Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

YARA rules for cobaltstrike and ccleaner #89

Merged
merged 2 commits into from
Dec 14, 2017
Merged

YARA rules for cobaltstrike and ccleaner #89

merged 2 commits into from
Dec 14, 2017

Conversation

austinbyers
Copy link
Collaborator

to: @javuto and @mime-frame
cc: @airbnb/binaryalert-maintainers
size: medium

Changes

  • Adds YARA rules which detect different CobaltStrike components
  • Adds a YARA rule for the backdoored CCleaner

Testing

  • CI: Tests that rules compile as expected

@coveralls
Copy link

Coverage Status

Coverage remained the same at 95.851% when pulling acfea40 on austin-cobalt-yara-rules into cebb706 on master.

@austinbyers austinbyers requested a review from a user December 14, 2017 01:41
javuto
javuto approved these changes Dec 14, 2017
View reviewed changes
Copy link

@javuto javuto left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚁

@coveralls
Copy link

Coverage Status

Coverage remained the same at 95.856% when pulling 2d47233 on austin-cobalt-yara-rules into 0fcb60e on master.

@austinbyers austinbyers merged commit d443913 into master Dec 14, 2017
@austinbyers austinbyers deleted the austin-cobalt-yara-rules branch December 14, 2017 18:56
@austinbyers austinbyers added this to the v1.1.0 milestone Dec 14, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@javuto javuto javuto approved these changes

Assignees
No one assigned
Labels
YARA
Projects
None yet
Milestone
v1.1.0
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@austinbyers @coveralls @javuto