linneman
labs
building
breaking
observing
content
···
verified
home
/ yara
Yara
2026.04.13
The DNF Numbers Station
C2 traffic indistinguishable from DNF update checks, with tasking hidden in the microseconds of Apache ETags.
2026.04.09
Building and Detecting a Rust C2 Beacon
Dual-layer encryption and a hardening pass from 1.4MB to 388K and the YARA rules that catch the beacon anyway.