├── LATEST ├── .gitignore ├── logo.png ├── .github ├── FUNDING.yml └── workflows │ └── docker-image.yml ├── w-rules ├── rules │ ├── signatures │ │ ├── UserDB.yar │ │ ├── userdb_panda.yar │ │ ├── userdb_exeinfope.yar │ │ ├── userdb_jclausing.yar │ │ ├── sandboxdetect.yar │ │ ├── wce.yar │ │ ├── dbgdetect.yar │ │ └── avdetect.yar │ ├── GeorBotBinary.yara │ ├── fpu.yara │ ├── GeorBotMemory.yara │ ├── Loki Rules │ │ ├── generic_lsass_dump.yar │ │ ├── apt_webshell_chinachopper.yar │ │ ├── crime_dexter_trojan.yar │ │ ├── apt_shamoon.yar │ │ ├── apt_backspace.yar │ │ ├── crime_antifw_installrex.yar │ │ ├── crime_cmstar.yar │ │ ├── crime_cryptowall_svg.yar │ │ ├── crime_buzus_softpulse.yar │ │ ├── apt_blackenergy_2.yar │ │ ├── apt_backdoor_ssh_python.yar │ │ ├── apt_poisonivy_gen3.yar │ │ ├── crime_kraken_bot1.yar │ │ ├── exploit_cve_2015_1674.yar │ │ ├── crime_mikey_trojan.yar │ │ ├── generic_cryptors.yar │ │ ├── apt_fidelis_phishing_plain_sight.yar │ │ ├── exploit_cve_2015_1701.yar │ │ ├── crime_dridex_xml.yar │ │ ├── threat_lenovo_superfish.yar │ │ ├── apt_apt17_malware.yar │ │ ├── crime_malumpos.yar │ │ ├── apt_scanbox_deeppanda.yar │ │ ├── pup_lightftp.yar │ │ ├── apt_blackenergy_installer.yar │ │ ├── apt_snowglobe_babar.yar │ │ ├── apt_naikon.yar │ │ ├── crime_malware_generic.yar │ │ ├── general_cloaking.yar │ │ ├── crime_kins_dropper.yar │ │ ├── crime_enfal.yar │ │ ├── apt_alienspy_rat.yar │ │ ├── apt_coreimpact_agent.yar │ │ ├── general_officemacros.yar │ │ ├── generic_anomalies.yar │ │ ├── falsepositive-hashes.txt │ │ ├── apt_skeletonkey.yar │ │ ├── apt_miniasp.yar │ │ ├── apt_casper.yar │ │ ├── apt_anthem_deeppanda.yar │ │ ├── apt_woolengoldfish.yar │ │ ├── apt_sofacy_xtunnel_bundestag.yar │ │ ├── apt_volatile_cedar.yar │ │ ├── crime_rombertik_carbongrabber.yar │ │ ├── apt_apt28.yar │ │ ├── apt_hellsing_kaspersky.yar │ │ ├── apt_waterbug.yar │ │ ├── exploit_uac_elevators.yar │ │ ├── apt_kaspersky_duqu2.yar │ │ ├── filename-iocs.txt │ │ ├── apt_op_cleaver.yar │ │ ├── apt_poisonivy.yar │ │ └── spy_querty_fiveeyes.yar │ ├── APT_NGO_wuaclt_PDF.yara │ ├── urausy_skypedat.yar │ ├── leverage.yar │ ├── CVE_2013_3893.yar │ ├── index.yar │ ├── embedded.yara │ ├── kins.yara │ ├── themask.yara │ ├── vmdetect.yara │ ├── WannaCry.yar │ └── hangover.yara ├── .dockerignore └── Dockerfile ├── 3.4 ├── .dockerignore └── Dockerfile ├── no-py ├── .dockerignore └── Dockerfile ├── 3.10 ├── .dockerignore └── Dockerfile ├── 3.11 ├── .dockerignore └── Dockerfile ├── 3.5 ├── .dockerignore └── Dockerfile ├── 3.6 ├── .dockerignore └── Dockerfile ├── 3.7 ├── .dockerignore └── Dockerfile ├── 3.8 ├── .dockerignore └── Dockerfile ├── 3.9 ├── .dockerignore └── Dockerfile ├── 4.0 ├── .dockerignore └── Dockerfile ├── 4.1 ├── .dockerignore └── Dockerfile ├── 4.2 ├── .dockerignore └── Dockerfile ├── CHANGELOG.md ├── LICENSE ├── Makefile └── README.md /LATEST: -------------------------------------------------------------------------------- 1 | 4.2 2 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | build 2 | release 3 | *.bu 4 | .circleci/build_num 5 | -------------------------------------------------------------------------------- /logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blacktop/docker-yara/HEAD/logo.png -------------------------------------------------------------------------------- /.github/FUNDING.yml: -------------------------------------------------------------------------------- 1 | # You can add one username per supported platform and one custom link 2 | patreon: blacktop_ -------------------------------------------------------------------------------- /w-rules/rules/signatures/UserDB.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blacktop/docker-yara/HEAD/w-rules/rules/signatures/UserDB.yar -------------------------------------------------------------------------------- /w-rules/rules/signatures/userdb_panda.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blacktop/docker-yara/HEAD/w-rules/rules/signatures/userdb_panda.yar -------------------------------------------------------------------------------- /3.4/.dockerignore: -------------------------------------------------------------------------------- 1 | # Ignore .git folder 2 | .git* 3 | 4 | README.md 5 | README.md.bu 6 | LICENSE 7 | logo.png 8 | build 9 | release 10 | -------------------------------------------------------------------------------- /no-py/.dockerignore: -------------------------------------------------------------------------------- 1 | # Ignore .git folder 2 | .git* 3 | 4 | README.md 5 | README.md.bu 6 | LICENSE 7 | logo.png 8 | build 9 | release 10 | -------------------------------------------------------------------------------- /w-rules/rules/signatures/userdb_exeinfope.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blacktop/docker-yara/HEAD/w-rules/rules/signatures/userdb_exeinfope.yar -------------------------------------------------------------------------------- /w-rules/rules/signatures/userdb_jclausing.yar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blacktop/docker-yara/HEAD/w-rules/rules/signatures/userdb_jclausing.yar -------------------------------------------------------------------------------- /w-rules/.dockerignore: -------------------------------------------------------------------------------- 1 | # Ignore .git folder 2 | .git* 3 | 4 | README.md 5 | README.md.bu 6 | LICENSE 7 | logo.png 8 | build 9 | release 10 | -------------------------------------------------------------------------------- /3.10/.dockerignore: -------------------------------------------------------------------------------- 1 | # Ignore .git folder 2 | .git* 3 | 4 | README.md 5 | README.md.bu 6 | LICENSE 7 | logo.png 8 | build 9 | release 10 | test_rule 11 | -------------------------------------------------------------------------------- /3.11/.dockerignore: -------------------------------------------------------------------------------- 1 | # Ignore .git folder 2 | .git* 3 | 4 | README.md 5 | README.md.bu 6 | LICENSE 7 | logo.png 8 | build 9 | release 10 | test_rule 11 | -------------------------------------------------------------------------------- /3.5/.dockerignore: -------------------------------------------------------------------------------- 1 | # Ignore .git folder 2 | .git* 3 | 4 | README.md 5 | README.md.bu 6 | LICENSE 7 | logo.png 8 | build 9 | release 10 | test_rule 11 | -------------------------------------------------------------------------------- /3.6/.dockerignore: -------------------------------------------------------------------------------- 1 | # Ignore .git folder 2 | .git* 3 | 4 | README.md 5 | README.md.bu 6 | LICENSE 7 | logo.png 8 | build 9 | release 10 | test_rule 11 | -------------------------------------------------------------------------------- /3.7/.dockerignore: -------------------------------------------------------------------------------- 1 | # Ignore .git folder 2 | .git* 3 | 4 | README.md 5 | README.md.bu 6 | LICENSE 7 | logo.png 8 | build 9 | release 10 | test_rule 11 | -------------------------------------------------------------------------------- /3.8/.dockerignore: -------------------------------------------------------------------------------- 1 | # Ignore .git folder 2 | .git* 3 | 4 | README.md 5 | README.md.bu 6 | LICENSE 7 | logo.png 8 | build 9 | release 10 | test_rule 11 | -------------------------------------------------------------------------------- /3.9/.dockerignore: -------------------------------------------------------------------------------- 1 | # Ignore .git folder 2 | .git* 3 | 4 | README.md 5 | README.md.bu 6 | LICENSE 7 | logo.png 8 | build 9 | release 10 | test_rule 11 | -------------------------------------------------------------------------------- /4.0/.dockerignore: -------------------------------------------------------------------------------- 1 | # Ignore .git folder 2 | .git* 3 | 4 | README.md 5 | README.md.bu 6 | LICENSE 7 | logo.png 8 | build 9 | release 10 | test_rule 11 | -------------------------------------------------------------------------------- /4.1/.dockerignore: -------------------------------------------------------------------------------- 1 | # Ignore .git folder 2 | .git* 3 | 4 | README.md 5 | README.md.bu 6 | LICENSE 7 | logo.png 8 | build 9 | release 10 | test_rule 11 | -------------------------------------------------------------------------------- /4.2/.dockerignore: -------------------------------------------------------------------------------- 1 | # Ignore .git folder 2 | .git* 3 | 4 | README.md 5 | README.md.bu 6 | LICENSE 7 | logo.png 8 | build 9 | release 10 | test_rule 11 | -------------------------------------------------------------------------------- /w-rules/rules/GeorBotBinary.yara: -------------------------------------------------------------------------------- 1 | rule GeorBotBinary 2 | { 3 | strings: 4 | $a = {63 72 ?? 5F 30 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C} 5 | 6 | condition: 7 | all of them 8 | } 9 | -------------------------------------------------------------------------------- /w-rules/rules/fpu.yara: -------------------------------------------------------------------------------- 1 | rule undocumentedFPUAtEntryPoint { 2 | strings: 3 | $fpu1 = {D9 D8} 4 | $fpu2 = {DF DF} 5 | $fpu3 = {DF D8} 6 | $fpu4 = {DC D9} 7 | $fpu5 = {DF DA} 8 | $fpu6 = {DF CB} 9 | condition: 10 | (for any of ($fpu*) : ($ at entrypoint)) or $fpu2 in (entrypoint..entrypoint + 10) 11 | } 12 | -------------------------------------------------------------------------------- /w-rules/rules/GeorBotMemory.yara: -------------------------------------------------------------------------------- 1 | rule GeorBotMemory 2 | { 3 | strings: 4 | $a = {53 4F 46 54 57 41 52 45 5C 00 4D 69 63 72 6F 73 6F 66 74 5C 00 57 69 6E 64 6F 77 73 5C 43 75 72 72 65 6E 74 56 65 72 73 69 6F 6E 5C 00 52 75 6E 00 55 53 42 53 45 52 56} 5 | $b = {73 79 73 74 65 6D 33 32 5C 75 73 62 73 65 72 76 2E 65 78 65} 6 | $c = {5C 75 73 62 73 65 72 76 2E 65 78 65} 7 | condition: 8 | $a and ($b or $c) 9 | } 10 | -------------------------------------------------------------------------------- /w-rules/rules/Loki Rules/generic_lsass_dump.yar: -------------------------------------------------------------------------------- 1 | rule LSASS_memory_dump_file { 2 | meta: 3 | description = "Detects a LSASS memory dump file" 4 | author = "Florian Roth" 5 | date = "2015/03/31" 6 | memory = 0 7 | score = 50 8 | strings: 9 | $s1 = "lsass.exe" ascii fullword 10 | $s2 = "wdigest.DLL" wide nocase 11 | condition: 12 | uint32(0) == 0x504D444D and all of them 13 | } 14 | 15 | -------------------------------------------------------------------------------- /w-rules/rules/APT_NGO_wuaclt_PDF.yara: -------------------------------------------------------------------------------- 1 | rule APT_NGO_wuaclt_PDF 2 | { 3 | strings: 4 | $pdf = "%PDF" nocase 5 | $comment = {3C 21 2D 2D 0D 0A 63 57 4B 51 6D 5A 6C 61 56 56 56 56 56 56 56 56 56 56 56 56 56 63 77 53 64 63 6A 4B 7A 38 35 6D 37 4A 56 6D 37 4A 46 78 6B 5A 6D 5A 6D 52 44 63 5A 58 41 73 6D 5A 6D 5A 7A 42 4A 31 79 73 2F 4F 0D 0A} 6 | 7 | condition: 8 | $pdf at 0 and $comment in (0..200) 9 | } 10 | 11 | 12 | -------------------------------------------------------------------------------- /w-rules/rules/Loki Rules/apt_webshell_chinachopper.yar: -------------------------------------------------------------------------------- 1 | 2 | rule ChinaChopper_Generic { 3 | meta: 4 | description = "China Chopper Webshells - PHP and ASPX" 5 | author = "Florian Roth" 6 | reference = "https://www.fireeye.com/content/dam/legacy/resources/pdfs/fireeye-china-chopper-report.pdf" 7 | date = "2015/03/10" 8 | strings: 9 | $aspx = /%@\sPage\sLanguage=.Jscript.%><%eval\(RequestItem\[.{,100}unsafe/ 10 | $php = /nul" wide 10 | condition: 11 | (any of ($testn*) or $pingcmd) and $testdomain 12 | } 13 | -------------------------------------------------------------------------------- /w-rules/rules/Loki Rules/apt_backspace.yar: -------------------------------------------------------------------------------- 1 | /* 2 | Author: Bit Byte Bitten 3 | Date: 5/14/2015 4 | */ 5 | 6 | rule apt_backspace{ 7 | meta: 8 | description = "Detects APT backspace" 9 | author = "Bit Byte Bitten" 10 | date = "2015-05-14" 11 | hash = "6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99" 12 | strings: 13 | $s1 = "!! Use Splice Socket !!" 14 | $s2 = "User-Agent: SJZJ (compatible; MSIE 6.0; Win32)" 15 | $s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" 16 | condition: 17 | uint16(0) == 0x5a4d and all of them 18 | } -------------------------------------------------------------------------------- /CHANGELOG.md: -------------------------------------------------------------------------------- 1 | Change Log 2 | ========== 3 | 4 | All notable changes to this project will be documented in this file. 5 | 6 | [3.5] - 2016-08-04 7 | ------------------ 8 | 9 | ### Fixed 10 | 11 | ### Added 12 | 13 | ### Removed 14 | 15 | ### Changed 16 | 17 | 18 | [3.4] - 2016-07-29 19 | ------------------ 20 | 21 | ### Fixed 22 | 23 | ### Added 24 | 25 | - krallin/tini 26 | - tianon/gosu 27 | 28 | ### Removed 29 | 30 | - I am not including my rules folder by default anymore, but you can easily add it at runtime as shown in the README.md OR you can use the `w-rules` tag 31 | 32 | ### Changed 33 | -------------------------------------------------------------------------------- /w-rules/rules/signatures/sandboxdetect.yar: -------------------------------------------------------------------------------- 1 | 2 | rule sandboxdetect_misc : sandboxdetect 3 | { 4 | meta: 5 | author = "AlienVault Labs" 6 | type = "info" 7 | severity = 1 8 | description = "Sandbox detection tricks" 9 | 10 | strings: 11 | $sbxie1 = "sbiedll" nocase ascii wide 12 | 13 | // CWSandbox 14 | $prodid1 = "55274-640-2673064-23950" ascii wide 15 | $prodid2 = "76487-644-3177037-23510" ascii wide 16 | $prodid3 = "76487-337-8429955-22614" ascii wide 17 | 18 | $proc1 = "joeboxserver" ascii wide 19 | $proc2 = "joeboxcontrol" ascii wide 20 | condition: 21 | any of them 22 | } 23 | 24 | -------------------------------------------------------------------------------- /w-rules/rules/Loki Rules/crime_antifw_installrex.yar: -------------------------------------------------------------------------------- 1 | 2 | rule PUP_InstallRex_AntiFWb { 3 | meta: 4 | description = "Malware InstallRex / AntiFW" 5 | author = "Florian Roth" 6 | date = "2015-05-13" 7 | hash = "bb5607cd2ee51f039f60e32cf7edc4e21a2d95cd" 8 | score = 65 9 | strings: 10 | $s4 = "Error %u while loading TSU.DLL %ls" fullword ascii 11 | $s7 = "GetModuleFileName() failed => %u" fullword ascii 12 | $s8 = "TSULoader.exe" fullword wide 13 | $s15 = "\\StringFileInfo\\%04x%04x\\Arguments" fullword wide 14 | $s17 = "Tsu%08lX.dll" fullword wide 15 | condition: 16 | uint16(0) == 0x5a4d and all of them 17 | } -------------------------------------------------------------------------------- /w-rules/rules/Loki Rules/crime_cmstar.yar: -------------------------------------------------------------------------------- 1 | 2 | rule ce_enfal_cmstar_debug_msg { 3 | meta: 4 | author = "rfalcone" 5 | description = "Detects the static debug strings within CMSTAR" 6 | reference = "http://goo.gl/JucrP9" 7 | hash = "9b9cc7e2a2481b0472721e6b87f1eba4faf2d419d1e2c115a91ab7e7e6fc7f7c" 8 | date = "5/10/2015" 9 | strings: 10 | $d1 = "EEE\x0d\x0a" fullword 11 | $d2 = "TKE\x0d\x0a" fullword 12 | $d3 = "VPE\x0d\x0a" fullword 13 | $d4 = "VPS\x0d\x0a" fullword 14 | $d5 = "WFSE\x0d\x0a" fullword 15 | $d6 = "WFSS\x0d\x0a" fullword 16 | $d7 = "CM**\x0d\x0a" fullword 17 | condition: 18 | uint16(0) == 0x5a4d and all of ($d*) 19 | } -------------------------------------------------------------------------------- /w-rules/rules/Loki Rules/crime_cryptowall_svg.yar: -------------------------------------------------------------------------------- 1 | 2 | rule SVG_LoadURL { 3 | meta: 4 | description = "Detects a tiny SVG file that loads an URL (as seen in CryptoWall malware infections)" 5 | author = "Florian Roth" 6 | reference = "http://goo.gl/psjCCc" 7 | date = "2015-05-24" 8 | hash1 = "ac8ef9df208f624be9c7e7804de55318" 9 | hash2 = "3b9e67a38569ebe8202ac90ad60c52e0" 10 | hash3 = "7e2be5cc785ef7711282cea8980b9fee" 11 | hash4 = "4e2c6f6b3907ec882596024e55c2b58b" 12 | score = 50 13 | strings: 14 | $s1 = "" nocase 15 | $s2 = "