100daysofyara 2025
@100daysyara20250 followers637 downloads15 copies0 likes1,392 views
46 detections
Filters
Last updated
All Time
Detection languages
46
Categories
24
12
5
5
4
Platforms
28
10
7
5
1
Products / Services
4
3
3
3
3
MITRE Techniques
18
10
10
7
5
CVEs
2
2
Detects obfuscated PHP code, specifically webshells, that utilize apostrophe-based concatenation (e.g., 'a'.'b'.'c') to break up strings into 1-3 character chunks. This technique is often used to evade signature-based detection.
This YARA rule detects specific ASP.NET web shells associated with the CL0P ransomware gang's exploitation of the MOVEit Transfer vulnerability (CVE-2023-34362). It identifies malicious activity by looking for custom HTTP headers ('X-siLock-') used by the exploit, specific hardcoded Azure storage interaction code snippets, and characteristic SQL injection queries targeting the application's user database.
This YARA rule detects files associated with the Agenda (Qilin) ransomware by searching for specific string patterns within the binary, such as hardcoded ransom note contents, Rust language artifacts, and an onion domain used for command-and-control or negotiation. It also validates the file as a Windows executable.
MAL AMOS yara x
YARA
This YARA rule detects the Amos Stealer malware on macOS by matching a specific Mach-O dylib hash and entitlement hash, which are consistent markers for samples of this information stealer.
This rule detects the use of HTML tables to render QR codes without external image files. This technique, often referred to as 'imageless QR codes', involves creating a grid using HTML table cells (td) with CSS background colors (white and black) to form the QR pattern. Attackers use this method in phishing emails to embed QR codes that redirect victims to malicious websites, bypassing simple image-based security filters.
This rule identifies a specific version of the Nmap executable by verifying the file's hash (MD5), the PE machine type, the linker version, and the existence of a specific section header. It is designed to confirm the integrity or identity of an authorized Nmap binary on Windows systems.
No description available.
This YARA rule detects the presence of the WEBC2-GREENCAT malware family by identifying specific binary patterns (opcodes and function structures) typically associated with this threat.
Detects exploitation attempts against Joomla websites targeting CVE-2023-23752. This vulnerability allows an unauthenticated attacker to disclose sensitive information, such as configuration details or user data, by crafting specific GET requests to the Joomla API.
This YARA rule detects specific macOS malware components associated with the threat actor Citrine Sleet (AppleJeus) by matching static dylib and entitlement hashes. It targets identified malicious payloads including UpdateAgent, SimpleTea (POOLRAT), and CrashReporter to track the group's tooling.
Page 1 of 5