creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-09-03 06:50:51 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix: use explicit path for YARA rule in Volatility command

Browse Source 
The --yara-file reference should not assume a specific working directory.
Use a placeholder path that analysts will substitute for their setup.
This commit is contained in:
Kevin Glynn
2026-07-16 17:16:09 -04:00
parent d4e38c2867
commit eec1246fee
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/detecting-fileless-malware-techniques/SKILL.md
+3 -2
View File
@@ -245,8 +245,9 @@ vol3 -f memory.dmp windows.vadinfo --pid 4012 | grep -i "PAGE_EXECUTE"
# PowerShell CLR usage (indicates .NET reflection loading) # PowerShell CLR usage (indicates .NET reflection loading)
vol3 -f memory.dmp windows.cmdline | grep -i "powershell" vol3 -f memory.dmp windows.cmdline | grep -i "powershell"
# Scan for known fileless frameworks (rule file avoids AV false positives on SKILL.md) # Scan for known fileless frameworks
vol3 -f memory.dmp yarascan.YaraScan --yara-file references/yara-fileless-powershell.yar # YARA rule lives in references/yara-fileless-powershell.yar (kept separate to reduce AV false positives)
vol3 -f memory.dmp yarascan.YaraScan --yara-file /path/to/yara-fileless-powershell.yar
# Extract PowerShell command history from memory # Extract PowerShell command history from memory
vol3 -f memory.dmp windows.cmdline vol3 -f memory.dmp windows.cmdline