A set of YARA rules for the AIL framework to detect leak or information disclosure. This repository can be used by other tools.
- rules
- api-keys
- b64_encoded
- blacklist
- classified
- cloud
- code
- crypto
- database
- detection
- keylogger
- obfuscation
- password
- stealer
- ailurophile.yara
- arechclientv2.yara
- astris.yara
- atomic.yara
- banshee.yara
- blankgrabber.yara
- cryptbot.yara
- darkcrystal.yara
- luca.yara
- lumma2.yara
- lumma.yara
- meduza.yara
- noxy.yara
- phemedrone.yara
- raccoon2.yara
- raccoon.yara
- redline.yara
- risepro.yara
- rlstealer.yara
- skalka.yara
- stealc.yara
- stealerium.yara
- vidar.yara
- xfiles.yara
- kevthehermit via PasteHunter for the initial rule set licensed under the GNU General Public License
- AlienVault-Labs for some additional rules
- what-is-this-stealer
- AIL Project contributors
ail-yara-rules is distributed under the AGPL if not specified or the original license of the rules.
It's quite easy. Fork the repository, add or modify existing YARA rule and make a pull request. Please take a look at the directory name to map the scope of the YARA rule.