WithSecure Labs IOCs
- Repository
- https://github.com/WithSecureLabs/iocs
- Commit
- 1a8384468dd292c6d2c5114c32e42dc0da1f5ae1
- Abgerufen
- 2026-09-27
- Lizenz
- BSD 2-Clause License
- ©
- Copyright (c) 2022, WithSecure Oyj
- Veröffentlicht
- Volltext
- Begründung
- BSD 2-Clause: redistribution allowed with the copyright notice and licence text retained.
Paket herunterladen (.yar, 24 Regeln)
Lizenztext (wie von YARA Forge abgerufen)
BSD 2-Clause License Copyright (c) [2022], [WithSecure Oyj] Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Regeln von WithSecure Labs IOCs
Detects JelusRAT packer and payload samples via PDB path
Verdächtig / HuntingWithSecure Labs IOCs· WithSecure· 2026-01-22Detects JelusRAT plugins
MalwareWithSecure Labs IOCs· WithSecure· 2026-01-22Detects NativeAOT variants of DUCKTAIL malware
MalwareWithSecure Labs IOCs· WithSecure· 2022-11-17Detects strings found in EDR killer batch script
GenerischWithSecure Labs IOCs· WithSecure· 2026-01-22Detects GopherRAT samples
GenerischWithSecure Labs IOCs· WithSecure· 2026-01-22Detects custom port scanner based on file version info
GenerischWithSecure Labs IOCs· WithSecure· 2026-01-22Detects StarshellRAT samples
GenerischWithSecure Labs IOCs· WithSecure· 2026-01-22Detects UnderCrypt samples based on shared code portions
GenerischWithSecure Labs IOCs· WithSecure· 2026-01-22Detects UnderCrypt samples based on version info
GenerischWithSecure Labs IOCs· WithSecure· 2026-01-22Detects HTA files masqeurading as fake VPN clients
GenerischWithSecure Labs IOCs· WithSecure· 2026-08-26Detects FallSpy Android malware
MalwareWithSecure Labs IOCs· WithSecure· 2026-05-28Detects common strings found across one of GREYVIBE's loaders (observed across PrincessClub and PhantomMail campaigns)
GenerischWithSecure Labs IOCs· WithSecure· 2026-05-28Detects common strings found across one of GREYVIBE's loaders (observed in PhantomMail campaign)
GenerischWithSecure Labs IOCs· WithSecure· 2026-05-28Detects GREYVIBE's watchdog script for PhantomRelay
GenerischWithSecure Labs IOCs· WithSecure· 2026-05-28Detects LegionRelay client script
GenerischWithSecure Labs IOCs· WithSecure· 2026-05-28Detects a common string found across samples obfuscated with LOOKVALJS
Verdächtig / HuntingWithSecure Labs IOCs· WithSecure· 2026-05-28Detects common strings found across samples obfuscated with LOOKVALPS
Verdächtig / HuntingWithSecure Labs IOCs· WithSecure· 2026-05-28Detects PhantomRelay client script
GenerischWithSecure Labs IOCs· WithSecure· 2026-05-28Detects PhantomRelay's fingerprinting script
GenerischWithSecure Labs IOCs· WithSecure· 2026-05-28Detects common strings found across samples obfuscated with TEASOUP
Verdächtig / HuntingWithSecure Labs IOCs· WithSecure· 2026-05-28Detects common strings found across samples obfuscated with DAYLIGHT
Verdächtig / HuntingWithSecure Labs IOCs· WithSecure· 2026-05-28Detects artifacts found in files associated to DUCKTAIL malware
MalwareWithSecure Labs IOCs· WithSecure· 2022-07-18Detects SILKLOADER samples
GenerischWithSecure Labs IOCs· WithSecure· 2023-03-15Detects samples packed with TangleCrypt
Verdächtig / HuntingWithSecure Labs IOCs· WithSecure· 2025-11-25