shellcromancer

rule obfus_stackstring_imov {
    meta:
        descrption = "Identify stack-strings obfuscation via indirect moves."
        author = "@shellcromancer <root@shellcromancer.io>"
        version = "0.1"
        date = "2022-01-07"
        reference = "https://www.mandiant.com/resources/automatically-extracting-obfuscated-strings"
    strings:
        $mov_r = { c6 4? ?? 72 } // mov byte [rdi + ?], 0x72 ; 'r'
        $mov_s = { c6 4? 0? 73 } // mov byte [rdi + ?], 0x73 ; 's'

wxsBSD

One way to find PE files that start at offset 0 and have a single byte xor key:

rule single_byte_xor_pe_and_mz {
  meta:
    author = "Wesley Shields <wxs@atarininja.org>"
    description = "Look for single byte xor of a PE starting at offset 0"
  strings:
    $b = "PE\x00\x00" xor(0x01-0xff)
 condition:

yt0ng

// Must have console module via yara-4.2.0-rc1+
// expects decoded beacons 

import "pe"
import "console"


rule CobaltStrike_Watermark_Profiler: Profiler 
{
meta:

notareverser

#!/usr/bin/env python

# for our homey, Claude Shannon

import sys
import logging
import binascii
import hashlib
import argparse

tlansec

# Simple script to demo use of yara-python + externals
# think of all the externals you could define!

import os
import sys
import yara

example_rule = '''
rule demo_externals
{

JusticeRage

"""
got_tmilk.py - Go Type Milking
Written by Ivan Kwiatkowski @ Kaspersky GReAT
Shared under the terms of the GPLv3 license
"""

C_HEADER = """
enum golang_kind : __int8
{
  INVALID = 0x0,

notareverser

#!/usr/bin/env python3

import sys, string, struct

def strByByte(_strval):
    strval = bytearray(_strval.encode())
    for s in strval: yield s

def strByDword(_strval):
    strval = bytearray(_strval.encode())

notareverser

#!/usr/bin/env python3


import argparse
import sys
import json

import logging

wxsBSD

Test rules:

wxs@wxs-mbp yara % cat rules/test.yara
rule b {
  strings:
    $a = "LSCOLORS"
  condition:
    $a
}

Droogy

import "pe"
import "hash"
import "math"
import "time"

rule Gootloader_container {
   meta:
      description = "Gootloader Dropper Container"    
      author = "Droogy"