rule_blackarch_offensive_tool_keyword

YARA detection rule by @mthcht · NOASSERTION

Detection patterns for the tool 'blackarch' taken from the ThreatHunting-Keywords github project

rule rule_blackarch_offensive_tool_keyword
{
    meta:
        description = "Detection patterns for the tool 'blackarch' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "blackarch"
        rule_category = "offensive_tool_keyword"

    strings:
                        $string1_blackarch_offensive_tool_keyword = "/tmp/blackarch" nocase ascii wide
                        $string2_blackarch_offensive_tool_keyword = /au\.mirrors\.cicku\.me\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string3_blackarch_offensive_tool_keyword = /blackarch\.cs\.nycu\.edu\.tw\/.{0,1000}\/os\// nocase ascii wide
                        $string4_blackarch_offensive_tool_keyword = /blackarch\.leneveu\.fr\/.{0,1000}\/os\// nocase ascii wide
                        $string5_blackarch_offensive_tool_keyword = /blackarch\.mirror\.digitalpacific\.com\.au\/.{0,1000}\/os\// nocase ascii wide
                        $string6_blackarch_offensive_tool_keyword = /blackarch\.mirror\.garr\.it\/mirrors\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string7_blackarch_offensive_tool_keyword = /blackarch\.org\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string8_blackarch_offensive_tool_keyword = /blackarch\.org\/blackarch\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string9_blackarch_offensive_tool_keyword = /blackarch\.unixpeople\.org\/.{0,1000}\/os\// nocase ascii wide
                        $string10_blackarch_offensive_tool_keyword = /ca\.mirrors\.cicku\.me\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string11_blackarch_offensive_tool_keyword = /de\.mirrors\.cicku\.me\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string12_blackarch_offensive_tool_keyword = /distro\.ibiblio\.org\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string13_blackarch_offensive_tool_keyword = /download\.nus\.edu\.sg\/mirror\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string14_blackarch_offensive_tool_keyword = /eu\.mirrors\.cicku\.me\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string15_blackarch_offensive_tool_keyword = /ftp\.cc\.uoc\.gr\/mirrors\/linux\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string16_blackarch_offensive_tool_keyword = /ftp\.halifax\.rwth\-aachen\.de\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string17_blackarch_offensive_tool_keyword = /ftp\.icm\.edu\.pl\/pub\/Linux\/dist\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string18_blackarch_offensive_tool_keyword = /ftp\.kddilabs\.jp\/Linux\/packages\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string19_blackarch_offensive_tool_keyword = /ftp\.linux\.org\.tr\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string20_blackarch_offensive_tool_keyword = /http\:\/\/mirror\.archlinux\.no/ nocase ascii wide
                        $string21_blackarch_offensive_tool_keyword = /https\:\/\/raw\.githubusercontent\.com\/BlackArch\/blackarch\/master\/mirror\/mirror\.lst/ nocase ascii wide
                        $string22_blackarch_offensive_tool_keyword = /https\:\/\/www\.blackarch\.org\/blackarch\/blackarch\/lastupdate/ nocase ascii wide
                        $string23_blackarch_offensive_tool_keyword = /in\.mirrors\.cicku\.me\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string24_blackarch_offensive_tool_keyword = /jp\.mirrors\.cicku\.me\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string25_blackarch_offensive_tool_keyword = /kr\.mirrors\.cicku\.me\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string26_blackarch_offensive_tool_keyword = /md\.mirrors\.hacktegic\.com\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string27_blackarch_offensive_tool_keyword = /mirror\.archlinux\.tw\/BlackArch\/.{0,1000}\/os\// nocase ascii wide
                        $string28_blackarch_offensive_tool_keyword = /mirror\.cedia\.org\.ec\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string29_blackarch_offensive_tool_keyword = /mirror\.cyberbits\.eu\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string30_blackarch_offensive_tool_keyword = /mirror\.easyname\.at\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string31_blackarch_offensive_tool_keyword = /mirror\.easyname\.ch\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string32_blackarch_offensive_tool_keyword = /mirror\.maa\.albony\.in\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string33_blackarch_offensive_tool_keyword = /mirror\.math\.princeton\.edu\/pub\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string34_blackarch_offensive_tool_keyword = /mirror\.serverion\.com\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string35_blackarch_offensive_tool_keyword = /mirror\.sg\.gs\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string36_blackarch_offensive_tool_keyword = /mirror\.sjtu\.edu\.cn\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string37_blackarch_offensive_tool_keyword = /mirror\.team\-cymru\.com\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string38_blackarch_offensive_tool_keyword = /mirror\.telepoint\.bg\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string39_blackarch_offensive_tool_keyword = /mirror\.tillo\.ch\/ftp\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string40_blackarch_offensive_tool_keyword = /mirror\.yandex\.ru\/mirrors\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string41_blackarch_offensive_tool_keyword = /mirror\.zetup\.net\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string42_blackarch_offensive_tool_keyword = /mirrors\.aliyun\.com\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string43_blackarch_offensive_tool_keyword = /mirrors\.cicku\.me\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string44_blackarch_offensive_tool_keyword = /mirrors\.dotsrc\.org\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string45_blackarch_offensive_tool_keyword = /mirrors\.gethosted\.online\/blackarch\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string46_blackarch_offensive_tool_keyword = /mirrors\.hostico\.ro\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string47_blackarch_offensive_tool_keyword = /mirrors\.hust\.edu\.cn\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string48_blackarch_offensive_tool_keyword = /mirrors\.nju\.edu\.cn\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string49_blackarch_offensive_tool_keyword = /mirrors\.ocf\.berkeley\.edu\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string50_blackarch_offensive_tool_keyword = /mirrors\.tuna\.tsinghua\.edu\.cn\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string51_blackarch_offensive_tool_keyword = /mirrors\.ustc\.edu\.cn\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string52_blackarch_offensive_tool_keyword = /quantum\-mirror\.hu\/mirrors\/pub\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string53_blackarch_offensive_tool_keyword = /repository\.su\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string54_blackarch_offensive_tool_keyword = /sg\.mirrors\.cicku\.me\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string55_blackarch_offensive_tool_keyword = /us\.mirrors\.cicku\.me\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string56_blackarch_offensive_tool_keyword = /www\.ftp\.ne\.jp\/Linux\/packages\/blackarch\/.{0,1000}\/os\// nocase ascii wide
                        $string57_blackarch_offensive_tool_keyword = /www\.mirrorservice\.org\/sites\/blackarch\.org\/blackarch\/.{0,1000}\/os\// nocase ascii wide

    condition:
        any of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0a1cc7b2-4752-49f9-b6b7-cc152fa8de6b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion