From eec1246feec2f61d5135bb38ac6f3b26d31a58f8 Mon Sep 17 00:00:00 2001 From: Kevin Glynn Date: Thu, 16 Jul 2026 17:16:09 -0400 Subject: [PATCH] fix: use explicit path for YARA rule in Volatility command The --yara-file reference should not assume a specific working directory. Use a placeholder path that analysts will substitute for their setup. --- skills/detecting-fileless-malware-techniques/SKILL.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/skills/detecting-fileless-malware-techniques/SKILL.md b/skills/detecting-fileless-malware-techniques/SKILL.md index aec1a6c5..da372f0a 100644 --- a/skills/detecting-fileless-malware-techniques/SKILL.md +++ b/skills/detecting-fileless-malware-techniques/SKILL.md @@ -245,8 +245,9 @@ vol3 -f memory.dmp windows.vadinfo --pid 4012 | grep -i "PAGE_EXECUTE" # PowerShell CLR usage (indicates .NET reflection loading) vol3 -f memory.dmp windows.cmdline | grep -i "powershell" -# Scan for known fileless frameworks (rule file avoids AV false positives on SKILL.md) -vol3 -f memory.dmp yarascan.YaraScan --yara-file references/yara-fileless-powershell.yar +# Scan for known fileless frameworks +# YARA rule lives in references/yara-fileless-powershell.yar (kept separate to reduce AV false positives) +vol3 -f memory.dmp yarascan.YaraScan --yara-file /path/to/yara-fileless-powershell.yar # Extract PowerShell command history from memory vol3 -f memory.dmp windows.cmdline