#yara — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #yara, aggregated by home.social.
-
From now on all #CVe #CVEAlert additional to #yara #Sigma and #Suricate rules will have #Splunk #Wazuh rules all for FREE no tracking no registration, no payments! #cybersecurity #devsecops #devops #infosec #redteam #blueteam #github #gitlab #git #developers #developer info source and follow for more updates as there will be more EX: https://www.valtersit.com/cve/CVE-2026-9734/
-
Linux Incident Response: системный подход. Часть 2
Это вторая часть статьи про Linux Incident Response — разбор live response на работающем Linux-хосте с подозрением на компрометацию. Если вы не читали первую часть, лучше начать с неё: в ней разобрали принципы расследования, изоляцию хоста, trusted toolkit, фиксацию исходного состояния, сетевые соединения и процессы. Без этого контекста часть команд и логика дальнейшего анализа будут менее понятны. Первая часть здесь . В этой части процесс идет далее — к менее изменчивым артефактам. Рассмотрим механизмы закрепления и следы на диске: systemd-сервисы и timers, cron, автозапуск, пользователи, группы, пакеты, логи, kernel-артефакты. В финале расскажем о построении таймлайна, оформлении IOC и действия с системой после завершения расследования.
-
Linux Incident Response: системный подход. Часть 1
Пару лет назад я уже публиковал статью о реагировании на инциденты в Linux-системах. Она по-прежнему может быть полезна как практическая шпаргалка, но с тех пор изменился и мой опыт, и требования к таким материалам. В этом цикле статей я хочу разобрать Linux live response более системно. Большинство материалов по Linux IR сводятся к спискам команд: посмотреть процессы, сеть, пользователей, cron, логи. Проблема в том, что сами по себе команды мало что дают, если нет порядка их применения, ограничения live response, смысл полученного вывода и вообще — методологии, базиса работы. Этот материал исправляет такие упущения. Он будет разбит на две части. В этой статье обсудим принципы расследования, изоляции, подготовки инструментария, начала анализа и исследования сети и процессов. Добро пожаловать под кат.
-
https://www.europesays.com/no/292444/ Amerikanske inflasjonstall: – Gir en pekepinn – E24 #aker #AkerSolutions #borregaard #Business #Economy #Eurosonen #Gjensidige #KevinWarsh #KongsbergGruppen #Konsumprisindeksen #Næringsliv #NO #NordeaMarkets #Norge #Norway #norwegian #SaraMidtgaard #SlåAvTickerPåFront #Telenor #Yara
-
THE OPEN-SOURCE ANTIVIRUS POWERED BY COMMUNITY SECURITY 🛡️
#ClamAV #OpenSource #CyberSecurity #Antivirus #Malware #YARA #ThreatDetection #InformationSecurity #Linux #Windows #macOS #EthicalHacking #TechTools #TechNews #ArtestoMellivoura
-
THE OPEN-SOURCE ANTIVIRUS POWERED BY COMMUNITY SECURITY 🛡️
#ClamAV #OpenSource #CyberSecurity #Antivirus #Malware #YARA #ThreatDetection #InformationSecurity #Linux #Windows #macOS #EthicalHacking #TechTools #TechNews #ArtestoMellivoura
-
New YARA rule targets malicious Office macros in OLE2 docs (.doc, .xls). Uses OLE2 module to scan 'Macros' stream for VBA signatures like AutoOpen/AutoExec. Works on YARA 4.0+ across Linux, Windows, macOS. #yara #snippet #ValtersIT
https://www.valtersit.com/vault/yara-rule-for-office-macro-ole2-stream-analysis-12e20d/
-
New YARA rule to detect suspicious base64 decoding in shell scripts. Matches patterns like echo [base64] | base64 -d and openssl enc -base64 -d, capturing inline and variable assignments with nocase flexibility. #yara #shell #base64 #ValtersIT
https://www.valtersit.com/vault/flag-suspicious-base64-decoding-in-shell-scripts-3ff079/
-
Schnellkochtopf
Kochen ist intuitiv, ich kann improvisieren, spontan eingreifen und das Ergebnis bleibt immer ein bisschen unvorhersehbar. Beim Backen muss man... mehr
https://radiocorax.de/schnellkochtopf/
#Dramatist #fluppe #MyUglyClementine #Schraegfunk #Schrägfunk #SnakeEyes #Yara
-
Schnellkochtopf
Kochen ist intuitiv, ich kann improvisieren, spontan eingreifen und das Ergebnis bleibt immer ein bisschen unvorhersehbar. Beim Backen muss man... mehr
https://radiocorax.de/schnellkochtopf/
#Dramatist #fluppe #MyUglyClementine #Schraegfunk #Schrägfunk #SnakeEyes #Yara
-
🚀 SO-CRATES 1.1 is here — now with Light Mode! ☀️
The tool you loved as OhMyPCAP keeps getting better.
Your all-in-one Docker/Podman container for rapid analysis of PCAPs, logs, and binaries just leveled up.
✅ PCAPs → Suricata alerts, rich metadata, ASCII transcripts, stream carving
✅ Logs → Sigma alerts + originals
✅ Binaries → YARA matches + metadataPerfect for air-gapped environments, malware analysis, IR, threat hunting, forensics & teaching.
What’s your preference?
→ Dark Mode 🖤
→ Light Mode ☀️
→ Why not both?
→ Needs glorious 4-color CGA option lol
Comment below!#DFIR #Cybersecurity #BlueTeam #ThreatHunting #Suricata #YARA #Sigma #DarkMode #LightMode
-
Also, notable mention. unexpected thread: https://github.com/lenucksi/aur-malware-check/issues/5
Are there any plans on some bit more central validation, maybe even with some AI/LLM/... with regular conversion of insights to fixed/deterministic rules as discussed throughout the thread? Something something semgrep/opengrep, yara, flathub manifest style etc pp?
Update: Looping in @archlinux here.
Also, any plans on enforcing this -> https://wiki.archlinux.org/title/DeveloperWiki:Building_in_a_clean_chroot for all the AUR build business?Also: How does this incident not yet have a creative name? I'm not asking for a #bumsrakete but there's gotta be something 🤣
Edit: https://jguer.space/blog/2026-06-15-yay-v13 delivered. It's the #AURpocalypse 😱 🤣
#llm #flathub #abuseprevention #malwareCheck #yara #opengrep #archLinux #archlinuxaur #aur #AURpocalypse
-
🚀Introducing SO-CRATES 1.0 — Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
SO-CRATES is a single container image for analyzing pcap files, log files, and binary files. It was formerly known as OhMyPCAP.
Here's what you can do with SO-CRATES:
✅analyze pcap files and then review Suricata alerts, metadata, and extracted files
✅import log files and then review Sigma alerts and the original log entries
✅import binary files and then review YARA matches and file metadataAll of this runs in a single Docker/Podman container — perfect for air-gapped environments, malware analysis, incident response, threat hunting, forensics & teaching.
Who’s trying it out? Drop a ❤️ and reply with your main use case!
#DFIR #Cybersecurity #BlueTeam #ThreatHunting #Suricata #YARA #Sigma
-
🚀Introducing SO-CRATES 1.0 — Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
SO-CRATES is a single container image for analyzing pcap files, log files, and binary files. It was formerly known as OhMyPCAP.
Here's what you can do with SO-CRATES:
✅analyze pcap files and then review Suricata alerts, metadata, and extracted files
✅import log files and then review Sigma alerts and the original log entries
✅import binary files and then review YARA matches and file metadataAll of this runs in a single Docker/Podman container — perfect for air-gapped environments, malware analysis, incident response, threat hunting, forensics & teaching.
Who’s trying it out? Drop a ❤️ and reply with your main use case!
#DFIR #Cybersecurity #BlueTeam #ThreatHunting #Suricata #YARA #Sigma
-
Мониторинг, IDS и системный анализ. YARA
YARA — инструмент для идентификации и классификации вредоносного программного обеспечения по правилам. Правила YARA описывают паттерны (строки, бинарные последовательности, регулярные выражения) в файлах. Широко используется в антивирусах, IDS, threat hunting для поиска малвари.
https://habr.com/ru/articles/1044952/
#безопастность #защита #системный_администратор #yara #ids #системный_анализ
-
Мониторинг, IDS и системный анализ. YARA
YARA — инструмент для идентификации и классификации вредоносного программного обеспечения по правилам. Правила YARA описывают паттерны (строки, бинарные последовательности, регулярные выражения) в файлах. Широко используется в антивирусах, IDS, threat hunting для поиска малвари.
https://habr.com/ru/articles/1044952/
#безопастность #защита #системный_администратор #yara #ids #системный_анализ
-
Мониторинг, IDS и системный анализ. YARA
YARA — инструмент для идентификации и классификации вредоносного программного обеспечения по правилам. Правила YARA описывают паттерны (строки, бинарные последовательности, регулярные выражения) в файлах. Широко используется в антивирусах, IDS, threat hunting для поиска малвари.
https://habr.com/ru/articles/1044952/
#безопастность #защита #системный_администратор #yara #ids #системный_анализ
-
🚀 OhMyPCAP 4.0.0 is HERE!
The ultimate FOSS PCAP analyzer just got a massive upgrade for deeper file intelligence.
New in v4.0:
• Upgraded to YARA Forge Full ruleset — more comprehensive malware & threat detection
• Exiftool + rich file metadata analysis — get more file information even if there are no YARA matchesAll the power you love is still here:
Suricata alerts, file alerts, Sankey diagrams, full-text search, ASCII transcripts, hexdumps, stream carving + single Docker/Podman container (perfect for air-gapped or quick spins).Ideal for malware analysis, incident response, threat hunting, forensics & teaching.
Who’s pulling this version right now? Drop a ❤️+ reply with your main use case (malware samples? CTFs? real-world incidents? teaching?)
#PCAP #DFIR #Cybersecurity #Infosec #BlueTeam #ThreatHunting #Suricata #YARA #MalwareAnalysis
-
Cuba e Vietnã ampliam cooperação agrícola com novo projeto de cultivo de arroz em Granma
-
Cuba e Vietnã ampliam cooperação agrícola com novo projeto de cultivo de arroz em Granma
-
#YARA #SHAHIDI allgraph.ro/advanced-sea... #SEABED #WARFARE www.perplexity.ai/search/new?q... semantic-map-engine.aepiot.com/semantic-map... aePiot: Empowering the present for Web 4.0. Construct nodes and own the SEO of tomorrow.
MultiSearch Tag Explorer -
RE: https://infosec.exchange/@binaryninja/116403309269355624
For the few people using #BinYars, it has been updated to support #BinaryNinja 5.3 and now targets YARA-X 1.15.0
Update via Binja's plugin manager to get the latest.
-
RE: https://infosec.exchange/@binaryninja/116403309269355624
For the few people using #BinYars, it has been updated to support #BinaryNinja 5.3 and now targets YARA-X 1.15.0
Update via Binja's plugin manager to get the latest.
-
Охота на Emmenhtal: как мы восстановили полную kill chain банковского трояна с переформатированного диска
Разбираем реальный IR-кейс: ClickFix → Emmenhtal Loader → банковский троян с Telegram C2. Форензик переформатированного диска на 930 ГБ, VDM-дисамбигуация ложноположительных и восстановление артефактов из hibernation-файла.
https://habr.com/ru/articles/1021698/
#DFIR #форензика #malware_analysis #банковский_троян #Emmenhtal #ClickFix #threat_hunting #YARA #fileless_malware #incident_response
-
ClearWater — обзор нового шифровальщика
Приветствую, сегодня я расскажу про новый шифровальщик, который мне удалось обнаружить на просторах Интернета. Первые упоминания ClearWater появились ещё в январе 2026 года. Исследуя всемирную паутину, я ещё не находил ни одной нормальной статьи по этому вредоносу, поэтому решил сам написать такую. Данный шифровальщик не отличается какой-то технической сложностью или необычными приемами поэтому его обзор несёт больше информативный характер и предназначен для Malware и TI-аналитиков.
https://habr.com/ru/articles/1018822/
#ClearWater #шифровальщик #вредонос #вредоносное_по #реверсинжиниринг #реверс #анализ_вредоносов #yara #mitre
-
Een samenvoeging van verschillende video’s die ik heb geüpload op mijn Youtube Kanaal Peter Stuif #Gezelligheid #Slechtziend #Yara Stuif
-
Yara-X 1.13 released!
Run (to get the latest): cargo install-update -i yara-x-cli
-
Yara-X 1.13 released!
Run (to get the latest): cargo install-update -i yara-x-cli
-
Yara-X has a language server for VS-Code
https://marketplace.visualstudio.com/items?itemName=VirusTotal.yara-x-ls
-
Yara-X has a language server for VS-Code
https://marketplace.visualstudio.com/items?itemName=VirusTotal.yara-x-ls
-
Released v1.3.3. of #Yaralyzer, my surprisingly popular tool for visualizing YARA rule matches with colors (a lot of colors).
1. --export-png images lets you export images of the analysis
2. almost all command line options (including multi argument ones like --yara-rules-dir) can be permanently set via environment variables or .yaralyzer file
3. couple of small bug fixes and debugging related command line options
You can try it on the web here: https://yaratoolkit.securitybreak.io/
(I didn't build this website, Thomas Roccia from Microsoft just integrated Yaralyzer into his existing site)- Github: https://github.com/michelcrypt4d4mus/yaralyzer
- Pypi: https://pypi.org/project/yaralyzer/
- on macOS you can also get it with #Homebrew by installing Pdfalyzer: brew install pdfalyzer#ascii #asciiArt #blueteam #cybersecurity #detectionEngineering #DFIR #forensics #FOSS #GPL #hacking #infosec #KaliLinux #maldoc #malware #malwareAnalysis #malwareDetection #openSource #pypi #python #redteam #reverseEngineering #reversing #Threatassessment #threathunting #YARA #YARArule #YARArules
-
Released v1.3.3. of #Yaralyzer, my surprisingly popular tool for visualizing YARA rule matches with colors (a lot of colors).
1. --export-png images lets you export images of the analysis
2. almost all command line options (including multi argument ones like --yara-rules-dir) can be permanently set via environment variables or .yaralyzer file
3. couple of small bug fixes and debugging related command line options
You can try it on the web here: https://yaratoolkit.securitybreak.io/
(I didn't build this website, Thomas Roccia from Microsoft just integrated Yaralyzer into his existing site)- Github: https://github.com/michelcrypt4d4mus/yaralyzer
- Pypi: https://pypi.org/project/yaralyzer/
- on macOS you can also get it with #Homebrew by installing Pdfalyzer: brew install pdfalyzer#ascii #asciiArt #blueteam #cybersecurity #detectionEngineering #DFIR #forensics #FOSS #GPL #hacking #infosec #KaliLinux #maldoc #malware #malwareAnalysis #malwareDetection #openSource #pypi #python #redteam #reverseEngineering #reversing #Threatassessment #threathunting #YARA #YARArule #YARArules
-
🛠️ Tool
===================Opening:
Loki-RS is a Rust-based rewrite of the original Loki scanner that consolidates YARA rule matching and IOC detection into a single high-performance, multi-threaded binary. The project is published as Beta and emphasizes speed, concurrency, and multiple output formats for forensic ingestion.Key Features:
• YARA scanning of files and process memory with the Core YARA Forge rule set as the default detection surface.
• IOC matching covering cryptographic hashes (MD5, SHA1, SHA256), filename patterns and C2 indicators drawn from the signature-base collection.
• Concurrency model permitting configurable thread counts for parallel scanning and CPU-bound tuning.
• Archive handling with ZIP inspection to reach nested artifacts.
• Operational tooling including an interactive TUI for real-time stats and controls, HTML report generation, and JSONL output for SIEM/log pipeline ingestion.
• Remote logging via syslog over UDP/TCP, with both SYSLOG and JSON formats supported.Technical Implementation:
• The codebase leverages Rust for memory safety and performance; multi-threaded scanning suggests internal worker queues and file/process enumeration that avoid scanning virtual filesystems by default (/proc, /sys).
• Signature management integrates signature-base for IOCs and YARA Forge for rule sets; the Core rule set is chosen for accuracy and low false positives, while Extended/Full sets are available for swap-in.
• Output pathways include structured JSONL for ingestion pipelines and HTML for human-readable reporting; remote sinks support syslog framing in both traditional SYSLOG and JSON payload modes.Use Cases:
• Forensic triage on endpoints and mounts where quick identification of known artifacts (hashes, filenames, C2 indicators) is needed.
• Bulk filesystem scans across images or mounted volumes with multi-threaded throughput requirements.
• Integration with logging/monitoring stacks via JSONL or syslog exports.Limitations & Considerations:
• Project is Beta: features and signatures remain under active development.
• Signature freshness depends on external sources; operational users should plan for regular signature updates.
• Default smart filtering skips virtual filesystems and mounted drives; scanning network/cloud mounts requires explicit configuration.References:
• Detection content: signature-base (IOCs) and YARA Forge (YARA rules).🔹 tool #rust #yara #ioctools #forensics
🔗 Source: https://github.com/Neo23x0/Loki-RS
-
🛠️ Tool
===================Opening:
Loki-RS is a Rust-based rewrite of the original Loki scanner that consolidates YARA rule matching and IOC detection into a single high-performance, multi-threaded binary. The project is published as Beta and emphasizes speed, concurrency, and multiple output formats for forensic ingestion.Key Features:
• YARA scanning of files and process memory with the Core YARA Forge rule set as the default detection surface.
• IOC matching covering cryptographic hashes (MD5, SHA1, SHA256), filename patterns and C2 indicators drawn from the signature-base collection.
• Concurrency model permitting configurable thread counts for parallel scanning and CPU-bound tuning.
• Archive handling with ZIP inspection to reach nested artifacts.
• Operational tooling including an interactive TUI for real-time stats and controls, HTML report generation, and JSONL output for SIEM/log pipeline ingestion.
• Remote logging via syslog over UDP/TCP, with both SYSLOG and JSON formats supported.Technical Implementation:
• The codebase leverages Rust for memory safety and performance; multi-threaded scanning suggests internal worker queues and file/process enumeration that avoid scanning virtual filesystems by default (/proc, /sys).
• Signature management integrates signature-base for IOCs and YARA Forge for rule sets; the Core rule set is chosen for accuracy and low false positives, while Extended/Full sets are available for swap-in.
• Output pathways include structured JSONL for ingestion pipelines and HTML for human-readable reporting; remote sinks support syslog framing in both traditional SYSLOG and JSON payload modes.Use Cases:
• Forensic triage on endpoints and mounts where quick identification of known artifacts (hashes, filenames, C2 indicators) is needed.
• Bulk filesystem scans across images or mounted volumes with multi-threaded throughput requirements.
• Integration with logging/monitoring stacks via JSONL or syslog exports.Limitations & Considerations:
• Project is Beta: features and signatures remain under active development.
• Signature freshness depends on external sources; operational users should plan for regular signature updates.
• Default smart filtering skips virtual filesystems and mounted drives; scanning network/cloud mounts requires explicit configuration.References:
• Detection content: signature-base (IOCs) and YARA Forge (YARA rules).🔹 tool #rust #yara #ioctools #forensics
🔗 Source: https://github.com/Neo23x0/Loki-RS
-
https://github.com/VirusTotal/yara-x/releases/tag/v1.11.0
Time to update: cargo install-update -i yara-x-cli
-
https://github.com/VirusTotal/yara-x/releases/tag/v1.11.0
Time to update: cargo install-update -i yara-x-cli
-
This company will capture 800 000 ton CO₂ yearly and store it below the seabed.
It's not removing anything from the air as I understand it, just reducing emissions, but it's still a large positive impact.
-
This company will capture 800 000 ton CO₂ yearly and store it below the seabed.
It's not removing anything from the air as I understand it, just reducing emissions, but it's still a large positive impact.
-
Open #KLara is a community-driven fork of the original KLara project by #Kaspersky Lab, aimed at helping Threat Intelligence researchers hunt for new #malware using #Yara.
https://github.com/xdanx/open-klara -
Open #KLara is a community-driven fork of the original KLara project by #Kaspersky Lab, aimed at helping Threat Intelligence researchers hunt for new #malware using #Yara.
https://github.com/xdanx/open-klara -
#BinYars (write #YARA-X rules inside of #BinaryNinja) is now available in Binja's plugin manager!
I want to give a special shout out to @cxiao (Thank You 🙏) who provided valuable feedback making the plugin experience better.
Happy rule writing!
Learn more @ https://github.com/xorhex/BinYars
-
#BinYars (write #YARA-X rules inside of #BinaryNinja) is now available in Binja's plugin manager!
I want to give a special shout out to @cxiao (Thank You 🙏) who provided valuable feedback making the plugin experience better.
Happy rule writing!
Learn more @ https://github.com/xorhex/BinYars
-
JPCERT/CC、新しいリアルタイム脅威検出ツール「YAMAGoya」をリリース／「Sigma」「YARA」ルールをサポート、エンドポイントセキュリティを補完
https://forest.watch.impress.co.jp/docs/news/2064198.html#forest_watch_impress #YAMAGoya #Sigma #YARA #セキュリティ #Windows
-
Gen Digital disclosure: Kimsuky deployed HttpTroy via a spear-phish ZIP (250908_A_HK이노션_SecuwaySSL VPN Manager U100S 100user_견적서.zip). Chain: dropper → MemLoad (sets scheduled task AhnlabUpdate) → HttpTroy (C2 load.auraria[.]org). Notable tech: custom API hashing, XOR/SIMD string obfuscation, dynamic API resolution, in-memory DLL execution. Capabilities include file transfer, screenshot capture, command execution, process termination, and trace cleanup.
Suggested detection priorities:
• Alert on new scheduled tasks with vendor-style names (AhnlabUpdate) and correlate to recent mail attachments.
• Monitor processes performing in-memory DLL loads or unusual CreateProcessW patterns following SCR/ZIP executions.
• Block or sandbox SCR files and scrutinize embedded decoy PDFs.Share your detection rules or SIGMA/YARA ideas in the comments — and follow @technadu for source-based threat intel.
#ThreatIntel #MalwareAnalysis #HttpTroy #Kimsuky #MemLoad #EDR #Sigma #YARA #IncidentResponse #Infosec
-
Still testing 🤞
For those able to use #BinaryNinja projects; #BinYars can sort the files into folders based upon the #Yara-X rule metadata field, BNFolder. The folder nesting structure is determined by the number of matches that reside under each folder - check out the video below!
-
Still testing 🤞
For those able to use #BinaryNinja projects; #BinYars can sort the files into folders based upon the #Yara-X rule metadata field, BNFolder. The folder nesting structure is determined by the number of matches that reside under each folder - check out the video below!
