From ccf0d32f7d8315ba01e26c023a9cd59c68ff59d2 Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Tue, 8 Sep 2026 09:50:47 +0200
Subject: [PATCH] refactor: disabled old rule

---
 yara/thor-hacktools.yar | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/yara/thor-hacktools.yar b/yara/thor-hacktools.yar
index 8494677e..ff2710c6 100644
--- a/yara/thor-hacktools.yar
+++ b/yara/thor-hacktools.yar
@@ -3038,20 +3038,21 @@ rule CN_Toolset_sig_1433_135_sqlr {
       all of them
 }
 
-rule DarkComet_Keylogger_File {
-   meta:
-      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-      author = "Florian Roth (Nextron Systems)"
-      description = "Looks like a keylogger file created by DarkComet Malware"
-      date = "25.07.14"
-      score = 50
-      id = "65058450-3ae3-5b85-bcc5-8bc1fab14614"
-   strings:
-      $entry = /\n:: [A-Z]/
-      $timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/
-   condition:
-      uint16(0) == 0x3A3A and #entry > 10 and #timestamp > 10
-}
+// Too many CPU cycles for the detection value
+// rule DarkComet_Keylogger_File {
+//    meta:
+//       license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+//       author = "Florian Roth (Nextron Systems)"
+//       description = "Looks like a keylogger file created by DarkComet Malware"
+//       date = "25.07.14"
+//       score = 50
+//       id = "65058450-3ae3-5b85-bcc5-8bc1fab14614"
+//    strings:
+//       $entry = /\n:: [A-Z]/
+//       $timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/
+//    condition:
+//       uint16(0) == 0x3A3A and #entry > 10 and #timestamp > 10
+// }
 
 rule VSSown_VBS {
    meta: