.yar files detected as malware

[B321321]

Microsoft defender and clouud tools detects these files gen_webshells.yar and thor-webshells.yer as these malware respectively PHP/Remoteshell.G and PHP/Dirtelti.CKB

[hitem]

Yes, the yara files are not compiled and thus all AV's will detect some of them as malware (as the AV's do have their own detections for the same hash and/or other indicators). Would be nice if we could run loki with compiled rules? :)

[Neo23x0]

Defender Issue