Skip to content

Instantly share code, notes, and snippets.

View esorlov's full-sized avatar

Egor S. Orlov esorlov

4 followers · 0 following
View GitHub Profile
@esorlov
esorlov / yara_performance_guidelines.md
Created February 25, 2022 08:58 — forked from Neo23x0/yara_performance_guidelines.md
YARA Performance Guidelines

This Gist has been transfered into a Github Repo. You'll find the most recent version here.

YARA Performance Guidelines

When creating your rules for YARA keep in mind the following guidelines in order to get the best performance from them. This guide is based on ideas and recommendations by Victor M. Alvarez and WXS.

  • Revision 1.4, October 2020, applies to all YARA versions higher than 3.7
@esorlov
esorlov / Base64_CheatSheet.md
Created February 25, 2022 08:58 — forked from Neo23x0/Base64_CheatSheet.md
Learning Aid - Top Base64 Encodings Table

Learning Aid - Top Base64 Encodings Table

Base64 Code Mnemonic Aid Decoded* Description
JAB 🗣 Jabber $. Variable declaration (UTF-16)
TVq 📺 Television MZ MZ header
SUVY 🚙 SUV IEX PowerShell Invoke Expression
SQBFAF 🐣 Squab favorite I.E. PowerShell Invoke Expression (UTF-16)
SQBuAH 🐣 Squab uahhh I.n. PowerShell Invoke string (UTF-16) e.g. Invoke-Mimikatz
PAA 💪 "Pah!" <. Often used by Emotet (UTF-16)
@esorlov
esorlov / snippet_gen_yara_hash.py
Created February 25, 2022 08:58 — forked from Neo23x0/snippet_gen_yara_hash.py
YARA Rule Hash Used by Nextron Systems
import hashlib
import re
def calculate_rule_hash(rule):
"""
Calculates a hash over the relevant YARA rule content (string contents, sorted condition)
Requires a YARA rule object as generated by 'plyara': https://github.com/plyara/plyara
:param rule: yara rule object
:return hash: generated hash
"""
@esorlov
esorlov / iddqd.yar
Created February 25, 2022 08:50 — forked from Neo23x0/iddqd.yar
IDDQD - Godmode YARA Rule
/*
_____ __ __ ___ __
/ ___/__ ___/ / / |/ /__ ___/ /__
/ (_ / _ \/ _ / / /|_/ / _ \/ _ / -_)
\___/\___/\_,_/_/_/__/_/\___/\_,_/\__/
\ \/ / _ | / _ \/ _ | / _ \__ __/ /__
\ / __ |/ , _/ __ | / , _/ // / / -_)
/_/_/ |_/_/|_/_/ |_| /_/|_|\_,_/_/\__/
Florian Roth - v0.5.0 October 2019
@esorlov
esorlov / gen_godmode_rule.yml
Created February 25, 2022 08:50 — forked from Neo23x0/gen_godmode_rule.yml
God Mode Sigma Rule
# ################################################################################
# IMPORTANT NOTE
# The most recent version of this POC rule can now be found in the main repository
# https://github.com/Neo23x0/sigma/blob/master/other/godmode_sigma_rule.yml
# ################################################################################
# _____ __ __ ___ __
# / ___/__ ___/ / / |/ /__ ___/ /__
# / (_ / _ \/ _ / / /|_/ / _ \/ _ / -_)
# \___/\___/\_,_/ /_/ /_/\___/\_,_/\__/_
# / __(_)__ ___ _ ___ _ / _ \__ __/ /__