Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
bartblaze authored Jul 31, 2024
1 parent 59e9921 commit 92af795
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,14 +13,14 @@ You can use them in your detection systems. For example, [CAPE sandbox](https://
All rules are TLP:White, so you can use and distribute them freely. Please retain the meta.

## Help! A generic rule is hitting my software!
If one of the rules in the [generic](https://github.com/bartblaze/Yara-rules/tree/master/rules/generic) rules section hits on your software: this is not a false positive. It is simply an objective fact that, for example, your software has been compiled or wrapped using AutoIT. It equally does **not** mean your software is malicious.
If one of the rules in the [generic](https://github.com/bartblaze/Yara-rules/tree/master/rules/generic) rules section hits on your software: this is not a false positive. It is simply an objective fact that, for example, your software has been compiled or wrapped using AutoIT. It equally does **not** mean your software is malicious. The Yara rules presented here do **not** influence antivirus detection results in any manner. If your software is detected by an antivirus or antimalware company, you need to contact them directly.

Note the meta also mentions _category = "**INFO**"_, in which case it is a purely generic or informational rule.
Note the `meta` section also mentions `category = "INFO"`, in which case it is a purely generic or informational rule.

## Actions
There's two workflows running on this Github repository:

* [YARA-CI](https://yara-ci.cloud.virustotal.com/): runs automatically to detect signature errors, as well as false positives and negatives.
* [YARA-CI](https://yara-ci.cloud.virustotal.com/): runs automatically to detect signature errors, as well as false positives and false negatives.
* [Package Yara rules](https://github.com/bartblaze/Yara-rules/blob/master/.github/workflows/yara.yml): allows download of a complete rules file (all Yara rules from this repo in one file) for convenience from the Actions tab > Choose the last workflow run > Artifacts (see image below).

![image](https://user-images.githubusercontent.com/3075118/113322817-731feb00-9315-11eb-86ab-94f133f07038.png)
Expand All @@ -47,7 +47,7 @@ More information: https://yara.readthedocs.io/en/stable/index.html
## What is TLP?
> The Traffic Light Protocol (TLP) was created in order to facilitate greater sharing of information.
The rules in this repo are TLP:White.
The rules in this repo are TLP:White (or TLP:Clear).
> Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.
More information: https://www.us-cert.gov/tlp
Expand Down

0 comments on commit 92af795

Please sign in to comment.