A collection of yara rules that can be used for forensics (non malware) cases
Yara
is the pattern matching swiss knife for malware researchers (and everyone else). Basically Yara
allow us to scan files based on textual or binary patterns, thus we can take advantage of Yara
's potential and focus it in forensic investigations.
If you start analysing a forensic image, a fast way to detect certain files like password safes is by using yara. It can also be used to hunt on file repositories for interesting files.
This repo is not meant to cover yara rules in regard to malware / rootkits / threat actors.
sudo apt-get install yara
git clone https://github.com/jaegeral/yara-forensics-rules
- https://github.com/Xumeiquer/yara-forensics focuses only on detecting magic bytes
- https://asecuritysite.com/forensics/magic good list of magic bytes