we cookin' for #100DaysofYARA 🤝🔥
Binary Ninja plugin for copy and pasting bytes into YARA friendly format, courtesy of @re.wtf
github.com/ald3ns/copy-...
Rumor has it there's a next-generation version in the works that will probably blow your mind.
github.com/ald3ns/copy-...
Rumor has it there's a next-generation version in the works that will probably blow your mind.
GitHub - ald3ns/copy-as-yara: This is a little plugin to copy disassembly in a way that is usable in YARA rules!
This is a little plugin to copy disassembly in a way that is usable in YARA rules! - ald3ns/copy-as-yara
github.com
November 27, 2024 at 4:41 PM
we cookin' for #100DaysofYARA 🤝🔥
For my #100daysofYARA 2025, I plan to focus on YARA-X experiments and scripting/plugins for Binary Ninja.
November 23, 2024 at 5:26 PM
For my #100daysofYARA 2025, I plan to focus on YARA-X experiments and scripting/plugins for Binary Ninja.
#100DaysofYARA we're brute forcing Steve's prompt with regular expressions :P
github.com/100DaysofYAR...
github.com/100DaysofYAR...
January 3, 2025 at 3:12 PM
#100DaysofYARA we're brute forcing Steve's prompt with regular expressions :P
github.com/100DaysofYAR...
github.com/100DaysofYAR...
🚨#100DaysofYARA lives!!
2 time reigning champ Yashraj
has kindly offered to take the helm for this community effort! Give the homie a follow 👊
Check the repo to contribute: github.com/100DaysofYARA
And gear up for Jan 1 when #100DaysofYARA will kick off!
2 time reigning champ Yashraj
has kindly offered to take the helm for this community effort! Give the homie a follow 👊
Check the repo to contribute: github.com/100DaysofYARA
And gear up for Jan 1 when #100DaysofYARA will kick off!
a black and white photo of a man with a stethoscope around his neck screaming .
ALT: a black and white photo of a man with a stethoscope around his neck screaming .
media.tenor.com
December 28, 2025 at 11:21 PM
🚨#100DaysofYARA lives!!
2 time reigning champ Yashraj
has kindly offered to take the helm for this community effort! Give the homie a follow 👊
Check the repo to contribute: github.com/100DaysofYARA
And gear up for Jan 1 when #100DaysofYARA will kick off!
2 time reigning champ Yashraj
has kindly offered to take the helm for this community effort! Give the homie a follow 👊
Check the repo to contribute: github.com/100DaysofYARA
And gear up for Jan 1 when #100DaysofYARA will kick off!
Friendly reminder that we have a #100DaysofYARA discord (thanks to @_John_Doyle !) where a lot of folks will be chilling and more responsive than on socials - check it out!
And yes red team friends are welcome alongside us blues! 🫶❤️💙💜
discord.gg/z2qFJKez
And yes red team friends are welcome alongside us blues! 🫶❤️💙💜
discord.gg/z2qFJKez
Join the 100DaysOfYara Discord Server!
Check out the 100DaysOfYara community on Discord - hang out with 158 other members and enjoy free voice and text chat.
discord.gg
November 30, 2024 at 2:19 PM
Friendly reminder that we have a #100DaysofYARA discord (thanks to @_John_Doyle !) where a lot of folks will be chilling and more responsive than on socials - check it out!
And yes red team friends are welcome alongside us blues! 🫶❤️💙💜
discord.gg/z2qFJKez
And yes red team friends are welcome alongside us blues! 🫶❤️💙💜
discord.gg/z2qFJKez
Powered the VM up and ready to start my first entry to #100DaysOfYARA 2025 edition! 🔥
January 1, 2025 at 4:51 PM
Powered the VM up and ready to start my first entry to #100DaysOfYARA 2025 edition! 🔥
January 2, 2025 at 3:00 PM
Happy 100DaysOfYARA Eve!
December 31, 2024 at 11:46 PM
Happy 100DaysOfYARA Eve!
#100DaysofYARA 2025 edition begins tomorrow!
Any #CTI or #detectionengineering folks looking for a self-paced challenge to start the year with a laid back & fun community? Look no further!
The challenge is simple - write a YARA rule every day for 100 days
Any #CTI or #detectionengineering folks looking for a self-paced challenge to start the year with a laid back & fun community? Look no further!
The challenge is simple - write a YARA rule every day for 100 days
December 31, 2024 at 6:47 PM
#100DaysofYARA 2025 edition begins tomorrow!
Any #CTI or #detectionengineering folks looking for a self-paced challenge to start the year with a laid back & fun community? Look no further!
The challenge is simple - write a YARA rule every day for 100 days
Any #CTI or #detectionengineering folks looking for a self-paced challenge to start the year with a laid back & fun community? Look no further!
The challenge is simple - write a YARA rule every day for 100 days
#100DaysofYARA wanna track DPRK Macho maldevs but don't wanna dump strings or reverse anything?
track their dependency and permission preferences!
github.com/100DaysofYAR...
track their dependency and permission preferences!
github.com/100DaysofYAR...
January 7, 2025 at 12:46 AM
#100DaysofYARA wanna track DPRK Macho maldevs but don't wanna dump strings or reverse anything?
track their dependency and permission preferences!
github.com/100DaysofYAR...
track their dependency and permission preferences!
github.com/100DaysofYAR...
If you liked this thread and would like to see more of my methodology, let me know! Also if you have any suggestions or comments on my YARA rule, I'd love to hear them.
github.com/Squiblydo...
7/7
github.com/Squiblydo...
7/7
100DaysofYARA/Squiblydoo/Day1.yara at main · Squiblydoo/100DaysofYARA
Rules shared by the community from 100 Days of YARA 2026 - Squiblydoo/100DaysofYARA
github.com
January 1, 2026 at 5:36 PM
If you liked this thread and would like to see more of my methodology, let me know! Also if you have any suggestions or comments on my YARA rule, I'd love to hear them.
github.com/Squiblydo...
7/7
github.com/Squiblydo...
7/7
New blog post for #100DaysofYARA , in this one I look at a VenomRAT sample and create rules based on PE metadata and an encryption salt value.
forensicitguy.github.io/exploring-ve...
#malware
forensicitguy.github.io/exploring-ve...
#malware
Exploring VenomRAT Metadata and Encryption with YARA - #100DaysOfYara
It’s that time of year again - 100 Days of YARA! In this post I want to walk through how I use YARA to document malware analysis findings. YARA has loads of different use cases:
forensicitguy.github.io
January 3, 2025 at 2:27 AM
New blog post for #100DaysofYARA , in this one I look at a VenomRAT sample and create rules based on PE metadata and an encryption salt value.
forensicitguy.github.io/exploring-ve...
#malware
forensicitguy.github.io/exploring-ve...
#malware
#100DaysofYARA day 1 - the Amos stealer is regularly evolving and updating its obfuscation techniques
You know what isn't changing?
the dylibs it depends on and the entitlements it requests from the OS. Combined, they give us excellent signal
github.com/100DaysofYAR...
You know what isn't changing?
the dylibs it depends on and the entitlements it requests from the OS. Combined, they give us excellent signal
github.com/100DaysofYAR...
January 1, 2025 at 4:36 PM
#100DaysofYARA day 1 - the Amos stealer is regularly evolving and updating its obfuscation techniques
You know what isn't changing?
the dylibs it depends on and the entitlements it requests from the OS. Combined, they give us excellent signal
github.com/100DaysofYAR...
You know what isn't changing?
the dylibs it depends on and the entitlements it requests from the OS. Combined, they give us excellent signal
github.com/100DaysofYAR...
crossposting here #100daysofyara continuing to explore yara-x today I tried to detect a renamed QEMU exe using pe attributes and a dynamic variable.
January 5, 2025 at 11:43 AM
crossposting here #100daysofyara continuing to explore yara-x today I tried to detect a renamed QEMU exe using pe attributes and a dynamic variable.
This scripts are deceptive as they contain 10,000 empty lines. BTW #malcat loads scripts like these better than most text editors.
If I get the chance, I may revise it to see how to find ones without the matching text or if you have ideas, hmu.
github.com/Squiblydo...
3/3
If I get the chance, I may revise it to see how to find ones without the matching text or if you have ideas, hmu.
github.com/Squiblydo...
3/3
100DaysofYARA/Squiblydoo/Day9.yara at main · Squiblydoo/100DaysofYARA
Rules shared by the community from 100 Days of YARA 2026 - Squiblydoo/100DaysofYARA
github.com
January 10, 2026 at 7:17 PM
This scripts are deceptive as they contain 10,000 empty lines. BTW #malcat loads scripts like these better than most text editors.
If I get the chance, I may revise it to see how to find ones without the matching text or if you have ideas, hmu.
github.com/Squiblydo...
3/3
If I get the chance, I may revise it to see how to find ones without the matching text or if you have ideas, hmu.
github.com/Squiblydo...
3/3
#100DaysOfYara Day 30
PE32 EXE that appears to be loaded/hidden as a nullsoft installer application with very little detail in properties
github.com/augustvansic...
PE32 EXE that appears to be loaded/hidden as a nullsoft installer application with very little detail in properties
github.com/augustvansic...
February 1, 2025 at 12:56 AM
#100DaysOfYara Day 30
PE32 EXE that appears to be loaded/hidden as a nullsoft installer application with very little detail in properties
github.com/augustvansic...
PE32 EXE that appears to be loaded/hidden as a nullsoft installer application with very little detail in properties
github.com/augustvansic...
Happy New Year! #100DaysOfYARA 2025 Edition begins today!
Check the 2025 Github page:
github.com/100DaysofYAR...
@greg-l.bsky.social
Check the 2025 Github page:
github.com/100DaysofYAR...
@greg-l.bsky.social
GitHub - 100DaysofYARA/2025: Rules shared by the community from 100 Days of YARA 2025
Rules shared by the community from 100 Days of YARA 2025 - 100DaysofYARA/2025
github.com
January 1, 2025 at 11:42 AM
Happy New Year! #100DaysOfYARA 2025 Edition begins today!
Check the 2025 Github page:
github.com/100DaysofYAR...
@greg-l.bsky.social
Check the 2025 Github page:
github.com/100DaysofYAR...
@greg-l.bsky.social
#100DaysofYARA throwback to @0xkyle.bsky.social and I finding a weird payload getting dropped by UNK_SweetSpector - it was like a weird cross-mutation of SugarGh0st and what Unit42 called TunnelSpecter and SweetSpecter. payload uses Incognito framework for token forgery
github.com/100DaysofYAR...
github.com/100DaysofYAR...
January 10, 2025 at 7:35 PM
#100DaysofYARA throwback to @0xkyle.bsky.social and I finding a weird payload getting dropped by UNK_SweetSpector - it was like a weird cross-mutation of SugarGh0st and what Unit42 called TunnelSpecter and SweetSpecter. payload uses Incognito framework for token forgery
github.com/100DaysofYAR...
github.com/100DaysofYAR...
#100DaysOfYARA - Day 15 (a little behind)
I used @REMnux 's MCP, to extract a payload from an (unknown to me) malware, I'm now tracking as AxolotlLoader. I used the MCP to build a YARA rule based off of the XOR decryption function.
Rule at end
1/5
I used @REMnux 's MCP, to extract a payload from an (unknown to me) malware, I'm now tracking as AxolotlLoader. I used the MCP to build a YARA rule based off of the XOR decryption function.
Rule at end
1/5
February 22, 2026 at 8:46 PM
#100DaysOfYARA - Day 15 (a little behind)
I used @REMnux 's MCP, to extract a payload from an (unknown to me) malware, I'm now tracking as AxolotlLoader. I used the MCP to build a YARA rule based off of the XOR decryption function.
Rule at end
1/5
I used @REMnux 's MCP, to extract a payload from an (unknown to me) malware, I'm now tracking as AxolotlLoader. I used the MCP to build a YARA rule based off of the XOR decryption function.
Rule at end
1/5
#100daysofyara todays rule hits on a suspicious LNK executing mshta.exe using yara-x format.
github.com/mgreen27/100...
github.com/mgreen27/100...
January 31, 2025 at 12:40 PM
#100daysofyara todays rule hits on a suspicious LNK executing mshta.exe using yara-x format.
github.com/mgreen27/100...
github.com/mgreen27/100...
Today's rule is intentionally left blank: github.com/Squiblydo...
However, this is a reminder to:
- Review and retire rules as appropriate
- Document what hashes you made your rule against so that others can check your work as appropriate.
10/10
However, this is a reminder to:
- Review and retire rules as appropriate
- Document what hashes you made your rule against so that others can check your work as appropriate.
10/10
100DaysofYARA/Squiblydoo/Day12.yara at main · Squiblydoo/100DaysofYARA
Rules shared by the community from 100 Days of YARA 2026 - Squiblydoo/100DaysofYARA
github.com
January 14, 2026 at 12:39 PM
Today's rule is intentionally left blank: github.com/Squiblydo...
However, this is a reminder to:
- Review and retire rules as appropriate
- Document what hashes you made your rule against so that others can check your work as appropriate.
10/10
However, this is a reminder to:
- Review and retire rules as appropriate
- Document what hashes you made your rule against so that others can check your work as appropriate.
10/10
#100DaysofYARA - Day 2
YARA rule to detect the default Delphi darkmode dib icon.
I've seen this icon excessively over the years. Using @unpacme 's YARA hunting tools, I saw 0 known goodware and 800 packed junk.
Rule at end
1/4
YARA rule to detect the default Delphi darkmode dib icon.
I've seen this icon excessively over the years. Using @unpacme 's YARA hunting tools, I saw 0 known goodware and 800 packed junk.
Rule at end
1/4
January 2, 2026 at 12:58 PM
#100DaysofYARA - Day 2
YARA rule to detect the default Delphi darkmode dib icon.
I've seen this icon excessively over the years. Using @unpacme 's YARA hunting tools, I saw 0 known goodware and 800 packed junk.
Rule at end
1/4
YARA rule to detect the default Delphi darkmode dib icon.
I've seen this icon excessively over the years. Using @unpacme 's YARA hunting tools, I saw 0 known goodware and 800 packed junk.
Rule at end
1/4
Quality meme by the man itself, @greg-l.bsky.social !
We are few days away from 2025! Get your YARA rules ready 👀 #100DaysOfYARA #YARARules
We are few days away from 2025! Get your YARA rules ready 👀 #100DaysOfYARA #YARARules
December 29, 2024 at 4:03 PM
Quality meme by the man itself, @greg-l.bsky.social !
We are few days away from 2025! Get your YARA rules ready 👀 #100DaysOfYARA #YARARules
We are few days away from 2025! Get your YARA rules ready 👀 #100DaysOfYARA #YARARules