.yar files detected as malware
B321321 opened this issue · 2 comments
B321321 commented
Microsoft defender and clouud tools detects these files gen_webshells.yar and thor-webshells.yer as these malware respectively PHP/Remoteshell.G and PHP/Dirtelti.CKB
hitem commented
Yes, the yara files are not compiled and thus all AV's will detect some of them as malware (as the AV's do have their own detections for the same hash and/or other indicators). Would be nice if we could run loki with compiled rules? :)
Neo23x0 commented
Defender Issue