brokensound77

Detecting RMM

ℹ️ This was duplicated to this blog for readability and reference

---

The most difficult challenge with RMM detection is contextual awareness around usage to determine if it is valid or malicious.

liudongmiao

// package me.piebridge;

import java.io.IOException;
import java.io.RandomAccessFile;
import java.math.BigInteger;
import java.nio.ByteBuffer;
import java.nio.ByteOrder;
import java.util.Arrays;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

Neo23x0

This Gist has been transfered into a Github Repo. You'll find the most recent version here.

YARA Performance Guidelines

When creating your rules for YARA keep in mind the following guidelines in order to get the best performance from them. This guide is based on ideas and recommendations by Victor M. Alvarez and WXS.

• Revision 1.4, October 2020, applies to all YARA versions higher than 3.7

johndstein

# Install mongodb 
---
- name: Add mongo ppa key
  sudo: yes
  apt_key: >
    keyserver=hkp://keyserver.ubuntu.com:80
    id=7F0CEB10
    state=present

- name: Add mongo sources list