yara_zip_module
This yara module can be used to search for strings inside a zip (.docx word file format) file. The files inside a zip are compressed and therefore not very well searchable for strings. This yara module unzips a requested file in memory and searches for a given string. Installation: The installation of the module should be pretty simple, but yara has to be built from source. - Clone the yara repository (https://github.com/VirusTotal/yara) - Copy yara_zip_modules files into the libyara folder of the yara clone: yara_zip_module/miniz.c --> yara/libyara/miniz.c yara_zip_module/include/yara/miniz.h --> yara/libyara/include/yara/miniz.h yara_zip_module/modules/zip.c --> yara/libyara/modules/zip.c - Edit the file yara/libyara/Makefile.am and add the module as well as the miniz library: MODULES += modules/zip.c yarainclude_HEADERS = include/yara/miniz.h libyara_la_SOURCES = miniz.c - Add the module to the module_list file in the modules folder: MODULE(zip) Now you can build yara by executing the make command inside the root folder. More information can be found here: https://yara.readthedocs.io/en/v3.7.0/writingmodules.html Usage: The yara zip module has at the moment only one funct
FEATURES
ALTERNATIVES
A library and command line interface for extracting URLs, IP addresses, MD5/SHA hashes, email addresses, and YARA rules from text corpora.
Interactive malware hunting service with live access to the heart of an incident.
A minimal, consistent API for building integrations with malware sandboxes
Studying Android malware behaviors through Information Flow monitoring techniques.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Fabric Platform by BlackStork
Fabric Platform is a cybersecurity reporting solution that automates and standardizes report generation, offering a private-cloud platform, open-source tools, and community-supported templates.
Mandos Brief Newsletter
Stay ahead in cybersecurity. Get the week's top cybersecurity news and insights in 8 minutes or less.
System Two Security
An AI-powered platform that automates threat hunting and analysis by processing cyber threat intelligence and generating customized hunt packages for SOC teams.
Aikido Security
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Permiso
Permiso is an Identity Threat Detection and Response platform that provides comprehensive visibility and protection for identities across multiple cloud environments.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.