Top 21 Yara Open-Source Projects
-
-
loki
-
Scout APM
Less time debugging, more time building. Scout APM allows you to find and fix performance issues with no hassle. Now with error monitoring and external services monitoring, Scout is a developer's best friend when it comes to application development.
-
-
If you have a Yara detection platform, Florian Roth’s rules should detect executables signed with this. https://github.com/Neo23x0/signature-base/blob/master/yara/gen_nvidia_leaked_cert.yar.
-
Project mention: Detect It Easy, or abbreviated "DIE" is a program for determining types of files and more | reddit.com/r/CKsTechNews | 2021-11-14
-
WeLiveSecurity And many more.
-
Project mention: Tasked with building a malware analysis / threat hunting machine . Need feedback | reddit.com/r/cybersecurity | 2022-03-10
Yara rules generator - Generate yara rules based on a set of malware sample, https://github.com/Neo23x0/yarGen
-
SonarQube
Static code analysis for 29 languages.. Your projects are multi-language. So is SonarQube analysis. Find Bugs, Vulnerabilities, Security Hotspots, and Code Smells so you can release quality code every time. Get started analyzing your projects today for free.
-
Project mention: Building a Threat Intelligence Feed using the Twitter API and a bit of code | reddit.com/r/netsec | 2022-05-28
-
But, due to the young ecosystem, Rust isn't often the best choice for the 2nd category. There are exceptions: while working on a ROP exploitation CLI tool, I was surprised to find the top 3 fastest x86-64 disassemblers are all written in Rust. But other languages just have more mature security ecosystems. Python in particular has some amazing libraries like scapy and bindings for yara.
-
-
-
fleur
Fleur implements a Bloom Filter library in C that is fully compatible with DCSO's Go and python implementations.
> There is also strange code like this loop https://github.com/hashlookup/fleur/blob/4ee2644a850381d928a... that jumped into my eye.
The line below that is worse:
strncpy(bloom_path , argv[optind], 128);
If you pass something >= 128 chars then bloom_path won't be null terminated. In general strncpy should never be used for copying strings.
For expansion on that: https://ramblings.implicit.net/c/2014/05/02/c-functions-that...
-
-
Project mention: Scans container images, running Docker containers and filesystems to find indicators of malware | reddit.com/r/kubernetes | 2022-07-11
-
-
-
Project mention: Cisco ASA Software and ASDM Security Research for creating malicious packages and various other techniques | reddit.com/r/blueteamsec | 2022-08-15
-
a-ray-grass
a-ray-grass is a yara module that provides support for DCSO-format bloom filters in yara. In the context of hashlookup, it allows quickly discard known files "pour séparer le grain de l'ivraie"
-
hawk
Multi Cloud Antivirus Scanning API using YARA and CLAMAV for AWS S3, Azure Blob Storage and GCP Cloud Storage (by cloudina)
Project mention: Multi Cloud Antivirus Scanning API using YARA and CLAMAV for AWS S3, Azure Blob Storage and GCP Cloud Storage | reddit.com/r/antivirus | 2021-09-01 -
CVE-2022-26134-Exploit-Detection
This repository contains Yara rule and the method that a security investigator may want to use for CVE-2022-26134 threat hunting on their Linux confluence servers.
Project mention: CVE-2022-26134 – Confluence Zero Day Remote Code Execution - live threat | reddit.com/r/blueteamsec | 2022-06-04General advice - https://github.com/th3b3ginn3r/CVE-2022-26134-Exploit-Detection
-
AMAYARA-Lab
The アマヤラ Lab project provides a ready-to-use Jupyter Lab environment to help out with Android malware analysis using YARA rules.
Project mention: Android Malware Analysis YARA with JupyterLab | reddit.com/r/JupyterNotebooks | 2022-04-23アマヤラ (Android Malware Analysis YARA) Lab is a project that provides a ready-to-use Jupyter Lab environment to help out with Android malware analysis using YARA rules. Give a look at the GitHub repo!
Yara related posts
Index
What are some of the best open-source Yara projects? This list will help you:
| Project | Stars | |
|---|---|---|
| 1 | yara | 5,916 |
| 2 | Loki | 2,531 |
| 3 | awesome-yara | 2,254 |
| 4 | signature-base | 1,738 |
| 5 | DIE-engine | 1,255 |
| 6 | malware-ioc | 1,240 |
| 7 | yarGen | 1,089 |
| 8 | ThreatIngestor | 584 |
| 9 | yara-python | 478 |
| 10 | reversinglabs-yara-rules | 469 |
| 11 | go-yara | 268 |
| 12 | fleur | 111 |
| 13 | uzen | 79 |
| 14 | YaraHunter | 68 |
| 15 | yaramanager | 64 |
| 16 | apooxml | 34 |
| 17 | cisco_asa_research | 20 |
| 18 | a-ray-grass | 7 |
| 19 | hawk | 5 |
| 20 | CVE-2022-26134-Exploit-Detection | 1 |
| 21 | AMAYARA-Lab | 0 |
Are you hiring? Post a new remote job listing for free.
