3 ms·

I would think mvt and related ioc repos would support these newer indicators,but sadly I'm not seeing that: https://docs.mvt.re/en/latest/iocs/ https://docs.mv

• transpute 1y ago
  It's a different approach: Traditional detection approaches like YARA rules, IOC matching, and signature-based systems fall apart when: • You don’t have the actual malicious samples to create signatures from • The attackers use polymorphic techniques that change file hashes • The exploit leverages legitimate file format features in unexpected ways • You need to detect future variants of the same technique The Philosophy: Structure Over Signatures ELEGANTBOUNCER takes a fundamentally different approach to threat detection. Instead of looking for specific byte patterns or known-bad indicators, it analyzes the structural properties of files that make exploits possible.
  • notepad0x90 1y ago
    I'm just thinking, I'd always prefer to run one tool to verify if a phone has been compromised. If mvt used ELEGANTBOUNCER as a plugin/extension/backend that'd be superb. But, not a big deal, I'm glad I found about this tool, thank you. I am interested in finding out more on why Yara can't be used to find structural patterns? it is supposed to do a lot more than simple string and byte-pattern matching. Maybe ELEGANTBOUNCER requires keeping/maintaining a complex state machine to evaluate/analyze content?