Modify Default YARA Dispatch Rules

PUNCH-Cyber / stoq-plugins-public

stoQ Public Plugins

https://stoq.punchcyber.com

Apache License 2.0

72 stars 24 forks source link

Modify Default YARA Dispatch Rules #93

Closed malvidin closed 4 years ago

malvidin commented 4 years ago

See issue https://github.com/PUNCH-Cyber/stoq-plugins-public/issues/92 Two rules in the dispatcher.yar file referenced plugins that are not available in this repository. Also added a rule to the default dispatcher.yar to dispatch SMTP messages to the smtp plugin.

mlaferrera commented 4 years ago

Thanks, @malvidin. I've just added an xordecode plugin, so the xor part should be fine now. Can you update to include only the added smtp rule and commented olepackagestream?