Here is an example using the same approach outlined in the previous post about identifying MD5 constants, but applied to SHA256. I used OpenSSL's source code to determine these constants and re-arranged each constant into little-endian byte sequences: https://github.com/openssl/openssl/blob/master/crypto/sha/sha256.c rule sha256_constants { meta: description = "SHA256 constants" strings: $ = { 852c7292 } $ = …
Category: 100 days of Yara
100 Days of YARA – Day 6: MD5
Find applications implementing the MD5 algorithm with YARA.
100 Days of YARA – Day 5: Shell Scripts Two Ways!
Find scripts with YARA.
100 Days of YARA – Day 4: Identifying Mach-O Files and Java Classes
Detect Mach-O binaries with YARA.
100 Days of YARA – Day 3: ELF Files
Identify ELF files with YARA.
100 Days of YARA – Day 2: Identifying PE files and Measuring Speed of Rules
Find PE files with YARA.
100 Days of YARA – Day 1: Basics
Getting started with YARA.
YARA Rules Index
YARA Rules Index
DMFR SECURITY 