Kyle Eaton

Thank you! I haven’t looked into writing yara x modules yet, but was thinking about a strelka scanner. Def going to see about yara x now though that’s a great idea

PDFs have been a constant struggle and I’ve found that this helps. Might be a little biased tho

I’ll be presenting at #GrrCON this year about some weird pdf detection ideas I’ve been messing with. Swing by and tell me your file format

People love people who use ms paint.

It’s a strong bug.

We don’t need AI for shitty art

a man in an apron is cooking in a kitchen with a sign on the wall that says no smoking ALT: a man in an apron is cooking in a kitchen with a sign on the wall that says no smoking

Cooking up signatures

Idk about y’all but I don’t plan on giving RU ops a free pass into our customer networks just because some ding dong says they aren’t a threat

If anything I might just wanna burn them with more prejudice out of spite for both regimes

GitHub - target/halogen: Automatically create YARA rules from malicious documents. Automatically create YARA rules from malicious documents. - GitHub - target/halogen: Automatically create YARA rules from malicious documents.

QR codes can be tricky just because the benign and malicious ones can be very similar. But you can use something like halogen to help generate the yara rules for testing it out. github.com/target/halogen

Check this episode out to hear about image lures and how we can detect them

www.virustotal.com/gui/file/f2a...

Also expecting to see indiandefenceforces[.]link soon

Haven’t seen PDFs for this yet but a new domain popped: defenceindia[.]link

departmentofdefence[.]link 🧐

threatresearch/yara/zip_file.yara at master · EmergingThreats/threatresearch I wanted to call this repo "Nuclear Football Codes". I was outvoted.. - EmergingThreats/threatresearch

Yara rule to match concatenated zip files. I like this one (biased) because of how we are able to avoid matching nested zip files.

More info: x.com/threatinsigh...

#yara github.com/EmergingThre...