malware

rule SuspiciousDownloader {
  strings:
    $a = "powershell -enc" nocase
    $b = "Invoke-WebRequest" nocase
    $c = "http://" nocase
  condition:

YARA rules for spotting suspicious binaries during triage

yara malware triage

by Kai Nakamura 1 tab

ruby

allowed_types = ['image/png', 'image/jpeg', 'application/pdf']
uploaded = params.require(:document)

raise ActionController::BadRequest, 'file too large' if uploaded.size > 10.megabytes
raise ActionController::BadRequest, 'type not allowed' unless allowed_types.include?(uploaded.content_type)

Hardening file uploads with MIME checks and storage isolation

file-uploads validation malware

by Kai Nakamura 1 tab