precursor 0.1.1

A data analysis tool for text and binary tagging and filtering with similarity comparisons.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

(?s)(?<wget>wget \S+ - http\S+ \| sh)
(?s)(?<wget>wget \S+ - http\S+ \| bash)
(?s)(?<simple_server>python -m SimpleHTTPServer)
(?s)(?<http_server>-m http.server)
(?s)(?<pty_spawn>import pty; pty.spawn\S*)
(?s)(?<socat>socat exec:\S*)
(?s)(?<socat>socat -O \/tmp\/\S*)
(?s)(?<socat>socat tcp-connect\S*)
(?s)(?<echo>\*echo binary >>\*)
(?s)(?<wget>\*wget \S+; chmod \+x\*)
(?s)(?<wget>\*wget \S+; chmod 777 \*)
(?s)(?<var_run>\*cd \/tmp \|\| cd \/var\/run \|\| cd \/mnt\*)
(?s)(?<iptables>\*stop;service iptables stop;\*)
(?s)(?<suse_firewall>\*stop;SuSEfirewall2 stop;\*)
(?s)(?<chmod>chmod 777 2020\*)
(?s)(?<rc_local>\*>>\/etc\/rc.local)
(?s)(?<base64>\*base64 -d \/tmp\/\*)
(?s)(?<base64>\* \| base64 -d \*)
(?s)(?<chmod>\/chmod u\+s \*)
(?s)(?<chmod>\*chmod \+s \/tmp\/\*)
(?s)(?<chmod>\*chmod u\+s \/tmp\/\*)
(?s)(?<haxhax>\/tmp\/haxhax\*)
(?s)(?<ns_sploit>\/tmp\/ns_sploit\*)
(?s)(?<netcat>nc -l -p \S+)
(?s)(?<ksh>cp \/bin\/ksh \*)
(?s)(?<sh>cp \/bin\/sh \*)
(?s)(?<base64>\* \/tmp\/\*.b64 \*)
(?s)(?<ysocereal>\/tmp\/ysocereal.jar\*)
(?s)(?<possible_shell_command>\/tmp\/x \*)
(?s)(?<chmod>\*; chmod \+x \/tmp\/\*)
(?s)(?<chmod>\*;chmod \+x \/tmp\/\*)
(?s)(?<wget>.*wget.*)
(?s)(?<chmod>.*chmod.*)
(?s)(?<curl>.*curl.*)
(?s)(?<orf_udp>.*orf;cd.*)
(?s)(?<httpx>.*httpx.*)
(?s)(?<loopback>.*?:localhost|127(?:\.[0-9]+){0,2}\.[0-9]+$|^(?:0*\:)*?:?0*1)