae9deae4c035dcae826260ff3b6e8a156240e28d7dbfef"
@@ -394675,8 +395081,8 @@ rule SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Chily_Jan23_1 : FILE
date = "2023-01-12"
modified = "2023-12-05"
reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ransom_vicesociety_dec22.yar#L33-L63"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ransom_vicesociety_dec22.yar#L33-L63"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4dabb914b8a29506e1eced1d0467c34107767f10fdefa08c40112b2e6fc32e41"
logic_hash = "fc2967d86bf73033e68b8b9409a197ae8f7fcdf06e1e2a17e3d277d243caa541"
score = 80
@@ -394708,8 +395114,8 @@ rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Twinpeaks : FILE
date = "2019-07-24"
modified = "2023-12-05"
reference = "https://github.com/br-data/2019-winnti-analyse"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_br.yar#L3-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_br.yar#L3-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "76457f5aa4cc4bf4f43ffbaa60d63006455977e881f1d74b845835c505a93fed"
score = 75
quality = 85
@@ -394732,8 +395138,8 @@ rule SIGNATURE_BASE_MAL_BR_Report_Thedao : FILE
date = "2019-07-24"
modified = "2023-12-05"
reference = "https://github.com/br-data/2019-winnti-analyse"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_br.yar#L17-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_br.yar#L17-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "798b092b7667462aa66590603504cb0cd1166e4ac3472627cd8cd8fdf8f0b778"
score = 75
quality = 60
@@ -394754,8 +395160,8 @@ rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Mockingjay : FILE
date = "2019-07-24"
modified = "2023-12-05"
reference = "https://github.com/br-data/2019-winnti-analyse"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_winnti_br.yar#L30-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_winnti_br.yar#L30-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7a63b6f10cc5feebba16e585cb29d741876e1dc7f4dde3ef43ac76db9c7ad135"
score = 75
quality = 85
@@ -394778,8 +395184,8 @@ rule SIGNATURE_BASE_APT6_Malware_Sample_Gen : FILE
date = "2016-04-09"
modified = "2023-01-06"
reference = "https://otx.alienvault.com/pulse/56c4d1664637f26ad04e5b73/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt6_malware.yar#L8-L55"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt6_malware.yar#L8-L55"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "321ec239bfa6927d39155ef5f10741ed786219489bbbb1dc8fee66e22f9f8e80"
hash = "7aef130b19d1f940e4c4cee6efe0f190f1402d2e0f741ee605c77518a04cb6d7"
logic_hash = "614a6673579630fc254d3c546161647e619df5a03ee6f21434d6cc50be1ed187"
@@ -394825,8 +395231,8 @@ rule SIGNATURE_BASE_Mswin_Check_Lm_Group : FILE
date = "2015-06-13"
modified = "2021-03-15"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L9-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L9-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "115d87d7e7a3d08802a9e5fd6cd08e2ec633c367"
logic_hash = "74be6bd9c6e01cc4ec7785b6950c8cf6acf549c06990a9d1734f4a3487a04ba7"
score = 70
@@ -394851,8 +395257,8 @@ rule SIGNATURE_BASE_WAF_Bypass : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L30-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L30-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "860a9d7aac2ce3a40ac54a4a0bd442c6b945fa4e"
logic_hash = "e66d51b465e5d919555084d299a22f07a949a0a9adf4a3f246f6b5222d39b91a"
score = 75
@@ -394880,8 +395286,8 @@ rule SIGNATURE_BASE_Guilin_Veterans_Cookie_Spoofing_Tool : FILE
date = "2015-06-13"
modified = "2023-01-27"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L50-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L50-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "06b1969bc35b2ee8d66f7ce8a2120d3016a00bb1"
logic_hash = "5fd136f44ebce28db4f77f2f8730eb67fc4c2d58921b73378b8d87e1444a4b67"
score = 75
@@ -394907,8 +395313,8 @@ rule SIGNATURE_BASE_Marathontool : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L69-L84"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L69-L84"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "084a27cd3404554cc799d0e689f65880e10b59e3"
logic_hash = "2d52d640ef44d933791d1da0d1263dba15702180c730500e04d364dd6b4d6081"
score = 75
@@ -394933,8 +395339,8 @@ rule SIGNATURE_BASE_PLUGIN_Trackid : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L86-L104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L86-L104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a114181b334e850d4b33e9be2794f5bb0eb59a09"
logic_hash = "a62112dbf2ef696e4eb7f6787a0e0930c29d9834f46c87493954498fa4b375f6"
score = 75
@@ -394962,8 +395368,8 @@ rule SIGNATURE_BASE_Pc_Pc2015 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L106-L121"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L106-L121"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "de4f098611ac9eece91b079050b2d0b23afe0bcb"
logic_hash = "34d66d8b9e637c067ec2d9387b7b57458312d75892e33b95eb1095200799cf3b"
score = 75
@@ -394988,8 +395394,8 @@ rule SIGNATURE_BASE_Sekurlsa : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L123-L139"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L123-L139"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
logic_hash = "dea05c7f19a834cc936c452ca2f6f4286e6c3dae002747c27913960199451c3f"
score = 75
@@ -395015,8 +395421,8 @@ rule SIGNATURE_BASE_Mysqlfast : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L141-L159"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L141-L159"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "32b60350390fe7024af7b4b8fbf50f13306c546f"
logic_hash = "3ea75954831e705d0d25efa115288e66868d9b814f0990fd048bbe1209a8d933"
score = 75
@@ -395044,8 +395450,8 @@ rule SIGNATURE_BASE_Dtools2_02_Dtools : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L161-L179"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L161-L179"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9f99771427120d09ec7afa3b21a1cb9ed720af12"
logic_hash = "51e30d39f388546ac233b4b97a38f225c90d2f006bc509dd7eecfb408aef9be5"
score = 75
@@ -395073,8 +395479,8 @@ rule SIGNATURE_BASE_Dll_Packetx : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L181-L196"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L181-L196"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3f0908e0a38512d2a4fb05a824aa0f6cf3ba3b71"
logic_hash = "161d174376c599b1b794fa1174349ae12b198842d89769baec4b9664729a3983"
score = 50
@@ -395098,8 +395504,8 @@ rule SIGNATURE_BASE_Sqldbx_Zhs : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L198-L217"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L198-L217"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e34228345498a48d7f529dbdffcd919da2dea414"
logic_hash = "b0215d29c58c252c1717f08135eab65794a99ed669c2225bcba690ae7d7a034c"
score = 75
@@ -395128,8 +395534,8 @@ rule SIGNATURE_BASE_Ms10048_X86 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L219-L237"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L219-L237"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e57b453966e4827e2effa4e153f2923e7d058702"
logic_hash = "50e45cae87f5d1cc4903a16f9283dd751d90cde0c71f3124467b4ff15bd34f1b"
score = 75
@@ -395157,8 +395563,8 @@ rule SIGNATURE_BASE_Dos_Ch : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L239-L257"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L239-L257"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "60bbb87b08af840f21536b313a76646e7c1f0ea7"
logic_hash = "49ab2c75267c2ed5c15c8fbdc6fa0f8826f6e7a45a2861d6ba4b293ffca6bcd6"
score = 75
@@ -395186,8 +395592,8 @@ rule SIGNATURE_BASE_Dubrute_Dubrute : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L259-L275"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L259-L275"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8aaae91791bf782c92b97c6e1b0f78fb2a9f3e65"
logic_hash = "1e6d8bd24a37e3f4b7de88989251ae904128ff1bf766d4a4408ff8990c6dfd2f"
score = 75
@@ -395213,8 +395619,8 @@ rule SIGNATURE_BASE_Cookietools : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L277-L294"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L277-L294"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b6a3727fe3d214f4fb03aa43fb2bc6fadc42c8be"
logic_hash = "7f8c59ef58a92db15d8965e54ed6e26834e268581581af2a0ff98a6f46564e7e"
score = 75
@@ -395241,8 +395647,8 @@ rule SIGNATURE_BASE_Update_Pcinit : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L296-L314"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L296-L314"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a6facc4453f8cd81b8c18b3b3004fa4d8e2f5344"
logic_hash = "ee4b17dfb0d70464669edab1b7610efa607adb2918306ae6c50130024008a169"
score = 75
@@ -395270,8 +395676,8 @@ rule SIGNATURE_BASE_Dat_Nasllib : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L316-L331"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L316-L331"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fb0d4263118faaeed2d68e12fab24c59953e862d"
logic_hash = "7d2f3c67fe78028a51ba01c88d7eb62c38fe3c918bb03eee41b6583bc464ad78"
score = 75
@@ -395296,8 +395702,8 @@ rule SIGNATURE_BASE_Dos_1 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L333-L347"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L333-L347"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b554f0687a12ec3a137f321cc15e052ff219f28c"
logic_hash = "d4cf3e738743e5402602e045cf590b969dca2d6f7f1bdd57cc398df3392560d9"
score = 75
@@ -395321,8 +395727,8 @@ rule SIGNATURE_BASE_Othertools_Servu : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L349-L365"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L349-L365"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5c64e6879a9746a0d65226706e0edc7a"
logic_hash = "fda476bdcc0bb496331ca9f506a1221d401d8671d23f61f1b88219c688163169"
score = 75
@@ -395348,8 +395754,8 @@ rule SIGNATURE_BASE_Ustrrefadd : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L367-L384"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L367-L384"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b371b122460951e74094f3db3016264c9c8a0cfa"
logic_hash = "e44f180e081494e28b35b4129eb2c1817ed3e83f23d86f0d3dd4dcf27941cdf1"
score = 75
@@ -395376,8 +395782,8 @@ rule SIGNATURE_BASE_Xscanlib : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L386-L402"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L386-L402"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
logic_hash = "ff18c527df9ff2a4d72bcc5e4905d6f42877d42536edcb13608c6e0e6773aa63"
score = 75
@@ -395403,8 +395809,8 @@ rule SIGNATURE_BASE_Idtools_For_Winxp_Idttool : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L404-L419"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L404-L419"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ebab6e4cb7ea82c8dc1fe4154e040e241f4672c6"
logic_hash = "9e14db3721afaba3ea5e9767afff593bf2b137306fe673acd7926bf6efc78391"
score = 75
@@ -395429,8 +395835,8 @@ rule SIGNATURE_BASE_Goodtoolset_Ms11046 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L421-L438"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L421-L438"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
logic_hash = "2fb36a589613f97d0c3a4da58c65352689062a8ba6d432b5f3cf3b51a7e77f8c"
score = 75
@@ -395457,8 +395863,8 @@ rule SIGNATURE_BASE_Cmdshell32 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L440-L455"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L440-L455"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3c41116d20e06dcb179e7346901c1c11cd81c596"
logic_hash = "cfe3d72d33d7a3c2b70d4fa0767a921c1cfcd360b2094af40b067789cace95af"
score = 75
@@ -395483,8 +395889,8 @@ rule SIGNATURE_BASE_Sniffer_Analyzer_Ssclone_1210_Full_Version : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L457-L473"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L457-L473"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6882125babb60bd0a7b2f1943a40b965b7a03d4e"
logic_hash = "982a213a106794e2cddb6148b3d3a119ae17fc318ad03237da1018e1859523d7"
score = 75
@@ -395510,8 +395916,8 @@ rule SIGNATURE_BASE_X64_Klock : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L475-L491"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L475-L491"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
logic_hash = "3fe00c08607d20daa055db2f551009ff1c447f1a651d4a78aba91621d53424f5"
score = 75
@@ -395537,8 +395943,8 @@ rule SIGNATURE_BASE_Dos_Down32 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L493-L508"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L493-L508"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0365738acd728021b0ea2967c867f1014fd7dd75"
logic_hash = "c1aaaaaaae2ea720d3fc1516d88d678895bcda81344e8c1f4f57e5a20e770123"
score = 75
@@ -395563,8 +395969,8 @@ rule SIGNATURE_BASE_Marathontool_2 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L510-L525"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L510-L525"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "75b5d25cdaa6a035981e5a33198fef0117c27c9c"
logic_hash = "7581b63a7bddeac93c65b2943b9f5f568464d8f300bc7385ca73880996bd390b"
score = 75
@@ -395589,8 +395995,8 @@ rule SIGNATURE_BASE_Scanms_Scanms : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L527-L544"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L527-L544"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "47787dee6ddea2cb44ff27b6a5fd729273cea51a"
logic_hash = "d6b33e603953194dab67104cbb9649710515050cf73afb18b2c9083a9e228e6d"
score = 75
@@ -395617,8 +396023,8 @@ rule SIGNATURE_BASE_CN_Tools_Pcshare : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L546-L565"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L546-L565"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ee7ba9784fae413d644cdf5a093bd93b73537652"
logic_hash = "57bd1629abe0af1345f505514b99deb4e63ebce7363f3b0abcb76e7201d9b7b7"
score = 75
@@ -395647,8 +396053,8 @@ rule SIGNATURE_BASE_Pw_Inspector : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L567-L582"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L567-L582"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4f8e3e101098fc3da65ed06117b3cb73c0a66215"
logic_hash = "3b54466d80692923b93689a9e43e30dfbc63e5982cb633120795817098d68e05"
score = 75
@@ -395673,8 +396079,8 @@ rule SIGNATURE_BASE_Dll_Loadex : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L584-L603"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L584-L603"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "213d9d0afb22fe723ff570cf69ff8cdb33ada150"
logic_hash = "588f4f4d0a2f8f8e76de0a5b1217191c1cace69f934582d4fc3c974fb94b8c3e"
score = 75
@@ -395703,8 +396109,8 @@ rule SIGNATURE_BASE_Dat_Report : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L605-L619"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L605-L619"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4582a7c1d499bb96dad8e9b227e9d5de9becdfc2"
logic_hash = "e3b21f37fae388958758af535727844d6e9696862fd9968340e1a619592c53b6"
score = 75
@@ -395728,8 +396134,8 @@ rule SIGNATURE_BASE_Dos_Iis7 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L621-L638"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L621-L638"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
logic_hash = "e0cbcb63cd2a542e6394792070392d393b2a3485f5a5ef3c6ba0f113ae9270ec"
score = 75
@@ -395756,8 +396162,8 @@ rule SIGNATURE_BASE_Switchsniffer : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L640-L654"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L640-L654"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1e7507162154f67dff4417f1f5d18b4ade5cf0cd"
logic_hash = "4c75473399a7d47b63c6247248fd2792c675740ac671028b1c0a8ba1a02f35aa"
score = 75
@@ -395781,8 +396187,8 @@ rule SIGNATURE_BASE_Dbexpora : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L656-L671"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L656-L671"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b55b007ef091b2f33f7042814614564625a8c79f"
logic_hash = "2dad6cedae6a3a446c2c4829516bffa5608ea4d1c13c907796cf4d13ec37965e"
score = 75
@@ -395807,8 +396213,8 @@ rule SIGNATURE_BASE_Sqlcracker : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L673-L690"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L673-L690"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1aa5755da1a9b050c4c49fc5c58fa133b8380410"
logic_hash = "3724f4b746da413f99880564ae72bc0de867120f1f7eacaf856d42492ebe359e"
score = 75
@@ -395835,8 +396241,8 @@ rule SIGNATURE_BASE_Freeversion_Debug : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L692-L711"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L692-L711"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
logic_hash = "f7f8302c70c5aed1885724a1bca4efdf0547cc5be62e7dd6bcd8cc2079f71f96"
score = 75
@@ -395865,8 +396271,8 @@ rule SIGNATURE_BASE_Dos_Look : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L713-L728"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L713-L728"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e1a37f31170e812185cf00a838835ee59b8f64ba"
logic_hash = "341c72eaa5db1953e008423374c3f322de0f8dc33fd8181362172982b52e2b8a"
score = 75
@@ -395891,8 +396297,8 @@ rule SIGNATURE_BASE_Ntgodmode : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L730-L747"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L730-L747"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8baac735e37523d28fdb6e736d03c67274f7db77"
logic_hash = "55efa908ebfcede207d3fe0b1072cce262af0e627e91ba8746e7a8924b8e75bd"
score = 75
@@ -395919,8 +396325,8 @@ rule SIGNATURE_BASE_Webcrack4_Routerpasswordcracking : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L749-L766"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L749-L766"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "00c68d1b1aa655dfd5bb693c13cdda9dbd34c638"
logic_hash = "48456f82163806852ecef3d71c2c8247f6c74c31ce28472c80a914a98247bdb3"
score = 75
@@ -395947,8 +396353,8 @@ rule SIGNATURE_BASE_Hscan_Gui : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L768-L783"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L768-L783"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1885f0b7be87f51c304b39bc04b9423539825c69"
logic_hash = "c87cfe78324638ac9d35c7fd1e47f24014c470b0892ceceaf394278d9706157b"
score = 75
@@ -395973,8 +396379,8 @@ rule SIGNATURE_BASE_S_Multifunction_Scanners_S : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L785-L809"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L785-L809"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "79b60ffa1c0f73b3c47e72118e0f600fcd86b355"
logic_hash = "96f0692c54d74388f8602a03475d95a2fcd89692dd189f9363592745a70c234b"
score = 75
@@ -396009,8 +396415,8 @@ rule SIGNATURE_BASE_HKTL_CN_Dos_Getpass : FILE
modified = "2023-01-06"
old_rule_name = "Dos_GetPass"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L811-L830"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L811-L830"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
logic_hash = "ea1410984fb1f66422faa943f1f16873f4e0d5ff1afa68c2d28f36889e214a52"
score = 75
@@ -396038,8 +396444,8 @@ rule SIGNATURE_BASE_HKTL_CN_Update_Pcmain : FILE
modified = "2023-01-06"
old_rule_name = "update_PcMain"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L832-L858"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L832-L858"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aa68323aaec0269b0f7e697e69cce4d00a949caa"
logic_hash = "aa905379f65a8d964b921f2b74b61d94f97536466a7fc48f05c437d617cf35f6"
score = 90
@@ -396073,8 +396479,8 @@ rule SIGNATURE_BASE_HKTL_CN_Dos_Sys : FILE
modified = "2023-01-06"
old_rule_name = "Dos_sys"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L860-L878"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L860-L878"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b5837047443f8bc62284a0045982aaae8bab6f18"
logic_hash = "3b3f55c45ebfe4ab6d8e6b06a3c452c84d4f755f984d913c683a49a8fd570d9d"
score = 75
@@ -396101,8 +396507,8 @@ rule SIGNATURE_BASE_HKTL_CN_Dat_Xpf : FILE
modified = "2023-01-06"
old_rule_name = "dat_xpf"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L880-L897"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L880-L897"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "761125ab594f8dc996da4ce8ce50deba49c81846"
logic_hash = "c46b10ef17a9fee2be15fc9cc8b8aeec94d656b86e7208e1ad1f5efcd95fddf5"
score = 75
@@ -396128,8 +396534,8 @@ rule SIGNATURE_BASE_HKTL_CN_Project1 : FILE
modified = "2023-01-06"
old_rule_name = "Project1"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L899-L916"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L899-L916"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
logic_hash = "c26590f13a185eb42a27d27e6b5996f7fdf4d5c146fb74062686f356ec4db47d"
score = 75
@@ -396154,8 +396560,8 @@ rule SIGNATURE_BASE_Arp_EMP_V1_0 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L918-L931"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L918-L931"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
logic_hash = "e46b0f730945dad3c75b6865f30005f4d5fa09c53e3a27c275ca22da9cc89e8d"
score = 75
@@ -396178,8 +396584,8 @@ rule SIGNATURE_BASE_CN_Tools_Myupnp : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L933-L948"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L933-L948"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "15b6fca7e42cd2800ba82c739552e7ffee967000"
logic_hash = "0bdd0d98dc5218bbe799e5e510c5f27d74a1ef398b09962f4267f846088f726e"
score = 75
@@ -396204,8 +396610,8 @@ rule SIGNATURE_BASE_CN_Tools_Shiell : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L950-L966"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L950-L966"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b432d80c37abe354d344b949c8730929d8f9817a"
logic_hash = "44c494c24c090b21c3c201d57f910e8f4d5132a863715a090fa1e18c9d349d48"
score = 75
@@ -396231,8 +396637,8 @@ rule SIGNATURE_BASE_Cndcom_Cndcom : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L968-L988"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L968-L988"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "08bbe6312342b28b43201125bd8c518531de8082"
logic_hash = "226be7ea7b09b2b87eeec006c8054b9fb59eb8324def14a4a0db97f94fb39d62"
score = 75
@@ -396262,8 +396668,8 @@ rule SIGNATURE_BASE_Isdebug_V1_4 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L990-L1010"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L990-L1010"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ca32474c358b4402421ece1cb31714fbb088b69a"
logic_hash = "d656327c33533b5ef7dc70ec00250ee35d878794fae189829a0ecad958f96616"
score = 75
@@ -396293,8 +396699,8 @@ rule SIGNATURE_BASE_HTTPSCANNER : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1012-L1026"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1012-L1026"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ae2929346944c1ea3411a4562e9d5e2f765d088a"
logic_hash = "0f1460101198d8b139b7cc0674bef2fc7b3d2a24249f521396b7bbe4318a83d5"
score = 75
@@ -396318,8 +396724,8 @@ rule SIGNATURE_BASE_Hscan_V1_20_Pipecmd : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1028-L1049"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1028-L1049"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "64403ce63b28b544646a30da3be2f395788542d6"
logic_hash = "91ed275896c2520893ba1af26b2563c0bd3564a9c5f9d812f35464469e27307b"
score = 75
@@ -396350,8 +396756,8 @@ rule SIGNATURE_BASE_Dos_Fp : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1051-L1067"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1051-L1067"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
logic_hash = "cc09743269ee36862c95c9323ad271ca9b6c350cf25163d126fef0f86bc6f671"
score = 75
@@ -396377,8 +396783,8 @@ rule SIGNATURE_BASE_Dos_Netstat : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1069-L1085"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1069-L1085"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d0444b7bd936b5fc490b865a604e97c22d97e598"
logic_hash = "e2b908308616c3f2c94849b4f22f0e9bb130b5759d89161604505ff25681be55"
score = 75
@@ -396404,8 +396810,8 @@ rule SIGNATURE_BASE_CN_Tools_Xsniff : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1087-L1104"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1087-L1104"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d61d7329ac74f66245a92c4505a327c85875c577"
logic_hash = "a32d07ecd635ad71edaa37d9b1e5f66d8ce5a7f84f1bba6eb06deb1f49a879c8"
score = 75
@@ -396432,8 +396838,8 @@ rule SIGNATURE_BASE_Mssqlpass : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1106-L1121"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1106-L1121"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "172b4e31ed15d1275ac07f3acbf499daf9a055d7"
logic_hash = "8037316eb157f8693bd342911af5fe5292f3ef8a3c169c80bc70edbabd7a92e6"
score = 75
@@ -396458,8 +396864,8 @@ rule SIGNATURE_BASE_Wsockexpert : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1123-L1141"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1123-L1141"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2962bf7b0883ceda5e14b8dad86742f95b50f7bf"
logic_hash = "34ac3c5f0651ccab851d67da8863e0e305f981cf53a06d46c23f19736cc1c400"
score = 75
@@ -396487,8 +396893,8 @@ rule SIGNATURE_BASE_Ms_Viru_Racle : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1143-L1159"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1143-L1159"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "13116078fff5c87b56179c5438f008caf6c98ecb"
logic_hash = "d36db04c6a62a72e9f3079d09aedc9056c0a5032b4594af4d02ba55373f8b6a4"
score = 75
@@ -396514,8 +396920,8 @@ rule SIGNATURE_BASE_Lamescan3 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1161-L1177"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1161-L1177"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3130eefb79650dab2e323328b905e4d5d3a1d2f0"
logic_hash = "8246128fa4378b0479a0c051965188c7c3fa0f52c8acc8934ef8af3155a85590"
score = 75
@@ -396541,8 +396947,8 @@ rule SIGNATURE_BASE_CN_Tools_Pc : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1179-L1195"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1179-L1195"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5cf8caba170ec461c44394f4058669d225a94285"
logic_hash = "1da263362e4c2ec8194bb80bfc3f25ff8c4b708919ba02ea02687d5404b99720"
score = 75
@@ -396568,8 +396974,8 @@ rule SIGNATURE_BASE_Dos_Down64 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1197-L1215"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1197-L1215"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "43e455e43b49b953e17a5b885ffdcdf8b6b23226"
logic_hash = "d181c2075762fc3bb5b61bcdef57eb6533cb59dde03c4b901b6ce5b8323f3c8a"
score = 75
@@ -396597,8 +397003,8 @@ rule SIGNATURE_BASE_Epathobj_Exp32 : FILE
date = "2015-06-13"
modified = "2022-12-21"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1217-L1235"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1217-L1235"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ed86ff44bddcfdd630ade8ced39b4559316195ba"
logic_hash = "8959837257848a08240d0423971b9d3a850a7e9cc796de2c9b2d34814923f8ec"
score = 75
@@ -396625,8 +397031,8 @@ rule SIGNATURE_BASE_Tools_Unknown : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1237-L1254"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1237-L1254"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4be8270c4faa1827177e2310a00af2d5bcd2a59f"
logic_hash = "493bb63d4dd519efbf53a29fa44ef74f0a85943b2d9f49f11e3daa57c6b03d8e"
score = 75
@@ -396653,8 +397059,8 @@ rule SIGNATURE_BASE_PLUGIN_Ajunk : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1256-L1271"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1256-L1271"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eb430fcfe6d13b14ff6baa4b3f59817c0facec00"
logic_hash = "e37504aab506138493ddc0979697502819824ef00c7931599130fafb5d84a7a9"
score = 75
@@ -396679,8 +397085,8 @@ rule SIGNATURE_BASE_Iisputscanner : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1273-L1316"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1273-L1316"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9869c70d6a9ec2312c749aa17d4da362fa6e2592"
logic_hash = "b2af9003cef528610280866bf00a9716b4421a5f7c65e7c8ec3202af9a592de1"
score = 75
@@ -396733,8 +397139,8 @@ rule SIGNATURE_BASE_Idtools_For_Winxp_Idttool_2 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1318-L1335"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1318-L1335"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "07feb31dd21d6f97614118b8a0adf231f8541a67"
logic_hash = "831f42abd7374b2ca2b4115a73aae2123e2212b0854d4cc0950b8e66a28e38a3"
score = 75
@@ -396761,8 +397167,8 @@ rule SIGNATURE_BASE_Hkmjjiis6 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1337-L1358"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1337-L1358"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
logic_hash = "4ea95b7a5bd24e0dfdcef045d101b7f15e18b20f1328901bb340d9aaad336981"
score = 75
@@ -396793,8 +397199,8 @@ rule SIGNATURE_BASE_Dos_Lcx : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1360-L1384"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1360-L1384"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b6ad5dd13592160d9f052bb47b0d6a87b80a406d"
logic_hash = "bbe215fb27825b4f4bbfa71808ac945f341efbc70a21f79689065982a843d7f1"
score = 75
@@ -396828,8 +397234,8 @@ rule SIGNATURE_BASE_X_Way2_5_X_Way : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1386-L1407"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1386-L1407"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8ba8530fbda3e8342e8d4feabbf98c66a322dac6"
logic_hash = "6261de5db1e7527f7726effe26ed5f88638e6cb378db4c99183dddcd42ae231f"
score = 75
@@ -396860,8 +397266,8 @@ rule SIGNATURE_BASE_Tools_Sqlcmd : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1409-L1428"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1409-L1428"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "99d56476e539750c599f76391d717c51c4955a33"
logic_hash = "aa600f7c56d72d767e9ca51d8b1ee2b2c62302ea1afbed39e4670debd30c5247"
score = 75
@@ -396890,8 +397296,8 @@ rule SIGNATURE_BASE_Sword1_5 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1430-L1449"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1430-L1449"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
logic_hash = "09e09f7ea16dc917388cbccb22a7abfed9b693a33d61698f0e838f029402c256"
score = 75
@@ -396920,8 +397326,8 @@ rule SIGNATURE_BASE_Tools_Scan : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1451-L1466"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1451-L1466"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c580a0cc41997e840d2c0f83962e7f8b636a5a13"
logic_hash = "d8bf2e4a4634f74ce548a5824090502f2ccef382bdbcaf795df711e88a325912"
score = 75
@@ -396946,8 +397352,8 @@ rule SIGNATURE_BASE_Dos_C : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1468-L1487"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1468-L1487"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3deb6bd52fdac6d5a3e9a91c585d67820ab4df78"
logic_hash = "2865b50e6a323462fab39bd84571939c618cf6f00e147039f6e699ba4d195a00"
score = 75
@@ -396976,8 +397382,8 @@ rule SIGNATURE_BASE_Arpsniffer : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1489-L1506"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1489-L1506"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7d8753f56fc48413fc68102cff34b6583cb0066c"
logic_hash = "eb0a425be0fff87eb58689a4eee4b6729e8ee985e6224790111322d4b182caf1"
score = 75
@@ -397004,8 +397410,8 @@ rule SIGNATURE_BASE_Pw_Inspector_2 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1508-L1524"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1508-L1524"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e0a1117ee4a29bb4cf43e3a80fb9eaa63bb377bf"
logic_hash = "7d2021ff471f03deb9e6d8b62fcb218ae3198f21fd7b8fa1fdd9b96228b8c2f8"
score = 75
@@ -397031,8 +397437,8 @@ rule SIGNATURE_BASE_Datpcshare : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1526-L1542"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1526-L1542"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "87acb649ab0d33c62e27ea83241caa43144fc1c4"
logic_hash = "15297a8019192371032fc11b966d1a89d951c176da6d64e80ca5a201f55341c0"
score = 75
@@ -397058,8 +397464,8 @@ rule SIGNATURE_BASE_Tools_Xport : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1544-L1565"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1544-L1565"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9584de562e7f8185f721e94ee3cceac60db26dda"
logic_hash = "9eea73732643f74b4802af0672f5c3ab09cc54cfecd80f8903efc26b7ceaec29"
score = 75
@@ -397090,8 +397496,8 @@ rule SIGNATURE_BASE_Pc_Xai : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1567-L1586"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1567-L1586"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f285a59fd931ce137c08bd1f0dae858cc2486491"
logic_hash = "80659fcf1721b20f459ac0480401bdf643c95b46118d03320bc6d4e4ee4b67f7"
score = 75
@@ -397120,8 +397526,8 @@ rule SIGNATURE_BASE_Radmin_Hash : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1588-L1605"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1588-L1605"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "be407bd5bf5bcd51d38d1308e17a1731cd52f66b"
logic_hash = "d6ee13a2ed30bb44471593386521f67be0d6ccd6f8a0ebf8557012a099f81d3d"
score = 75
@@ -397148,8 +397554,8 @@ rule SIGNATURE_BASE_Oseditor : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1607-L1624"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1607-L1624"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6773c3c6575cf9cfedbb772f3476bb999d09403d"
logic_hash = "6531c0b3c0f6123d9eda34ed028f05054e4805e5c329da4b29e4f37f9b5fc1b2"
score = 75
@@ -397176,8 +397582,8 @@ rule SIGNATURE_BASE_Goodtoolset_Ms11011 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1626-L1642"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1626-L1642"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
logic_hash = "99dd27eba7da44c71098446e17abfe626de91e899e28c2d2e99e7b54b9e0c825"
score = 75
@@ -397203,8 +397609,8 @@ rule SIGNATURE_BASE_Freeversion_Release : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1644-L1662"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1644-L1662"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f42e4b5748e92f7a450eb49fc89d6859f4afcebb"
logic_hash = "38722afb3b955aced2e68e2048a3268722524f61784dcb45c6a695b5684230eb"
score = 75
@@ -397232,8 +397638,8 @@ rule SIGNATURE_BASE_Churrasco : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1664-L1681"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1664-L1681"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a8d4c177948a8e60d63de9d0ed948c50d0151364"
logic_hash = "36ca7c8d1579eeb571c182c033c312b3b231313b8950c1e24eeb3df793b004c4"
score = 75
@@ -397260,8 +397666,8 @@ rule SIGNATURE_BASE_X64_Kiwicmd : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1682-L1697"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1682-L1697"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
logic_hash = "b49a70a49a67fbb57d643b38155482177f594bd1f01f5464c4f36b265aac48d8"
score = 75
@@ -397286,8 +397692,8 @@ rule SIGNATURE_BASE_Sql1433_SQL : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1699-L1715"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1699-L1715"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "025e87deadd1c50b1021c26cb67b76b476fafd64"
logic_hash = "5ceecc4f345cb603a0b03180f3f09f97e5f951b5d75c469aefffe3ec62916a8f"
score = 75
@@ -397311,8 +397717,8 @@ rule SIGNATURE_BASE_Cookietools2 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1717-L1733"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1717-L1733"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cb67797f229fdb92360319e01277e1345305eb82"
logic_hash = "8ddb8ea0bc047877d91f25375745ab8fa66af28b6b41de36e0fb16ea8284fce5"
score = 75
@@ -397338,8 +397744,8 @@ rule SIGNATURE_BASE_Cyclotron : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1735-L1752"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1735-L1752"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5b63473b6dc1e5942bf07c52c31ba28f2702b246"
logic_hash = "f3a0edf54039479c9f4e46b20249465bbe1bca57f47afeba37965e6e3fc0127f"
score = 75
@@ -397366,8 +397772,8 @@ rule SIGNATURE_BASE_Xscan_Gui : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1754-L1770"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1754-L1770"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a9e900510396192eb2ba4fb7b0ef786513f9b5ab"
logic_hash = "366db7eb19725a0a42ce371d7bfb50a22a259f0bc0252927af626e8c1c0b9b59"
score = 75
@@ -397393,8 +397799,8 @@ rule SIGNATURE_BASE_CN_Tools_Hscan : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1772-L1792"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1772-L1792"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
logic_hash = "9bc4800249bffcc4b8fc1191d600f0b9b2a7b0c1f067039c83c03671a0b4b5c5"
score = 75
@@ -397424,8 +397830,8 @@ rule SIGNATURE_BASE_Goodtoolset_Pr : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1794-L1812"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1794-L1812"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f6676daf3292cff59ef15ed109c2d408369e8ac8"
logic_hash = "0673bc445422f4339c9e81ff8ae8a9b2bb9bc1f107b85fe34906444a1754c43b"
score = 75
@@ -397453,8 +397859,8 @@ rule SIGNATURE_BASE_Hydra_7_4_1_Hydra : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1814-L1832"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1814-L1832"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3411d0380a1c1ebf58a454765f94d4f1dd714b5b"
logic_hash = "f52696cbf7355c982d1a1e0c73dce65324845c5ffc13c541e326720332b4788d"
score = 75
@@ -397482,8 +397888,8 @@ rule SIGNATURE_BASE_CN_Tools_Srss_2 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1834-L1856"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1834-L1856"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c418b30d004051bbf1b2d3be426936b95b5fea6f"
logic_hash = "e674ac7a99a67e2ebe8b4c4232e3435dd041b794f6c08a87ef7b8179127d6fc7"
score = 75
@@ -397514,8 +397920,8 @@ rule SIGNATURE_BASE_Dos_Ntgod : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1858-L1874"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1858-L1874"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "adefd901d6bbd8437116f0170b9c28a76d4a87bf"
logic_hash = "77b9204add5d25dcc36eabc07cabea2bdc67a23873c2faf7706e7fba5ed53f8b"
score = 75
@@ -397541,8 +397947,8 @@ rule SIGNATURE_BASE_CN_Tools_Vnclink : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1876-L1891"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1876-L1891"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cafb531822cbc0cfebbea864489eebba48081aa1"
logic_hash = "21328e2a871dfcfda47991a1f1e897efd27471420d644c09a94004cf5b0f9869"
score = 75
@@ -397567,8 +397973,8 @@ rule SIGNATURE_BASE_Tools_Ntcmd : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1893-L1911"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1893-L1911"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a3ae8659b9a673aa346a60844208b371f7c05e3c"
logic_hash = "c2487306a0d82ab76a048c001361c25bcd61d0f7a57a3b22df1c70299f0a72ba"
score = 75
@@ -397596,8 +398002,8 @@ rule SIGNATURE_BASE_Mysql_Pwd_Crack : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1913-L1930"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1913-L1930"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "57d1cb4d404688804a8c3755b464a6e6248d1c73"
logic_hash = "d272b98a6cf2749482ee501734d0043564ba528770161cb0ed4f032409305f22"
score = 75
@@ -397624,8 +398030,8 @@ rule SIGNATURE_BASE_Cmdshell64 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1932-L1951"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1932-L1951"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5b92510475d95ae5e7cd6ec4c89852e8af34acf1"
logic_hash = "fd8010ab2ab51feed62475f840ffaeef92cf1266c139b8f669b7fa5ff646fdab"
score = 75
@@ -397654,8 +398060,8 @@ rule SIGNATURE_BASE_Ms_Viru_V : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1953-L1971"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1953-L1971"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ecf4ba6d1344f2f3114d52859addee8b0770ed0d"
logic_hash = "028b589c11eeacb2edfeeaeaebf2da370e540cba964c9ebbb19e4c734afe190f"
score = 75
@@ -397683,8 +398089,8 @@ rule SIGNATURE_BASE_CN_Tools_Vscan : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1973-L1990"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1973-L1990"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0365fe05e2de0f327dfaa8cd0d988dbb7b379612"
logic_hash = "2bbf0a3fb2b3fc9b646c6f8fc021f65a38e1b64edd74301481051541f8938902"
score = 75
@@ -397711,8 +398117,8 @@ rule SIGNATURE_BASE_Dos_Iis : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L1992-L2011"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L1992-L2011"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61ffd2cbec5462766c6f1c44bd44eeaed4f3d2c7"
logic_hash = "d6852af79eac659f4dfa3019793290e0498739f02a06c5540cd7d2c65b46b960"
score = 75
@@ -397741,8 +398147,8 @@ rule SIGNATURE_BASE_Iisputscannesr : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2013-L2027"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2013-L2027"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2dd8fee20df47fd4eed5a354817ce837752f6ae9"
logic_hash = "27c190050aabcdff3713b388adb0113ad2334c107a2a7b3d682c209b102cf642"
score = 75
@@ -397766,8 +398172,8 @@ rule SIGNATURE_BASE_HKTL_Unknown_CN_Generate : FILE
date = "2015-06-13"
modified = "2022-01-20"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2029-L2047"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2029-L2047"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
logic_hash = "a83000880bd71f4ee6507cb448b611cb670a47a4dc47c400930d3a41ca594a5d"
score = 75
@@ -397794,8 +398200,8 @@ rule SIGNATURE_BASE_Pc_Rejoice : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2049-L2067"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2049-L2067"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
logic_hash = "9e22a98b5065a95a7f169fda8d6d4112101bffa11a1407e03ec152db41857206"
score = 75
@@ -397823,8 +398229,8 @@ rule SIGNATURE_BASE_Ms11080_Withcmd : FILE
date = "2015-06-13"
modified = "2022-12-21"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2069-L2087"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2069-L2087"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "745e5058acff27b09cfd6169caf6e45097881a49"
logic_hash = "cd7167269538a5dd197260682ad777f87e43cc2155acf3ce731d1a065395cf4a"
score = 75
@@ -397851,8 +398257,8 @@ rule SIGNATURE_BASE_Othertools_Xiaoa : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2089-L2107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2089-L2107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6988acb738e78d582e3614f83993628cf92ae26d"
logic_hash = "451ed602bd1e9dd7e4020108ea133b60c546965bd77be349d07be42150f80fee"
score = 75
@@ -397880,8 +398286,8 @@ rule SIGNATURE_BASE_Unknown2 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2109-L2128"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2109-L2128"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "32508d75c3d95e045ddc82cb829281a288bd5aa3"
logic_hash = "dea499eaa87cc454a31672fb842539779926d50785ef827162fde84bfcdcc54a"
score = 75
@@ -397910,8 +398316,8 @@ rule SIGNATURE_BASE_Hydra_7_3_Hydra : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2130-L2147"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2130-L2147"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f82b8bf1159e43427880d70bcd116dc9e8026ad"
logic_hash = "23194c2df0b8bdedc4fc66c423b0aebb10217de328a194b26560d4cc9a5531e3"
score = 75
@@ -397938,8 +398344,8 @@ rule SIGNATURE_BASE_Oraclescan : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2149-L2165"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2149-L2165"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "10ff7faf72fe6da8f05526367b3522a2408999ec"
logic_hash = "b9454f47123c32d6c6b51722aeadac9acc2a6232c259703c36ea00c83d8977e6"
score = 75
@@ -397965,8 +398371,8 @@ rule SIGNATURE_BASE_Sqltools : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2167-L2186"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2167-L2186"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38a9caa2079afa2c8d7327e7762f7ed9a69056f7"
logic_hash = "35b84c3445e92d61ca5e638a2eb19128dca2174327c6325436287d8d3f0bb976"
score = 75
@@ -397996,8 +398402,8 @@ rule SIGNATURE_BASE_HKTL_Portscanner_533_NET_Jun15 : FILE
modified = "2023-12-05"
old_rule_name = "portscanner"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2188-L2205"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2188-L2205"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1de367d503fdaaeee30e8ad7c100dd1e320858a4"
logic_hash = "446cbc1b8046bfd182e0b1c98fe37c8b8ef98f600f5d80d9de83b45aeaf2b386"
score = 75
@@ -398023,8 +398429,8 @@ rule SIGNATURE_BASE_Kappfree : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2207-L2222"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2207-L2222"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e57e79f190f8a24ca911e6c7e008743480c08553"
logic_hash = "b1b644f9b033ac8372369e81628ee3f6fe094f80d11b8f4f6c192a5e81d2e543"
score = 75
@@ -398049,8 +398455,8 @@ rule SIGNATURE_BASE_Smartniff : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2224-L2239"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2224-L2239"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "67609f21d54a57955d8fe6d48bc471f328748d0a"
logic_hash = "bac770ae3c8e7f619da0b0ff4243716ff8212dce0f36c08c127af892548fe0b6"
score = 75
@@ -398075,8 +398481,8 @@ rule SIGNATURE_BASE_Chinachopper_Caidao : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2241-L2259"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2241-L2259"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "056a60ec1f6a8959bfc43254d97527b003ae5edb"
logic_hash = "7e16a452c98e36a4946bcede5552bef7f6fc82314b28b506307cf010a0890ea6"
score = 75
@@ -398104,8 +398510,8 @@ rule SIGNATURE_BASE_Kiwitaskmgr_2 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2261-L2276"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2261-L2276"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
logic_hash = "6d197e9b7bb9bbd759d6c8c882f7d7412512ba10208cb52a08fcde5e32fd1733"
score = 75
@@ -398130,8 +398536,8 @@ rule SIGNATURE_BASE_Kappfree_2 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2278-L2294"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2278-L2294"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5d578df9a71670aa832d1cd63379e6162564fb6b"
logic_hash = "1862f1283e8a268f523b3922b3630ebbca9a81cc5aed19e5068315e6346d25c2"
score = 75
@@ -398157,8 +398563,8 @@ rule SIGNATURE_BASE_X_Way2_5_Sqlcmd : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2296-L2324"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2296-L2324"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5152a57e3638418b0d97a42db1c0fc2f893a2794"
logic_hash = "59fd25a786d56885e456fca154800a8313cd04a23fd9374361cc37b86be109a1"
score = 75
@@ -398196,8 +398602,8 @@ rule SIGNATURE_BASE_Win32_Klock : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2326-L2341"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2326-L2341"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7addce4434670927c4efaa560524680ba2871d17"
logic_hash = "e9f1d38de15ce06d55cf276e0f2becd9f9dbf5bd22f9061de03761d7ccdd3e60"
score = 75
@@ -398222,8 +398628,8 @@ rule SIGNATURE_BASE_Ipsearcher : FILE
date = "2015-06-13"
modified = "2022-12-21"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2343-L2360"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2343-L2360"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1e96e9c5c56fcbea94d26ce0b3f1548b224a4791"
logic_hash = "e63349ede826bc7b0e9c94d122e5b294c11a598fcf7096b80be726146e796a80"
score = 75
@@ -398249,8 +398655,8 @@ rule SIGNATURE_BASE_Ms10048_X64 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2362-L2378"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2362-L2378"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
logic_hash = "f6e353a9e4f751632ca5fda1663f0ba66b16b60df90570ccdaf836eaaa6a78ca"
score = 75
@@ -398276,8 +398682,8 @@ rule SIGNATURE_BASE_Hscangui : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2380-L2396"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2380-L2396"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "af8aced0a78e1181f4c307c78402481a589f8d07"
logic_hash = "9c0eb87dcf8aa107b5289d196650aebcf49c24f57a317de0afdadd61fb5bb5b7"
score = 75
@@ -398303,8 +398709,8 @@ rule SIGNATURE_BASE_Goodtoolset_Ms11080 : FILE
date = "2015-06-13"
modified = "2022-12-21"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2398-L2417"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2398-L2417"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
logic_hash = "a5b03dded6146dae48bca962e7c5419c2ea69f8709ae7f2c9355bd178d5d77fb"
score = 75
@@ -398332,8 +398738,8 @@ rule SIGNATURE_BASE_Epathobj_Exp64 : FILE
date = "2015-06-13"
modified = "2022-12-21"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2419-L2438"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2419-L2438"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "09195ba4e25ccce35c188657957c0f2c6a61d083"
logic_hash = "dc4073a7d319cffbbce7b3c7b7cf02b007839b72fe14ec1fbdcd3343d57cf7bf"
score = 75
@@ -398361,8 +398767,8 @@ rule SIGNATURE_BASE_Kelloworld_2 : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2440-L2455"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2440-L2455"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
logic_hash = "a575c30c06bd84196cbf01a9b5ef3a042cf29553610421b019227d30a2c7ad1c"
score = 75
@@ -398387,8 +398793,8 @@ rule SIGNATURE_BASE_Hscan_V1_20_Hscan : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2457-L2474"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2457-L2474"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
logic_hash = "8e30c366c5d5c34a7b50ba4dec17a46c173196b773fff6965891802bcebeb112"
score = 75
@@ -398415,8 +398821,8 @@ rule SIGNATURE_BASE__Project1_Generate_Rejoice : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2476-L2497"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2476-L2497"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
hash = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
hash = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
@@ -398447,8 +398853,8 @@ rule SIGNATURE_BASE__Hscan_Hscan_Hscangui : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2499-L2519"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2499-L2519"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
hash = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
hash = "af8aced0a78e1181f4c307c78402481a589f8d07"
@@ -398478,8 +398884,8 @@ rule SIGNATURE_BASE_Kiwi_Tools : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2521-L2554"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2521-L2554"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e57e79f190f8a24ca911e6c7e008743480c08553"
hash = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
hash = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
@@ -398522,8 +398928,8 @@ rule SIGNATURE_BASE_Kiwi_Tools_Gentil_Kiwi : FILE
date = "2015-06-13"
modified = "2023-12-05"
reference = "http://tools.zjqhr.com/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_cn_hacktools.yar#L2556-L2587"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_cn_hacktools.yar#L2556-L2587"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e57e79f190f8a24ca911e6c7e008743480c08553"
hash = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
hash = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
@@ -398564,11 +398970,11 @@ rule SIGNATURE_BASE_EXPL_LOG_Cacti_Commandinjection_CVE_2022_46169_Dec22_1 : CVE
date = "2022-12-27"
modified = "2023-12-05"
reference = "https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_cve_2022_46169_cacti.yar#L1-L13"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_cve_2022_46169_cacti.yar#L1-L13"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6ccd3b830deb5c5d65519274c4c528203a2a14a177382334da87e288174e2cfe"
score = 70
- quality = 60
+ quality = 85
tags = "CVE-2022-46169"
strings:
@@ -398586,8 +398992,8 @@ rule SIGNATURE_BASE_Bernhardpos
date = "2015-07-14"
modified = "2023-12-05"
reference = "http://morphick.com/blog/2015/7/14/bernhardpos-new-pos-malware-discovered-by-morphick"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_bernhard_pos.yar#L1-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_bernhard_pos.yar#L1-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e49820ef02ba5308ff84e4c8c12e7c3d"
logic_hash = "c00f2fda5a391b44767d918945069f18cef084dd4dc6aa94d8f945bf97ac462a"
score = 70
@@ -398612,8 +399018,8 @@ rule SIGNATURE_BASE_KR_Target_Malware_Aug17 : FILE
date = "2017-08-23"
modified = "2023-12-05"
reference = "https://twitter.com/eyalsela/status/900250203097354240"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_kr_malware.yar#L11-L35"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_kr_malware.yar#L11-L35"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "82cada01643a42c8cd9600b8c33f3760d15e5eb6fabec2d531cf13cece095c78"
logic_hash = "47c3350b489b023687f05f55a09f0092456c87b4beeda563756a99ccd5091b09"
score = 75
@@ -398643,8 +399049,8 @@ rule SIGNATURE_BASE_Rottenpotato_Potato : FILE
date = "2017-02-07"
modified = "2022-12-21"
reference = "https://github.com/foxglovesec/RottenPotato"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_rottenpotato.yar#L10-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_rottenpotato.yar#L10-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "59cdbb21d9e487ca82748168682f1f7af3c5f2b8daee3a09544dd58cbf51b0d5"
logic_hash = "79d2dfd5c2cfd12301c1924dce2ca2a2c3cc070565671c3e0cd69123d2245b1c"
score = 90
@@ -398675,8 +399081,8 @@ rule SIGNATURE_BASE_MAL_ELF_Reverseshell_Sslshell_Jun23_1 : CVE_2023_2868 FILE
date = "2023-06-07"
modified = "2023-12-05"
reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lnx_barracuda_cve_2023_2868.yar#L2-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lnx_barracuda_cve_2023_2868.yar#L2-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8849a3273e0362c45b4928375d196714224ec22cb1d2df5d029bf57349860347"
logic_hash = "57e9afb2f6928656242b8257cc3b98ae3b03e38c75ad40b544e3fc6afaea794d"
score = 75
@@ -398699,8 +399105,8 @@ rule SIGNATURE_BASE_MAL_ELF_SALTWATER_Jun23_1 : CVE_2023_2868 FILE
date = "2023-06-07"
modified = "2023-12-05"
reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lnx_barracuda_cve_2023_2868.yar#L21-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lnx_barracuda_cve_2023_2868.yar#L21-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "601f44cc102ae5a113c0b5fe5d18350db8a24d780c0ff289880cc45de28e2b80"
logic_hash = "cb35898c0ee726170da93b4364920ac065f083f9f02db8eb5d293b1ce127cb78"
score = 80
@@ -398729,8 +399135,8 @@ rule SIGNATURE_BASE_EXPL_Keepass_CVE_2023_24055_Jan23 : CVE_2023_24055 FILE
date = "2023-01-25"
modified = "2023-12-05"
reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_keepass_cve_2023_24055.yar#L2-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_keepass_cve_2023_24055.yar#L2-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3ca00f317838819bb7fb80c9d00d94db498e1d3ef146b9af2664dae09302a86d"
score = 75
quality = 81
@@ -398756,8 +399162,8 @@ rule SIGNATURE_BASE_SUSP_Keepass_CVE_2023_24055_Jan23 : CVE_2023_24055 FILE
date = "2023-01-25"
modified = "2023-12-05"
reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_keepass_cve_2023_24055.yar#L22-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_keepass_cve_2023_24055.yar#L22-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4ed3eee86baf3dddfe423795491a5a94c02df3f4a7525efa6f2436e19197e55b"
score = 60
quality = 85
@@ -398780,8 +399186,8 @@ rule SIGNATURE_BASE_TA17_318A_Rc4_Stack_Key_Fallchill : FILE
date = "2017-11-15"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_318A.yar#L10-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_318A.yar#L10-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "f284cb492ff5242d7bf577580fd95723ef7d3f109c7217a26bbefbbff7150255"
score = 75
quality = 85
@@ -398802,8 +399208,8 @@ rule SIGNATURE_BASE_TA17_318A_Success_Fail_Codes_Fallchill : FILE
date = "2017-11-15"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_318A.yar#L23-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_318A.yar#L23-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "73f6b36554d83f7708e9468602e529c4865269d362ebeebf6b355ccf7c2a8686"
score = 75
quality = 85
@@ -398828,8 +399234,8 @@ rule SIGNATURE_BASE_Hiddencobra_Fallchill_1 : FILE
date = "2017-11-15"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_318A.yar#L51-L77"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_318A.yar#L51-L77"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6"
logic_hash = "8e6215a81272ea457318dd83eff9e1902c5e1d1a124ff674b145f2dc5e4a3711"
score = 75
@@ -398861,8 +399267,8 @@ rule SIGNATURE_BASE_Hiddencobra_Fallchill_2 : FILE
date = "2017-11-15"
modified = "2023-12-05"
reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ta17_318A.yar#L79-L97"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ta17_318A.yar#L79-L97"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0a118eb23399000d148186b9079fa59caf4c3faa7e7a8f91533e467ac9b6ff41"
logic_hash = "ab421bea251ed3fda4304cd180e5c31f7ae55d3d8b26d6cf5f1cf11bacee9b8d"
score = 75
@@ -398887,8 +399293,8 @@ rule SIGNATURE_BASE_EXT_HKTL_MAL_Tinyshell_Backdoor : FILE
date = "2022-03-17"
modified = "2026-05-15"
reference = "https://www.mandiant.com/resources/blog/unc2891-overview"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc2891_tinyshell_slapstick.yar#L1-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2891_tinyshell_slapstick.yar#L1-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1f889871263bd6cdad8f3d4d5fc58b4a32669b944d3ed0860730374bb87d730a"
logic_hash = "1fe9def11dced638ad38236652877427b61d7138fc8c6ce3fe7f1403c367468f"
score = 80
@@ -398925,8 +399331,8 @@ rule SIGNATURE_BASE_EXT_HKTL_MAL_Tinyshell_Backdoor_SPARC : FILE
date = "2022-03-17"
modified = "2026-05-15"
reference = "https://www.mandiant.com/resources/blog/unc2891-overview"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc2891_tinyshell_slapstick.yar#L31-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2891_tinyshell_slapstick.yar#L31-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cda78e26c2e274d24d1e4656fcd09af2930f43af7fac01a3f410a5692d79a5ae"
score = 80
quality = 85
@@ -398948,8 +399354,8 @@ rule SIGNATURE_BASE_EXT_APT_UNC2891_SLAPSTICK : FILE
date = "2022-03-17"
modified = "2026-05-15"
reference = "https://www.mandiant.com/resources/blog/unc2891-overview"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_unc2891_tinyshell_slapstick.yar#L46-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_unc2891_tinyshell_slapstick.yar#L46-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b046a949dab2f38b8181782cc6ea0782d2e102c0c30bc782de74112a77c23d6e"
score = 80
quality = 85
@@ -398972,8 +399378,8 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_1 : FILE
date = "2017-02-03"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_pp_zerot.yar#L11-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_pp_zerot.yar#L11-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "09061c603a32ac99b664f7434febfc8c1f9fd7b6469be289bb130a635a6c47c0"
logic_hash = "ad3018e6aa377b5032b04226ecb1e27b2cc7bc8294455ea51e426b5182ed7821"
score = 75
@@ -398996,8 +399402,8 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_2 : FILE
date = "2017-02-03"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_pp_zerot.yar#L26-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_pp_zerot.yar#L26-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "74eb592ef7f5967b14794acdc916686e061a43169f06e5be4dca70811b9815df"
logic_hash = "e31ade3690938fe0999423fbe446d9426e14abd01ebbada4eed8bddb1e2c9ea6"
score = 75
@@ -399020,8 +399426,8 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_3 : FILE
date = "2017-02-03"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_pp_zerot.yar#L41-L59"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_pp_zerot.yar#L41-L59"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ee2e2937128dac91a11e9bf55babc1a8387eb16cebe676142c885b2fc18669b2"
logic_hash = "6920febf177667610e3edb8ba88ec137d085a867c1d6a570d4785fcc9cc62d49"
score = 75
@@ -399049,8 +399455,8 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_4 : FILE
date = "2017-02-03"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_pp_zerot.yar#L61-L75"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_pp_zerot.yar#L61-L75"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a9519d2624a842d2c9060b64bb78ee1c400fea9e43d4436371a67cbf90e611b8"
logic_hash = "8011497e7d061a9ebde06667e47b5cd9469a433e0be1401d70637e7ace8e8155"
score = 75
@@ -399074,8 +399480,8 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_5 : FILE
date = "2017-02-03"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_pp_zerot.yar#L77-L95"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_pp_zerot.yar#L77-L95"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "74dd52aeac83cc01c348528a9bcb20bbc34622b156f40654153e41817083ba1d"
logic_hash = "fbc1a2e078cfae7a9c72612b9c769e84d8c1d59c89e05001571ad00071e38577"
score = 75
@@ -399102,8 +399508,8 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_6 : FILE
date = "2017-02-03"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_pp_zerot.yar#L97-L111"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_pp_zerot.yar#L97-L111"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a16078c6d09fcfc9d6ff7a91e39e6d72e2d6d6ab6080930e1e2169ec002b37d3"
logic_hash = "2de78012cc384211cef6c12817fd8cef9d93eef6de3197d0cfec64c1a8022ae3"
score = 75
@@ -399127,8 +399533,8 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_7 : FILE
date = "2017-02-03"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_pp_zerot.yar#L113-L129"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_pp_zerot.yar#L113-L129"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fc2d47d91ad8517a4a974c4570b346b41646fac333d219d2f1282c96b4571478"
logic_hash = "87ab6cd5c769e7e38bef807fa7d15af3a66fed8fdb7fed49fa62d87e1049ceb4"
score = 75
@@ -399154,8 +399560,8 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_8 : FILE
date = "2017-02-03"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_pp_zerot.yar#L131-L147"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_pp_zerot.yar#L131-L147"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4ef91c17b1415609a2394d2c6c353318a2503900e400aab25ab96c9fe7dc92ff"
logic_hash = "a1d5e72970919cd5c0493f8882cbc6fb1bb3c5b6517813a4022efd0028dfe728"
score = 75
@@ -399181,8 +399587,8 @@ rule SIGNATURE_BASE_PP_CN_APT_Zerot_9 : FILE
date = "2017-02-03"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_pp_zerot.yar#L149-L163"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_pp_zerot.yar#L149-L163"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a685cf4dca6a58213e67d041bba637dca9cb3ea6bb9ad3eae3ba85229118bce0"
logic_hash = "af4b85ef01c4fa21a2506369f3bc0f8eff6e95a4cfd494e1ea11a44d75bb024e"
score = 75
@@ -399206,8 +399612,8 @@ rule SIGNATURE_BASE_CN_APT_Zerot_Nflogger : FILE
date = "2017-02-04"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_pp_zerot.yar#L165-L178"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_pp_zerot.yar#L165-L178"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "946adbeb017616d56193a6d43fe9c583be6ad1c7f6a22bab7df9db42e6e8ab10"
logic_hash = "dc9b19e3c4c321cb9f840ec9ff78bec9e4a075cc62ea2823d92a3fbd9f99cc07"
score = 75
@@ -399230,8 +399636,8 @@ rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Go : FILE
date = "2017-02-04"
modified = "2023-01-06"
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_pp_zerot.yar#L180-L203"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_pp_zerot.yar#L180-L203"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "83ddc69fe0d3f3d2f46df7e72995d59511c1bfcca1a4e14c330cb71860b4806b"
logic_hash = "bf5e2d825e4bd63e94455ffb4013fa1088098a826390c1916c0aa50866588fcb"
score = 75
@@ -399262,8 +399668,8 @@ rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Mcutil : FILE
date = "2017-02-04"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_pp_zerot.yar#L205-L223"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_pp_zerot.yar#L205-L223"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "266c06b06abbed846ebabfc0e683f5d20dadab52241bc166b9d60e9b8493b500"
logic_hash = "edb6000fd65d6593bd94842e60ec099c5a652d10005f81d17063dba1a2e267d2"
score = 75
@@ -399291,8 +399697,8 @@ rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Zlh : FILE
date = "2017-02-04"
modified = "2023-12-05"
reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_cn_pp_zerot.yar#L225-L241"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cn_pp_zerot.yar#L225-L241"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "711f0a635bbd6bf1a2890855d0bd51dff79021db45673541972fe6e1288f5705"
logic_hash = "26796f75a8302bd6c93eb3ea43d0491b86770b52bd11aad6e1e250d968a77004"
score = 75
@@ -399318,8 +399724,8 @@ rule SIGNATURE_BASE_Xdedic_Sysscan_Unpacked : CRIMEWARE FILE
date = "2016-03-14"
modified = "2023-12-05"
reference = "https://securelist.com/blog/research/75027/xdedic-the-shady-world-of-hacked-servers-for-sale/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sysscan.yar#L1-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sysscan.yar#L1-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fac495be1c71012682ebb27092060b43"
hash = "e8cc69231e209db7968397e8a244d104"
hash = "a53847a51561a7e76fd034043b9aa36d"
@@ -399354,8 +399760,8 @@ rule SIGNATURE_BASE_Xdedic_Packed_Syscan : FILE
date = "2016-07-02"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sysscan.yar#L29-L39"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sysscan.yar#L29-L39"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "04eb5b056e892b2c2cf87e3770847226cccaceb1c743f3b9f8ac548026747ccf"
score = 75
quality = 83
@@ -399378,8 +399784,8 @@ rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_A : FILE
date = "2014-11-23"
modified = "2024-04-24"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_regin_fiveeyes.yar#L14-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_regin_fiveeyes.yar#L14-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "187044596bc1328efa0ed636d8aa4a5c"
hash = "06665b96e293b23acc80451abb413e50"
hash = "d240f06e98c8d3e647cbf4d442d79475"
@@ -399414,8 +399820,8 @@ rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_B : FILE
date = "2014-11-23"
modified = "2024-04-24"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_regin_fiveeyes.yar#L43-L94"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_regin_fiveeyes.yar#L43-L94"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ffb0b9b5b610191051a7bdf0806e1e47"
hash = "bfbe8c3ee78750c3a520480700e440f8"
hash = "b29ca4f22ae7b7b25f79c1d4a421139d"
@@ -399469,8 +399875,8 @@ rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_C : FILE
date = "2014-11-23"
modified = "2024-04-24"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_regin_fiveeyes.yar#L96-L122"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_regin_fiveeyes.yar#L96-L122"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e0895336617e0b45b312383814ec6783556d7635"
hash = "732298fa025ed48179a3a2555b45be96f7079712"
logic_hash = "9454eb8b45a720fbe517caa2221fb0ceedf561902d94cabe513e921cc52fe035"
@@ -399501,8 +399907,8 @@ rule SIGNATURE_BASE_Regin_Sig_Svcsstat : FILE
date = "2014-11-26"
modified = "2024-04-24"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_regin_fiveeyes.yar#L126-L143"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_regin_fiveeyes.yar#L126-L143"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5164edc1d54f10b7cb00a266a1b52c623ab005e2"
logic_hash = "2b1fdc2cc8c0aedaf749ee0e87a8853b91735a4e215c65df221a930d4b1d02f7"
score = 75
@@ -399530,8 +399936,8 @@ rule SIGNATURE_BASE_Regin_Sample_1 : FILE
date = "2014-11-25"
modified = "2024-04-24"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_regin_fiveeyes.yar#L145-L174"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_regin_fiveeyes.yar#L145-L174"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "773d7fab06807b5b1bc2d74fa80343e83593caf2"
logic_hash = "e8291b4a68924dccdd825ee2cc8930acb794e92e0302598872ec78eb0bf8504f"
score = 70
@@ -399569,8 +399975,8 @@ rule SIGNATURE_BASE_Regin_Sample_2 : FILE
date = "2014-11-26"
modified = "2024-04-24"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_regin_fiveeyes.yar#L176-L203"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_regin_fiveeyes.yar#L176-L203"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a7b285d4b896b66fce0ebfcd15db53b3a74a0400"
logic_hash = "a11d03d10661c1fc094450b250056196e5d8d16bd171eba9e37c7524aa2301d2"
score = 75
@@ -399608,8 +400014,8 @@ rule SIGNATURE_BASE_Regin_Sample_3 : FILE
date = "2014-11-27"
modified = "2024-04-24"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_regin_fiveeyes.yar#L205-L230"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_regin_fiveeyes.yar#L205-L230"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"
logic_hash = "5a0f77f203765f7737c00c3df760ea7f3ed354559aad07f3053173ff09e1ce1a"
score = 75
@@ -399644,8 +400050,8 @@ rule SIGNATURE_BASE_Regin_Sample_Set_2 : FILE
date = "2014-11-26"
modified = "2024-04-24"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_regin_fiveeyes.yar#L232-L264"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_regin_fiveeyes.yar#L232-L264"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8487a961c8244004c9276979bb4b0c14392fc3b8"
hash = "bcf3461d67b39a427c83f9e39b9833cfec977c61"
logic_hash = "26125cea704532cbc22df46af228299ae810bce60938bee7b067ed273158d76f"
@@ -399688,8 +400094,8 @@ rule SIGNATURE_BASE_Regin_Sample_Set_1 : FILE
date = "2014-11-27"
modified = "2023-01-06"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_regin_fiveeyes.yar#L266-L296"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_regin_fiveeyes.yar#L266-L296"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be"
hash = "e420d0cf7a7983f78f5a15e6cb460e93c7603683ae6c41b27bf7f2fa34b2d935"
logic_hash = "7402f409e7dd3180d8e6fe017af19d0a1d0dd86f85279191db1bc8f6c94951ac"
@@ -399728,8 +400134,8 @@ rule SIGNATURE_BASE_Apt_Regin_Legspin : FILE
date = "2023-01-27"
modified = "2024-04-24"
reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_regin_fiveeyes.yar#L298-L319"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_regin_fiveeyes.yar#L298-L319"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "29105f46e4d33f66fee346cfd099d1cc"
logic_hash = "1b026f475fdbb3c97f33895520844fa4944eb2fffc0883502a6cb79162bbd388"
score = 75
@@ -399760,8 +400166,8 @@ rule SIGNATURE_BASE_Apt_Regin_Hopscotch : FILE
date = "2023-01-27"
modified = "2024-04-24"
reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_regin_fiveeyes.yar#L321-L342"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_regin_fiveeyes.yar#L321-L342"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6c34031d7a5fc2b091b623981a8ae61c"
logic_hash = "33b5fa61aaa802a60f3d42d59eb474222841a8a557b06b23a9e325e922e2cec1"
score = 75
@@ -399791,8 +400197,8 @@ rule SIGNATURE_BASE_Regin_Related_Malware
date = "2015-06-03"
modified = "2024-04-24"
reference = "VT Analysis"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_regin_fiveeyes.yar#L344-L367"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_regin_fiveeyes.yar#L344-L367"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "76c355bfeb859a347e38da89e3d30a6ff1f94229"
logic_hash = "61ce7a69ab357740158e355455362a4f5fddc67ee60af120733f509e7407216f"
score = 70
@@ -399823,8 +400229,8 @@ rule SIGNATURE_BASE_HKTL_Nim_Nimpackt : EXE FILE HKTL
date = "2022-01-26"
modified = "2023-12-05"
reference = "https://github.com/chvancooten/NimPackt-v1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_nimpackt.yar#L2-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_nimpackt.yar#L2-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2bda7acb440d1c72efeaddcb18b736343d658d59feccf6c9339b313cd35f32eb"
score = 80
quality = 79
@@ -399850,8 +400256,8 @@ rule SIGNATURE_BASE_Powershell_Case_Anomaly : FILE
date = "2017-08-11"
modified = "2022-06-12"
reference = "https://twitter.com/danielhbohannon/status/905096106924761088"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_case_anomalies.yar#L11-L60"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_case_anomalies.yar#L11-L60"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cbef94b899a2d22930ee0e8b3eac03c505db629d19a62ddd8f56482403dfa595"
score = 70
quality = 77
@@ -399893,8 +400299,8 @@ rule SIGNATURE_BASE_Wscriptshell_Case_Anomaly : FILE
date = "2017-09-11"
modified = "2022-06-09"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_case_anomalies.yar#L62-L84"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_case_anomalies.yar#L62-L84"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5c64e124186ae2eb974639627287fb27fe27eb2855342703e4a27a9c0fd62a91"
score = 60
quality = 83
@@ -399921,8 +400327,8 @@ rule SIGNATURE_BASE_APT_MAL_HP_Ilo_Firmware_Dec21_1 : FILE
date = "2021-12-28"
modified = "2023-12-05"
reference = "https://threats.amnpardaz.com/en/2021/12/28/implant-arm-ilobleed-a/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_mal_ilo_board_elf.yar#L2-L18"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_mal_ilo_board_elf.yar#L2-L18"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7e959d07d864a485b8cc7765f9e12869ff34747ab552e26244eb28f510d1051f"
score = 80
quality = 85
@@ -399947,8 +400353,8 @@ rule SIGNATURE_BASE_MAL_WIPER_Isaacwiper_Mar22_1 : FILE
date = "2022-03-03"
modified = "2023-12-05"
reference = "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ua_isaacwiper.yar#L3-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ua_isaacwiper.yar#L3-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
hash = "7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0"
logic_hash = "6fe7d1536db5fc30c9b4a171be66993fc69e6a1d96dae00be4170bdb4a53afb8"
@@ -399978,8 +400384,8 @@ rule SIGNATURE_BASE_SUSP_NVIDIA_LAPSUS_Leak_Compromised_Cert_Mar22_1 : FILE
date = "2022-03-03"
modified = "2022-03-04"
reference = "https://twitter.com/cyb3rops/status/1499514240008437762"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_nvidia_leaked_cert.yar#L4-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_nvidia_leaked_cert.yar#L4-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e7e9e58ec1e3922471ad3ffd4ad9fbb3ac4b3c3841c35d1cd8886607f3cf1ab9"
score = 70
quality = 85
@@ -399997,8 +400403,8 @@ rule SIGNATURE_BASE_MAL_Sophos_XG_Pygmy_Goat_AES_Key : FILE
date = "2024-10-22"
modified = "2024-12-12"
reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_sophos_pygmy_nov24.yar#L2-L24"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_sophos_pygmy_nov24.yar#L2-L24"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "71f70d61af00542b2e9ad64abd2dda7e437536ff"
logic_hash = "da6c5d7a03eab01ddbb460cbdd16622839b3a52cfa4e91f169d3d477c60cfed4"
score = 75
@@ -400027,8 +400433,8 @@ rule SIGNATURE_BASE_MAL_Sophos_XG_Pygmy_Goat_Magic_Strings : FILE
date = "2024-10-22"
modified = "2024-12-12"
reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_sophos_pygmy_nov24.yar#L26-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_sophos_pygmy_nov24.yar#L26-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "71f70d61af00542b2e9ad64abd2dda7e437536ff"
logic_hash = "df40e818002a72ee649dd2bb79cb59938dc108690cce03c99a72fc036406c4b2"
score = 75
@@ -400055,8 +400461,8 @@ rule SIGNATURE_BASE_MAL_Earthworm_Socks_Proxy_ID_Generation : FILE
date = "2024-10-22"
modified = "2024-12-12"
reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_sophos_pygmy_nov24.yar#L46-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_sophos_pygmy_nov24.yar#L46-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "71f70d61af00542b2e9ad64abd2dda7e437536ff"
logic_hash = "6837cba2637ed02d1d620c037b200d528c09a39498c1e320873a3a244e67932c"
score = 75
@@ -400090,8 +400496,8 @@ rule SIGNATURE_BASE_SUSP_BAT_Aux_Jan20_1 : FILE
date = "2020-01-29"
modified = "2023-12-05"
reference = "https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_bat_aux.yar#L2-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_bat_aux.yar#L2-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f5d558ec505b635b1e37557350562ad6f79b3da5cf2cf74db6e6e648b7a47127"
logic_hash = "6b8cd9b7683a18a02a81222d6819fe903500702c83f198f73ac428d1bc91fb9a"
score = 65
@@ -400117,8 +400523,8 @@ rule SIGNATURE_BASE_Venom_Rootkit : FILE
date = "2017-01-12"
modified = "2023-12-05"
reference = "https://security.web.cern.ch/security/venom.shtml"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_venom_linux_rootkit.yar#L10-L32"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_venom_linux_rootkit.yar#L10-L32"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0b2211edc6737e9da3e43bec9ef823e80c6bd6463adbb10d6839e9914aed22ac"
score = 75
quality = 85
@@ -400150,8 +400556,8 @@ rule SIGNATURE_BASE_Mimikatz_Memory_Rule_1 : APT
date = "2014-12-22"
modified = "2023-07-04"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimikatz.yar#L5-L26"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimikatz.yar#L5-L26"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "22064af570b8e0a93ca0d45484848eda3fbecfd27c88247ef0897fe53be4b7fc"
score = 70
quality = 85
@@ -400180,8 +400586,8 @@ rule SIGNATURE_BASE_Mimikatz : FILE
date = "2022-11-16"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimikatz.yar#L48-L74"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimikatz.yar#L48-L74"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "bf972a2c0465c3bbdde6f03d91c6f479d0f66c6d3e9512355de5a973164b56a5"
score = 75
quality = 85
@@ -400208,8 +400614,8 @@ rule SIGNATURE_BASE_Wce
date = "2020-08-10"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimikatz.yar#L76-L89"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimikatz.yar#L76-L89"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a16db99dcaaf1b6c33a738aab4f4d3812366258bc2f6dd32250ee1b1a0616f1c"
score = 75
quality = 85
@@ -400233,8 +400639,8 @@ rule SIGNATURE_BASE_Power_Pe_Injection
date = "2020-08-10"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimikatz.yar#L91-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimikatz.yar#L91-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "64a7033d51e8933912f37ce68bffc216073a88cae1ea7492e71a812411ae6a9d"
score = 75
quality = 85
@@ -400255,8 +400661,8 @@ rule SIGNATURE_BASE_Mimikatz_Logfile
date = "2015-03-31"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimikatz.yar#L103-L119"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimikatz.yar#L103-L119"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4591cda5bd5a555292087da26193accc4f00d7c0611be8d5ab6dd4dabb14a0ef"
score = 80
quality = 85
@@ -400282,8 +400688,8 @@ rule SIGNATURE_BASE_Mimikatz_Strings : FILE
date = "2016-06-08"
modified = "2023-12-05"
reference = "not set"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimikatz.yar#L121-L154"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimikatz.yar#L121-L154"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "baba1e159c0fb23f68b80459291a2d2c52e84f742f51ca30b894f7fc6282ad7a"
score = 65
quality = 85
@@ -400320,8 +400726,8 @@ rule SIGNATURE_BASE_Appinithook : FILE
date = "2015-07-15"
modified = "2023-12-05"
reference = "https://goo.gl/Z292v6"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimikatz.yar#L156-L176"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimikatz.yar#L156-L176"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e7563e4f2a7e5f04a3486db4cefffba173349911a3c6abd7ae616d3bf08cfd45"
logic_hash = "a4de3a062e309715c339a45a16a7ff8f9a55851cb41097a6925fd11f649547d2"
score = 70
@@ -400350,8 +400756,8 @@ rule SIGNATURE_BASE_HKTL_Mimikatz_Skeletonkey_In_Memory_Aug20_1
date = "2020-08-09"
modified = "2023-12-05"
reference = "https://twitter.com/sbousseaden/status/1292143504131600384?s=12"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimikatz.yar#L178-L190"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimikatz.yar#L178-L190"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "0cc9a4d3b63e07a695df342bd2c96a55570502d6fd0ab9a1b61d63e28e1c3e05"
score = 75
quality = 85
@@ -400373,8 +400779,8 @@ rule SIGNATURE_BASE_HKTL_Mimikatz_Memssp_Hookfn
date = "2020-08-26"
modified = "2023-12-05"
reference = "https://github.com/sbousseaden/YaraHunts/blob/master/mimikatz_memssp_hookfn.yara"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimikatz.yar#L192-L216"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimikatz.yar#L192-L216"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "27cf87f801111f17af76ab4c4f8329b73165f24f755d33edbb22d845bba6d3ff"
score = 70
quality = 85
@@ -400406,8 +400812,8 @@ rule SIGNATURE_BASE_HKTL_Mimikatz_Icon : FILE
date = "2023-02-18"
modified = "2023-12-05"
reference = "https://blog.gentilkiwi.com/mimikatz"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_mimikatz.yar#L218-L238"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_mimikatz.yar#L218-L238"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1"
hash = "1c3f584164ef595a37837701739a11e17e46f9982fdcee020cf5e23bad1a0925"
hash = "c6bb98b24206228a54493274ff9757ce7e0cbb4ab2968af978811cc4a98fde85"
@@ -400434,8 +400840,8 @@ rule SIGNATURE_BASE_SUSP_Two_Byte_XOR_PE_And_MZ : FILE
date = "2021-10-11"
modified = "2025-11-03"
reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_xored_pe.yar#L1-L12"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_xored_pe.yar#L1-L12"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8a43ff9ec966df72ef35fb9ba9bbbd6f8b0f3761669bb91dc5919645d6327174"
score = 60
quality = 85
@@ -400453,8 +400859,8 @@ rule SIGNATURE_BASE_SUSP_Four_Byte_XOR_PE_And_MZ : FILE
date = "2021-10-11"
modified = "2025-11-03"
reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_xored_pe.yar#L14-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_xored_pe.yar#L14-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "28230cd3c1d1da97a98df09243593eb59b57f376f651d5f22c3ea5903f0f73e4"
score = 60
quality = 85
@@ -400472,8 +400878,8 @@ rule SIGNATURE_BASE_Malware_JS_Powershell_Obfuscated : FILE
date = "2017-03-24"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_javascript_powershell.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_javascript_powershell.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3af15a2d60f946e0c4338c84bd39880652f676dc884057a96a10d7f802215760"
logic_hash = "1dd745624971f10acb7911433f363b0cf20c8c45344f702d7f3549c58689b371"
score = 75
@@ -400496,8 +400902,8 @@ rule SIGNATURE_BASE_Apt_Equation_Exploitlib_Mutexes : FILE
date = "2016-02-15"
modified = "2023-01-27"
reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L3-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L3-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "4414dd4ca16d08b8edad26842640960ace434cdde769766fb1c38a1a249565fd"
score = 75
quality = 85
@@ -400523,8 +400929,8 @@ rule SIGNATURE_BASE_Apt_Equation_Equationlaser_Runtimeclasses
date = "2015-02-16"
modified = "2025-03-29"
reference = "https://securelist.com/blog/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L40-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L40-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "663ea56f869f7099a92658df5bddd76d4e5ba8ac5dfc693733579682b9eee860"
score = 75
quality = 85
@@ -400551,8 +400957,8 @@ rule SIGNATURE_BASE_Apt_Equation_Cryptotable
date = "2015-02-16"
modified = "2025-03-29"
reference = "https://securelist.com/blog/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L59-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L59-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e660fe423330334a1e3167d6a45e5ce2469fec276838618a7cb0340ec8172275"
score = 75
quality = 85
@@ -400574,8 +400980,8 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Triplefantasy_1 : FILE
date = "2015-02-16"
modified = "2025-03-29"
reference = "http://goo.gl/ivt8EW"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L75-L107"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L75-L107"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b2b2cd9ca6f5864ef2ac6382b7b6374a9fb2cbe9"
logic_hash = "cfa3c1756c8dfb04e0a1590f76cad6d5b3878000d220c263d199322cf6a4f58a"
score = 75
@@ -400611,8 +401017,8 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Doublefantasy_1 : FILE
date = "2015-02-16"
modified = "2025-03-29"
reference = "http://goo.gl/ivt8EW"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L109-L138"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L109-L138"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d09b4b6d3244ac382049736ca98d7de0c6787fa2"
logic_hash = "4471601300616b5442de95a3eb23c28563206f3423b57fe81007d005203a439f"
score = 75
@@ -400645,8 +401051,8 @@ rule SIGNATURE_BASE_Equation_Kaspersky_GROK_Keylogger : FILE
date = "2015-02-16"
modified = "2025-03-29"
reference = "http://goo.gl/ivt8EW"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L140-L172"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L140-L172"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "50b8f125ed33233a545a1aac3c9d4bb6aa34b48f"
logic_hash = "502afd23b92e948a8fba33ccc4da2f4b1ec91bce5a24d153ffc545129fd8c9fa"
score = 75
@@ -400681,8 +401087,8 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Greyfishinstaller
date = "2015-02-16"
modified = "2025-03-29"
reference = "http://goo.gl/ivt8EW"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L174-L189"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L174-L189"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "58d15d1581f32f36542f3e9fb4b1fc84d2a6ba35"
logic_hash = "dae6963f3210503c6c86c818a9cd6f309ba7876f14ca42966097023d474a2366"
score = 75
@@ -400707,8 +401113,8 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Equationdruginstaller : FILE
date = "2015-02-16"
modified = "2025-03-29"
reference = "http://goo.gl/ivt8EW"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L191-L213"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L191-L213"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61fab1b8451275c7fd580895d9c68e152ff46417"
logic_hash = "815ed47a53bbc5f6c3fec3464336863028e804bde4681526ecac5de0cfff21b4"
score = 75
@@ -400739,8 +401145,8 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Equationlaserinstaller : FILE
date = "2015-02-16"
modified = "2025-03-29"
reference = "http://goo.gl/ivt8EW"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L215-L236"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L215-L236"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5e1f56c1e57fbff96d4999db1fd6dd0f7d8221df"
logic_hash = "6f8ba26f5efaa7ec422171862e1b645472387395f0be3a4625d58de5f0584c0b"
score = 80
@@ -400769,8 +401175,8 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Fannyworm : FILE
date = "2015-02-16"
modified = "2023-01-06"
reference = "http://goo.gl/ivt8EW"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L238-L277"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L238-L277"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1f0ae54ac3f10d533013f74f48849de4e65817a7"
logic_hash = "57e938ba1e53eeb99491547f53086eae3fc4d50bc5612e1b5ae6da6b029ac49e"
score = 80
@@ -400810,8 +401216,8 @@ rule SIGNATURE_BASE_Equation_Kaspersky_HDD_Reprogramming_Module : FILE
date = "2015-02-16"
modified = "2025-03-29"
reference = "http://goo.gl/ivt8EW"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L279-L297"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L279-L297"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
logic_hash = "65800e5f122dce1dd4473bc8cebce0f9258b38d570118b154dbaf6939b68f925"
score = 75
@@ -400838,8 +401244,8 @@ rule SIGNATURE_BASE_Equation_Kaspersky_EOP_Package : FILE
date = "2015-02-16"
modified = "2025-03-29"
reference = "http://goo.gl/ivt8EW"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L299-L318"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L299-L318"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2bd1b1f5b4384ce802d5d32d8c8fd3d1dc04b962"
logic_hash = "abbc562b8e822422ae1852a5675a680e797a6af0be5581a8482785bd0c1ad1bf"
score = 75
@@ -400868,8 +401274,8 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Triplefantasy_Loader : FILE
date = "2015-02-16"
modified = "2025-03-29"
reference = "http://goo.gl/ivt8EW"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L320-L342"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L320-L342"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4ce6e77a11b443cc7cbe439b71bf39a39d3d7fa3"
logic_hash = "f49735a587085e95f1a8e405e42e5ff3eb4beda1f26c7b4c3c0a33bec21f48c7"
score = 75
@@ -400900,8 +401306,8 @@ rule SIGNATURE_BASE_Equation_Kaspersky_Suspiciousstring : FILE
date = "2015-02-17"
modified = "2025-03-29"
reference = "http://goo.gl/ivt8EW"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L346-L364"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L346-L364"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "dd7f72c2263a3af9b8c9072b415a3b066e821e000b52ddd684ecb6b80a99067a"
score = 60
quality = 85
@@ -400928,8 +401334,8 @@ rule SIGNATURE_BASE_Equationdrug_Networksniffer1
date = "2015-03-11"
modified = "2023-01-06"
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L368-L388"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L368-L388"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "26e787997a338d8111d96c9a4c103cf8ff0201ce"
logic_hash = "ec90cba3b790c52f475a08b586f5af5a88ec46cfcf8abd74435981a34dfdb3f7"
score = 75
@@ -400958,8 +401364,8 @@ rule SIGNATURE_BASE_Equationdrug_Compatlayer_Unilaydll : FILE
date = "2015-03-11"
modified = "2025-03-29"
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L390-L402"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L390-L402"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a3a31937956f161beba8acac35b96cb74241cd0f"
logic_hash = "86434bd0456ea0c9ac9ed74dc3cf63520eb6b880dd4ea7920d0e82873dfec21e"
score = 75
@@ -400981,8 +401387,8 @@ rule SIGNATURE_BASE_Equationdrug_Networksniffer2
date = "2015-03-11"
modified = "2025-03-29"
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L419-L438"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L419-L438"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7e3cd36875c0e5ccb076eb74855d627ae8d4627f"
logic_hash = "d29744a801194e5488795a8167965b94290be477efe478ee3e71c4bc98733967"
score = 75
@@ -401011,8 +401417,8 @@ rule SIGNATURE_BASE_Equationdrug_Networksniffer3
date = "2015-03-11"
modified = "2025-03-29"
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L440-L455"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L440-L455"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "14599516381a9646cd978cf962c4f92386371040"
logic_hash = "18c516fe0cd74e7a02ee15260abf3d27bba992492e6042a148abdee3086a9a00"
score = 75
@@ -401037,8 +401443,8 @@ rule SIGNATURE_BASE_Equationdrug_Volrec_Driver
date = "2015-03-11"
modified = "2025-03-29"
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L457-L471"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L457-L471"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ee2b504ad502dc3fed62d6483d93d9b1221cdd6c"
logic_hash = "24b8202a8590ddb1dd76e01499d02282ad40a6fd6f6b9020040381a370e91f40"
score = 75
@@ -401062,8 +401468,8 @@ rule SIGNATURE_BASE_Equationdrug_Kernelrootkit
date = "2015-03-11"
modified = "2023-01-06"
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L473-L493"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L473-L493"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "597715224249e9fb77dc733b2e4d507f0cc41af6"
logic_hash = "4b41af8656ada1b4db7ec11f65aeb2d335f424d8557cfa74a064b40c65627012"
score = 75
@@ -401092,8 +401498,8 @@ rule SIGNATURE_BASE_Equationdrug_Keylogger
date = "2015-03-11"
modified = "2025-03-29"
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L495-L510"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L495-L510"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b93aa17b19575a6e4962d224c5801fb78e9a7bb5"
logic_hash = "b5db0e6e24979b07cd180fed11545daef281e7b0858a7de001a83c2cbc186557"
score = 75
@@ -401118,8 +401524,8 @@ rule SIGNATURE_BASE_Equationdrug_Platformorchestrator
date = "2015-03-11"
modified = "2025-03-29"
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L538-L555"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L538-L555"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "febc4f30786db7804008dc9bc1cebdc26993e240"
logic_hash = "26c3b84a00702f155daa50c8f17e5f37e1aac46adde8a06a711e732a4cd806e9"
score = 75
@@ -401146,8 +401552,8 @@ rule SIGNATURE_BASE_Equationdrug_Networksniffer5
date = "2015-03-11"
modified = "2023-01-06"
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L557-L575"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L557-L575"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "09399b9bd600d4516db37307a457bc55eedcbd17"
logic_hash = "84f009e2ef639e5270273a7d9dd2542fdf1386c4c8363071d711e2333a112cd1"
score = 75
@@ -401174,8 +401580,8 @@ rule SIGNATURE_BASE_Equationdrug_Filesystem_Filter
date = "2015-03-11"
modified = "2025-03-29"
reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L577-L591"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L577-L591"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "57fa4a1abbf39f4899ea76543ebd3688dcc11e13"
logic_hash = "5da0c279da1b84a41e7d15df3c19cd50af1872156f133de0a367b9140425aa11"
score = 75
@@ -401199,8 +401605,8 @@ rule SIGNATURE_BASE_Apt_Equation_Keyword : FILE
date = "2015-09-26"
modified = "2025-03-29"
reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/spy_equation_fiveeyes.yar#L593-L604"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/spy_equation_fiveeyes.yar#L593-L604"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d9a2b31d078eabbc930e9ec06e5ead5a6cda4eebf1c0ebe8164caf75a9d3cba6"
score = 75
quality = 85
@@ -401222,8 +401628,8 @@ rule SIGNATURE_BASE_MAL_Kwampirs_Apr18 : KWAMPIRS
date = "2018-04-23"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_kwampirs.yar#L1-L70"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_kwampirs.yar#L1-L70"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e9387c46b9e3fff90415c46af270d143bdeb6292f2521d889b8d6ae726a4cf3b"
score = 75
quality = 85
@@ -401299,8 +401705,8 @@ rule SIGNATURE_BASE_EXT_EXPL_ZTH_LNK_EXPLOIT_A : FILE
date = "2025-03-18"
modified = "2025-03-29"
reference = "https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_lnk_zdi_can_25373.yar#L1-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_lnk_zdi_can_25373.yar#L1-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "b2c6a7f0abd62d3eef916352f984d1fcc721cfba4f5de9d159de8fd428c02b31"
score = 75
quality = 85
@@ -401328,8 +401734,8 @@ rule SIGNATURE_BASE_MAL_Emotet_JS_Dropper_Oct19_1 : FILE
date = "2019-10-03"
modified = "2023-12-05"
reference = "https://app.any.run/tasks/aaa75105-dc85-48ca-9732-085b2ceeb6eb/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_emotet.yar#L2-L16"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_emotet.yar#L2-L16"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "38295d728522426672b9497f63b72066e811f5b53a14fb4c4ffc23d4efbbca4a"
hash = "9bc004a53816a5b46bfb08e819ac1cf32c3bdc556a87a58cbada416c10423573"
logic_hash = "563077f3bc8ee18a887eecb9f0591c693e5543a9875eebad2186745154af1ade"
@@ -401354,8 +401760,8 @@ rule SIGNATURE_BASE_MAL_Emotet_Jan20_1 : FILE
date = "2020-01-29"
modified = "2023-12-05"
reference = "https://app.any.run/tasks/5e81638e-df2e-4a5b-9e45-b07c38d53929/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_emotet.yar#L20-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_emotet.yar#L20-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e7c22ccdb1103ee6bd15c528270f56913bb2f47345b360802b74084563f1b73d"
logic_hash = "23ffcdde3eae7637e5b47a0f940cbebafccfd4c3f222b882e73d7d02447b83c3"
score = 75
@@ -401379,8 +401785,8 @@ rule SIGNATURE_BASE_MAL_Emotet_BKA_Quarantine_Apr21
date = "2021-03-23"
modified = "2023-12-05"
reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_emotet.yar#L39-L52"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_emotet.yar#L39-L52"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "cc75be5f641e21446a41bf9cc855330a612847e7e3a3be935577d33195f40d05"
score = 75
quality = 85
@@ -401404,8 +401810,8 @@ rule SIGNATURE_BASE_MAL_Emotet_BKA_Cleanup_Apr21 : FILE
date = "2021-03-23"
modified = "2023-12-05"
reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_emotet.yar#L54-L70"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_emotet.yar#L54-L70"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "533adaed96d015ea2dcd54d5aaf9e71b5b70430ed5733a98618925cf978a6515"
score = 75
quality = 85
@@ -401429,8 +401835,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Auct_Dez16_Strings : FILE
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L11-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L11-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3c632d90c5b26b840b267647faf453f85496b78c900910ad22896698c553c949"
score = 60
quality = 60
@@ -401497,8 +401903,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Violetspirit
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L73-L86"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L73-L86"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
logic_hash = "01a45feb5c9f9cfe8834306993c53b1e53d79b89b07106ffec0c81cdebb8b71c"
score = 75
@@ -401521,8 +401927,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Gr_Gr
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L88-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L88-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b2b60dce7a4cfdddbd3d3f1825f1885728956bae009de3a307342fbdeeafcb79"
logic_hash = "facce45a335d7ca799d68fc26ee2bf5682cec0914502482189cd6aa496cba489"
score = 75
@@ -401545,8 +401951,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Yellowspirit
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L103-L117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L103-L117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a7c4b718fa92934a9182567288146ffa3312d9f3edc3872478c90e0e2814078c"
logic_hash = "698b23cc4cc6f319ddef7a93cf7ddc83ffae1d2c2b0a9545011b51e381f8cd0c"
score = 75
@@ -401570,8 +401976,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Eleganteagle_Opscript_1_0_0
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L119-L132"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L119-L132"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "57e223318de0a802874642652b3dc766128f25d7e8f320c6f04c6f2659bb4f7f"
logic_hash = "3df5ba1a497ffe5306ed7966f25f69c30a5191e935c5638869a62b3cb2324f70"
score = 75
@@ -401594,8 +402000,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Opscript
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L134-L147"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L134-L147"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "275c91531a9ac5a240336714093b6aa146b8d7463cb2780cfeeceaea4c789682"
logic_hash = "23dd6d537a8639bd84ede141cca577dc91328bd293f96f865c7dedd9ef693ee3"
score = 75
@@ -401618,8 +402024,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Shentysdelight
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L149-L162"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L149-L162"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a564efeaae9c13fe09a27f2d62208a1dec0a19b4a156f5cfa96a0259366b8166"
logic_hash = "1acfb6aea7e208b7fd52325258219c162482deb4fa7ee87ddc4de0774e3e74f4"
score = 75
@@ -401642,8 +402048,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Epichero
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L164-L178"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L164-L178"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "679d194c32cbaead7281df9afd17bca536ee9d28df917b422083ae8ed5b5c484"
logic_hash = "36dc38f2dd630f22b87e8d9130de7d40ee3cdba45597b2b667a1a9536d990aad"
score = 75
@@ -401667,8 +402073,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L180-L193"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L180-L193"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "98ae935dd9515529a34478cb82644828d94a2d273816d50485665535454e37cd"
logic_hash = "8135c07b8c217e81f7618d58c9c3da6585cdb9b8f7afab85bb6556c5b846ba64"
score = 75
@@ -401691,8 +402097,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Dubmoat
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L195-L209"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L195-L209"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bcd4ee336050488f5ffeb850d8eaa11eec34d8ba099b370d94d2c83f08a4d881"
logic_hash = "368c0a6a1db0003e3a2e4ec5e42a5b5563ea1c2cb89db1751226891e1f7181d8"
score = 75
@@ -401716,8 +402122,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Strifeworld
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L211-L225"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L211-L225"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "222b00235bf143645ad0d55b2b6839febc5b570e3def00b77699915a7c9cb670"
logic_hash = "2b113b042fd62109ee3ee39515fbd22f3898abf320d75f1288ea88e40b3444c0"
score = 75
@@ -401741,8 +402147,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Pork
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L227-L242"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L227-L242"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9c400aab74e75be8770387d35ca219285e2cedc0c7895225bbe567ce9c9dc078"
logic_hash = "c3f9f90f83f3672b101e52f36012c485c29840cf0b2ced00087fb27725fd1545"
score = 75
@@ -401767,8 +402173,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Ebbisland
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L244-L258"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L244-L258"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "390e776ae15fadad2e3825a5e2e06c4f8de6d71813bef42052c7fd8494146222"
logic_hash = "0a45ea3cd6aeea9299ef67ae82c9f4bf929a961695e7cce344aa1737fa4c07b0"
score = 75
@@ -401792,8 +402198,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Stoicsurgeon
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L260-L273"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L260-L273"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "967facb19c9b563eb90d3df6aa89fd7dcfa889b0ba601d3423d9b71b44191f50"
logic_hash = "322599ba7d5536b7f0856980a6caab86de66c02da75bf55e97bf129d08c43031"
score = 75
@@ -401816,8 +402222,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Elgingamble
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L275-L288"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L275-L288"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4130284727ddef4610d63bfa8330cdafcb6524d3d2e7e8e0cb34fde8864c8118"
logic_hash = "2f4dd668c59244e92ebfe0e2fc2859b2376cf1dd6fc6522e8f452787aa96365f"
score = 75
@@ -401840,8 +402246,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_README_Cup
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L290-L304"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L290-L304"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "98aaad31663b89120eb781b25d6f061037aecaeb20cf5e32c36c68f34807e271"
logic_hash = "bd05a23ce29be88c1a459358c984e1317cf56d21e5b378624af644fb2b41931d"
score = 75
@@ -401865,8 +402271,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Nopen_Oneshot
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L306-L319"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L306-L319"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a85b260d6a53ceec63ad5f09e1308b158da31062047dc0e4d562d2683a82bf9a"
logic_hash = "19aa32aafaaccc6697bbaff642d996554eccf2261d23071cfb8599ea0eea628b"
score = 75
@@ -401889,8 +402295,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Earlyshovel
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L321-L334"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L321-L334"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "504e7a376c21ffbfb375353c5451dc69a35a10d7e2a5d0358f9ce2df34edf256"
logic_hash = "396810b439ac53f393ad37a8acbd7236f8325730c75c1a6339e4c6343ecade7a"
score = 75
@@ -401913,8 +402319,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Envisioncollision
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L336-L352"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L336-L352"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f04f078a8f0fdfc864d3d2e37d123f55ecc1d5e401a87eccd0c3846770f9e02"
logic_hash = "36b2a20ef3a6540a686d7f52c8c885842fd84ba7c7daa74c21e241e25826030e"
score = 75
@@ -401940,8 +402346,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme1
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L356-L372"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L356-L372"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
hash = "64c24bbf42f15dcac04371aef756feabb7330f436c20f33cb25fbc8d0ff014c7"
hash = "a237a2bd6aec429f9941d6de632aeb9729880aa3d5f6f87cf33a76d6caa30619"
@@ -401967,8 +402373,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme2
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L374-L389"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L374-L389"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
hash = "f4b728c93dba20a163b59b4790f29aed1078706d2c8b07dc7f4e07a6f3ecbe93"
logic_hash = "eb68c415d64d1db3d4bb0f4ad994bd050cb2287e4dc7b3ac57549f818a7914d8"
@@ -401993,8 +402399,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme3
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L391-L411"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L391-L411"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
hash = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
hash = "3fe78949a9f3068db953b475177bcad3c76d16169469afd72791b4312f60cfb3"
@@ -402024,8 +402430,8 @@ rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme4
date = "2016-12-17"
modified = "2023-12-05"
reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fvey_shadowbroker_dec16.yar#L413-L429"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fvey_shadowbroker_dec16.yar#L413-L429"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
hash = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
logic_hash = "c19c77d7e7e26e01a9a50fd67cc0a7fd05069def878bf18726c3e115df307cb2"
@@ -402051,8 +402457,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_1 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L13-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L13-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "59509a17d516813350fe1683ca6b9727bd96dd81ce3435484a5a53b472ff4ae9"
logic_hash = "6e94111abe83aa500bfa35a3a7c2d43c3ed4011bc540401f047e84cfc27204ca"
score = 75
@@ -402078,8 +402484,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_2 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L31-L46"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L31-L46"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1fc9f7065856cd8dc99b6f46cf0953adf90e2c42a3b65374bf7b50274fb200cc"
logic_hash = "ddd3dee11e25ea40fa3cc578c6a836ea850359a5914d5eb5d16ea4340827b91b"
score = 75
@@ -402104,8 +402510,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_3 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L48-L62"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L48-L62"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0d2abdcaad99e102fdf6574b3dc90f17cb9d060c20e6ac4ff378875d3b91a840"
logic_hash = "f1617829ccf7da6ee2e9f692fbf1f61d3f1c6a17103db85190d6a8b4fca69328"
score = 75
@@ -402129,8 +402535,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_4 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L64-L85"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L64-L85"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6b236d3fc54d36e6dc2a26299f6ded597058fed7c9099f1a37716c5e4b162abc"
logic_hash = "f258070054a29cbec0876536d295b85c7bd9f23988d1e0fc2ba58660b0796716"
score = 75
@@ -402161,8 +402567,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_5 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L87-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L87-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "32889639a27961497d53176765b3addf9fff27f1c8cc41634a365085d6d55920"
logic_hash = "6f2d4cfd55017ebb34fb6e8ad1b0b46b184926c69d4bacee88dc639771f96792"
score = 75
@@ -402186,8 +402592,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_6 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L103-L116"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L103-L116"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "44f58496578e55623713c4290abb256d03103e78e99939daeec059776bd79ee2"
logic_hash = "f6cc84ebed26a0dbecfcb3ffb3a11c111ae3d5b40497d59ada518d33bee57fdd"
score = 75
@@ -402210,8 +402616,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_7 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L118-L131"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L118-L131"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6b714dc1c7e58589374200d2c7f3d820798473faeb26855e53101b8f3c701e3f"
logic_hash = "198f8869e56d5549d9195524a86f6557162c5d25b4915bec0bf513797d880ea1"
score = 75
@@ -402234,8 +402640,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_8 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L133-L148"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L133-L148"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0f2d09b1ad0694f9e71eeebec5b2d137665375bf1e76cb4ae4d7f20487394ed3"
logic_hash = "6c8ddc7fb5f3256e57e66f502f6e3c582d82540f773bf4113cac4a685d45f81b"
score = 75
@@ -402261,8 +402667,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_9 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L150-L170"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L150-L170"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8e6682bcc51643f02a864b042f7223b157823f3d890fe21d38caeb43500d923e"
hash = "0c8ca0fd0ec246ef207b96a3aac5e94c9c368504905b0a033f11eef8c62fa14c"
hash = "6d0a2c822e2bc37cc0cec35f040d3fec5090ef2775df658d3823e47a93a5fef3"
@@ -402285,8 +402691,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_10 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L172-L189"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L172-L189"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "350d2a6f8e6a4969ffbf75d9f9aae99e7b3a8cd8708fd66f977e07d7fbf842e3"
logic_hash = "79a8dfd63e96ccc9259272476e364e53b841b42255a2a5f3b9f93e91caa5d1c2"
score = 75
@@ -402313,8 +402719,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_11 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L191-L210"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L191-L210"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "590a6796b97469f8e6977832a63c0964464901f075a9651f7f1b4578e55bd8c8"
logic_hash = "066fc3622a0db5cc511e85f6efc08191c2c9268524c8761dc17a05e6d133c263"
score = 75
@@ -402342,8 +402748,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_12 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L212-L234"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L212-L234"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "33c01d3266fe6a70e8785efaf10208f869ae58a17fd9cdb2c6995324c9a01062"
logic_hash = "49357a34f3b1d0bb86d1c6ddfa6a6c3b92bfafaebd050d835c0a902199a2121b"
score = 75
@@ -402376,8 +402782,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_13 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L236-L254"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L236-L254"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "780620521c92aab3d592b3dc149cbf58751ea285cfdaa50510002b441796b312"
logic_hash = "3c319a3ca78687cd2af77d97b4b4a8e72dadd812bf3da2145a23df278c3aa9a2"
score = 75
@@ -402405,8 +402811,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_14 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L256-L276"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L256-L276"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "67dd44a8fbf6de94c4589cf08aa5757b785b26e49e29488e9748189e13d90fb3"
logic_hash = "c96a40495bc2a17a6215c877ad054bd2e1e10c524c2d54da1955d370b9ccdcd7"
score = 75
@@ -402434,8 +402840,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_15 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L278-L299"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L278-L299"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "231c569f11460a12b171f131c40a6f25d8416954b35c28ae184aba8a649d9786"
logic_hash = "22769d215e52965f48eb3455b39fbd8f8ce950a67f8132612d42b78fde9822a5"
score = 75
@@ -402466,8 +402872,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_16 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L301-L317"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L301-L317"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2b1c1c6d82837dbbccd171a0413c1d761b1f7c3668a21c63ca06143e731f030e"
logic_hash = "950ece29e8fd056e3506684bce9b16eb185d63c1b020e4911972f5fcbdadbe30"
score = 75
@@ -402492,8 +402898,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_17 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L319-L343"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L319-L343"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "05036de73c695f59adf818d3c669c48ce8626139d463b8a7e869d8155e5c0d85"
hash = "08d8c610e1ec4a02364cb53ba44e3ca5d46e8a177a0ecd50a1ef7b5db252701d"
hash = "14535607d9a7853f13e8bf63b629e3a19246ed9db6b4d2de2ca85ec7a7bee140"
@@ -402526,8 +402932,8 @@ rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_18 : FILE
date = "2018-06-21"
modified = "2023-12-05"
reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_thrip.yar#L345-L367"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_thrip.yar#L345-L367"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "33029f5364209e05481cfb2a4172c6dc157b0070f51c05dd34485b8e8da6e820"
hash = "263c01a3b822722dc288a5ac138d953630d8c548a0bee080ae3979b7d364cecb"
hash = "52d190a8d20b4845551b8765cbd12cfbe04cf23e6812e238e5a5023c34ee9b37"
@@ -402560,8 +402966,8 @@ rule SIGNATURE_BASE_SUSP_EXPL_POC_Vmware_Workspace_ONE_CVE_2022_22954_Apr22_1 :
modified = "2025-03-29"
old_rule_name = "EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22"
reference = "https://twitter.com/rwincey/status/1512241638994853891/photo/1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2022_22954_vmware_workspace_one.yar#L2-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2022_22954_vmware_workspace_one.yar#L2-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "20c1d55e29b777cca3cb8e92fbe45e23e6bbf972167dee8b0a012d9ff12f3841"
score = 60
quality = 85
@@ -402597,8 +403003,8 @@ rule SIGNATURE_BASE_LOG_SUSP_EXPL_POC_Vmware_Workspace_ONE_CVE_2022_22954_Apr22_
modified = "2025-03-29"
old_rule_name = "EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22"
reference = "https://twitter.com/rwincey/status/1512241638994853891/photo/1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_cve_2022_22954_vmware_workspace_one.yar#L37-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_cve_2022_22954_vmware_workspace_one.yar#L37-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3c383f197da1e043e632c4d4de03fa7ff42e3fb6fa7824f326874446bcd13588"
score = 60
quality = 85
@@ -402621,8 +403027,8 @@ rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Sheel_Oct23 : FILE
date = "2023-10-06"
modified = "2023-12-05"
reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_camaro_dragon_oct23.yar#L2-L25"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_camaro_dragon_oct23.yar#L2-L25"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7985f992dcc6fcce76ee2892700c8538af075bd991625156bf2482dbfebd5a5a"
logic_hash = "b06f645b766a099adb71c144bdced70c130735e75d5be6451f71077c7d3a5d19"
score = 85
@@ -402648,8 +403054,8 @@ rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Horseshell_Oct23 : FILE
date = "2023-10-06"
modified = "2023-12-05"
reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_camaro_dragon_oct23.yar#L27-L56"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_camaro_dragon_oct23.yar#L27-L56"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "998788472cb1502c03675a15a9f09b12f3877a5aeb687f891458a414b8e0d66c"
logic_hash = "73adaa286b345cffd35e6ba017b3204d8818dcaeea8a48ca93959566461ac3ca"
score = 85
@@ -402680,8 +403086,8 @@ rule SIGNATURE_BASE_Gen_Macro_Shellexecute_Action : FILE
date = "2019-01-08"
modified = "2023-12-05"
reference = "https://twitter.com/ItsReallyNick/status/1091170625698316288"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_macro_ShellExecute_action.yar#L1-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_macro_ShellExecute_action.yar#L1-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0878eec9ecae493659e42c1d87588573c1e6fc30acf7a59e6fdb5296b1c198ef"
hash = "a0963ac15339c9803b4355fd71b68bf6ddedad960d5b3ad40bae873263470191"
hash = "dd094e44a817604596d1ab06ca6e9597d49ca0a2cbe9239c73ceaad70265ec2a"
@@ -402716,8 +403122,8 @@ rule SIGNATURE_BASE_EXPL_Citrix_Netscaler_ADC_Forensicartifacts_CVE_2023_3519_Ju
date = "2023-07-21"
modified = "2023-12-05"
reference = "https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L27-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L27-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "48d4225d0935084003f7a98c554d7c4722a91290dfe190001da52bce332b3f7d"
score = 70
quality = 85
@@ -402740,8 +403146,8 @@ rule SIGNATURE_BASE_EXPL_Citrix_Netscaler_ADC_Forensicartifacts_CVE_2023_3519_Ju
date = "2023-07-24"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L43-L61"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L43-L61"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e78e1a788503b841ed0f4e5cd415eb35d8911092778120d7fd061ed20820da37"
score = 70
quality = 85
@@ -402768,11 +403174,11 @@ rule SIGNATURE_BASE_LOG_EXPL_Citrix_Netscaler_ADC_Exploitation_Attempt_CVE_2023_
date = "2023-07-27"
modified = "2023-12-05"
reference = "https://blog.assetnote.io/2023/07/24/citrix-rce-part-2-cve-2023-3519/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L63-L77"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L63-L77"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7ad3164c5b2616b12a513a2bb3736d530769e75fca03346a72351a27b8343b2a"
score = 65
- quality = 60
+ quality = 85
tags = "CVE-2023-3519"
strings:
@@ -402791,8 +403197,8 @@ rule SIGNATURE_BASE_WEBSHELL_SECRETSAUCE_Jul23_1 : CVE_2023_3519 FILE
date = "2023-07-24"
modified = "2023-12-05"
reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L79-L100"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L79-L100"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c762d46ae43a3e10453c2ee17039812a06086ac85bdb000cf8308f5196a9dee2"
score = 85
quality = 85
@@ -402818,8 +403224,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_1 : FILE
date = "2021-05-29"
modified = "2025-03-21"
reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_may21.yar#L56-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L56-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "ad8a7bb5a1d2065e3a573842fb37ee3c63b7695c18840f0c26d32e6ae3d99c6c"
score = 75
quality = 85
@@ -402840,8 +403246,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_2 : FILE
date = "2021-05-29"
modified = "2025-03-21"
reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_may21.yar#L69-L83"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L69-L83"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "6f5c50b340d628559799897a2ba79add7d126e3ecb2daeb365bc15d64796ccd2"
score = 75
quality = 85
@@ -402865,8 +403271,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_NV_Link_May21_2 : FILE
date = "2021-05-29"
modified = "2025-03-21"
reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_may21.yar#L85-L97"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L85-L97"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5eee9df368da3fc98c00a0f8c65a7f3bd5b812342082be58054b272b5bb03455"
score = 75
quality = 85
@@ -402888,8 +403294,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_Samples_May21_1 : FILE
date = "2021-05-27"
modified = "2025-03-21"
reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_may21.yar#L99-L128"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L99-L128"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "24caf54e7c3fe308444093f7ac64d6d520c8f44ea4251e09e24931bdb72f5548"
logic_hash = "32d76bb1af76f0fc2afb76d9726bc8ec99c4be34c9d46cebab7356d8c68af11c"
score = 85
@@ -402920,8 +403326,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_1 : FILE
date = "2021-05-27"
modified = "2025-03-20"
reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_may21.yar#L130-L161"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L130-L161"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27"
logic_hash = "034ea34eb34ea6de0c65b9a7fc9d16f108ef34cd75294b022371ac17789c3830"
score = 85
@@ -402951,8 +403357,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_PDF_Masq_May21_1 : FILE
date = "2021-05-27"
modified = "2025-03-21"
reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_may21.yar#L163-L182"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L163-L182"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "8f1514648b2b797adfe3f8f5acb577c26707dfe1da942c9634be3d88a180a407"
score = 70
quality = 35
@@ -402977,8 +403383,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Nativezone_Loader_May21_1 : FILE
date = "2021-05-27"
modified = "2025-03-21"
reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_may21.yar#L184-L204"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L184-L204"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d"
logic_hash = "a02fd6fcd7423781bbd2e4458bd61d28e16a5b1a73b1682e63db5c86d53c7da4"
score = 85
@@ -403005,8 +403411,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_2 : FILE
date = "2021-05-29"
modified = "2025-03-21"
reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_may21.yar#L206-L234"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L206-L234"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0acb884f2f4cfa75b726cb8290b20328c8ddbcd49f95a1d761b7d131b95bafec"
hash = "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27"
hash = "cf1d992f776421f72eabc31d5afc2f2067ae856f1c9c1d6dc643a67cb9349d8c"
@@ -403039,8 +403445,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_2 : FILE
date = "2021-05-29"
modified = "2025-03-21"
reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_may21.yar#L236-L252"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L236-L252"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "292e5b0a12fea4ff3fc02e1f98b7a370f88152ce71fe62670dd2f5edfaab2ff8"
hash = "776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b"
logic_hash = "18a52f5fd71455b8564d4b485c233dd358a304bfddc5e6fb604b8e5a2a1949a3"
@@ -403065,8 +403471,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Stageless_Loader_May21_2 : FILE
date = "2021-05-29"
modified = "2025-03-21"
reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_may21.yar#L254-L276"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L254-L276"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf"
hash = "c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78"
logic_hash = "850f6a1ad342fd5e4bb29c7bf90a032ddd8ac9d2eac5ffcbedf43e4d04b178f5"
@@ -403094,8 +403500,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_3 : FILE
date = "2021-05-29"
modified = "2025-03-21"
reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_may21.yar#L278-L300"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L278-L300"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e"
logic_hash = "472acd1d6daf3480de59ecd3fa038d644e339dcc979cf7e56617eadc6cb32dc5"
score = 75
@@ -403124,8 +403530,8 @@ rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_4 : FILE
date = "2021-05-29"
modified = "2025-03-21"
reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_apt29_nobelium_may21.yar#L302-L323"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt29_nobelium_may21.yar#L302-L323"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4"
logic_hash = "7d5858cc6dab094d5dceab75a2002d9145537008241a08ac7bd399c9d6e6c270"
score = 75
@@ -403152,8 +403558,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Revil_Oct20_1 : FILE
date = "2020-10-13"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_revil.yar#L2-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_revil.yar#L2-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4"
hash = "f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5"
hash = "f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d"
@@ -403182,8 +403588,8 @@ rule SIGNATURE_BASE_SUSP_NET_Msil_Suspicious_Use_Strreverse : FILE
date = "2023-01-31"
modified = "2023-02-22"
reference = "https://github.com/dr4k0nia/yara-rules"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_net_msil.yar#L2-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_net_msil.yar#L2-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "02ce0980427dea835fc9d9eed025dd26672bf2c15f0b10486ff8107ce3950701"
logic_hash = "a7440600ee4826568d465d204e0a602f61752e4ffcfa3b4f29e5bc81c4d67b46"
score = 70
@@ -403210,8 +403616,8 @@ rule SIGNATURE_BASE_APT_Sandworm_Keywords_May20_1 : CVE_2019_10149 FILE
date = "2020-05-28"
modified = "2023-12-05"
reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_exim_expl.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_exim_expl.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9f9a81ff0c576f05ac063eaca7a5882dbdb09c9a0778610cca2864636a00efce"
score = 75
quality = 85
@@ -403233,8 +403639,8 @@ rule SIGNATURE_BASE_APT_Sandworm_SSH_Key_May20_1 : FILE
date = "2020-05-28"
modified = "2023-12-05"
reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_exim_expl.yar#L17-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_exim_expl.yar#L17-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
hash = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
logic_hash = "23a43849dfaa80bad2ca4f46b53181b3a4855ee89673ae9b658c854069b9aaa9"
@@ -403257,8 +403663,8 @@ rule SIGNATURE_BASE_APT_Sandworm_SSHD_Config_Modification_May20_1 : FILE
date = "2020-05-28"
modified = "2023-12-05"
reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_exim_expl.yar#L33-L49"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_exim_expl.yar#L33-L49"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
hash = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
logic_hash = "5775588b3a9d44e9eb2c8ef0f50351d7e3b06f1005f669775fae7187900d5999"
@@ -403282,8 +403688,8 @@ rule SIGNATURE_BASE_APT_Sandworm_Initfile_May20_1 : FILE
date = "2020-05-28"
modified = "2023-12-05"
reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_exim_expl.yar#L51-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_exim_expl.yar#L51-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
hash = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
logic_hash = "989f37069820d9ecf67dc71e4761a7cde2c1adf8db40b5f8a47e9c610ddec2e6"
@@ -403307,8 +403713,8 @@ rule SIGNATURE_BASE_APT_Sandworm_User_May20_1 : FILE
date = "2020-05-28"
modified = "2023-12-05"
reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_exim_expl.yar#L68-L84"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_exim_expl.yar#L68-L84"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
hash = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
logic_hash = "d052792a674dfa2d93a048b550ea085c3b9225662fdb09bf4a602093b0527e38"
@@ -403333,8 +403739,8 @@ rule SIGNATURE_BASE_APT_WEBSHELL_PHP_Sandworm_May20_1 : FILE
date = "2020-05-28"
modified = "2023-12-05"
reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_exim_expl.yar#L86-L101"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_exim_expl.yar#L86-L101"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
hash = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
logic_hash = "0d10f618c7b465c7691d6054e994a76f56c12eb0a36d2d98b5accd2c1e2c1da7"
@@ -403358,8 +403764,8 @@ rule SIGNATURE_BASE_APT_SH_Sandworm_Shell_Script_May20_1 : FILE
date = "2020-05-28"
modified = "2023-12-05"
reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_exim_expl.yar#L103-L129"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_exim_expl.yar#L103-L129"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
hash = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
logic_hash = "b9116585e74ad6159cd31c0c8a84566f981a62ca5b5f82ace8b855a180461071"
@@ -403392,8 +403798,8 @@ rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_1 : FILE
date = "2020-05-28"
modified = "2023-12-05"
reference = "https://twitter.com/billyleonard/status/1266054881225236482"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_exim_expl.yar#L131-L148"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_exim_expl.yar#L131-L148"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c025008463fdbf44b2f845f2d82702805d931771aea4b506573b83c8f58bccca"
logic_hash = "2ccc4c7fc75c04cbcab34904de2e7ab055a15c1017ec0f8d01b06454f4395047"
score = 75
@@ -403417,8 +403823,8 @@ rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_2 : FILE
date = "2020-05-28"
modified = "2023-12-05"
reference = "https://twitter.com/billyleonard/status/1266054881225236482"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_sandworm_exim_expl.yar#L150-L167"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_sandworm_exim_expl.yar#L150-L167"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "abfa83cf54db8fa548942acd845b4f34acc94c46d4e1fb5ce7e97cc0c6596676"
logic_hash = "5fb61a9cef64ecf97adc78bf67db667cfd9e5e6f3e03f1bba8f3cdbf6c257520"
score = 75
@@ -403443,8 +403849,8 @@ rule SIGNATURE_BASE_MAL_Ransomware_Germanwiper : FILE
date = "2019-08-05"
modified = "2023-12-05"
reference = "https://twitter.com/r3c0nst/status/1158326526766657538"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_germanwiper.yar#L1-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_germanwiper.yar#L1-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c"
hash = "708967cad421bb2396017bdd10a42e6799da27e29264f4b5fb095c0e3503e447"
logic_hash = "dcb4f91006a893149a60e9708efb9de809f75c810bddfd2d90c8f6fffa0879ea"
@@ -403476,8 +403882,8 @@ rule SIGNATURE_BASE_SUSP_Claude_Refusal_Magic_String_Jan26
date = "2026-01-29"
modified = "2026-05-15"
reference = "https://x.com/williballenthin/status/2014687699165135150"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_claude_magic_strings.yar#L1-L14"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_claude_magic_strings.yar#L1-L14"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ffa48ed4b7b48897f6756c4222b2606399de0bca627cedfddf61e69986580430"
logic_hash = "ae5b451168d03440f84b89d96db2688f828e5dcbcdd1121edf3fb973571d2dbd"
score = 75
@@ -403499,8 +403905,8 @@ rule SIGNATURE_BASE_MAL_Claude_Refusal_Magic_String_Jan26
date = "2026-01-29"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_claude_magic_strings.yar#L16-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_claude_magic_strings.yar#L16-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "e1c070b77e3568966f605fa47a2b3be917065954bc157e3721ff2fb3ac4d72f7"
score = 80
quality = 85
@@ -403521,8 +403927,8 @@ rule SIGNATURE_BASE_SUSP_Claude_Redacted_Thinking_Magic_String_Jan26_1
date = "2026-01-29"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_claude_magic_strings.yar#L30-L43"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_claude_magic_strings.yar#L30-L43"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ffa48ed4b7b48897f6756c4222b2606399de0bca627cedfddf61e69986580430"
logic_hash = "02b85e9df893d6be91f8053ac67884e5a24893ef225ca0e7b3878b38afb79420"
score = 65
@@ -403544,8 +403950,8 @@ rule SIGNATURE_BASE_SUSP_Claude_Redacted_Thinking_Magic_String_Jan26_2
date = "2026-01-29"
modified = "2026-05-15"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/susp_claude_magic_strings.yar#L45-L57"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_claude_magic_strings.yar#L45-L57"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3b901ffeaff1e4bef579df00e4e99fe8f9eb4ae9ee8e8bde7a730f0fd4646762"
score = 75
quality = 85
@@ -403566,8 +403972,8 @@ rule SIGNATURE_BASE_Ce_Enfal_Cmstar_Debug_Msg : FILE
date = "2015-05-10"
modified = "2023-12-05"
reference = "http://goo.gl/JucrP9"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_cmstar.yar#L2-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_cmstar.yar#L2-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b9cc7e2a2481b0472721e6b87f1eba4faf2d419d1e2c115a91ab7e7e6fc7f7c"
logic_hash = "31251b7ce33eb561aeb7405514df83dc1e00fdf184e3deeaa48505407d9567a0"
score = 75
@@ -403595,8 +404001,8 @@ rule SIGNATURE_BASE_VUL_Exchange_CVE_2020_0688 : FILE
date = "2020-02-26"
modified = "2023-12-05"
reference = "https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vul_cve_2020_0688.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vul_cve_2020_0688.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "035971028d36c8bbcc6a274817187adfbfefe530ff6808af5a7c0b4667c1bd8b"
score = 60
quality = 85
@@ -403618,8 +404024,8 @@ rule SIGNATURE_BASE_MAL_Github_Repo_Compromise_Myjino_Ru_Aug22
date = "2022-08-03"
modified = "2023-12-05"
reference = "https://twitter.com/stephenlacy/status/1554697077430505473"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_github_repo_compromise_myjino_ru.yar#L2-L15"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_github_repo_compromise_myjino_ru.yar#L2-L15"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5cbe6ee46a68d89b1e772762e29baa907458235cd014f20a0d0932e95c046f19"
score = 90
quality = 85
@@ -403641,8 +404047,8 @@ rule SIGNATURE_BASE_Equationgroup_Emptycriss : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L15-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L15-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a698d35a0c4d25fd960bd40c1de1022bb0763b77938bf279e91c9330060b0b91"
logic_hash = "fcfbe4a8a959491dfba9e5d958e43221d83a1e49dcf005872a1b71efb1226d99"
score = 75
@@ -403667,8 +404073,8 @@ rule SIGNATURE_BASE_Equationgroup_Scripme : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L32-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L32-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a1adf1c1caad96e7b7fd92cbf419c4cfa13214e66497c9e46ec274a487cd098a"
logic_hash = "5cffded6563bb3c94868f25e086be8d92837a7656707bf4e6a9e9f375d9ee7e0"
score = 75
@@ -403694,8 +404100,8 @@ rule SIGNATURE_BASE_Equationgroup_Crypttool : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L50-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L50-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "96947ad30a2ab15ca5ef53ba8969b9d9a89c48a403e8b22dd5698145ac6695d2"
logic_hash = "ae2d5eda038326376511450e1f5bd2bbf6264d23df013b005b322d70eb6266a0"
score = 75
@@ -403719,8 +404125,8 @@ rule SIGNATURE_BASE_Equationgroup_Dumppoppy : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L66-L82"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L66-L82"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4a5c01590063c78d03c092570b3206fde211daaa885caac2ab0d42051d4fc719"
logic_hash = "b6fb6a3799196375796da6f3a0169246145e668019dd692da67ca6f06d09c3dc"
score = 75
@@ -403745,8 +404151,8 @@ rule SIGNATURE_BASE_Equationgroup_Auditcleaner : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L84-L102"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L84-L102"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8c172a60fa9e50f0df493bf5baeb7cc311baef327431526c47114335e0097626"
logic_hash = "30a6ae9ce7d02c1d945d57eabf29f430ad4cdbc48dba5fe71654efc2c59fde08"
score = 75
@@ -403773,8 +404179,8 @@ rule SIGNATURE_BASE_Equationgroup_Reverse_Shell : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L104-L118"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L104-L118"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d29aa24e6fb9e3b3d007847e1630635d6c70186a36c4ab95268d28aa12896826"
logic_hash = "6dc388fecbf606b19c04626d64f5fe4184f07c2a1597a6f8337aa4a827b2d89b"
score = 75
@@ -403798,8 +404204,8 @@ rule SIGNATURE_BASE_Equationgroup_Tnmunger : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L120-L134"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L120-L134"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1ab985d84871c54d36ba4d2abd9168c2a468f1ba06994459db06be13ee3ae0d2"
logic_hash = "ddb957ca9350288d0fa98ba20847a99dcba931b5a03d0ae94cd3409f82f728eb"
score = 75
@@ -403823,8 +404229,8 @@ rule SIGNATURE_BASE_Equationgroup_Ys_Ratload : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L136-L151"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L136-L151"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a340e5b5cfd41076bd4d6ad89d7157eeac264db97a9dddaae15d935937f10d75"
logic_hash = "82d00b7eecdb60911ecd933387eeb2ce4eec9721993beee60247d1273ad3368f"
score = 75
@@ -403849,8 +404255,8 @@ rule SIGNATURE_BASE_Equationgroup_Eh_1_1_0 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L153-L168"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L153-L168"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0f8dd094516f1be96da5f9addc0f97bcac8f2a348374bd9631aa912344559628"
logic_hash = "d0972bb57076606b3c84f3cbbb0be85cd5663c7cd6f6d9f09a2991cb6532bfa9"
score = 75
@@ -403875,8 +404281,8 @@ rule SIGNATURE_BASE_Equationgroup_Evolvingstrategy_1_0_1 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L170-L188"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L170-L188"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fe70e16715992cc86bbef3e71240f55c7d73815b4247d7e866c845b970233c1b"
logic_hash = "87d25f1a4ca4a75292ab6cdcd1a79890c4475c2a9b34761ed92988bd517b4497"
score = 75
@@ -403902,8 +404308,8 @@ rule SIGNATURE_BASE_Equationgroup_Toast_V3_2_0 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L190-L205"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L190-L205"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2ce2d16d24069dc29cf1464819a9dc6deed38d1e5ffc86d175b06ddb691b648b"
logic_hash = "a505eaafb6882e2701fe0a9b8712f85c1073d83291436eeaa7f4c52876d12359"
score = 75
@@ -403928,8 +404334,8 @@ rule SIGNATURE_BASE_Equationgroup_Sshobo : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L207-L223"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L207-L223"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c7491898a0a77981c44847eb00fb0b186aa79a219a35ebbca944d627eefa7d45"
logic_hash = "90c892e06ccedb6a3208d728e9f3c27c14bbe1b4c13b63d4a350bbbf38efbe9d"
score = 75
@@ -403955,8 +404361,8 @@ rule SIGNATURE_BASE_Equationgroup_Magicjack_V1_1_0_0_Client_1_1_0_0 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L225-L239"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L225-L239"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "63292a2353275a3bae012717bb500d5169cd024064a1ce8355ecb4e9bfcdfdd1"
logic_hash = "44e853b8d148f84107d29449aa44b2e52226c9d2f397c019aa0f1d347863e388"
score = 75
@@ -403980,8 +404386,8 @@ rule SIGNATURE_BASE_Equationgroup_Packrat : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L241-L256"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L241-L256"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d3e067879c51947d715fc2cf0d8d91c897fe9f50cae6784739b5c17e8a8559cf"
logic_hash = "7e88e14e0d9c8e8f5ccca3bea78b875bf75fbf0dd54badc339237ca94f0d6373"
score = 75
@@ -404006,8 +404412,8 @@ rule SIGNATURE_BASE_Equationgroup_Telex : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L258-L274"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L258-L274"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e9713b15fc164e0f64783e7a2eac189a40e0a60e2268bd7132cfdc624dfe54ef"
logic_hash = "9661bc43831307cb04883cfe8e54ebb2fe72bf3d7731b2b483cd19c40a5aeaa9"
score = 75
@@ -404033,8 +404439,8 @@ rule SIGNATURE_BASE_Equationgroup_Calserver : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L276-L291"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L276-L291"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "048625e9a0ca46d7fe221e262c8dd05e7a5339990ffae2fb65a9b0d705ad6099"
logic_hash = "85080074058703a696ac7f978abd8f4d5234f6553c19736fb52375421c4af42b"
score = 75
@@ -404059,8 +404465,8 @@ rule SIGNATURE_BASE_Equationgroup_Porkclient : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L293-L308"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L293-L308"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5c14e3bcbf230a1d7e2909876b045e34b1486c8df3c85fb582d9c93ad7c57748"
logic_hash = "4de13f1cac8698fc86e44d29143877924aec4e6712415ee6b35810afed8072d6"
score = 75
@@ -404085,8 +404491,8 @@ rule SIGNATURE_BASE_Equationgroup_Electricslide : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L310-L326"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L310-L326"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d27814b725568fa73641e86fa51850a17e54905c045b8b31a9a5b6d2bdc6f014"
logic_hash = "0803b61afc592d4fba523dc54d8f856a557b916a9f6e256efccd50178e8e024c"
score = 75
@@ -404112,8 +404518,8 @@ rule SIGNATURE_BASE_Equationgroup_Libxmexploit2 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L328-L343"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L328-L343"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d7ed0234d074266cb37dd6a6a60119adb7d75cc6cc3b38654c8951b643944796"
logic_hash = "7bd88d15cca38e91c65e8373194e35ab9492a80eb27b22ad4000e192f2d9b886"
score = 75
@@ -404138,8 +404544,8 @@ rule SIGNATURE_BASE_Equationgroup_Wrap_Telnet : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L345-L360"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L345-L360"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4962b307a42ba18e987d82aa61eba15491898978d0e2f0e4beb02371bf0fd5b4"
logic_hash = "aa7fda8b95b697bb0541642677579f9db9df379048421481cdb66068032bf681"
score = 75
@@ -404164,8 +404570,8 @@ rule SIGNATURE_BASE_Equationgroup_Elgingamble
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L362-L378"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L362-L378"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0573e12632e6c1925358f4bfecf8c263dd13edf52c633c9109fe3aae059b49dd"
logic_hash = "e561794d969b6198f71115087db8cc89043f2079252eef22458450e16596b0eb"
score = 75
@@ -404191,8 +404597,8 @@ rule SIGNATURE_BASE_Equationgroup_Cmsd : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L380-L397"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L380-L397"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "634c50614e1f5f132f49ae204c4a28f62a32a39a3446084db5b0b49b564034b8"
logic_hash = "2b9c7ef750c2e45df7839395db51c93204bc9855f5de05bd59c50bb6a964bc8b"
score = 75
@@ -404218,8 +404624,8 @@ rule SIGNATURE_BASE_Equationgroup_Ebbshave : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L399-L415"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L399-L415"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eb5e0053299e087c87c2d5c6f90531cc1946019c85a43a2998c7b66a6f19ca4b"
logic_hash = "8a1a5ddefc646dc55161eb9b2a1b0e4176df7e99660db48b245af3ef9ab0871c"
score = 75
@@ -404245,8 +404651,8 @@ rule SIGNATURE_BASE_Equationgroup_Eggbasket : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L417-L432"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L417-L432"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b078a02963610475217682e6e1d6ae0b30935273ed98743e47cc2553fbfd068f"
logic_hash = "e4800d5c820a18d3483dc5c055c0e2f5374ce3b160ecb4d940a00ec4a90ca50d"
score = 75
@@ -404271,8 +404677,8 @@ rule SIGNATURE_BASE_Equationgroup_Jparsescan : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L434-L448"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L434-L448"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8c248eec0af04300f3ba0188fe757850d283de84cf42109638c1c1280c822984"
logic_hash = "d86b6757abb5ad1902e91f100e6a6bea52e6e14684d184b6b8138270484275f4"
score = 75
@@ -404296,8 +404702,8 @@ rule SIGNATURE_BASE_Equationgroup_Sambal : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L450-L467"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L450-L467"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2abf4bbe4debd619b99cb944298f43312db0947217437e6b71b9ea6e9a1a4fec"
logic_hash = "6066332b16996a9d8635d3752f46c6529cfc2c94d3d6f0c9791f2068c982bf3e"
score = 75
@@ -404324,8 +404730,8 @@ rule SIGNATURE_BASE_Equationgroup_Pclean_V2_1_1_2 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L469-L483"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L469-L483"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cdb5b1173e6eb32b5ea494c38764b9975ddfe83aa09ba0634c4bafa41d844c97"
logic_hash = "9323ef0c76348d242b010cf0f1c6a1bf5dd120a02418350bb0ed137f468ac624"
score = 75
@@ -404349,8 +404755,8 @@ rule SIGNATURE_BASE_Equationgroup_Envisioncollision : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L485-L501"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L485-L501"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "75d5ec573afaf8064f5d516ae61fd105012cbeaaaa09c8c193c7b4f9c0646ea1"
logic_hash = "8cd8c24b212ca71feb6093682fc614c88790c10d7c7d72dac65b047e5791894a"
score = 75
@@ -404376,8 +404782,8 @@ rule SIGNATURE_BASE_Equationgroup_Cmsex : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L503-L520"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L503-L520"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2d8ae842e7b16172599f061b5b1f223386684a7482e87feeb47a38a3f011b810"
logic_hash = "997e08a49c5ae82bcc590e5febd449a4d3e9098f5aa154ccc0824b976f0a6365"
score = 75
@@ -404404,8 +404810,8 @@ rule SIGNATURE_BASE_Equationgroup_Exze : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L522-L537"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L522-L537"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1af6dde6d956db26c8072bf5ff26759f1a7fa792dd1c3498ba1af06426664876"
logic_hash = "b8678f58da689be9507a345b6b80ece6cdb7a78d73db339bdc15ad0a66b4a2e6"
score = 75
@@ -404430,8 +404836,8 @@ rule SIGNATURE_BASE_Equationgroup_DUL : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L539-L553"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L539-L553"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "24d1d50960d4ebf348b48b4db4a15e50f328ab2c0e24db805b106d527fc5fe8e"
logic_hash = "55df9a844352babf0c30075139e2a62cbf9db898280546d27b172e4d611ce1c0"
score = 75
@@ -404455,8 +404861,8 @@ rule SIGNATURE_BASE_Equationgroup_Slugger2 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L555-L574"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L555-L574"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a6a9ab66d73e4b443a80a69ef55a64da7f0af08dfaa7e17eb19c327301a70bdf"
logic_hash = "3c736fdfa96d5e99bc4d093c03a81b8a4f58501ec8c03a2891f9f694d88b5284"
score = 75
@@ -404484,8 +404890,8 @@ rule SIGNATURE_BASE_Equationgroup_Ebbisland : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L576-L594"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L576-L594"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eba07c98c7e960bb6c71dafde85f5da9f74fd61bc87793c87e04b1ae2d77e977"
logic_hash = "1f4b5054d4239e23146f0764ffe9037b658ecdb9a5f479956c5c45abc1012a17"
score = 75
@@ -404513,8 +404919,8 @@ rule SIGNATURE_BASE_Equationgroup_Jackpop : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L596-L614"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L596-L614"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0b208af860bb2c7ef6b1ae1fcef604c2c3d15fc558ad8ea241160bf4cbac1519"
logic_hash = "6efc4ccd2727f93713ad35dc1f054fa25e976e8c3d95f00226fbd56d7f1ce30b"
score = 75
@@ -404541,8 +404947,8 @@ rule SIGNATURE_BASE_Equationgroup_Parsescan : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L616-L630"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L616-L630"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "942c12067b0afe9ebce50aa9dfdbf64e6ed0702d9a3a00d25b4fca62a38369ef"
logic_hash = "25e0bc21f93cd72814cd6114883ed903af84a62dced126201b6037a476dbd2cd"
score = 75
@@ -404566,8 +404972,8 @@ rule SIGNATURE_BASE_Equationgroup_Jscan : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L632-L646"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L632-L646"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8075f56e44185e1be26b631a2bad89c5e4190c2bfc9fa56921ea3bbc51695dbe"
logic_hash = "d3bbdb90da9fa5b8b41a8b5d35a9b42e4fa15f291146575b0ef22e81441dcbde"
score = 75
@@ -404591,8 +404997,8 @@ rule SIGNATURE_BASE_Equationgroup_Promptkill : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L648-L662"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L648-L662"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b448204503849926be249a9bafbfc1e36ef16421c5d3cfac5dac91f35eeaa52d"
logic_hash = "7b46161b8cbb9a539171349b3e2a58f8e5a48c344b6d99020b3e96da9c878771"
score = 75
@@ -404616,8 +405022,8 @@ rule SIGNATURE_BASE_Equationgroup_Epoxyresin_V1_0_0 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L664-L681"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L664-L681"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eea8a6a674d5063d7d6fc9fe07060f35b16172de6d273748d70576b01bf01c73"
logic_hash = "c1cbc18f05b299837463aa27a9c47ea0355ca5974b2c6ab1e0a18cc9ad1b26a1"
score = 75
@@ -404643,8 +405049,8 @@ rule SIGNATURE_BASE_Equationgroup_Estopmoonlit : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L683-L699"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L683-L699"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "707ecc234ed07c16119644742ebf563b319b515bf57fd43b669d3791a1c5e220"
logic_hash = "06293b6f48d2595f3426088cddc4b0c4d1ebc1de90fa640d5b5e806a45a2b6bd"
score = 75
@@ -404670,8 +405076,8 @@ rule SIGNATURE_BASE_Equationgroup_Envoytomato : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L701-L715"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L701-L715"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9bd001057cc97b81fdf2450be7bf3b34f1941379e588a7173ab7fffca41d4ad5"
logic_hash = "f15b3b4281ec45a7a71c9bf8b88c60befec665f78b76a615c5912a6b7f94235b"
score = 75
@@ -404695,8 +405101,8 @@ rule SIGNATURE_BASE_Equationgroup_Smash : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L717-L732"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L717-L732"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1dc94b46aaff06d65a3bf724c8701e5f095c1c9c131b65b2f667e11b1f0129a6"
logic_hash = "073496e34dded05be40ee851442f9c0ec998f35e02a5d4221677a195b792f786"
score = 75
@@ -404721,8 +405127,8 @@ rule SIGNATURE_BASE_Equationgroup_Ratload : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L734-L749"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L734-L749"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4a4a8f2f90529bee081ce2188131bac4e658a374a270007399f80af74c16f398"
logic_hash = "34298175663a01b26e317c31c720f2f4fe93a5c7e375c9642664479d8672e8cd"
score = 75
@@ -404747,8 +405153,8 @@ rule SIGNATURE_BASE_Equationgroup_Ys : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L751-L766"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L751-L766"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a6387307d64778f8d9cfc60382fdcf0627cde886e952b8d73cc61755ed9fde15"
logic_hash = "4962cc732ce3dea6dc52c7d91ce94089eb4498ba4c442ecc6363ea75de47de31"
score = 75
@@ -404773,8 +405179,8 @@ rule SIGNATURE_BASE_Equationgroup_Ewok : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L768-L784"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L768-L784"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "567da502d7709b7814ede9c7954ccc13d67fc573f3011db04cf212f8e8a95d72"
logic_hash = "d10d75885daa8cd20e5d7d7e142d1e7a2dbc10a50debf7892629f67b948bbdbe"
score = 75
@@ -404800,8 +405206,8 @@ rule SIGNATURE_BASE_Equationgroup_Xspy : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L786-L799"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L786-L799"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "841e065c9c340a1e522b281a39753af8b6a3db5d9e7d8f3d69e02fdbd662f4cf"
logic_hash = "94ab45d6c94c63c5c9c68ee3d509143af4eb574058c0cd4f26eed8058dbd9213"
score = 75
@@ -404824,8 +405230,8 @@ rule SIGNATURE_BASE_Equationgroup_Estesfox
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L801-L814"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L801-L814"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "33530cae130ee9d9deeee60df9292c00242c0fe6f7b8eedef8ed09881b7e1d5a"
logic_hash = "bfbc8ac62dcb61b492b1803de535f51ceb54ac83e45071270a6ef5faeaa521b2"
score = 75
@@ -404848,8 +405254,8 @@ rule SIGNATURE_BASE_Equationgroup_Elatedmonkey_1_0_1_1 : FILE
date = "2017-04-08"
modified = "2022-08-18"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L816-L832"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L816-L832"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "bf7a9dce326604f0681ca9f7f1c24524543b5be8b6fcc1ba427b18e2a4ff9090"
logic_hash = "756337ecb951357c5440ea2fe010982089539c35dc556288d61db6de22348c1f"
score = 75
@@ -404874,8 +405280,8 @@ rule SIGNATURE_BASE_Equationgroup_Scanner : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L834-L849"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L834-L849"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dcbcd8a98ec93a4e877507058aa26f0c865b35b46b8e6de809ed2c4b3db7e222"
logic_hash = "b0454fd41d3591fc5811da6407a422b7c28d0b923109cdfa85b337cc7fffb178"
score = 75
@@ -404900,8 +405306,8 @@ rule SIGNATURE_BASE_Equationgroup__Ftshell_Ftshell_V3_10_3_0 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L853-L871"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L853-L871"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9bebeb57f1c9254cb49976cc194da4be85da4eb94475cb8d813821fb0b24f893"
hash = "0be739024b41144c3b63e40e46bab22ac098ccab44ab2e268efc3b63aea02951"
logic_hash = "1eb7915fd057b2cc5f788ca11b3c71210ce5e7ac29c52790c249490435e62926"
@@ -404929,8 +405335,8 @@ rule SIGNATURE_BASE_Equationgroup__Scanner_Scanner_V2_1_2 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L873-L892"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L873-L892"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dcbcd8a98ec93a4e877507058aa26f0c865b35b46b8e6de809ed2c4b3db7e222"
hash = "9807aaa7208ed6c5da91c7c30ca13d58d16336ebf9753a5cea513bcb59de2cff"
logic_hash = "3c42aaacea1347fd64d7f91421f692e77e33e273d4c2e71806ef7f5f086aba11"
@@ -404959,8 +405365,8 @@ rule SIGNATURE_BASE_Equationgroup__Ghost_Sparc_Ghost_X86_3 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L894-L912"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L894-L912"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d5ff0208d9532fc0c6716bd57297397c8151a01bf4f21311f24e7a72551f9bf1"
hash = "82c899d1f05b50a85646a782cddb774d194ef85b74e1be642a8be2c7119f4e33"
logic_hash = "c4ad8e06934c1ece520863951f14cbf86d1bc4bba97aede1d58def1e5c7df4eb"
@@ -404988,8 +405394,8 @@ rule SIGNATURE_BASE_Equationgroup__Pclean_V2_1_1_Pclean_V2_1_1_4 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L914-L930"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L914-L930"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cdb5b1173e6eb32b5ea494c38764b9975ddfe83aa09ba0634c4bafa41d844c97"
hash = "ab7f26faed8bc2341d0517d9cb2bbf41795f753cd21340887fc2803dc1b9a1dd"
logic_hash = "5622d6fff876fa5d07795491d14f0396378c1b07b69cf8bcabb5e0bd3c19e72a"
@@ -405015,8 +405421,8 @@ rule SIGNATURE_BASE_Equationgroup__Jparsescan_Parsescan_5 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L932-L950"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L932-L950"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8c248eec0af04300f3ba0188fe757850d283de84cf42109638c1c1280c822984"
hash = "942c12067b0afe9ebce50aa9dfdbf64e6ed0702d9a3a00d25b4fca62a38369ef"
logic_hash = "719baa53db53f4cc4f3e9ed935814e42e5cb4b7fb8eaaa373feb73df69bfcde0"
@@ -405044,8 +405450,8 @@ rule SIGNATURE_BASE_Equationgroup__Funnelout_V4_1_0_1 : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L952-L969"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L952-L969"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "457ed14e806fdbda91c4237c8dc058c55e5678f1eecdd78572eff6ca0ed86d33"
logic_hash = "ae0b387725017de2766593ea55677dca36eee68107e0692a7d5e2526db74765b"
score = 75
@@ -405072,8 +405478,8 @@ rule SIGNATURE_BASE_Equationgroup__Magicjack_V1_1_0_0_Client : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L971-L988"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L971-L988"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "63292a2353275a3bae012717bb500d5169cd024064a1ce8355ecb4e9bfcdfdd1"
logic_hash = "5e22b01aa9b1283fa7a326b7c0f8047ed373fac750c89e9ba02c49f0f454e275"
score = 75
@@ -405100,8 +405506,8 @@ rule SIGNATURE_BASE_Equationgroup__Ftshell : FILE
date = "2017-04-08"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L990-L1007"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L990-L1007"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9bebeb57f1c9254cb49976cc194da4be85da4eb94475cb8d813821fb0b24f893"
hash = "0be739024b41144c3b63e40e46bab22ac098ccab44ab2e268efc3b63aea02951"
logic_hash = "84c646b2c81f870f650fafd26471017b00b3b7020e72390f818304958e694572"
@@ -405128,8 +405534,8 @@ rule SIGNATURE_BASE_Equationgroup_Store_Linux_I386_V_3_3_0 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1018-L1033"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1018-L1033"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "abc27fda9a0921d7cf2863c29768af15fdfe47a0b3e7a131ef7e5cc057576fbc"
logic_hash = "f284c2fecee23f01f83e0534d7d56a88b102e6dcc02a26321fe246604dc8cb0e"
score = 75
@@ -405154,8 +405560,8 @@ rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Genkey : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1035-L1049"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1035-L1049"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0ce455fb7f46e54a5db9bef85df1087ff14d2fc60a88f2becd5badb9c7fe3e89"
logic_hash = "c1d823e297b0b1f47f12a3240d59f5ecc482f1140e5b2962f76ec2fff719664a"
score = 75
@@ -405179,8 +405585,8 @@ rule SIGNATURE_BASE_Equationgroup_Cursetingle_2_0_1_2_Mswin32_V_2_0_1 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1051-L1065"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1051-L1065"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "614bf159b956f20d66cedf25af7503b41e91841c75707af0cdf4495084092a61"
logic_hash = "bc27edc946beb5065d4fe43e53a33b448c24c7dd3eae0cedd4770c02fce7836b"
score = 75
@@ -405204,8 +405610,8 @@ rule SIGNATURE_BASE_Equationgroup_Cursesleepy_Mswin32_V_1_0_0 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1067-L1082"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1067-L1082"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6293439b4b49e94f923c76e302f5fc437023c91e063e67877d22333f05a24352"
logic_hash = "0dcbf2b314ff9c392ae0cb4f14762dd20c6b85f7f547af683db3aea1c57dee57"
score = 75
@@ -405230,8 +405636,8 @@ rule SIGNATURE_BASE_Equationgroup_Cursehelper_Win2K_I686_V_2_2_0 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1084-L1100"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1084-L1100"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5ac6fde8a06f4ade10d672e60e92ffbf78c4e8db6b5152e23171f6f53af0bfe1"
logic_hash = "f6c92fc3540750a1223682b1672575b3a3120f5ebf63190a9b31d7e4e5ce13c7"
score = 75
@@ -405256,8 +405662,8 @@ rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Addkey : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1102-L1117"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1102-L1117"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6c67c03716d06a99f20c1044585d6bde7df43fee89f38915db0b03a42a3a9f4b"
logic_hash = "ec5b7499e3c3cc6b581c381ae61a4c987691c0d93dd589a5907fd7419335963a"
score = 75
@@ -405282,8 +405688,8 @@ rule SIGNATURE_BASE_Equationgroup_Noclient_3_3_2 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1119-L1136"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1119-L1136"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3cf0eb010c431372af5f32e2ee8c757831215f8836cabc7d805572bb5574fc72"
logic_hash = "14b1f135da81fd9a071e0f692bc7f1ab6f6f63d7dd05e1557e5c2d51135727b6"
score = 75
@@ -405310,8 +405716,8 @@ rule SIGNATURE_BASE_Equationgroup_Curseflower_Mswin32_V_1_0_0 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1138-L1153"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1138-L1153"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fdc452629ff7befe02adea3a135c3744d8585af890a4301b2a10a817e48c5cbf"
logic_hash = "e70954945b3a5e08e5ae216b16702056b403dbf14391276eae1ed13e8273c1ee"
score = 75
@@ -405335,8 +405741,8 @@ rule SIGNATURE_BASE_Equationgroup_Tmpwatch : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1155-L1169"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1155-L1169"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "65ed8066a3a240ee2e7556da74933a9b25c5109ffad893c21a626ea1b686d7c1"
logic_hash = "6fab5100f6ee0bf9a4e13e262c8d47e600f5aad64c7e04fe08fa42a5d78c38e8"
score = 75
@@ -405360,8 +405766,8 @@ rule SIGNATURE_BASE_Equationgroup_Orleans_Stride_Sunos5_9_V_2_4_0 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1171-L1186"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1171-L1186"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6a30efb87b28e1a136a66c7708178c27d63a4a76c9c839b2fc43853158cb55ff"
logic_hash = "1380b22e661926ebb2878d89c80e115a58d0bfc060681a55564c97c1e9f36765"
score = 75
@@ -405386,8 +405792,8 @@ rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Noprep : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1188-L1203"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1188-L1203"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a5b191a8ede8297c5bba790ef95201c516d64e2898efaeb44183f8fdfad578bb"
logic_hash = "c27815333e05d318bc32d01e755386bc1d1dbfd9f2b92a460fbd0f703e9ba210"
score = 75
@@ -405412,8 +405818,8 @@ rule SIGNATURE_BASE_Equationgroup_Cursezinger_Linuxrh7_3_V_2_0_0 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1205-L1221"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1205-L1221"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "af7c7d03f59460fa60c48764201e18f3bd3f72441fd2e2ff6a562291134d2135"
logic_hash = "fa56fe4dd44d266741a3f0b0edfc24660b260c1ade45c23171f22bc43a3bee75"
score = 75
@@ -405439,8 +405845,8 @@ rule SIGNATURE_BASE_Equationgroup_Seconddate_Implantstandalone_3_0_3 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1223-L1238"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1223-L1238"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d687aa644095c81b53a69c206eb8d6bdfe429d7adc2a57d87baf8ff8d4233511"
logic_hash = "8d56f471104bfb2ef2bf730e5a8b60c123706f12eb52226895b123b16eed2883"
score = 75
@@ -405465,8 +405871,8 @@ rule SIGNATURE_BASE_Equationgroup_Watcher_Solaris_I386_V_3_3_0 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1240-L1256"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1240-L1256"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "395ec2531970950ffafde234dded0cce0c95f1f9a22763d1d04caa060a5222bb"
logic_hash = "61ded97e99e6bdfe2738c6d73719b3182d970aba8ea9d7cab751349669129de2"
score = 75
@@ -405492,8 +405898,8 @@ rule SIGNATURE_BASE_Equationgroup_Gr_Dev_Bin_Now : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1258-L1272"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1258-L1272"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f5ed8312fc6e624b04e1e2d6614f3c651c9e9902ff41f4d069c32caca0869fa4"
logic_hash = "1d7f009c5593ac1b1517024b828b016d705b63f6812a49d909f35c34b936e6d7"
score = 75
@@ -405517,8 +405923,8 @@ rule SIGNATURE_BASE_Equationgroup_Gr_Dev_Bin_Post : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1274-L1287"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1274-L1287"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c1546155efa95dbc4e3cc95299a3968fc075f89d33164e78b00b76c7d08a0591"
logic_hash = "ffd95302df11d1ebab37817e967a1ad4d1e85e62b38a0ccd6adf0f36925e64c1"
score = 75
@@ -405541,8 +405947,8 @@ rule SIGNATURE_BASE_Equationgroup_Curseyo_Win2K_V_1_0_0 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1289-L1306"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1289-L1306"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5dc77614764b23a38610fdd8abe5b2274222f206889e4b0974a3fea569055ed6"
logic_hash = "ad9bb848a0c4805a14465ff44e3c967c9afa7369536a211a8a1fb100902fbb55"
score = 75
@@ -405568,8 +405974,8 @@ rule SIGNATURE_BASE_Equationgroup_Gr : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1308-L1322"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1308-L1322"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d3cd725affd31fa7f0e2595f4d76b09629918612ef0d0307bb85ade1c3985262"
logic_hash = "6df2a36e51fbe23e090094a91da76ca881a65d7e129c6e428ffef13787f230bc"
score = 75
@@ -405593,8 +405999,8 @@ rule SIGNATURE_BASE_Equationgroup_Curseroot_Win2K_V_2_1_0 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1324-L1340"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1324-L1340"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a1637948ed6ebbd2e582eb99df0c06b27a77c01ad1779b3d84c65953ca2cb603"
logic_hash = "64ea35c9287ed35b5e7fbc8aaa228f87bc003111dd6fc35f5277eeea5f371a2c"
score = 75
@@ -405620,8 +406026,8 @@ rule SIGNATURE_BASE_Equationgroup_Cursewham_Curserazor_Cursezinger_Curseroot_Win
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1342-L1362"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1342-L1362"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "aff27115ac705859871ab1bf14137322d1722f63705d6aeada43d18966843225"
hash = "7a25e26950bac51ca8d37cec945eb9c38a55fa9a53bc96da53b74378fb10b67e"
logic_hash = "a5a8e6a516b51c2eed616c80a1162990c1dda4460ec7786793d66820ca15b5a4"
@@ -405650,8 +406056,8 @@ rule SIGNATURE_BASE_Equationgroup_Watcher_Linux_I386_V_3_3_0 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1364-L1381"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1364-L1381"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ce4c9bfa25b8aad8ea68cc275187a894dec5d79e8c0b2f2f3ec4184dc5f402b8"
logic_hash = "245662b561178f4d929ed858811846b2a49dc80af25396864a3d7bd90d16ac2b"
score = 75
@@ -405678,8 +406084,8 @@ rule SIGNATURE_BASE_Equationgroup_Charm_Saver_Win2K_V_2_0_0 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1383-L1399"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1383-L1399"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0f7936a37482532a8ba5df4112643ed7579dd0e59181bfca9c641b9ba0a9912f"
logic_hash = "87cea1f46a3165485274165e840a4945d6f6a6f9ff7fd011e685e8bb90acae8a"
score = 75
@@ -405704,8 +406110,8 @@ rule SIGNATURE_BASE_Equationgroup_Cursehappy_Win2K_V_6_1_0 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1401-L1415"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1401-L1415"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "eb669afd246a7ac4de79724abcce5bda38117b3138908b90cac58936520ea632"
logic_hash = "3bf5878c3be20a7a543d4937c6d820df726062e39ee262a6c31f7e91b32fd55e"
score = 75
@@ -405729,8 +406135,8 @@ rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Store : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1417-L1433"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1417-L1433"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "619944358bc0e1faffd652b6af0600de055c5e7f1f1d91a8051ed9adf5a5b465"
logic_hash = "34dc21d933d56b6f6c342ca110d9cff7bb51d9fd1b88b359861e5b5650679ad0"
score = 75
@@ -405756,8 +406162,8 @@ rule SIGNATURE_BASE_Equationgroup_Watcher_Linux_X86_64_V_3_3_0 : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1435-L1450"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1435-L1450"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a8d65593f6296d6d06230bcede53b9152842f1eee56a2a72b0a88c4f463a09c3"
logic_hash = "be2ca3791ef1025db6a1dd6bcdf1a9f0b224c3f7585af4546029840251c50094"
score = 75
@@ -405782,8 +406188,8 @@ rule SIGNATURE_BASE_Equationgroup_Linux_Exactchange : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1452-L1472"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1452-L1472"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dfecaf5b85309de637b84a686dd5d2fca9c429e8285b7147ae4213c1f49d39e6"
hash = "6ef6b7ec1f1271503957cf10bb6b1bfcedb872d2de3649f225cf1d22da658bec"
hash = "39d4f83c7e64f5b89df9851bdba917cf73a3449920a6925b6cd379f2fdec2a8b"
@@ -405813,8 +406219,8 @@ rule SIGNATURE_BASE_Equationgroup_X86_Linux_Exactchange : FILE
date = "2017-04-09"
modified = "2023-12-05"
reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1474-L1490"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1474-L1490"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dfecaf5b85309de637b84a686dd5d2fca9c429e8285b7147ae4213c1f49d39e6"
hash = "6ef6b7ec1f1271503957cf10bb6b1bfcedb872d2de3649f225cf1d22da658bec"
logic_hash = "9365eb74a364eb83150672919ea1abe635465fe3239fff26ba91037c74971466"
@@ -405840,8 +406246,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eclipsedwing_Rpcproxy_Pcdlllaunc
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1502-L1519"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1502-L1519"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "48251fb89c510fb3efa14c4b5b546fbde918ed8bb25f041a801e3874bd4f60f8"
hash = "237c22f4d43fdacfcbd6e1b5f1c71578279b7b06ea8e512b4b6b50f10e8ccf10"
hash = "79a584c127ac6a5e96f02a9c5288043ceb7445de2840b608fc99b55cf86507ed"
@@ -405868,8 +406274,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Explodingcantouch_1_2_1 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1521-L1536"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1521-L1536"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0cdde7472b077610d0068aa7e9035da89fe5d435549749707cae24495c8d8444"
logic_hash = "9239a61e71c86fc239f75baa9c781da18553e3c502495ad7429eaf3c744e870c"
score = 75
@@ -405894,8 +406300,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Architouch_1_0_0 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1538-L1551"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1538-L1551"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "444979a2387530c8fbbc5ddb075b15d6a4717c3435859955f37ebc0f40a4addc"
logic_hash = "cb6959b7b50e6f2895bab5f3355bef836c9a9774285cfb5fea339ce3d2c67f73"
score = 75
@@ -405918,8 +406324,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Erraticgopher_1_0_1 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1553-L1569"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1553-L1569"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3d11fe89ffa14f267391bc539e6808d600e465955ddb854201a1f31a9ded4052"
logic_hash = "6b099bd202a962e64cb4f417eb7e09893b869e950eb0740394d222e8b4b89283"
score = 75
@@ -405945,8 +406351,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Esteemaudit_2_1_0 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1571-L1585"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1571-L1585"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "61f98b12c52739647326e219a1cf99b5440ca56db3b6177ea9db4e3b853c6ea6"
logic_hash = "272d435758c0021bfd84d84c00eb05ece2461a39d092693b61d362365ab098cd"
score = 75
@@ -405970,8 +406376,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Darkpulsar_1_1_0 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1587-L1601"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1587-L1601"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b439ed18262aec387984184e86bfdb31ca501172b1c066398f8c56d128ba855a"
logic_hash = "da8e1723da9e2d9955a3042bceb313d7d10903bfc078ba090c1c5a57be243b96"
score = 75
@@ -405995,8 +406401,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Educatedscholar_1_0_0 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1603-L1617"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1603-L1617"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4cce9e39c376f67c16df3bcd69efd9b7472c3b478e2e5ef347e1410f1105c38d"
logic_hash = "0265ce5dfb5697a0610a6023b75f6e3ef2ef0308f639978a8617337df2e16c77"
score = 75
@@ -406020,8 +406426,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Doublepulsar_1_3_1 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1619-L1634"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1619-L1634"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13"
logic_hash = "1b7ed9dbd4312541bd4d939602f63ce1d909729cce1845b018be6a07a9cb7fe2"
score = 75
@@ -406046,8 +406452,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Erraticgophertouch_1_0_1 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1636-L1651"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1636-L1651"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "729eacf20fe71bd74e57a6b829b45113c5d45003933118b53835779f0b049bad"
logic_hash = "08646f7887daddd8efac875bc7b111df7a52feae0a4b81bfd2d2ae7ef9453b5e"
score = 75
@@ -406072,8 +406478,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Smbtouch_1_1_1 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1653-L1666"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1653-L1666"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "108243f61c53f00f8f1adcf67c387a8833f1a2149f063dd9ef29205c90a3c30a"
logic_hash = "b5eb9d45dfc47470236923a5b8174bc17733e4333db6f8bbe63c4f4bc913cf26"
score = 75
@@ -406096,8 +406502,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Educatedscholartouch_1_0_0 : FIL
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1668-L1682"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1668-L1682"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f4b958a0d3bb52cb34f18ea293d43fa301ceadb4a259d3503db912d0a9a1e4d8"
logic_hash = "4c06fad158db8337ff768ad1553401ec31eee6b0d50333ce91a3a12e79d8981a"
score = 75
@@ -406121,8 +406527,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Esteemaudittouch_2_1_0 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1684-L1698"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1684-L1698"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f6b9caf503bb664b22c6d39c87620cc17bdb66cef4ccfa48c31f2a3ae13b4281"
logic_hash = "f4e62ec7a68115d5ff155ea94fb2c99b9177e928533338a111e531c694ff7b8f"
score = 75
@@ -406146,8 +406552,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Rpctouch_2_1_0 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1700-L1714"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1700-L1714"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7fe4c3cedfc98a3e994ca60579f91b8b88bf5ae8cf669baa0928508642c5a887"
logic_hash = "3ea1f30c0a2c91cc9ca2eec8eaab167c83f4f52c2732d03d1e7fb99e63986662"
score = 75
@@ -406171,8 +406577,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mofconfig_1_0_0 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1716-L1729"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1716-L1729"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c67a24fe2380331a101d27d6e69b82d968ccbae54a89a2629b6c135436d7bdb2"
logic_hash = "a922eb01efa52601b72c3d91a26585504fcf706a9ed16a36328f94f5871b0b24"
score = 75
@@ -406195,8 +406601,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Easypi_Explodingcan : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1731-L1747"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1731-L1747"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dc1ddad7e8801b5e37748ec40531a105ba359654ffe8bdb069bd29fb0b5afd94"
hash = "97af543cf1fb59d21ba5ec6cb2f88c8c79c835f19c8f659057d2f58c321a0ad4"
logic_hash = "c5978d8cbffde2339cadd84f44d1df24e76f298a2f05bd9a6565246bfae1b1e3"
@@ -406222,8 +406628,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eclipsedwingtouch_1_0_4 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1749-L1763"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1749-L1763"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "46da99d80fc3eae5d1d5ab2da02ed7e61416e1eafeb23f37b180c46e9eff8a1c"
logic_hash = "4707dbbb302b9b2192bdd23e4b64e25b5b2f49c3dd7951905a07cb5b54d524d9"
score = 75
@@ -406247,8 +406653,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Iistouch_1_2_2 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1765-L1779"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1765-L1779"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c433507d393a8aa270576790acb3e995e22f4ded886eb9377116012e247a07c6"
logic_hash = "f4f5e17d3777d6ae8bfd0646eeffcd631331e4d8966f5124ebc9352438dc790f"
score = 75
@@ -406272,8 +406678,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Namedpipetouch_2_0_0 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1781-L1800"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1781-L1800"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cb5849fcbc473c7df886828d225293ffbd8ee58e221d03b840fd212baeda6e89"
hash = "043d1c9aae6be65f06ab6f0b923e173a96b536cf84e57bfd7eeb9034cd1df8ea"
logic_hash = "63d4395db4672b7a146dbd285e42344fb895b38f67fa9f7885b73855d7211190"
@@ -406301,8 +406707,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Easybee_1_0_1 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1802-L1816"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1802-L1816"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "59c17d6cb564edd32c770cd56b5026e4797cf9169ff549735021053268b31611"
logic_hash = "e3488a1d686b9ad468553cfe2c939e70ea6b9a21409df8b06bb54418495576ec"
score = 75
@@ -406326,8 +406732,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Regread_1_1_1 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1818-L1832"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1818-L1832"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "722f034ba634f45c429c7dafdbff413c08976b069a6b30ec91bfa5ce2e4cda26"
logic_hash = "5bf833d7fb073ad74037cf6df4729c75d50641a46a962aee8deac19e31b74419"
score = 75
@@ -406351,8 +406757,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Englishmansdentist_1_2_0 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1834-L1848"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1834-L1848"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2a6ab28885ad7d5d64ac4c4fb8c619eca3b7fb3be883fc67c90f3ea9251f34c6"
logic_hash = "cd415731c1c8398d2b0b1758c4e7eb3e708620b269f9312cf0a750ab2099162e"
score = 75
@@ -406376,8 +406782,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Architouch_Eternalsynergy_Smbtou
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1850-L1870"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1850-L1870"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "444979a2387530c8fbbc5ddb075b15d6a4717c3435859955f37ebc0f40a4addc"
hash = "92c6a9e648bfd98bbceea3813ce96c6861487826d6b2c3d462debae73ed25b34"
hash = "108243f61c53f00f8f1adcf67c387a8833f1a2149f063dd9ef29205c90a3c30a"
@@ -406406,8 +406812,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eternalromance_2 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1872-L1889"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1872-L1889"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d"
hash = "b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b"
hash = "92c6a9e648bfd98bbceea3813ce96c6861487826d6b2c3d462debae73ed25b34"
@@ -406434,8 +406840,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Emphasismine : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1891-L1910"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1891-L1910"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "dcaf91bd4af7cc7d1fb24b5292be4e99c7adf4147892f6b3b909d1d84dd4e45b"
hash = "348eb0a6592fcf9da816f4f7fc134bcae1b61c880d7574f4e19398c4ea467f26"
logic_hash = "20ec32f5e9e439fb212985d5ae104ae5742231f594423cd125a9e64ed6eb234a"
@@ -406464,8 +406870,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eternalromance : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1912-L1930"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1912-L1930"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d"
hash = "b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b"
logic_hash = "757740038b9b1e1d099bb208104e9f48e7eb57ffb2de09e83c66df7914b816cb"
@@ -406493,8 +406899,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen4 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1932-L1963"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1932-L1963"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fe7ce2fdb245c62e4183c728bc97e966a98fdc8ffd795ed09da23f96e85dcdcd"
hash = "0989bfe351342a7a1150b676b5fd5cbdbc201b66abcb23137b1c4de77a8f61a6"
hash = "270850303e662be53d90fa60a9e5f4bd2bfb95f92a046c77278257631d9addf4"
@@ -406534,8 +406940,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen1 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1965-L1984"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1965-L1984"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1b5b33931eb29733a42d18d8ee85b5cd7d53e81892ff3e60e2e97f3d0b184d31"
hash = "139697168e4f0a2cc73105205c0ddc90c357df38d93dbade761392184df680c7"
logic_hash = "cd40d51ba26706517dae332d84f574eb206a424693cfb586375695e364990b5d"
@@ -406564,8 +406970,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen2 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L1986-L2012"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L1986-L2012"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7fe425cd040608132d4f4ab2671e04b340a102a20c97ffdcf1b75be43a9369b5"
hash = "561c0d4fc6e0ff0a78613d238c96aed4226fbb7bb9ceea1d19bc770207a6be1e"
hash = "f2e90e04ddd05fa5f9b2fec024cd07365aebc098593d636038ebc2720700662b"
@@ -406600,8 +407006,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen3 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2014-L2042"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2014-L2042"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "270850303e662be53d90fa60a9e5f4bd2bfb95f92a046c77278257631d9addf4"
hash = "7a086c0acb6df1fa304c20733f96e898d21ca787661270f919329fadfb930a6e"
hash = "c236e0d9c5764f223bd3d99f55bd36528dfc0415e14f5fde1e5cdcada14f4ec0"
@@ -406638,8 +407044,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Yak : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2054-L2070"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2054-L2070"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "66ff332f84690642f4e05891a15bf0c9783be2a64edb2ef2d04c9205b47deb19"
logic_hash = "69b9514508f557376d876262793e5650289abfeeeee8b5ca9beaf42f3ec4d64c"
score = 75
@@ -406665,8 +407071,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Aduser_Implant : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2072-L2086"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2072-L2086"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fd2efb226969bc82e2e38769a10a8a751138db69f4594a8de4b3c0522d4d885f"
logic_hash = "d378773f4acd850e5a8d92d6cce84d57f659330edc025565cf4bc34afb0a6ae6"
score = 75
@@ -406690,8 +407096,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remoteexecute_Implant : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2088-L2112"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2088-L2112"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "770663c07c519677316934cf482e500a73540d9933342c425f3e56258e6e6d8b"
logic_hash = "aa46cb188ba820199c013633ade72ab1c8bea316384042e9e3b5098c439841a5"
score = 75
@@ -406725,8 +407131,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Banner_Implant9X : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2114-L2129"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2114-L2129"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5d69a8cfc9b636448f023fcf18d111f13a8e6bcb9a693eb96276e0d796ab4e0c"
logic_hash = "5bda7b8ab097c0a5ca90b05147d4227e5a03735b99633b5081d80d2d72bceba9"
score = 75
@@ -406750,8 +407156,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Greatdoc_Dll_Config : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2131-L2147"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2131-L2147"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fd9d0abfa727784dd07562656967d220286fc0d63bcf7e2c35d4c02bc2e5fc2e"
logic_hash = "edb14cc9e51bbf6b3ca2c52f841edfa3df1ca89b3e7c1b5a59baf3a13be0fc46"
score = 75
@@ -406777,8 +407183,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Scanner : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2149-L2166"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2149-L2166"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f180bdb247687ea9f1b58aded225d5c80a13327422cd1e0515ea891166372c53"
logic_hash = "7f2ee4ac260b78764573187c501ed27fbfdf573e618f15dbd307177afa670605"
score = 75
@@ -406805,8 +407211,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mcl_Ntmemory_Std : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2168-L2183"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2168-L2183"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "087db4f2dbf8e0679de421fec8fb2e6dd50625112eb232e4acc1408cc0bcd2d7"
logic_hash = "5d3c76cf0ca0f798e1ca3c0a1b88c3bb425f1c36439842c4c33247dfcb44a877"
score = 75
@@ -406831,8 +407237,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Tacothief : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2185-L2198"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2185-L2198"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c71953cc84c27dc61df8f6f452c870a7880a204e9e21d9fd006a5c023b052b35"
logic_hash = "565d94ac0dd65de0926d11ae08ee78f14dcb211ca97c77c39f394fb36890fc6f"
score = 75
@@ -406855,8 +407261,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ntevt : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2200-L2219"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2200-L2219"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4254ee5e688fc09bdc72bcc9c51b1524a2bb25a9fb841feaf03bc7ec1a9975bf"
logic_hash = "29572cce9af51adf12db019f885f868fd77ff9034a6944a6286a4d2a0988842a"
score = 75
@@ -406883,8 +407289,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Processes_Target : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2221-L2236"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2221-L2236"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "69cf7643dbecc5f9b4b29edfda6c0295bc782f0e438f19be8338426f30b4cc74"
logic_hash = "e9e26224b7eafc999c9638d4591a45297e3293b0e90e63c2d207ee52848c4ce2"
score = 75
@@ -406909,8 +407315,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_St_Lp : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2238-L2254"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2238-L2254"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3b6f756cca096548dcad2b6c241c1dafd16806c060bec82a530f4d38755286a2"
logic_hash = "38a48a931856e0eb8e16b7902f5e494b50f8895d4221b5359fc3339d1b52eb8e"
score = 75
@@ -406936,8 +407342,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Epwrapper : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2256-L2271"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2256-L2271"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a8eed17665ee22198670e22458eb8c9028ff77130788f24f44986cce6cebff8d"
logic_hash = "9a1a54cd3fef3db9a20f3be25336fcbabe0d993403f001a04a02b5dbfd629543"
score = 75
@@ -406962,8 +407368,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_2000 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2273-L2290"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2273-L2290"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f9ea8ff5985b94f635d03f3aab9ad4fb4e8c2ad931137dba4f8ee8a809421b91"
logic_hash = "dfcd7d928c921dbe7162712ca74a105a938fd9ac675faaaa228d05139b2077de"
score = 75
@@ -406989,8 +407395,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dllload_Target : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2292-L2309"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2292-L2309"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a42d5201af655e43cefef30d7511697e6faa2469dc4a74bc10aa060b522a1cf5"
logic_hash = "ab50ad9e01c55b3f40e98e6e2cf77c1ad7d6d6ec81a56bbb2263a6e05912e272"
score = 75
@@ -407016,8 +407422,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_EXPA : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2311-L2327"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2311-L2327"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2017176d3b5731a188eca1b71c50fb938c19d6260c9ff58c7c9534e317d315f8"
logic_hash = "2aa4ee5b128714cfa7f5d29f7ef110e1b18fb7bc21351444b2472ff74c4139d3"
score = 75
@@ -407043,8 +407449,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remoteexecute_Target : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2329-L2345"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2329-L2345"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "4a649ca8da7b5499821a768c650a397216cdc95d826862bf30fcc4725ce8587f"
logic_hash = "3eedb6abb09989784a7dc5e721f9901e936f2c0241967b48858e5e5897b9f24a"
score = 75
@@ -407069,8 +407475,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_DS_Parselogs : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2347-L2362"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2347-L2362"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0228691d63038b072cdbf50782990d505507757efbfa87655bb2182cf6375956"
logic_hash = "e4c35476b512378d1e3c7e7e3e9dae16adb0d4de4ecab143d034110836c11d0d"
score = 75
@@ -407095,8 +407501,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Oracle_Implant : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2364-L2379"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2364-L2379"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8e9be4960c62ed7f210ce08f291e410ce0929cd3a86fe70315d7222e3df4587e"
logic_hash = "568a5d103527e6fd99bbac8d49a2d667f464fd16d5bf276f98c88c39e129b58b"
score = 75
@@ -407121,8 +407527,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dmgz_Target : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2381-L2395"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2381-L2395"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5964966041f93d5d0fb63ce4a85cf9f7a73845065e10519b0947d4a065fdbdf2"
logic_hash = "9ae3e0c30c9dbee311d4e5576b1a447ac57f8b1786dc5753246ad3c08ccecb85"
score = 75
@@ -407146,8 +407552,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setresourcename : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2397-L2413"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2397-L2413"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "537793d5158aecd0debae25416450bd885725adfc8ca53b0577a3df4b0222e2e"
logic_hash = "e26aac30e06da14060a955761d08e6f543db2f2747be2959b0090f60e6eb52a5"
score = 75
@@ -407173,8 +407579,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Drivers_Implant : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2415-L2431"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2415-L2431"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ee8b048f1c6ba821d92c15d614c2d937c32aeda7b7ea0943fd4f640b57b1c1ab"
logic_hash = "45190a317f3d293dbc3015873080d1253bfb3298008f5dea69ab1a5780a70721"
score = 75
@@ -407199,8 +407605,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Shares_Target : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2433-L2449"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2433-L2449"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6c57fb33c5e7d2dee415ae6168c9c3e0decca41ffe023ff13056ff37609235cb"
logic_hash = "11a1af97d720286a7fadf8b056f8f7add70acb041a828441166f5c74bc7a819d"
score = 75
@@ -407226,8 +407632,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ntfltmgr : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2451-L2475"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2451-L2475"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3df61b8ef42a995b8f15a0d38bc51f2f08f8d9a2afa1afc94c6f80671cf4a124"
hash = "f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5"
hash = "980954a2440122da5840b31af7e032e8a25b0ce43e071ceb023cca21cedb2c43"
@@ -407260,8 +407666,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_BH : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2477-L2492"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2477-L2492"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7ae9a247b60dc31f424e8a7a3b3f1749ba792ff1f4ba67ac65336220021fce9f"
logic_hash = "273e38e287b1597753f653c0ed8300936581a1b767029d3f0ba757de589bcd5a"
score = 75
@@ -407286,8 +407692,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_LP : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2494-L2508"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2494-L2508"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3a505c39acd48a258f4ab7902629e5e2efa8a2120a4148511fe3256c37967296"
logic_hash = "cd7b92f13e0a00d23baef70e38b476b62394106dfa70e831786f398c573aa744"
score = 75
@@ -407311,8 +407717,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remotecommand_Lp : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2510-L2524"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2510-L2524"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "57b47613a3b5dd820dae59fc6dc2b76656bd578f015f367675219eb842098846"
logic_hash = "974772264324e7721f51a88534aaa3b4eb1d409e04f673783caf4849d90522de"
score = 75
@@ -407336,8 +407742,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Lp_Mstcp : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2526-L2545"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2526-L2545"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2ab1e1d23021d887759750a0c053522e9149b7445f840936bbc7e703f8700abd"
logic_hash = "5d1423661f95d955f411414138da45cc4be59b2e6bf8e70f471b8f41fc9ea3f4"
score = 75
@@ -407365,8 +407771,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Renamer : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2547-L2561"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2547-L2561"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9c30331cb00ae8f417569e9eb2c645ebbb36511d2d1531bb8d06b83781dfe3ac"
logic_hash = "4941f31be6674499b202a3071d795317e6d97fb19088ea370180708e3d04bca7"
score = 75
@@ -407390,8 +407796,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Exploit : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2563-L2579"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2563-L2579"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "77486bb828dba77099785feda0ca1d4f33ad0d39b672190079c508b3feb21fb0"
logic_hash = "6f04ec5d1066b34ebee2504f7d229610e525743f7536d58bf99fc4f89ac6aa3b"
score = 75
@@ -407417,8 +407823,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level3_Gen : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2581-L2600"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2581-L2600"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c7dd49b98f399072c2619758455e8b11c6ee4694bb46b2b423fa89f39b185a97"
hash = "f6b723ef985dfc23202870f56452581a08ecbce85daf8dc7db4491adaa4f6e8f"
logic_hash = "2ba0f5ada13bd8c71836f26e278c334fdbf2578eac189852befee7a81c07e169"
@@ -407446,8 +407852,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Put_Implant9X : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2602-L2618"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2602-L2618"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8fcc98d63504bbacdeba0c1e8df82f7c4182febdf9b08c578d1195b72d7e3d5f"
logic_hash = "e79a59e400aac544dc1160d5898e3053f88f7d5bc142440177526187650484e7"
score = 75
@@ -407472,8 +407878,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Promiscdetect_Safe : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2620-L2635"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2620-L2635"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "6070d8199061870387bb7796fb8ccccc4d6bafed6718cbc3a02a60c6dc1af847"
logic_hash = "4b8c2e9a00af4e6aed7f603dee0439357e3389180fbd2e83d6809e76dc7d0428"
score = 75
@@ -407498,8 +407904,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Packetscan_Implant : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2637-L2652"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2637-L2652"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9b97cac66d73a9d268a15e47f84b3968b1f7d3d6b68302775d27b99a56fbb75a"
logic_hash = "aa2106d2aad3e81c864181c851574f76f48cd4fe48bb3327135f2956d271dfde"
score = 75
@@ -407524,8 +407930,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setports : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2654-L2668"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2654-L2668"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "722d3cf03908629bc947c4cca7ce3d6b80590a04616f9df8f05c02de2d482fb2"
logic_hash = "b2c61f6ca2d59d5e596e7c5c87ed3476d957763daeaf41e6f356bacf26415faf"
score = 75
@@ -407549,8 +407955,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Grdo_Filescanner_Implant : FILE
date = "2017-04-15"
modified = "2023-01-06"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2670-L2686"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2670-L2686"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "8d2e43567e1360714c4271b75c21a940f6b26a789aa0fce30c6478ae4ac587e4"
logic_hash = "ae88d27f41dd4888c445c654c919b3862fe3fc8c92aef816b22b2fb408a49cce"
score = 75
@@ -407575,8 +407981,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Msgks_Mskgu : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2688-L2704"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2688-L2704"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7b4986aee8f5c4dca255431902907b36408f528f6c0f7d7fa21f079fa0a42e09"
hash = "ef906b8a8ad9dca7407e0a467b32d7f7cf32814210964be2bfb5b0e6d2ca1998"
logic_hash = "d3a230d29997ab247db2b7a2a0f369206513a98c16f744e2fb1fca6495d5e36b"
@@ -407602,8 +408008,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ifconfig_Target : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2706-L2722"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2706-L2722"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "1ebfc0ce7139db43ddacf4a9af2cb83a407d3d1221931d359ee40588cfd0d02b"
logic_hash = "e88f589bed7830a1be81c85c9eb77b7f5c14bef2f0f1b3be6293aa9c5e870278"
score = 75
@@ -407628,8 +408034,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2724-L2739"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2724-L2739"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ffff3526ed0d550108e97284523566392af8523bbddb5f212df12ef61eaad3e6"
logic_hash = "3ee7a1284e2abd0282606c22b9112bd1af536e5fd48ef27e8d9216da8e1fb1c5"
score = 75
@@ -407654,8 +408060,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dsz_Implant : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2741-L2755"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2741-L2755"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fbe103fac45abe4e3638055a3cac5e7009166f626cf2d3049fb46f3b53c1057f"
hash = "ad1dddd11b664b7c3ad6108178a8dade0a6d9795358c4a7cedbe789c62016670"
logic_hash = "3d76131a42aed642a8c54076544488a8d24ec16416469813324541d72e30101b"
@@ -407679,8 +408085,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Genkey : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2757-L2770"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2757-L2770"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b6f100b21da4f7e3927b03b8b5f0c595703b769d5698c835972ca0c81699ff71"
logic_hash = "cdaa33645d0ea614891fc0579937e983b8b4f6c4830191518dc8272791dcc8df"
score = 75
@@ -407703,8 +408109,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Wmi_Implant : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2772-L2785"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2772-L2785"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "de08d6c382faaae2b4b41b448b26d82d04a8f25375c712c12013cb0fac3bc704"
logic_hash = "69754b6f26292aa1a457c71d079d934ce75794624c38e9d19c84ceb77a5fb26d"
score = 75
@@ -407727,8 +408133,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Clocksvc : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2787-L2807"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2787-L2807"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c1bcd04b41c6b574a5c9367b777efc8b95fe6cc4e526978b7e8e09214337fac1"
logic_hash = "04cdd8e4ca9df0231ca66caa8083eff1fe0834cdedc4360fce0a934970a6d162"
score = 75
@@ -407757,8 +408163,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Xxxridearea : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2809-L2825"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2809-L2825"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "214b0de83b04afdd6ad05567825b69663121eda9e804daff9f2da5554ade77c6"
logic_hash = "4d2eeabbb3bb27f46232fe0a43f0ecda9f3589dbe6b08fd4f8aac14f6d12090b"
score = 75
@@ -407784,8 +408190,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Yak_Min_Install : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2827-L2842"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2827-L2842"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f67214083d60f90ffd16b89a0ce921c98185b2032874174691b720514b1fe99e"
logic_hash = "f224c87c5626fee98dae5b4bbab2b4468bdd126ac63371ede53545d7cb177123"
score = 75
@@ -407810,8 +408216,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setouraddr : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2844-L2858"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2844-L2858"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "04ccc060d401ddba674371e66e0288ebdbfa7df74b925c5c202109f23fb78504"
logic_hash = "d49bcef48afeb63b763c88443930f28be1d6f9f27d5f0bd9161d151fa3081868"
score = 75
@@ -407835,8 +408241,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Getadmin_LSADUMP_Modifyprivilege
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2860-L2882"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2860-L2882"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c8b354793ad5a16744cf1d4efdc5fe48d5a0cf0657974eb7145e0088fcf609ff"
hash = "5f06ec411f127f23add9f897dc165eaa68cbe8bb99da8f00a4a360f108bb8741"
logic_hash = "ee5c818c29ccb1b280669f7f5e828963c4523b73b68674d8c0aae72189f0208c"
@@ -407867,8 +408273,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Sendpktrigger : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2884-L2897"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2884-L2897"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f9c7a857948795873a61f4d4f08e1bd0a41e3d6ffde212db389365488fa6e26"
logic_hash = "277367e69406a84ff4ff6b57d05bf97468b0083e23f9c5cd14cdd26cad5846d7"
score = 75
@@ -407891,8 +408297,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dmgz_Target_2 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2899-L2916"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2899-L2916"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "55ac29b9a67e0324044dafaba27a7f01ca3d8e4d8e020259025195abe42aa904"
logic_hash = "ab9ab949ee17655e424f6a65d3605e9900d214d1c620e051104762d5c214419f"
score = 75
@@ -407918,8 +408324,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mstcp32_DXGHLP16_Tdip : FILE
date = "2017-04-15"
modified = "2023-01-06"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2918-L2938"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2918-L2938"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
hash = "fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
hash = "a5ec4d102d802ada7c5083af53fd9d3c9b5aa83be9de58dbb4fac7876faf6d29"
@@ -407948,8 +408354,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Regprobe : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2940-L2955"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2940-L2955"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "99a42440d4cf1186aad1fd09072bd1265e7c6ebbc8bcafc28340b4fe371767de"
logic_hash = "01e7387c26ae3736c8fac1a3bb6ff283f8b06949af7a4ac36a556b292412bda2"
score = 75
@@ -407974,8 +408380,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Doublefeaturedll_Dll_2 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2957-L2974"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2957-L2974"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f265defd87094c95c7d3ddf009d115207cd9d4007cf98629e814eda8798906af"
hash = "8d62ca9e6d89f2b835d07deb5e684a576607e4fe3740f77c0570d7b16ebc2985"
hash = "634a80e37e4b32706ad1ea4a2ff414473618a8c42a369880db7cc127c0eb705e"
@@ -408002,8 +408408,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gangsterthief_Implant : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2976-L2993"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2976-L2993"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "50b269bda5fedcf5a62ee0514c4b14d48d53dd18ac3075dcc80b52d0c2783e06"
logic_hash = "c8145d6eedf20cf95baf329a6240b5b740273ff0a7f82edd3c346eb8c67e69e1"
score = 75
@@ -408030,8 +408436,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setcallbackports : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L2995-L3009"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L2995-L3009"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "16f66c2593665c2507a78f96c0c2a9583eab0bda13a639e28f550c92f9134ff0"
logic_hash = "e087534589228ac1af8b8b8d2ebbc1bc99fc25b38cb4c4d840cab8e90e75644a"
score = 75
@@ -408055,8 +408461,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_BH_2000 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3011-L3025"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3011-L3025"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0654b4b8727488769390cd091029f08245d690dd90d1120e8feec336d1f9e788"
logic_hash = "0cd3ba351b1c5716ed322c9f177a848322324526f3d39c2be5cc34bc6aee9fa6"
score = 75
@@ -408080,8 +408486,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Rc5 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3027-L3043"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3027-L3043"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "69e2c68c6ea7be338497863c0c5ab5c77d5f522f0a84ab20fe9c75c7f81318eb"
logic_hash = "6d9ba73fe2a6da99ba44b00bcb5ecf51e983ac245fd5c6e620d35e8120514464"
score = 75
@@ -408107,8 +408513,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level_Generic : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3045-L3075"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3045-L3075"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "7a6488dd13936e505ec738dcc84b9fec57a5e46aab8aff59b8cfad8f599ea86a"
hash = "0e3cfd48732d0b301925ea3ec6186b62724ec755ed40ed79e7cd6d3df511b8a0"
hash = "d1d6e3903b6b92cc52031c963e2031b5956cadc29cc8b3f2c8f38be20f98a4a7"
@@ -408147,8 +408553,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level3_Http_Exe : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3077-L3094"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3077-L3094"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3e855fbea28e012cd19b31f9d76a73a2df0eb03ba1cb5d22aafe9865150b020c"
logic_hash = "50d83b157c338830eea6aba2e09e9d513dd5b50e257d1a16c0d51616bfa26a7f"
score = 75
@@ -408174,8 +408580,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Parsecapture : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3096-L3111"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3096-L3111"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c732d790088a4db148d3291a92de5a449e409704b12e00c7508d75ccd90a03f2"
logic_hash = "8946bc6d1812a998757a4032755f37aa2be6121a958ebfb6fec90fa60da038fb"
score = 75
@@ -408200,8 +408606,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Activedirectory_Target : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3113-L3127"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3113-L3127"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "33c1b7fdee7c70604be1e7baa9eea231164e62d5d5090ce7f807f43229fe5c36"
logic_hash = "0dee634fe81870b21531046be512e9e54b127207c1910ca5ce5dfab63b1d0603"
score = 75
@@ -408225,8 +408631,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Legacy_Dll : HIGHVOL FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3129-L3144"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3129-L3144"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0cbc5cc2e24f25cb645fb57d6088bcfb893f9eb9f27f8851503a1b33378ff22d"
logic_hash = "923a595737bc83fe05d0ca7301c70e1cb03cecf97dfa99f5967b77b892a9a533"
score = 75
@@ -408251,8 +408657,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Svctouch : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3146-L3159"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3146-L3159"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "96b6a3c4f53f9e7047aa99fd949154745e05dc2fd2eb21ef6f0f9b95234d516b"
logic_hash = "0e876611ffe4740141a0454f68cfc7dd3c46e0fd44deeb9f3e0f66c8fccd3745"
score = 75
@@ -408275,8 +408681,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Pwd_Implant : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3161-L3176"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3161-L3176"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "ee72ac76d82dfec51c8fbcfb5fc99a0a45849a4565177e01d8d23a358e52c542"
logic_hash = "f565c42781ff4b0b37e7c00673fb2da2877018317cd415bdb47d4e019485c727"
score = 75
@@ -408300,8 +408706,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Kisucomms_Target_2000 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3178-L3198"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3178-L3198"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "94eea1bad534a1dc20620919de8046c9966be3dd353a50f25b719c3662f22135"
logic_hash = "7d350228ad779d0453c1077afb2b533036eb1e43e4f74a433d68c781db963ab1"
score = 75
@@ -408328,8 +408734,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Sldecoder : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3200-L3214"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3200-L3214"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b220f51ca56d9f9d7d899fa240d3328535f48184d136013fd808d8835919f9ce"
logic_hash = "81a74169dc8f93f314f384bd859df07a4ffaaf430b221b440de922fad3497535"
score = 75
@@ -408353,8 +408759,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Windows_Implant : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3216-L3229"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3216-L3229"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "d38ce396926e45781daecd18670316defe3caf975a3062470a87c1d181a61374"
logic_hash = "5b6b349c98a328b4bbdd6d8718af8477c36ec219bb0076dd56998395d0ef5f32"
score = 75
@@ -408377,8 +408783,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Msgkd_Msslu64_Msgki_Mssld : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3231-L3256"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3231-L3256"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9ab667b7b5b9adf4ff1d6db6f804824a22c7cc003eb4208d5b2f12809f5e69d0"
hash = "320144a7842500a5b69ec16f81a9d1d4c8172bb92301afd07fb79bc0eca81557"
hash = "c10f4b9abee0fde50fe7c21b9948a2532744a53bb4c578630a81d2911f6105a3"
@@ -408412,8 +408818,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setcallback : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3258-L3272"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3258-L3272"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a8854f6b01d0e49beeb2d09e9781a6837a0d18129380c6e1b1629bc7c13fdea2"
logic_hash = "63a17dd56874085753cae92f70d6248ceaac6eaea99fda0d3a551e4988a73895"
score = 75
@@ -408437,8 +408843,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Doublefeaturereader_Doublefeatu
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3274-L3293"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3274-L3293"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "052e778c26120c683ee2d9f93677d9217e9d6c61ffc0ab19202314ab865e3927"
hash = "5db457e7c7dba80383b1df0c86e94dc6859d45e1d188c576f2ba5edee139d9ae"
logic_hash = "9049e1fe31917ecc27e57afecd5845afcd966aac83d386b7c0995c1e3378a0d0"
@@ -408466,8 +408872,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Vtuner_Vtuner_1 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3295-L3315"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3295-L3315"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3e6bec0679c1d8800b181f3228669704adb2e9cbf24679f4a1958e4cdd0e1431"
hash = "b0d2ebf455092f9d1f8e2997237b292856e9abbccfbbebe5d06b382257942e0e"
logic_hash = "8c161b36599b11264c31c54b94d6bdba53b3f13d27861ededc9f03bba394b775"
@@ -408496,8 +408902,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Ecwi_ESKE_EVFR_RPC2_2 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3317-L3336"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3317-L3336"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c4152f65e45ff327dade50f1ac3d3b876572a66c1ce03014f2877cea715d9afd"
hash = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
hash = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
@@ -408526,8 +408932,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__EAFU_Ecwi_ESKE_EVFR_RPC2_4 : FI
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3338-L3361"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3338-L3361"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3e181ca31f1f75a6244b8e72afaa630171f182fbe907df4f8b656cc4a31602f6"
hash = "c4152f65e45ff327dade50f1ac3d3b876572a66c1ce03014f2877cea715d9afd"
hash = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
@@ -408559,8 +408965,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Sendcftrigger_Sendpktrigger_6 :
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3363-L3379"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3363-L3379"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "3bee31b9edca8aa010a4684c2806b0ca988b2bcc14ad0964fec4f11f3f6fb748"
hash = "2f9c7a857948795873a61f4d4f08e1bd0a41e3d6ffde212db389365488fa6e26"
logic_hash = "4fb290bdf15e0701b6d543e1f978011046abe23e58c790ee1b992a5e0443a271"
@@ -408586,8 +408992,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Addresource : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3381-L3398"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3381-L3398"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e83e4648875d4c4aa8bc6f3c150c12bad45d066e2116087cdf78a4a4efbab6f0"
hash = "5a04d65a61ef04f5a1cbc29398c767eada367459dc09c54c3f4e35015c71ccff"
logic_hash = "e59863ac7f1147cdbc34cbd2b09183487999d9f01974279c7ccc0c5af7a99976"
@@ -408614,8 +409020,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ESKE_RPC2_8 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3400-L3416"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3400-L3416"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
hash = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
logic_hash = "1fa706fb7f138d679421fe6c5b29d6bf93893adc8bffe9dffaafa728c1b2d1d5"
@@ -408641,8 +409047,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ETBL_ETRE_10 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3441-L3458"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3441-L3458"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
hash = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
logic_hash = "bc30c62da7a7fd9144efef6f44c50552234f372c38c4479a024fbb0ca72530de"
@@ -408669,8 +409075,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11 : FI
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3460-L3479"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3460-L3479"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
hash = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
hash = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
@@ -408699,8 +409105,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_Ridearea2_12 : FI
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3481-L3498"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3481-L3498"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
hash = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
hash = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
@@ -408727,8 +409133,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_13 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3500-L3516"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3500-L3516"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
hash = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
logic_hash = "0a1859266b859d4da660a7fc7d0015954ff100c39b941b5461ba0c99b5103547"
@@ -408754,8 +409160,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Nameprobe_SMBTOUCH_14 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3518-L3535"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3518-L3535"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fbe3a4501654438f502a93f51b298ff3abf4e4cad34ce4ec0fad5cb5c2071597"
hash = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b16688305309"
logic_hash = "c60fc34aa42810a5622fbe53122ded4ffb4ee321fed1badd481ce5c2ae5225ef"
@@ -408782,8 +409188,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3537-L3555"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3537-L3555"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
hash = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
hash = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
@@ -408811,8 +409217,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_16 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3557-L3578"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3557-L3578"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
hash = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
hash = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
@@ -408843,8 +409249,8 @@ rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17 : FILE
date = "2017-04-15"
modified = "2023-12-05"
reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3580-L3597"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3580-L3597"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
hash = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
hash = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b16688305309"
@@ -408871,8 +409277,8 @@ rule SIGNATURE_BASE_Equationgroup_Scanner_Output : FILE
date = "2017-04-17"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_eqgrp_apr17.yar#L3609-L3626"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_eqgrp_apr17.yar#L3609-L3626"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "a8ac7e7f14d72798a1f6658eae4c66d871a525c8cb49afa2ca8656047da20524"
score = 75
quality = 85
@@ -408899,8 +409305,8 @@ rule SIGNATURE_BASE_VULN_Erlang_OTP_SSH_CVE_2025_32433_Apr25 : CVE_2025_32433 FI
date = "2025-04-18"
modified = "2026-05-15"
reference = "https://www.upwind.io/feed/cve-2025-32433-critical-erlang-otp-ssh-vulnerability-cvss-10"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_erlang_otp_ssh_cve_2025_32433.yar#L1-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_erlang_otp_ssh_cve_2025_32433.yar#L1-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "77d23956bd467a6eb56a91fa7a4bd939873363cd101a9d21b5b298c7b2e6c1ec"
score = 60
quality = 85
@@ -408926,8 +409332,8 @@ rule SIGNATURE_BASE_SNOWGLOBE_Babar_Malware : FILE
date = "2015-02-18"
modified = "2023-12-05"
reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_snowglobe_babar.yar#L4-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_snowglobe_babar.yar#L4-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
logic_hash = "a93425a95efe471b815e2daf0b5e290b3472b722c6a48f8c22f0a6e9c588ffc9"
score = 80
@@ -408963,8 +409369,8 @@ rule SIGNATURE_BASE_Invoke_Smbexec : FILE
date = "2017-06-14"
modified = "2023-12-05"
reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_invoke_thehash.yar#L12-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_invoke_thehash.yar#L12-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
logic_hash = "cc9feb7d4eadfc470aabf18d82c884f454ebcdd37f3ca6b0ee4b3634cd9e33ae"
score = 75
@@ -408991,8 +409397,8 @@ rule SIGNATURE_BASE_Invoke_Wmiexec_Gen_1
date = "2017-06-14"
modified = "2023-12-05"
reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_invoke_thehash.yar#L32-L51"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_invoke_thehash.yar#L32-L51"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "140c23514dbf8043b4f293c501c2f9046efcc1c08630621f651cfedb6eed8b97"
hash = "7565d376665e3cd07d859a5cf37c2332a14c08eb808cc5d187a7f0533dc69e07"
logic_hash = "12aeba5255527a337c49f1c4d1dc506a13ea02da69a8fc509c77bcb07c2135c8"
@@ -409021,8 +409427,8 @@ rule SIGNATURE_BASE_Invoke_Smbexec_Invoke_Wmiexec_1
date = "2017-06-14"
modified = "2023-12-05"
reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_invoke_thehash.yar#L53-L70"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_invoke_thehash.yar#L53-L70"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
hash = "b41bd54bbf119d153e0878696cd5a944cbd4316c781dd8e390507b2ec2d949e7"
logic_hash = "feb2973cd7e2c221cd91ec543f1d943cf1b5d5d18fe74c8f7e58341f76f95b51"
@@ -409049,8 +409455,8 @@ rule SIGNATURE_BASE_Invoke_Wmiexec_Gen
date = "2017-06-14"
modified = "2023-12-05"
reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_invoke_thehash.yar#L72-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_invoke_thehash.yar#L72-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "56c6012c36aa863663fe5536d8b7fe4c460565d456ce2277a883f10d78893c01"
hash = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
hash = "b41bd54bbf119d153e0878696cd5a944cbd4316c781dd8e390507b2ec2d949e7"
@@ -409078,8 +409484,8 @@ rule SIGNATURE_BASE_Mal_Lockbit4_Hashing_Alg_Win_Feb24 : FILE
date = "2024-02-16"
modified = "2026-05-15"
reference = "https://0x0d4y.blog/lockbit4-0-evasion-tales/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_lockbit4_hashing_alg_win_feb24.yar#L1-L22"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lockbit4_hashing_alg_win_feb24.yar#L1-L22"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "062311f136d83f64497fd81297360cd4"
logic_hash = "41497ea30a4cfdd111726a5819ec404a1eeba1693f5d6b89ac38558eb1c6bde9"
score = 100
@@ -409105,8 +409511,8 @@ rule SIGNATURE_BASE_LOG_Proxynotshell_POC_CVE_2022_41040_Nov22 : CVE_2022_41040
date = "2022-11-17"
modified = "2023-12-05"
reference = "https://github.com/testanull/ProxyNotShell-PoC"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/vuln_proxynotshell_cve_2022_41040.yar#L2-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/vuln_proxynotshell_cve_2022_41040.yar#L2-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "7f91502fd9c59180970fc4253134582b44ba318db03ef4eb575257b2f3818d94"
score = 70
quality = 85
@@ -409132,8 +409538,8 @@ rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_1 : FILE
date = "2018-07-28"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_darkhydrus.yar#L13-L29"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_darkhydrus.yar#L13-L29"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
logic_hash = "2c39f2e6b37e6422984275f45a2917891c3b482d137dbbfd6293088c2f2dacc3"
score = 75
@@ -409156,8 +409562,8 @@ rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_2 : FILE
date = "2018-07-28"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_darkhydrus.yar#L31-L48"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_darkhydrus.yar#L31-L48"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b2571e3b4afbce56da8faa726b726eb465f2e5e5ed74cf3b172b5dd80460ad81"
logic_hash = "e967fec69ad1cbb46a63ee520594e7d6f2445a400510a9864dbd6d4c6e092737"
score = 75
@@ -409185,8 +409591,8 @@ rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_3 : FILE
date = "2018-07-28"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_darkhydrus.yar#L50-L67"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_darkhydrus.yar#L50-L67"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c8b3d4b6acce6b6655e17255ef7a214651b7fc4e43f9964df24556343393a1a3"
logic_hash = "0f3425322846e6064ec2576ad4e73061fbec3e4400de54d05fe07b8ad2a31f92"
score = 75
@@ -409211,8 +409617,8 @@ rule SIGNATURE_BASE_HKTL_Unlicensed_Cobaltstrike_EICAR_Jul18_5 : FILE
date = "2018-07-28"
modified = "2021-06-17"
reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_darkhydrus.yar#L69-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_darkhydrus.yar#L69-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "cec36e8ed65ac6f250c05b4a17c09f58bb80c19b73169aaf40fa15c8d3a9a6a1"
logic_hash = "d066f22e01f9ca3a33c669552046a5ab8dd9e579236974b1c468ba9644498951"
score = 75
@@ -409237,8 +409643,8 @@ rule SIGNATURE_BASE_Beepservice_Hacktool : FILE
date = "2016-05-12"
modified = "2023-12-05"
reference = "https://goo.gl/p32Ozf"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_beepservice.yar#L10-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_beepservice.yar#L10-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "032df812a68852b6f3822b9eac4435e531ca85bdaf3ee99c669134bd16e72820"
hash = "e30933fcfc9c2a7443ee2f23a3df837ca97ea5653da78f782e2884e5a7b734f7"
hash = "ebb9c4f7058e19b006450b8162910598be90428998df149977669e61a0b7b9ed"
@@ -409267,8 +409673,8 @@ rule SIGNATURE_BASE_MAL_JS_NPM_Supplychain_Attack_Nov25 : FILE
date = "2025-11-24"
modified = "2025-12-15"
reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_npm_supply_chain_nov25.yar#L1-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_npm_supply_chain_nov25.yar#L1-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0"
logic_hash = "b5a8da01ecb31dfa7a3921847a0fe26021b7618b1ee7a115a366b0854a4fa0a8"
score = 80
@@ -409295,8 +409701,8 @@ rule SIGNATURE_BASE_SUSP_JS_NPM_Sha1_Hulud_Nov25 : FILE
date = "2025-11-24"
modified = "2025-12-15"
reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_npm_supply_chain_nov25.yar#L25-L41"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_npm_supply_chain_nov25.yar#L25-L41"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0"
logic_hash = "95f7e657108bc63825f969baa28211c5c63746f525db5e71a486d76aaf98ba32"
score = 70
@@ -409319,8 +409725,8 @@ rule SIGNATURE_BASE_SUSP_JS_NPM_Setupscript_Nov25 : FILE
date = "2025-11-24"
modified = "2025-12-15"
reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_npm_supply_chain_nov25.yar#L43-L64"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_npm_supply_chain_nov25.yar#L43-L64"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a"
logic_hash = "b685f642d1d62200da973aad7fd7a2d606a098b92524aaebe5e2bb45c63f3155"
score = 70
@@ -409345,8 +409751,8 @@ rule SIGNATURE_BASE_MAL_NPM_Supplychain_Attack_Preinstallscript_Nov25 : FILE
date = "2025-11-24"
modified = "2026-05-15"
reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_npm_supply_chain_nov25.yar#L66-L80"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_npm_supply_chain_nov25.yar#L66-L80"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c4bc2afd133916f064f2fb7d1e2e067ea65db33463eeae2fa54a9860a6303865"
logic_hash = "7472fc4759bbf03abd05a0eade1144c7ca3ab31af26ed4eab4028056027b2e47"
score = 80
@@ -409368,8 +409774,8 @@ rule SIGNATURE_BASE_MAL_RANSOM_Ragna_Locker_Apr20_1 : FILE
date = "2020-04-27"
modified = "2023-12-05"
reference = "https://otx.alienvault.com/indicator/file/c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_ragna_locker.yar#L3-L36"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_ragna_locker.yar#L3-L36"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
logic_hash = "05a18818f22c836c3e1f1fa9682d787bbe86e6d3bb026a80a7d4c33ad95c2cd3"
score = 75
@@ -409408,8 +409814,8 @@ rule SIGNATURE_BASE_MAL_Ransom_Ragnarlocker_July_2020_1 : FILE
date = "2020-07-30"
modified = "2023-12-05"
reference = "https://twitter.com/JAMESWT_MHT/status/1288797666688851969"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ransom_ragna_locker.yar#L38-L70"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ransom_ragna_locker.yar#L38-L70"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87"
logic_hash = "dc44da2f9023e0702afa8081e85ba817ebfde15f449261fae9de729d51262b04"
score = 75
@@ -409451,8 +409857,8 @@ rule SIGNATURE_BASE_MAL_Compromised_Cert_Ducktail_Stealer_Jun23 : FILE
date = "2023-06-16"
modified = "2023-08-12"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/mal_ducktail_compromised_certs_jun23.yar#L2-L37"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_ducktail_compromised_certs_jun23.yar#L2-L37"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "17c75f2d14af9f00822fc1dba00ccc9ec71fc50962e196d7e6f193f4b2ee0183"
hash = "b3cfdb442772d07a7f037b0bb093ba315dfd1e79b0e292736c52097355495270"
hash = "9afe013cae0167993a6a7ccd650eb1221a5ec163110565eb3a49a8b57949d4ee"
@@ -409493,8 +409899,8 @@ rule SIGNATURE_BASE_Quasar_RAT_Jan18_1 : FILE
date = "2018-01-29"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_quasar_vermin.yar#L11-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_quasar_vermin.yar#L11-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6"
hash = "24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18"
logic_hash = "4b2c8695a053a714e97f3e108f0f359d9e49151297a21e460b3201d8f4e72a89"
@@ -409525,8 +409931,8 @@ rule SIGNATURE_BASE_Vermin_Keylogger_Jan18_1 : FILE
date = "2018-01-29"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_quasar_vermin.yar#L35-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_quasar_vermin.yar#L35-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d"
hash = "e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7"
hash = "0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6"
@@ -409568,8 +409974,8 @@ rule SIGNATURE_BASE_RUAG_Tavdig_Malformed_Executable : FILE
date = "2016-05-24"
modified = "2023-12-05"
reference = "https://goo.gl/N5MEj0"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ruag.yar#L9-L19"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ruag.yar#L9-L19"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "2a6eb90cc77f4556da0b5b0211bf0c4759dae0d78e9c6b765eff0e9a34f52e0f"
score = 60
quality = 85
@@ -409587,8 +409993,8 @@ rule SIGNATURE_BASE_RUAG_Bot_Config_File : FILE
date = "2016-05-24"
modified = "2023-12-05"
reference = "https://goo.gl/N5MEj0"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ruag.yar#L21-L34"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ruag.yar#L21-L34"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "256808511233da446ec69db4f5a5e23a237296c100e79e78bbe5e4964fa5dde6"
score = 60
quality = 85
@@ -409611,8 +410017,8 @@ rule SIGNATURE_BASE_RUAG_Cobra_Malware : FILE
date = "2016-05-24"
modified = "2023-12-05"
reference = "https://goo.gl/N5MEj0"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ruag.yar#L36-L47"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ruag.yar#L36-L47"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "5576e8e465eb289e8da44009cb2237080c5b5c3eb6d7a337634d91c5d68ecd80"
score = 60
quality = 85
@@ -409633,8 +410039,8 @@ rule SIGNATURE_BASE_RUAG_Cobra_Config_File : FILE
date = "2016-05-24"
modified = "2023-12-05"
reference = "https://goo.gl/N5MEj0"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ruag.yar#L49-L71"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ruag.yar#L49-L71"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "703a89562f3a2e5692883892f468288276459ad528cd371b1ac226e1d1c4be02"
score = 60
quality = 85
@@ -409665,8 +410071,8 @@ rule SIGNATURE_BASE_RUAG_Exfil_Config_File : FILE
date = "2016-05-24"
modified = "2023-12-05"
reference = "https://goo.gl/N5MEj0"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_ruag.yar#L73-L90"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_ruag.yar#L73-L90"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "379e8762932ca565f3bd35ec241aef2d0445fbe6182a041e4d4e16a1170202ef"
score = 60
quality = 85
@@ -409693,8 +410099,8 @@ rule SIGNATURE_BASE_APT_Tick_Sysmon_Loader_Jun18 : FILE
date = "2018-06-23"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_tick_weaponized_usb.yar#L13-L38"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_tick_weaponized_usb.yar#L13-L38"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8"
logic_hash = "e6256269409322a4f48bfdaafc52f5ec83602cf66f2e3b8d83ed5175e1dc506f"
score = 75
@@ -409725,8 +410131,8 @@ rule SIGNATURE_BASE_APT_Tick_Homamdownloader_Jun18 : FILE
date = "2018-06-23"
modified = "2023-12-05"
reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_tick_weaponized_usb.yar#L40-L58"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_tick_weaponized_usb.yar#L40-L58"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec"
logic_hash = "b4c798aa0c71f44f271e710d791c97adcbf9bd28ec87dd1d8d589029e58d1cfb"
score = 75
@@ -409754,8 +410160,8 @@ rule SIGNATURE_BASE_Fareit_Trojan_Oct15 : FILE
date = "2015-10-18"
modified = "2023-12-05"
reference = "http://goo.gl/5VYtlU"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_fareit.yar#L8-L30"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_fareit.yar#L8-L30"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "230ca0beba8ae712cfe578d2b8ec9581ce149a62486bef209b04eb11d8c088c3"
hash = "3477d6bfd8313d37fedbd3d6ba74681dd7cb59040cabc2991655bdce95a2a997"
hash = "408fa0bd4d44de2940605986b554e8dab42f5d28a6a525b4bc41285e37ab488d"
@@ -409786,8 +410192,8 @@ rule SIGNATURE_BASE_Crime_Ole_Loadswf_Cve_2018_4878 : PURPORTED_NORTH_KOREAN_ACT
date = "2026-01-01"
modified = "2023-12-05"
reference = "hxxps://www[.]krcert[.]or[.kr/data/secNoticeView.do?bulletin_writing_sequence=26998"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_ole_loadswf_cve_2018_4878.yar#L2-L31"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_ole_loadswf_cve_2018_4878.yar#L2-L31"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "716cad0c5a12cc360522e2649c7870a493bef4bec3d55c3a3e235f3a85c02a56"
score = 75
quality = 85
@@ -409821,8 +410227,8 @@ rule SIGNATURE_BASE_SUSP_SFX_Runprogram_Wscript : FILE
date = "2018-09-27"
modified = "2023-12-05"
reference = "Internal Research"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_susp_sfx.yar#L2-L20"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_sfx.yar#L2-L20"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e3bb02c5985fc64759b9c2d3c5474d46237ce472b4a0101c6313dafa939de5a9"
hash = "0ecf88d4b32895b4819dec3acb62eaaa7035aa6292499d903f76af60fcec0d6a"
hash = "a7a48f5220bd1ebe04de258d71fdd001711c165d162bd45e8cfbe8964eddf01c"
@@ -409850,8 +410256,8 @@ rule SIGNATURE_BASE_Unspecified_Malware_Sep1_A1 : FILE
date = "2017-09-12"
modified = "2023-12-05"
reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dragonfly.yar#L13-L27"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dragonfly.yar#L13-L27"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "28143c7638f22342bff8edcd0bedd708e265948a5fcca750c302e2dca95ed9f0"
logic_hash = "d235dc964ac74d2b635251d07b2a9119b731a6c3c45b6b2a81ca88e6fc8b63b7"
score = 75
@@ -409871,8 +410277,8 @@ rule SIGNATURE_BASE_Dragonfly_APT_Sep17_1 : FILE
date = "2017-09-12"
modified = "2023-12-05"
reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dragonfly.yar#L29-L44"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dragonfly.yar#L29-L44"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "fc54d8afd2ce5cb6cc53c46783bf91d0dd19de604308d536827320826bc36ed9"
logic_hash = "c885fb690b7e047203529f0c4a6dd60dea822ce60a47e42b52d3216bc26da62e"
score = 75
@@ -409897,8 +410303,8 @@ rule SIGNATURE_BASE_Dragonfly_APT_Sep17_2 : FILE
date = "2017-09-12"
modified = "2023-01-06"
reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dragonfly.yar#L46-L66"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dragonfly.yar#L46-L66"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "178348c14324bc0a3e57559a01a6ae6aa0cb4013aabbe324b51f906dcf5d537e"
logic_hash = "433711dd15c8d1044b381046747194e47402288df06da6bbc61055dc9c90f52a"
score = 75
@@ -409928,8 +410334,8 @@ rule SIGNATURE_BASE_Dragonfly_APT_Sep17_3 : FILE
date = "2017-09-12"
modified = "2023-12-05"
reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dragonfly.yar#L68-L89"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dragonfly.yar#L68-L89"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "b051a5997267a5d7fa8316005124f3506574807ab2b25b037086e2e971564291"
logic_hash = "f564685eb1426d1a3eb888a888bfdf3a8fa9bc96af07fb0bc5f10c0a324f1d9d"
score = 75
@@ -409955,8 +410361,8 @@ rule SIGNATURE_BASE_Dragonfly_APT_Sep17_4 : FILE
date = "2017-09-12"
modified = "2023-12-05"
reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_dragonfly.yar#L91-L109"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_dragonfly.yar#L91-L109"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
logic_hash = "61af81f0cd1eccba3a1000e6715c9715e8e67849e5edd4279728a7e47bd8cb75"
score = 75
@@ -409984,8 +410390,8 @@ rule SIGNATURE_BASE_SUSP_Nullsoftinst_Combo_Oct20_1 : FILE
date = "2020-10-06"
modified = "2023-12-05"
reference = "https://twitter.com/malwrhunterteam/status/1313023627177193472"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/gen_anomalies_keyword_combos.yar#L2-L33"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_anomalies_keyword_combos.yar#L2-L33"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f"
hash = "93951379e57e4f159bb62fd7dd563d1ac2f3f23c80ba89f2da2e395b8a647dcf"
hash = "a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78"
@@ -410020,8 +410426,8 @@ rule SIGNATURE_BASE_COZY_FANCY_BEAR_Hunt : FILE
date = "2016-06-14"
modified = "2023-12-05"
reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fancybear_dnc.yar#L10-L28"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fancybear_dnc.yar#L10-L28"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "9009f181eeecce0ae322ba24335426399cf4484dfc9b7ea6905fb163b4bf0a25"
score = 75
quality = 85
@@ -410049,8 +410455,8 @@ rule SIGNATURE_BASE_COZY_FANCY_BEAR_Pagemgr_Hunt : FILE
date = "2016-06-14"
modified = "2023-12-05"
reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_fancybear_dnc.yar#L30-L42"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fancybear_dnc.yar#L30-L42"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "c6055b7cd04b994c80395276e83bec664b7dd32f8093411bfde0850cca39e9f7"
score = 75
quality = 85
@@ -410072,8 +410478,8 @@ rule SIGNATURE_BASE_Locky_Ransomware
date = "2016-02-17"
modified = "2023-12-05"
reference = "https://goo.gl/qScSrE"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_locky.yar#L8-L21"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_locky.yar#L8-L21"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8"
logic_hash = "c7584ea39c4aceedeb0ea2952be6ff212461674175855274f1783eef80ffba86"
score = 75
@@ -410096,8 +410502,8 @@ rule SIGNATURE_BASE_Dexter_Malware
date = "2015-02-10"
modified = "2023-12-05"
reference = "http://goo.gl/oBvy8b"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/crime_dexter_trojan.yar#L1-L17"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_dexter_trojan.yar#L1-L17"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "3b05bccce63c1f7e8d6d3f654b611f33da5fc1dbcbd28ff28f817d00bf961e64"
score = 70
quality = 60
@@ -410122,8 +410528,8 @@ rule SIGNATURE_BASE_Triton_Trilog : FILE
date = "2017-12-14"
modified = "2023-12-05"
reference = "https://goo.gl/vtQoCQ"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/apt_triton.yar#L70-L85"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_triton.yar#L70-L85"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
hash = "e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230"
logic_hash = "6406e9e7651978a6817079945dc801afdb6c16dd107527cbfd9a946eca27a51a"
score = 75
@@ -410148,8 +410554,8 @@ rule SIGNATURE_BASE_Malrtf_Ole2Link : EXPLOIT FILE
date = "2017-04-12"
modified = "2023-12-05"
reference = "https://github.com/Neo23x0/signature-base"
- source_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/yara/exploit_rtf_ole2link.yar#L1-L23"
- license_url = "https://github.com/Neo23x0/signature-base/blob/278165d7845decece517f756cf92ff4a41938d1e/LICENSE"
+ source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_rtf_ole2link.yar#L1-L23"
+ license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
logic_hash = "d7ef764a0006b81c2b50699aa1fccb35c7c7da982cb8d56e02097114468e298f"
score = 75
quality = 85
diff --git a/third_party/yara/update.sh b/third_party/yara/update.sh
index f063fc531..a9b96fe37 100755
--- a/third_party/yara/update.sh
+++ b/third_party/yara/update.sh
@@ -17,9 +17,9 @@ IFS=$'\n\t'
# a dependency, run this script, copy the computed hash printed in the abort
# message, and append a new pinned entry below.
#
-# yara-forge-rules-full.zip @ release tag 20260906
+# yara-forge-rules-full.zip @ release tag 20260913
# shellcheck disable=SC2034 # referenced indirectly via ${!pin_var}
-YARAFORGE_FULL_ZIP_SHA256_20260906="f8dc3910f6c0b645f34b6e729030c5c97426ed63683cce5ddfc07f185b03e2e2"
+YARAFORGE_FULL_ZIP_SHA256_20260913="75804814027aa759b6275bfe0e5e828051a785529b12a5a09604739b75c0372e"
# sha256_of computes the sha256 of a file using the platform-appropriate tool.
# Prints only the hex digest to stdout.