Hello and welcome to the Wednesday, April 23rd, 2025 edition of the Sandslanded Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

And then we got yet another diary by DDA about the improvement to XOR search.

So the last improvement was the ability to use YARA rule, which of course

also allows regular expressions. Now, in this diary, DTIA talks about how to use what he calls

ad hoc Yara rules. Usually Yara rules are written in a file and they span multiple lines but there are things that

you often want to do in these yara rules like simple things like look for regular expression

look for a string so what these ad hoc yara rules are these are yara rules in command line

arguments that are essentially sort of abbreviations.

So instead of spelling out the entire yarrow roll, you just tell it, I would like to use a

reckless expression.

Here's the regular expression.

I would like to use a static string and the like.

And that'll make it easier to use these yarrow rolls.

In particular, if you're sort of just searching around, it's not necessarily. that'll make it easier to use these yarrow rules.

In particular, if you're sort of just searching around,

it's not necessarily some yar rules that you would like to, for example,

maintain as a standard configuration file.

And then some security news from a couple days ago that I haven't had a chance to cover yet, and it involves

Decim, the email anti-spam standard. So, DeKim adds a cryptographic signature header. However,

that cryptographic signature only covers select headers, typically the from the subject, maybe the two header.

This is what's abused here in this particular attack. The email being sent here claims to be

...