Mirrors/reversinglabs-reversinglabs-yara-rules
1
0
Fork 0
mirror of https://github.com/reversinglabs/reversinglabs-yara-rules synced 2026-06-11 03:01:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added new YARA rules.

Browse Source
This commit is contained in:
Threat Analyst
2020-10-19 12:00:02 +02:00
parent 1640abe6ba
commit d17217551a
3 changed files with 258 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
yara/certificate/blocklist.yara
+5
View File
@@ -7,6 +7,11 @@
b) Files that fail integrity validation due to checksum mismatch
c) Files that have extra data appended after the certificate
It's also worth mentioning that the timestamp value in the condition is only
informative, since YARA doesn't extract timestamping certificate information.
This information could be used in combination with other tools to reduce
potential false positives.
ReversingLabs recommends using Titanium platform for best results with certificate-based classifications.
References on importance of certificate verification: