Reglas YARA para RedLine
15 reglas de 8 fuentes detectan RedLine. Se ordenan por compatibilidad con YARA-X, licencia (texto completo primero), puntuación y calidad. Sobre todo: Malware, Sospechoso / hunting.
La agrupación por familia es heurística: revisa la descripción de cada regla.
Escanear archivos con todas las reglas de RedLineBuscar reglas
Matches rare strings found in Redline panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Matches prompt messages in Redline panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Matches error/success messages in Redline panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Matches view headers in Redline Panel
MalwareESET malware-ioc· ESET Research· 2022-10-11Finds Redline samples based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-09-07Bytecodes found in late 2023 Redline malware
MalwareEmbee Research· Matthew @ Embee_Research· 2023-08-27Patterns observed in redline loader
MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24Patterns observed in redline
MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24Configuration related bytecodes in redline .net files
MalwareEmbee Research· Matthew @ Embee_Research· 2023-10-11Detects typical stealer output files as created by RedLine or Racoon stealer
Sospechoso / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-09-17Rule to detect the RedLine payload
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-16Detects native packer stub for version 4.5-4.7 of .NET Reactor. A pirated copy of version 4.5 of this commercial obfuscation solution is used by various malware families like BlackBit, RedLine, AgentTesla etc.
Sospechoso / huntingCod3nym detection-rules· Jonathan Peters· 2024-01-05- ARKBIRD_SOLG_Mal_Stealer_NET_Redline_Aug_2020_1Solo metadatos
Detect Redline Stealer (August 2020)
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-08-24 - SECUINFRA_MAL_Redline_Certificate_BoschSolo metadatos
Detects Certificate used by Redline Stealer
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02 - SECUINFRA_MAL_Redline_Certificate_GeforceSolo metadatos
Detects Certificate used by Redline Stealer
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-13