YARA rules tagged PE
3 rules carry the tag “PE”.
Triggers on parts of a big hex string available in lots of crime'ish PE files.
MalwareSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2021-06-04- SECUINFRA_SUSP_Discord_Attachments_URLMetadata only
Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19 - SECUINFRA_SUSP_Netsh_Firewall_CommandMetadata only
No description has been set in the source file - SecuInfra
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27