Cod3nym detection-rules
- Dépôt
- https://github.com/cod3nym/detection-rules
- Commit
- 86a04c4594cb48895192aad4af164f21f568c136
- Récupéré le
- 2026-09-27
- Licence
- Detection Rule License 1.1
- Publication
- Texte complet
- Justification
- Repository LICENSE.md is DRL 1.1.
Télécharger le pack (.yar, 8 règles)
Texte de licence (tel que récupéré par YARA Forge)
## Detection Rule License (DRL) 1.1
Permission is hereby granted, free of charge, to any person obtaining a copy
of this rule set and associated documentation files (the "Rules"), to deal
in the Rules without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Rules, and to permit persons to whom the Rules are furnished to do so,
subject to the following conditions:
If you share the Rules (including in modified form), you must retain the
following if it is supplied within the Rules:
1. identification of the authors(s) ("author" field) of the Rule and any
others designated to receive attribution, in any reasonable manner
requested by the Rule author (including by pseudonym if designated).
2. a URI or hyperlink to the Rule set or explicit Rule to the extent
reasonably practicable
3. indicate the Rules are licensed under this Detection Rule License, and
include the text of, or the URI or hyperlink to, this Detection Rule
License to the extent reasonably practicable
If you use the Rules (including in modified form) on data, messages based on
matches with the Rules must retain the following if it is supplied within the
Rules:
1. identification of the authors(s) ("author" field) of the Rule and any
others designated to receive attribution, in any reasonable manner
requested by the Rule author (including by pseudonym if designated).
THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE
RULES.Règles de Cod3nym detection-rules
Detects LimeCrypter RunPE module. LimeCrypter is an open source .NET based crypter and loader commonly used by threat actors
MalwareCod3nym detection-rules· Jonathan Peters· 2024-01-16Detects open-source NixImports .NET malware loader. A stealthy loader using dynamic import resolving to evade static detection
MalwareCod3nym detection-rules· Jonathan Peters· 2024-01-12Detects single file host .NET bundled apps.
GénériqueCod3nym detection-rules· Jonathan Peters· 2024-01-02Detects binaries packed with ConfuserEx compression packer. This feature compresses and encrypts the actual image into a stub that unpacks and loads the original image on runtime.
Suspect / chasseCod3nym detection-rules· Jonathan Peters· 2024-01-09Detects direct syscall evasion technqiue using NtProtectVirtualMemory to invoke shellcode
Suspect / chasseCod3nym detection-rules· Jonathan Peters· 2024-01-14Detects indicators of shellcode loaders in .NET binaries
Suspect / chasseCod3nym detection-rules· Jonathan Peters· 2024-01-11Detects indicators of .NET Reactors managed obfuscation. Reactor is a commercial obfuscation solution, pirated versions are often abused by threat actors.
Suspect / chasseCod3nym detection-rules· Jonathan Peters· 2024-01-09Detects native packer stub for version 4.5-4.7 of .NET Reactor. A pirated copy of version 4.5 of this commercial obfuscation solution is used by various malware families like BlackBit, RedLine, AgentTesla etc.
Suspect / chasseCod3nym detection-rules· Jonathan Peters· 2024-01-05