Skip to content

Instantly share code, notes, and snippets.

@anthonykasza
Created December 15, 2015 14:42
Show Gist options
  • Save anthonykasza/09b54e3f76e4855793dc to your computer and use it in GitHub Desktop.
Save anthonykasza/09b54e3f76e4855793dc to your computer and use it in GitHub Desktop.
domains2yara
import random
import fileinput
print 'import "cuckoo"'
a='a444'
for d in fileinput.input():
d = d.strip()
a = 'a%d' % (random.randint(0, 100000000))
print "rule %s" % (a)
print "{"
print " condition:"
print " cuckoo.network.dns_lookup(/%s/)" % (d.replace(".", "\."))
print "}"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment