advanced-threat-research/Yara-Rules

Stars
560
Rank 79,541 (Top 2 %)
Language YARA
License
Apache License 2.0
Created about 6 years ago
Updated 11 months ago

advanced-threat-research/Yara-Rules

advanced-threat-research

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository of YARA rules made by Trellix ATR Team

Yara-Rules

Repository of YARA rules to accompany the Trellix ATR blogposts & investigations

We endorse contributing to improve our rules - please send us a pull request with your proposal

In case you discovered a false positive with our rules, please share with us your details in an issue report and we’ll try to improve our Yara rules.

Happy Hunting!

DotDumper

An automatic unpacker and logger for DotNet Framework targeting files

CVE-2020-16898

CVE-2020-16898 (Bad Neighbor) Microsoft Windows TCP/IP Vulnerability Detection Logic and Rule

Creosote

Creosote is our solution to searching for the tarfile vulnerability described by CVE-2007-4559.

IOCs

Repository containing IOCs, CSV and MISP JSON from our blogs

GhidraScripts

Scripts to run within Ghidra, maintained by the Trellix ARC team

DarkSide-Config-Extract

NetLlix

A project created with an aim to emulate and test exfiltration of data over different network protocols.

CVE-2020-16899

CVE-2020-16899 - Microsoft Windows TCP/IP Vulnerability Detection Logic and Rule

xbypass

A tool to facilitate ROP Chain Development for XML Character Sanitization

Expert-Rules

Ripple-20-Detection-Logic

Ripple20 Critical Vulnerabilities - Detection Logic and Signatures

Threat-Reports

Repository to store the Threat Reports made by the McAfee Enterprise ATR Team

ATR_HAX_CTF_2021

McAfee Enterprise Advanced Threat Research Capture the Flag

DotDumperGUI

A graphical user interface to easily read through, and filter, DotDumper JSON-based logs

ATR_HAX_CTF_2022

Trellix Advanced Threat Research CTF compitition of 2022

Russian_CyberThreats_Yara

Repository with aggregated public source yara rules

DotDumperNative

The native (unmanaged) library which contains hooks for native functions that are hooked using DotDumper

Golang-Runtime-Binaries

A repository with a variety of compiled Golang binaries, each of which contains the entire Golang runtime for the given architecture for the specific Golang version

BSim

BSim signatures and databases for Ghidra to recover function symbols with

FIDBs

FunctionID databases for Ghidra to recover function symbols with from stripped binaries