Yen Wang

0x10Work / Detection engineering

A daily Rust malware dossier, with detections

An AI research agent that writes one defensive dossier a day on Rust malware, each with YARA, Sigma and Sentinel KQL detections mapped to MITRE ATT&CK.

When June 2026 – present Role Independent project Tools YARA, Sigma, Microsoft Sentinel KQL, Cribl, MITRE ATT&CK, Claude Code
82
daily dossiers, 19 June to 5 November 2026
259
YARA rules
215
Sigma rules, plus 34 Sentinel KQL query files
191
distinct MITRE ATT&CK technique IDs mapped

What it is

A scheduled task runs an AI research agent once a day. Each run picks one Rust malware family or technique, writes a defensive dossier on it, and saves detection artefacts beside it: YARA rules, Sigma rules, Microsoft Sentinel KQL queries, and notes on how to wire them through Cribl. A running index lists every dossier, its technique of the day, its ATT&CK mapping and its detections.

What it covers

Ransomware such as Akira v2, Qilin, FunkSec, Nova/RALord and DeadLock. Espionage tooling such as RUSTYSHADE and RUSTYMOVE from Operation RapidRust. Infostealers such as Warden Stealer and HyperHives. Supply-chain attacks through malicious Rust crates, and Rust components inside the GlassWorm VS Code worm.

Each dossier has a reverse-engineering angle as well as detections, for example:

  • recovering hardcoded ransomware keys through crate-API cross-references rather than entropy
  • using the PE exception directory (.pdata/.xdata) as a symbol-independent function census
  • telling Rust dyn Trait dispatch apart from COM vtable calls by their call shapes
  • fingerprinting the TLS backend (rustls or Schannel) from imports and crate strings

Keeping it honest

The index records its own limits. Single-source claims are marked as unverified. When a technique has no live-telemetry signature, the dossier says so instead of forcing a Sigma rule. Earlier entries are revisited and corrected in place, with the correction noted.