From 92af79549aaa3653dd226a5fb87449749b0d395f Mon Sep 17 00:00:00 2001 From: Bart P Date: Wed, 31 Jul 2024 15:51:41 +0200 Subject: [PATCH] Update README.md --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index de14408..47d60af 100644 --- a/README.md +++ b/README.md @@ -13,14 +13,14 @@ You can use them in your detection systems. For example, [CAPE sandbox](https:// All rules are TLP:White, so you can use and distribute them freely. Please retain the meta. ## Help! A generic rule is hitting my software! -If one of the rules in the [generic](https://github.com/bartblaze/Yara-rules/tree/master/rules/generic) rules section hits on your software: this is not a false positive. It is simply an objective fact that, for example, your software has been compiled or wrapped using AutoIT. It equally does **not** mean your software is malicious. +If one of the rules in the [generic](https://github.com/bartblaze/Yara-rules/tree/master/rules/generic) rules section hits on your software: this is not a false positive. It is simply an objective fact that, for example, your software has been compiled or wrapped using AutoIT. It equally does **not** mean your software is malicious. The Yara rules presented here do **not** influence antivirus detection results in any manner. If your software is detected by an antivirus or antimalware company, you need to contact them directly. -Note the meta also mentions _category = "**INFO**"_, in which case it is a purely generic or informational rule. +Note the `meta` section also mentions `category = "INFO"`, in which case it is a purely generic or informational rule. ## Actions There's two workflows running on this Github repository: -* [YARA-CI](https://yara-ci.cloud.virustotal.com/): runs automatically to detect signature errors, as well as false positives and negatives. +* [YARA-CI](https://yara-ci.cloud.virustotal.com/): runs automatically to detect signature errors, as well as false positives and false negatives. * [Package Yara rules](https://github.com/bartblaze/Yara-rules/blob/master/.github/workflows/yara.yml): allows download of a complete rules file (all Yara rules from this repo in one file) for convenience from the Actions tab > Choose the last workflow run > Artifacts (see image below). ![image](https://user-images.githubusercontent.com/3075118/113322817-731feb00-9315-11eb-86ab-94f133f07038.png) @@ -47,7 +47,7 @@ More information: https://yara.readthedocs.io/en/stable/index.html ## What is TLP? > The Traffic Light Protocol (TLP) was created in order to facilitate greater sharing of information. -The rules in this repo are TLP:White. +The rules in this repo are TLP:White (or TLP:Clear). > Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. More information: https://www.us-cert.gov/tlp