100daysofyara 2025
@100daysyara20250 followers637 downloads15 copies0 likes1,392 views
46 detections
Filters
Last updated
All Time
Detection languages
46
Categories
24
12
5
5
4
Platforms
28
10
7
5
1
Products / Services
4
3
3
3
3
MITRE Techniques
18
10
10
7
5
CVEs
2
2
cipher wipe
YARA
This rule detects the use of the Windows 'cipher.exe' utility with the '/W' flag to wipe free disk space, invoked via a command shell (cmd.exe) within a PowerShell environment. This technique is often used by adversaries to prevent the forensic recovery of deleted files after they have been staged, modified, or exfiltrated, aligning with data destruction or anti-forensic activities.
day1 CruLoader
YARA
This YARA rule detects the presence of the Cruloader malware by identifying specific embedded strings associated with its operation, such as custom character sets and internal identifiers, as well as unique code sequences characteristic of its cryptographic implementation.
day3 ProgLangs
YARA
These YARA rules detect the presence of compiled executables written in Rust, Golang, or Nim by matching specific language-related artifacts, such as compiler-generated metadata, runtime library paths, or symbol patterns within Windows PE or Linux ELF binaries.
day2 FakePDF PE
YARA
This YARA rule detects malicious PE executable files that masquerade as PDF documents by embedding known PDF-related icons within their resource section. It inspects the PE file header and calculates the SHA256 hash of the first resource, matching it against a list of hashes corresponding to legitimate PDF icons.
This rule detects the presence of Agenda Ransomware based on specific strings found within the file. These strings include references to 'Qilin' (a known alias for Agenda Ransomware), ransom notes detailing encrypted files and financial information, threats regarding law enforcement, and indicators of the ransomware being written in Rust ('rust', 'cargo'). It also looks for API calls 'Sleep' and 'SleepEx' which can be used for evasion, and an .onion address for communication.
Detects malicious ASP.NET webshell activity associated with the CL0P Ransomware Gang exploiting CVE-2023-34362. The rule looks for specific HTTP headers used by the webshell, indicators of Azure Blob Storage interaction, or SQL injection attempts.
These YARA rules are designed to identify executables compiled with specific programming languages: Rust, Golang, and Nim. They achieve this by looking for unique strings, section names, and other artifacts left by the respective compilers and runtime environments within PE (Windows) and ELF (Linux) files. The rules are primarily for file identification and profiling, rather than detecting malicious behavior directly. They help in understanding the technology stack of an executable, which can be useful in malware analysis, threat intelligence, and software inventory.
This rule detects the usage of the 'Get-ReverseShell' PowerShell tool by looking for specific strings associated with its code and its GitHub repository. The rule specifically targets the string "odTPYnuuGIGzrAeHM ", the obfuscation string "Invoke-PSObfuscation", and the GitHub repository URL "https://github.com/gh0x0st". This tool is designed to create reverse shells, which are commonly used by attackers for remote access and control.
This rule detects LNK (shortcut) files that contain embedded PowerShell commands, specifically looking for the string "powershell" and the argument "-windowstyle hidden". This combination is often used by adversaries to execute malicious PowerShell scripts discreetly, making them less visible to the user.
The rule `MAL_GOLANG_STEALER_QBIT` is designed to detect the Qbit Stealer malware by identifying specific branding strings, setup configurations, and error messages commonly found within its binaries. The rule looks for strings like "qBit Stealer", "TRIAL VERSION - 24 Hour Access", "Stolen Folder Name:", "Max File Size(MB):", "Targeted File Extensions:", "[+] Logged into Mega", "[+] Loaded configJs", "Failed to load configJs", "Failed to archive files", "Failed to upload files", and "Failed to get file info". It also specifies a file size range between 7MB and 9MB. The rule `HUNT_QBIT_STEALER_DEV` aims to detect other software potentially created by the same author (n1k714i) by looking for developer-related strings such as "qbit@hitler.rocks", "n1k7l4i", "N1k7", and "CrabCat".
Page 3 of 5