github.com/VirusTotal/y... - 1.11.0 is out! Lots of new features, modules and bug fixes. Read the release notes and congrats to Victor and the contributors!

One wheel Jesus was at the Christmas parade again. All praise be to one wheel Jesus and his crew.

Quality of life improvement for yara-x: I realized the functions that output hash values do not have constraints on them like the hash module functions do. See virustotal.github.io/yara-x/blog/... for details on why this is useful to extend everywhere. PR that fixes it: github.com/VirusTotal/y...

Yara-x 1.10.0 released today! It can now automatically fix some warnings, and some improvements in code generation. This is another great step forward for the project. github.com/VirusTotal/y...

Don't ask why but you may now refer to me as "Sir Wesley, robot, esq." (thanks @gabagool.ing for that one) and gemini thinks this is what I look like. It may have had some help with the Pikachu hoodie and hot dogs. You're welcome for this visual.

Finally put this up for review in a PR (github.com/VirusTotal/y...) - it's now in it's own command and has been tested on some pretty gnarly graphs of rules. If you have huge dependency graphs the output gets messy, but it works well otherwise.

If you're interested in my dependency querying code for yara rules check out my deps branch: github.com/wxsBSD/yara-... You can build it with "cargo build --features=debug-cmd" and use it like "yr debug deps -h". My TODO list for this is basically: - Write tests - Move to it's own command

@pdub5.bsky.social does great work! If you’re going to be at the conference go see his talk and maybe heckle him for me.

I've got something built on Victor's new DFSIter for yara-x AST that takes a set of rules and outputs the dependencies and modules used (based upon the compiled list of modules). Ultimately I want to make it output a graphviz file for visualization but for now it's dumping them to stdout...

yara-x 1.9.0 is out! The DFSIterator for AST traversal is what I was finishing up this week (and now I don’t have to, yay), and is definitely really interesting if you are into that sort of thing. I’ll finish my work onto top of this new implementation. github.com/VirusTotal/y...

I’ve been working on something in YARA-X that I think is needed if you have complex sets of rules and dependencies. Should have something to show next week.

cloud.google.com/blog/topics/... I wrote some more on COLDRIVER - specifically about their recent malware they have been using since at least May. If you’re on the COLDRIVER target list keep an eye out for this stuff. They have been more active with it than previous malware.

Thanks to @xorhex for an interesting discussion that is worth sharing here. I knew I read this somewhere but here's a fun thing you can do in YARA-X: 2 of ($a*, $b*, 3 of ($c*)) This is documented but not widely known: virustotal.github.io/yara-x/docs/...

Is it a good idea to have a modifier that treats ' the same as " in strings. Something like this: $a = "foo('bar')" quotes This would effectively get you that string and foo("bar") but also foo('bar") or any combination of quote usage. Might have to put some thought into this and implement it.

Smart person says smart things! And it’s not just when walking this structure (though it is great there) it is for any loop that can get out of hand. Use it and be happy. Don’t use it and be sad - as I have seen first hand multiple times.

I won’t be at CYBERWARCON this year so I need someone to give @hultquist.bsky.social a hard time for me. I don’t yet know why he deserves this, but I’m sure a reason will present itself between now and then. The man never disappoints in the shenanigans and tomfoolery department.

Two things: YARA-X 1.8.0 is out with some nice features if you use the various bindings and a bug fix involving an edge case in PE signatures. Congrats to all involved! To be more useful I wrote a small PR to display filenames in console.log() output when using yr scan. github.com/VirusTotal/y...

www.zscaler.com/blogs/securi... - Nice writeup by zscaler on some COLDRIVER malware. I'm talking about this stuff at #FTSCon in a few weeks and will have lots more details there.

The first album by Lucid Planet was an instant like. A great progressive rock album that is insanely well produced. When the second album came out I liked it but it took a few full listens to really come into its own - I had to really embrace the electronica inspirations but definitely great album.

The whole “wxs is a robot” meme has officially gone too far. See you in October!

yara-x 1.7.0 is out. Some good bug fixes in there! Congrats to Victor and all the contributors! github.com/VirusTotal/y...

Spotify algorithm is on some serious drugs. What the deuce is this?

I’ll be giving a talk at FTS this year. Not going to lie, I’m doing it just so I can heckle Sir Tom of The House of Lancaster (@tlansec.bsky.social) in person. volatilityfoundation.org/from-the-sou...

Almost a month ago I had to have emergency surgery to have my gallbladder removed (not fun, do not recommend). It does mean I just got to use the sentence: "unnecessary organs will be removed for efficiency" - and for that I am happy.

Patrick doing good work and with classy emoji usage in the <whatever the equivalent to a tweet is>.

YARA-X 1.5.0 is out. Nice new features (including a crx module) and bug fixes. Congratulations to Victor and all the contributors! github.com/VirusTotal/y...

I’ve said this and a corollary to this for years. It’s all just bytes but “why is that particular sequence interesting” and “what do those bytes mean in the context of this malware” are the more interesting questions. Many decades ago I discovered something new to me that illustrates this…

First question: Will I be fired for only referring to you as Sir Tom of The House of Lancaster? Seriously though, if you’re looking this is one of the teams I would consider.

I took inspiration from the always classy @jacoblatonis.me recently and added support for underscores in integer and float literals in YARA. It makes reading large integers (in any supported base) much easier. github.com/VirusTotal/y...

We (@gabagool.ing - AKA gabbot) and I updated this with some more recent tomfoolery from this group. They continued the ASP campaign with evidence they responded to our initial publication. They were doing some sneaky calendar stuff that lead to adding a device to the target's O365 tenant.

The view from my driveway this year. Happy 4th of July!

I know I've been slacking on contributing to YARA-X, but I've been busy elsewhere. I do run a small keybase group where developers and users hang out. Ideas, features and bugs are discussed there. If you think you would benefit from being part of the discussion just hit me up for an invite.

So @gabagool.ing (who will henceforth be referred to as "gabbot") and I wrote some stuff on some ASP phishing campaigns: cloud.google.com/blog/topics/... Citizen Lab worked closely with one of the targets and shared their work on it also: citizenlab.ca/2025/06/russ...

Apparently my lightning talk at @cyberwarcon.bsky.social last year was released. Go watch it for a quick overview. COLDRIVER is still active, and still evolving to this day. The critical question is do I want to use emojis when I post about them?

New YARA-X release! In fact, Victor released 1.0.0. Lots of hard work by Victor and others to make this happen, congratulations to everyone involved! github.com/VirusTotal/y...

Despite the emoji count getting out of control, this is good work!

Me: I've got a few minutes to kill while this thing runs, what's going on in the world of linkedin? Linkedin:

New release by Victor! Includes a bug fix, support for “includes” and module invocation directly in python. Congrats to all involved! github.com/VirusTotal/y...

Merged into main, will try and get go bindings up next.

You can technically do this already in the python bindings, but it is less than ideal; it is basically the equivalent to my old -D trick with a dummy rule. I just put up a PR that directly exposes the modules to the python bindings: yara_x.Module('pe').invoke(data) # :) github.com/VirusTotal/y...

I wrote some details on LOSTKEYS: malware which we directly attribute to COLDRIVER. They don't deploy it often, but we have seen it a few times and want to make people aware of it. cloud.google.com/blog/topics/...

Have you ever found yourself in need of an ASCII art donkey on a waffle? Fear not, because past wxs has got you covered: people.freebsd.org/~wxs/donkey-... Just don't ask why I found that again.

You would think I would learn how to easily handle PKCS7 padding manually by now, but no. I decrypt something that is PKCS7 padded and I manually add a "[:-N]" (for the correct value of N) at the end of my code because ain't nobody got time to do it right.

New release of yara-x by Victor. Some nice fixes and features, so go update! Congrats to Victor and the contributors! github.com/VirusTotal/y...

Today marks 3 years since I joined TAG (now part of GTIG). A lot of things have happened in those 3 years, but the constants are what keep me here: the people and the work. Earning the respect of those that I respect while doing interesting and meaningful work is all I ask for.

First thing that popped into my brain when they were joking about praying to the spaceship gods was the ancient aliens guy. But the truth is PARC was so far ahead of its time it might as well have been aliens.

This is really interesting and good work by Volexity. I'm not sure how many places are looking for this kind of abuse or have outright prevented it. As a provider finding this kind of abuse has got to be difficult too.

Proposed linter on tags (and an API change that makes it so we can now get multiple linter errors in a single pass): github.com/VirusTotal/y...

Tag linting is in the works. It isn't right yet: it currently stops linting at the first invalid tag. Should be fixable with some thought and maybe some API changes though.

I watched this talk when it came out. It has only got better with age. If you have kids, are a technologist or just generally interested in being a decent human being this is mandatory viewing. This is a talk I hope to watch every couple of years, to help kick me in the ass from time to time.