Decided it was time to upload a few Yara rules to my Github. Most of them are pretty old unfortunately but there's some stuff in there that might be useful. I'll add more if/when I can.

Here's some I had luck with:

Hunting for Github/Telegram integration in a PowerShell script (in conjunction with -Uri):

https://github.com/ozuriexv/Detection-Rules/blob/main/YARA/misc/service_usage_powershell.yar

Common file magic other than PE but contains XORed DOS stub:

https://github.com/ozuriexv/Detection-Rules/blob/main/YARA/obfuscation/misc_obfuscation.yar#L1-L14

Generic/common Windows paths targeted by stealers:

https://github.com/ozuriexv/Detection-Rules/blob/main/YARA/hunting/hunt_stealers.yar

@Iaintshootinmis I'm currently positioned to focus on both proactive and reactive detections but as most will know, proactive is extremely difficult relative to reactive.

Unfortunately, many organizations do not have the resources to engineer the environments you're describing. I know for a fact that some of these same organizations consider open source offensive tooling to be a plague, what would be the solution for these teams that are lacking the required resources? I realize we're quickly heading down a path of "just increase your security budget" here which is unfortunate.

@Iaintshootinmis I feel that most of what I say here (https://infosec.exchange/@ozurie/109355833508031830) applies to what you've just said. I do see value in open source offensive tooling but why is there seemingly no line drawn? When I've thought about this in the past, I've thought to myself "why not at least include signatures when publishing the framework" but, maybe that's contradictory to what the red team wants to achieve. That confuses me further because I often see statements implying that red and blue must work together, this is the opposite, no?

I'm unsure about CobaltStrike in this scenario due to it being a paid-for product but of course, there are plenty of cracked/leaked versions floating around.

While my following/reach is relatively small on here compared to Twitter, I want to start this discussion regardless.

Red Team vs.(?) Blue Team

Frequent releases of offensive tooling, specifically C2 frameworks are awfully detrimental to blue teams. As someone that works on network detections, observing newly published frameworks regularly is disheartening and frustrating. It's no secret that open source offensive tooling is adopted by APTs and cybercrime groups and that leaves me with one question, why do it?

From my perspective, I can see some value in open sourcing such tooling for the purpose of assisting other red teams with engagements but surely the fact that malicious actors adopt the same tooling heavily outweighs the pros here?

For the red teamers following me (if any), what is your opinion on this issue? Why does it feel like 'vs.' is legitimate here but for the wrong reasons? These practices are also (in my opinion) contradictory to what purple teams stand for and shouldn't be considered purple teaming by any stretch of the any imagination.

I'd like to keep snarky/passive aggressive remarks (I've been guilty in the past) to non-existent here please. If you want to call me an idiot, my DMs are open.