adding own dir for contributions

zendannyy/Linux/Linux_trojanized_binary_kaiji.yara

@@ -0,0 +1,34 @@
+rule linux_trojanized_binary_kaiji : linux persistence Kaiji {
+    meta:
+        description = "This rule detects trojanized Linux binaries, specifically targeting those that resemble Kaiji malware. The combination of these strings suggests a malicious binary with persistence and potential crypto-mining capabilities."
+        author = "zendanny"
+        date = "2026-03-07"
+        mitre_technique = "T1554"
+        false_positive = "Legitimate binaries that contain related strings like 'mining' or 'miner' in their code, especially if they are related to cryptocurrency applications or development."
+
+    strings:
+        // directory the malware tends to copy itself to
+        $copy_dir = "/etc/profile.d/" nocase
+
+        // Crypto mining indicators (common in Perfctl)
+        $crypto1 = "mining" nocase
+        $crypto2 = "miner" nocase
+        $crypto3 = "moneroocean" nocase
+        $crypto4 = "xmrpool" nocase
+        $crypto5 = "stratum" nocase
+
+        // Commands Kaiji has been known to use
+        $command1 = "netstat -anp" nocase
+        $command2 = "lsof -i tcp" nocase
+        $command3 = "ps auxf" nocase
+        $command4 = "chmod 777" nocase
+
+    condition:
+        // ELF magic bytes
+        uint32(0) == 0x464c457f and
+        filesize > 50KB and filesize < 5MB and
+        $copy_dir and
+        // Plus crypto indicators
+        any of ($crypto*) and
+        any of ($command*)
+}

zendannyy/Linux/Linux_trojanized_cron_binary.yara

@@ -0,0 +1,36 @@
+rule linux_trojanized_cron_binary : linux persistence perfctl cron {
+    meta:
+        description     = "Detects trojanized cron binaries that hide malicious cron jobs, with indicators resembling Perfctl"
+        author          = "zendanny"
+        date            = "2026-03-07"
+        mitre_technique = "T1554"
+        reference = "https://ostechnix.com/cron-persistence-linux-malware/"
+
+    strings:
+        // Standard cron binary strings that should be present
+        $cron1 = "crontab" nocase
+        $cron2 = "/var/spool/cron" nocase
+        $cron3 = "/etc/crontab" nocase
+
+        // Crypto mining indicators (common in Perfctl)
+        $crypto1 = "mining" nocase
+        $crypto2 = "miner" nocase
+        $crypto3 = "xmrig" nocase
+        $crypto4 = "stratum" nocase
+
+        // File filtering/hiding logic
+        $hide1 = "filter" nocase
+        $hide2 = "strcmp" nocase
+        $hide3 = "strstr" nocase
+
+    condition:
+        // ELF magic bytes
+        uint32(0) == 0x464c457f and
+        filesize > 50KB and filesize < 5MB and
+        // Must contain basic cron functionality
+        any of ($cron*) and
+        // Plus suspicious additions not found in legitimate cron
+        (any of ($crypto*)) and
+        // Contains string manipulation (for hiding cron jobs)
+        any of ($hide*)
+}