Giter Site home page Giter Site logo

2023's Introduction

100 Days of YARA Part 2 - Electric Detectaloo

Apologies in advance for the terrible naming, but welcome to 100 Days of YARA! This repository will act as the store for all YARA ideas created during this time. Any fun scripts, tools, or rules you write can be committed to this GitHub repository! For now, any associated blogging, walkthroughs, or other musing can be hosted elsewhere :)

So what is all this any way?

In short, #100DaysofYARA is place on the internet where malware analysts, detection engineers, and reversers share ideas for YARA rules, tips for rule creation, or methods of using YARA in unconventional ways.

We'll create a new repository for each calendar year, but the structure can be pretty free-form! At some point there will be style and structural requirements for YARA rules submitted (tabs vs spaces, necessary metadata like author, date, things like that) but the general vibes are positive and uplifting so go wild with your most outlandish rules!

It is not lost on me that we could just fork Florian Roth's repositories here and call it good on detection, but this event is about advancing your own YARA skills, whether it is your first rule or your 1000th. Documenting that learning journey is important, especially for most of us late-stage adopters who probably did not major in computer science (there will be a rant on this), so think of committing to this repo as slightly-public diary about malware detection where your pals can help you and encourage you along the way.

There will be an initial walkthrough for how to use GitHub for this for those that aren't familiar, once I get around to writing it.

For now, let those YARA ideas ferment and write em down so you have content to spare - #100DaysofYARA2 starts Jan 1, 2023!

2023's People

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

2023's Issues

idea: add a default license and encourage contributors to add a license in the meta section

to actually make some use of all the nice rules here, it would be useful if some license would be attached. you could add a default license to the repo and encourage contributors to add a license in the meta section, if they don't like the default e.g.:

private rule webshell_encoded_stats : WEBSHELL PROD {
	meta:
		description = "Webshell having statistical signs of encoded code which gets dynamically executed"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		license = "https://creativecommons.org/licenses/by-nc/4.0/"
		author = "Arnim Rupp"
		date = "2021/02/07"
	condition:
...

idea: integrate yara-ci

YARA-CI helps you to keep your YARA rules in good shape. It can be integrated into any GitHub repository containing YARA rules, and it will run automated tests every time you make some change. The automated tests include:

Rules validation
Detection of false positives
Detection of false negatives

https://yara-ci.cloud.virustotal.com/

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.