yara-forensics-rules
A collection of yara rules that can be used for forensics (non malware) cases
Yara is the pattern matching swiss knife for malware researchers (and everyone else). Basically Yara allow us to scan files based on textual or binary patterns, thus we can take advantage of Yara's potential and focus it in forensic investigations.
Reason
If you start analysing a forensic image, a fast way to detect certain files like password safes is by using yara. It can also be used to hunt on file repositories for interesting files.
Malware
This repo is not meant to cover yara rules in regard to malware / rootkits / threat actors.
Using
sudo apt-get install yara
git clone https://github.com/jaegeral/yara-forensics-rules
Other projects
- https://github.com/Xumeiquer/yara-forensics focuses only on detecting magic bytes
- https://asecuritysite.com/forensics/magic good list of magic bytes