We have deleted duplicated rule

2026-06-08 12:58:40 +00:00 · 2015-10-20 17:07:27 +02:00
parent 02409127a3
commit 0afa4987f0
1 changed files with 0 additions and 11 deletions
@@ -602,17 +602,6 @@ rule OrcaRAT
        $MZ at 0 and filesize < 500KB and (all of ($apptype*) and 1 of ($err*))
 }

-rule mimikatz_lsass_mdmp
-{
-	meta:
-		description		= "LSASS minidump file for mimikatz"
-		author			= "Benjamin DELPY (gentilkiwi)"
-	strings:
-		$lsass			= "System32\\lsass.exe"	wide nocase
-	condition:
-		(uint32(0) == 0x504d444d) and $lsass
-}
-
 rule EmiratesStatement 
 {
 	meta: