YARA Rules Collection
#Threat Defense#Threat Management
msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks with extensive functionality for log data analysis, threat intelligence enrichment, and visualization.
Collection of YARA Signatures from Recent Malware Research
This document presents a collection of YARA signatures derived from recent malware research:
- Dacls Trojan Rule: Dacls_Linux.yara
- Dacls_Windows.yara
- APT32 KerrDown Rule: APT32_KerrDown.yara
- ACBackdoor
- Linux Build Rule: ACBackdoor_Linux.rule
- Unnamed Linux Golang Ransomware Rule: Linux_Golang_Ransomware.rule
- KPOT v2 Rule: KPOT_v2.yara
- WatchBog Linux Botnet Rule: WatchBog_Linux.yara
- EvilGnome Linux Malware Rule: EvilGnome_Linux.yara
- APT34 PICKPOCKET Rule: APT34_PICKPOCKET.yara
- APT34 LONGWATCH Rule: APT34_LONGWATCH.yara
- APT34 VALUEVAULT Rule: APT34_VALUEVAULT.yara
