fadavvi / yara-repo

A script to collect (the most famous) Yara rules from more than 150 free resources. Free alternative to: https://valhalla.nextron-systems.com/

Really?!? So... Hmm... Hello! 👋

I'm Milad Fadavvi, an offensive security engineer who also occasionally takes on the role of protecting others from attacks!

yara-repo's Issues

new source

https://github.com/mokuso/yara-rules
https://github.com/5l1v3r1/yaraRules/tree/master/YaraRules

new sources

Hello,

thanks for your great script.

please add the following sources:

https://github.com/Jistrokz/TheSweeper-Rules
https://github.com/miladkahsarialhadi/RulesSet
https://github.com/0xbea/my-little-yara
https://github.com/gil121983/obfuscatedPHP

Many thanks in advance.

Kindly regards

new sources again

please be so kind and add:

https://gist.github.com/pedramamini/c586a151a978f971b70412ca4485c491
https://github.com/airbnb/binaryalert/tree/master/rules/public
https://github.com/codewatchorg/Burp-Yara-Rules
https://github.com/karttoon/binsequencer
https://github.com/DidierStevens/DidierStevensSuite
https://github.com/fideliscyber/indicators/tree/master/yararules
https://github.com/fireeye/red_team_tool_countermeasures
https://github.com/f0wl/yara_rules
https://github.com/EmersonElectricCo/fsf/tree/master/fsf-server/yara
https://github.com/jeFF0Falltrades/YARA-Signatures
https://koodous.com/rulesets
https://github.com/Loginsoft-Research
https://github.com/malice-plugins/yara/tree/master/rules
https://malpedia.caad.fkie.fraunhofer.de/api/get/yara/auto/zip
https://github.com/mikesxrs/Open-Source-YARA-rules
https://github.com/tylabs/quicksand_lite
https://github.com/rastrea2r/rastrea2r
https://github.com/securitymagic/yara
https://github.com/inv-ds-research/yaraml_rules
https://github.com/SpiderLabs/malware-analysis/tree/master/Yara
https://github.com/StrangerealIntel/DailyIOC
https://github.com/t4d/PhishingKit-Yara-Rules
https://github.com/VectraThreatLab/reyara
https://github.com/x64dbg/yarasigs
https://github.com/wrayjustin/yaids
https://github.com/DiabloHorn/yara4pentesters

new sources

git clone -q https://github.com/jtrombley90/Yara_Rules jtrombley90
git clone -q https://github.com/ail-project/ail-yara-rules ail-project
git clone -q https://github.com/Yara-Rules/rules/blob/master/malware/DarkComet.yar
git clone -q https://github.com/mandiant/sunburst_countermeasures mandiant

wget -q --output-document tlansec_pe_check.yar https://gist.githubusercontent.com/tlansec/4be4e92cbbd3354cf53386ef6edf0676/raw/f6cef23a2d3e6de6ead5b83c53801dbe1b653bf6/pe_check.yar
wget -q --output-document shellcromancer_mal_sysjoker_macOS.yara https://gist.githubusercontent.com/shellcromancer/e9e8c8ca95e0f31fc8b92ebc82b59303/raw/f706b420f6370d034781f605e55879e7d3322c1e/mal_sysjoker_macOS.yara
wget -q --output-document silascutler_WhisperGate.yar https://gist.githubusercontent.com/silascutler/f8e518564a8a1410ba58f0ab5ed493f6/raw/b465af32c4b546fb4ab3604fbe3c5d363aca7f2c/%2523WhisperGate%2520Yara%2520Rule
wget -q --output-document captainGeech42_scriptobf_replaceempty.yara https://gist.githubusercontent.com/captainGeech42/3e60e639ea62dd6e907e3e1e7cbac0fc/raw/43b3ef99249eb9b47c7062a98a3bdadad7863d65/scriptobf_replaceempty.yara
wget -q --output-document schrodyn_windows_drivers.yara https://gist.githubusercontent.com/schrodyn/30ca12d15e0e069224204adca41d5256/raw/7ff09541c30977173fb5dc192d5820a13f31a89d/windows_drivers.yara
git clone -q https://github.com/Te-k/cobaltstrike Te-k
git clone -q https://github.com/SEKOIA-IO/Community SEKOIA-IO
git clone -q https://github.com/NVISOsecurity/YARA NVISOsecurity
git clone -q https://github.com/t4d/PhishingKit-Yara-Search t4d

#!/usr/bin/env bash

#!/usr/bin/env bash
is more robust

new sources

git clone -q https://github.com/telekom-security/malware_analysis telekom-security
git clone -q https://github.com/tbarabosch/apihash_to_yara apihash_to_yara
git clone -q https://github.com/tillmannw/yara-rules tillmannw

printf instead of echo

https://github.com/koalaman/shellcheck/wiki/SC3037

echo -ne 'Foo:\tBar'
->
printf 'Foo:\tBar'

new source

https://github.com/thewhiteninja/yarasploit