Skip to content

Commit d45197a

Browse files
octo-sts[bot]github-actions[bot]
octo-sts[bot]
and
github-actions[bot]
authored
Update third-party rules as of 2026-01-28 (#1338)
Co-authored-by: Update third-party rules <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 8ea1645 commit d45197a

3 files changed

Lines changed: 203 additions & 1 deletion

File tree

‎third_party/yara/bartblaze/APT/Unk_Mythic_Loader.yar‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
rule Unk_Mythic_Loader
2+
{
3+
meta:
4+
id = "14BIyhtqgQCTCfLjhUU27p"
5+
fingerprint = "v1_sha256_30aabd24914ecbce0404d81427b6c6f2f6c5d92c342070da2cab90ed01bc754b"
6+
version = "1.0"
7+
date = "2026-01-27"
8+
modified = "2026-01-27"
9+
status = "RELEASED"
10+
sharing = "TLP:CLEAR"
11+
source = "BARTBLAZE"
12+
author = "@bartblaze"
13+
description = "Identifies an unknown loader for Mythic C2, likely redteam or APT."
14+
category = "MALWARE"
15+
malware_type = "LOADER"
16+
hash = "e7e4eee2bed7f472c0cd753f13bee3d2d3eefa7e055374d7fcd89049e836119e"
17+
18+
strings:
19+
$ = "[-] Error in NTWVM_4"
20+
$ = "[-] Error in NTWVM_3"
21+
$ = "[-] Error in NTWVM_2"
22+
$ = "[-] Error in NTWVM_1"
23+
$ = "[-] Error in NTAVM: "
24+
$ = "[-] Unable to get NNSsrc\\syscall.rs"
25+
$ = "[-] NT headers do not match signature with from dll base"
26+
$ = "[-] DOS header not matched from base address"
27+
$ = "[-] Error in NTWVM_4"
28+
$ = "[-] Unable to get NNS"
29+
$ = "[+] Found the PEB and the InMemoryOrderModuleList at"
30+
$ = "[+] Module address:"
31+
$ = "[+] DOS header matched"
32+
$ = "[+] NT headers matched"
33+
$ = "[+] Function name found"
34+
35+
condition:
36+
8 of them
37+
}

‎third_party/yara/bartblaze/RELEASE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
fb270088ede9b7f43a1e54b640bf1dd76cda1c32
1+
54cd41cbc52351b5465d9fb40fcdf4911f7ef8ca

‎third_party/yara/bartblaze/hacktools/Mythic.yar‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
rule Mythic
2+
{
3+
meta:
4+
id = "69R6s4O4jrRhzpA0GwJdh0"
5+
fingerprint = "v1_sha256_fd3f6ed7ae8191d98a0f7f3676795be2ab5656d7eed2fa5b4f452bd8610b9fa5"
6+
version = "1.0"
7+
date = "2026-01-27"
8+
modified = "2026-01-27"
9+
status = "RELEASED"
10+
sharing = "TLP:CLEAR"
11+
source = "BARTBLAZE"
12+
author = "@bartblaze"
13+
description = "Identifies Mythic, a collaborative, multi-platform, red teaming framework."
14+
category = "MALWARE"
15+
malware_type = "HACKTOOL"
16+
reference = "https://github.com/its-a-feature/Mythic"
17+
tool = "MYTHIC"
18+
19+
strings:
20+
$ = "access_time"
21+
$ = "agent_callback_id"
22+
$ = "c2_profile"
23+
$ = "c2_profile_id"
24+
$ = "enc_key_base64"
25+
$ = "encrypted_exchange_check"
26+
$ = "file_browser"
27+
$ = "get_delegate_tasks"
28+
$ = "get_tasking"
29+
$ = "is_file"
30+
$ = "is_screenshot"
31+
$ = "post_response"
32+
$ = "send_webhook"
33+
$ = "task_id"
34+
$ = "tasking_size"
35+
$ = "total_chunks"
36+
$ = "webhook_alert"
37+
38+
condition:
39+
8 of them
40+
}
41+
42+
rule Mythic_Apollo
43+
{
44+
meta:
45+
id = "5agM09gxQMDgPQacwgnLSf"
46+
fingerprint = "v1_sha256_73dac1002022c73249469d22cc5d9340e82a5b47c7f913d0e309674751031f08"
47+
version = "1.0"
48+
date = "2026-01-27"
49+
modified = "2026-01-27"
50+
status = "RELEASED"
51+
sharing = "TLP:CLEAR"
52+
source = "BARTBLAZE"
53+
author = "@bartblaze"
54+
description = "Identifies Mythic's Apollo agent, a collaborative, multi-platform, red teaming framework."
55+
category = "MALWARE"
56+
malware_type = "HACKTOOL"
57+
reference = "https://github.com/its-a-feature/Mythic"
58+
tool = "MYTHIC"
59+
60+
strings:
61+
$ = "apollo_tracker_uuid"
62+
$ = "mythic_uuid"
63+
$ = "MythicMessageEventArgs"
64+
$ = "IMythicMessage"
65+
$ = "ApolloLogonInformation"
66+
$ = "ApolloTokenInformation"
67+
$ = "MythicEncryption"
68+
$ = "MythicTask"
69+
$ = "MythicTaskResponse"
70+
$ = "MythicTaskStatus"
71+
72+
condition:
73+
2 of them
74+
}
75+
76+
rule Mythic_Apollo_Tasks
77+
{
78+
meta:
79+
id = "3Knpy0fO9mMnMIWqjX7Zzn"
80+
fingerprint = "v1_sha256_a8b6a3da21ae7fb70f5feee93fc9838171fcb3e370458dd1331672d0815f0710"
81+
version = "1.0"
82+
date = "2026-01-27"
83+
modified = "2026-01-27"
84+
status = "RELEASED"
85+
sharing = "TLP:CLEAR"
86+
source = "BARTBLAZE"
87+
author = "@bartblaze"
88+
description = "Identifies Mythic's Apollo agent, a collaborative, multi-platform, red teaming framework."
89+
category = "MALWARE"
90+
malware_type = "HACKTOOL"
91+
reference = "https://github.com/its-a-feature/Mythic"
92+
tool = "MYTHIC"
93+
94+
strings:
95+
$ = "assembly_inject"
96+
$ = "blockdlls"
97+
$ = "execute_assembly"
98+
$ = "execute_coff"
99+
$ = "execute_pe"
100+
$ = "getprivs"
101+
$ = "getsystem"
102+
$ = "get_injection_techniques"
103+
$ = "inline_assembly"
104+
$ = "jobkill"
105+
$ = "keylog_inject"
106+
$ = "listpipes"
107+
$ = "make_token"
108+
$ = "net_dclist"
109+
$ = "net_localgroup"
110+
$ = "net_localgroup_member"
111+
$ = "net_shares"
112+
$ = "powerpick"
113+
$ = "psinject"
114+
$ = "register_file"
115+
$ = "reg_query"
116+
$ = "reg_write_value"
117+
$ = "rev2self"
118+
$ = "screenshot_inject"
119+
$ = "self_delete"
120+
$ = "set_injection_technique"
121+
$ = "shinject"
122+
$ = "spawnto_x64"
123+
$ = "spawnto_x86"
124+
$ = "steal_token"
125+
$ = "wmiexecute"
126+
127+
condition:
128+
20 of them
129+
}
130+
131+
rule Mythic_Apollo_Net
132+
{
133+
meta:
134+
id = "18TC3KGJ9FKOFcryiefeQ0"
135+
fingerprint = "v1_sha256_5d24c0ad268da5fcb949f8eb15cefe48196aad0f00c81ca3622c0d88c7ec5e31"
136+
version = "1.0"
137+
date = "2026-01-27"
138+
modified = "2026-01-27"
139+
status = "RELEASED"
140+
sharing = "TLP:CLEAR"
141+
source = "BARTBLAZE"
142+
author = "@bartblaze"
143+
description = "Identifies Mythic's Apollo agent, a collaborative, multi-platform, red teaming framework."
144+
category = "MALWARE"
145+
malware_type = "HACKTOOL"
146+
reference = "https://github.com/MythicAgents/Apollo"
147+
tool = "MYTHIC"
148+
149+
strings:
150+
$ = "get_C2ProfileManager"
151+
$ = "get_TaskManager"
152+
$ = "get_FileManager"
153+
$ = "get_SocksManager"
154+
$ = "get_PeerManager"
155+
$ = "get_ProcessManager"
156+
$ = "get_InjectionManager"
157+
$ = "get_TicketManager"
158+
$ = "get_IdentityManager"
159+
$ = "get_SleepInterval"
160+
$ = "get_Jitter"
161+
162+
condition:
163+
9 of them
164+
}
165+

0 commit comments

Comments
 (0)