Skip to content

Commit a5d4324

Browse files
octo-sts-2[bot]github-actions[bot]
octo-sts-2[bot]
and
github-actions[bot]
authored
Update third-party rules as of 2026-05-03 (#1496)
Co-authored-by: Update third-party rules <41898282+github-actions[bot]@users.noreply.github.com>
1 parent c109cd0 commit a5d4324

9 files changed

Lines changed: 10828 additions & 10704 deletions

File tree

‎tests/linux/2024.sliver/de33b8d9694b6b4c44e3459b2151571af5d0e2031551f9f1a70b6db475ba71b2.elf.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,10 @@
2626
],
2727
"RiskScore": 4,
2828
"RiskLevel": "CRITICAL",
29-
"RuleURL": "https://github.com/Neo23x0/signature-base/blob/eaf65c0c2c2a7c4b5888b22f4b815369e6465e27/yara/gen_gobfuscate.yar#L2-L18",
29+
"RuleURL": "https://github.com/Neo23x0/signature-base/blob/a63a834c1ab5eda4428d077efe5f34fc5425dc8d/yara/gen_gobfuscate.yar#L2-L18",
3030
"ReferenceURL": "https://github.com/unixpickle/gobfuscate",
3131
"RuleAuthor": "James Quinn, Paul Hager (merged with new similar pattern)",
32-
"RuleLicenseURL": "https://github.com/Neo23x0/signature-base/blob/eaf65c0c2c2a7c4b5888b22f4b815369e6465e27/LICENSE",
32+
"RuleLicenseURL": "https://github.com/Neo23x0/signature-base/blob/a63a834c1ab5eda4428d077efe5f34fc5425dc8d/LICENSE",
3333
"ID": "3P/YARAForge/signature_susp_gobfuscate",
3434
"RuleName": "SIGNATURE_BASE_SUSP_Gobfuscate_May21"
3535
},

‎tests/macOS/2023.3CX/libffmpeg.change_decrease.mdiff‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@
55
| RISK | KEY | DESCRIPTION | EVIDENCE |
66
|:--|:--|:--|:--|
77
| -CRITICAL | [3P/YARAForge/sekoia_downloader_smooth](https://github.com/SEKOIA-IO/Community/blob/4a791f6fe20b053bc2acd963bb9955f6cd385791/yara_rules/downloader_mac_smooth_operator.yar#L1-L16) | Detect the Smooth_Operator malware, by [Sekoia.io](https://github.com/SEKOIA-IO/Community) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)<br>[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code) |
8-
| -CRITICAL | [3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/eaf65c0c2c2a7c4b5888b22f4b815369e6465e27/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275) | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)<br>[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)<br>`$op1`<br>`$op2`<br>`$sa1`<br>`$sa2` |
9-
| -CRITICAL | [3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/eaf65c0c2c2a7c4b5888b22f4b815369e6465e27/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214) | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`<br>`$xc2`<br>`$xc3` |
10-
| -CRITICAL | [3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/eaf65c0c2c2a7c4b5888b22f4b815369e6465e27/yara/gen_xor_hunting.yar#L2-L25) | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
8+
| -CRITICAL | [3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/a63a834c1ab5eda4428d077efe5f34fc5425dc8d/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275) | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)<br>[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)<br>`$op1`<br>`$op2`<br>`$sa1`<br>`$sa2` |
9+
| -CRITICAL | [3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/a63a834c1ab5eda4428d077efe5f34fc5425dc8d/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214) | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`<br>`$xc2`<br>`$xc3` |
10+
| -CRITICAL | [3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/a63a834c1ab5eda4428d077efe5f34fc5425dc8d/yara/gen_xor_hunting.yar#L2-L25) | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
1111
| -CRITICAL | [3P/YARAForge/volexity_iconic](https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-03-30%203CX/indicators/rules.yar#L32-L50) | [Detects the MACOS version of the ICONIC loader.](https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/), by threatintel@volexity.com | `$str1`<br>`$str2`<br>`$str3` |
1212
| -CRITICAL | [anti-static/xor/user_agent](https://github.com/chainguard-dev/malcontent/blob/main/rules/anti-static/xor/xor-user_agent.yara#xor_mozilla) | XOR'ed user agent, often found in backdoors, by Florian Roth | [xor_mozilla::$Mozilla_5_0](https://github.com/search?q=xor_mozilla%3A%3A%24Mozilla_5_0&type=code) |
1313
| -CRITICAL | [impact/remote_access/net_exec](https://github.com/chainguard-dev/malcontent/blob/main/rules/impact/remote_access/net_exec.yara#lazarus_darwin_nsurl) | executes programs, sets permissions, sleeps, makes HTTP requests | [NSMutableURLRequest](https://github.com/search?q=NSMutableURLRequest&type=code)<br>[gethostname](https://github.com/search?q=gethostname&type=code)<br>[localtime](https://github.com/search?q=localtime&type=code)<br>[sprintf](https://github.com/search?q=sprintf&type=code)<br>[strncpy](https://github.com/search?q=strncpy&type=code)<br>[pclose](https://github.com/search?q=pclose&type=code)<br>[chmod](https://github.com/search?q=chmod&type=code)<br>[flock](https://github.com/search?q=flock&type=code)<br>[popen](https://github.com/search?q=popen&type=code)<br>[sleep](https://github.com/search?q=sleep&type=code)<br>[rand](https://github.com/search?q=rand&type=code) |

‎tests/macOS/2023.3CX/libffmpeg.change_increase.mdiff‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@
55
| RISK | KEY | DESCRIPTION | EVIDENCE |
66
|:--|:--|:--|:--|
77
| +CRITICAL | **[3P/YARAForge/sekoia_downloader_smooth](https://github.com/SEKOIA-IO/Community/blob/4a791f6fe20b053bc2acd963bb9955f6cd385791/yara_rules/downloader_mac_smooth_operator.yar#L1-L16)** | Detect the Smooth_Operator malware, by [Sekoia.io](https://github.com/SEKOIA-IO/Community) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)<br>[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code) |
8-
| +CRITICAL | **[3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/eaf65c0c2c2a7c4b5888b22f4b815369e6465e27/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275)** | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)<br>[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)<br>`$op1`<br>`$op2`<br>`$sa1`<br>`$sa2` |
9-
| +CRITICAL | **[3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/eaf65c0c2c2a7c4b5888b22f4b815369e6465e27/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214)** | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`<br>`$xc2`<br>`$xc3` |
10-
| +CRITICAL | **[3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/eaf65c0c2c2a7c4b5888b22f4b815369e6465e27/yara/gen_xor_hunting.yar#L2-L25)** | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
8+
| +CRITICAL | **[3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/a63a834c1ab5eda4428d077efe5f34fc5425dc8d/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275)** | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)<br>[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)<br>`$op1`<br>`$op2`<br>`$sa1`<br>`$sa2` |
9+
| +CRITICAL | **[3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/a63a834c1ab5eda4428d077efe5f34fc5425dc8d/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214)** | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`<br>`$xc2`<br>`$xc3` |
10+
| +CRITICAL | **[3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/a63a834c1ab5eda4428d077efe5f34fc5425dc8d/yara/gen_xor_hunting.yar#L2-L25)** | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
1111
| +CRITICAL | **[3P/YARAForge/volexity_iconic](https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-03-30%203CX/indicators/rules.yar#L32-L50)** | [Detects the MACOS version of the ICONIC loader.](https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/), by threatintel@volexity.com | `$str1`<br>`$str2`<br>`$str3` |
1212
| +CRITICAL | **[anti-static/xor/user_agent](https://github.com/chainguard-dev/malcontent/blob/main/rules/anti-static/xor/xor-user_agent.yara#xor_mozilla)** | XOR'ed user agent, often found in backdoors, by Florian Roth | [xor_mozilla::$Mozilla_5_0](https://github.com/search?q=xor_mozilla%3A%3A%24Mozilla_5_0&type=code) |
1313
| +CRITICAL | **[impact/remote_access/net_exec](https://github.com/chainguard-dev/malcontent/blob/main/rules/impact/remote_access/net_exec.yara#lazarus_darwin_nsurl)** | executes programs, sets permissions, sleeps, makes HTTP requests | [NSMutableURLRequest](https://github.com/search?q=NSMutableURLRequest&type=code)<br>[gethostname](https://github.com/search?q=gethostname&type=code)<br>[localtime](https://github.com/search?q=localtime&type=code)<br>[sprintf](https://github.com/search?q=sprintf&type=code)<br>[strncpy](https://github.com/search?q=strncpy&type=code)<br>[pclose](https://github.com/search?q=pclose&type=code)<br>[chmod](https://github.com/search?q=chmod&type=code)<br>[flock](https://github.com/search?q=flock&type=code)<br>[popen](https://github.com/search?q=popen&type=code)<br>[sleep](https://github.com/search?q=sleep&type=code)<br>[rand](https://github.com/search?q=rand&type=code) |

‎tests/macOS/2023.3CX/libffmpeg.dirty.mdiff‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@
55
| RISK | KEY | DESCRIPTION | EVIDENCE |
66
|:--|:--|:--|:--|
77
| +CRITICAL | **[3P/YARAForge/sekoia_downloader_smooth](https://github.com/SEKOIA-IO/Community/blob/4a791f6fe20b053bc2acd963bb9955f6cd385791/yara_rules/downloader_mac_smooth_operator.yar#L1-L16)** | Detect the Smooth_Operator malware, by [Sekoia.io](https://github.com/SEKOIA-IO/Community) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)<br>[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code) |
8-
| +CRITICAL | **[3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/eaf65c0c2c2a7c4b5888b22f4b815369e6465e27/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275)** | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)<br>[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)<br>`$op1`<br>`$op2`<br>`$sa1`<br>`$sa2` |
9-
| +CRITICAL | **[3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/eaf65c0c2c2a7c4b5888b22f4b815369e6465e27/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214)** | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`<br>`$xc2`<br>`$xc3` |
10-
| +CRITICAL | **[3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/eaf65c0c2c2a7c4b5888b22f4b815369e6465e27/yara/gen_xor_hunting.yar#L2-L25)** | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
8+
| +CRITICAL | **[3P/YARAForge/signature_3cxdesktopapp_backdoor](https://github.com/Neo23x0/signature-base/blob/a63a834c1ab5eda4428d077efe5f34fc5425dc8d/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275)** | [Detects 3CXDesktopApp MacOS Backdoor component](https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/), by X__Junior (Nextron Systems) | [%s/.main_storage](https://github.com/search?q=%25s%2F.main_storage&type=code)<br>[%s/UpdateAgent](https://github.com/search?q=%25s%2FUpdateAgent&type=code)<br>`$op1`<br>`$op2`<br>`$sa1`<br>`$sa2` |
9+
| +CRITICAL | **[3P/YARAForge/signature_nk_3cx](https://github.com/Neo23x0/signature-base/blob/a63a834c1ab5eda4428d077efe5f34fc5425dc8d/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214)** | [Detects malicious DYLIB files related to 3CX compromise](https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/), by Florian Roth (Nextron Systems) | `$xc1`<br>`$xc2`<br>`$xc3` |
10+
| +CRITICAL | **[3P/YARAForge/signature_susp_xored](https://github.com/Neo23x0/signature-base/blob/a63a834c1ab5eda4428d077efe5f34fc5425dc8d/yara/gen_xor_hunting.yar#L2-L25)** | [Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key](https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()), by Florian Roth | `$xo1` |
1111
| +CRITICAL | **[3P/YARAForge/volexity_iconic](https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-03-30%203CX/indicators/rules.yar#L32-L50)** | [Detects the MACOS version of the ICONIC loader.](https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/), by threatintel@volexity.com | `$str1`<br>`$str2`<br>`$str3` |
1212
| +CRITICAL | **[anti-static/xor/user_agent](https://github.com/chainguard-dev/malcontent/blob/main/rules/anti-static/xor/xor-user_agent.yara#xor_mozilla)** | XOR'ed user agent, often found in backdoors, by Florian Roth | [xor_mozilla::$Mozilla_5_0](https://github.com/search?q=xor_mozilla%3A%3A%24Mozilla_5_0&type=code) |
1313
| +CRITICAL | **[impact/remote_access/net_exec](https://github.com/chainguard-dev/malcontent/blob/main/rules/impact/remote_access/net_exec.yara#lazarus_darwin_nsurl)** | executes programs, sets permissions, sleeps, makes HTTP requests | [NSMutableURLRequest](https://github.com/search?q=NSMutableURLRequest&type=code)<br>[gethostname](https://github.com/search?q=gethostname&type=code)<br>[localtime](https://github.com/search?q=localtime&type=code)<br>[sprintf](https://github.com/search?q=sprintf&type=code)<br>[strncpy](https://github.com/search?q=strncpy&type=code)<br>[pclose](https://github.com/search?q=pclose&type=code)<br>[chmod](https://github.com/search?q=chmod&type=code)<br>[flock](https://github.com/search?q=flock&type=code)<br>[popen](https://github.com/search?q=popen&type=code)<br>[sleep](https://github.com/search?q=sleep&type=code)<br>[rand](https://github.com/search?q=rand&type=code) |

0 commit comments

Comments
 (0)