diff --git a/malware/Miscelanea.yar b/malware/Miscelanea.yar index 7195db7..3c4990d 100644 --- a/malware/Miscelanea.yar +++ b/malware/Miscelanea.yar @@ -602,17 +602,6 @@ rule OrcaRAT $MZ at 0 and filesize < 500KB and (all of ($apptype*) and 1 of ($err*)) } -rule mimikatz_lsass_mdmp -{ - meta: - description = "LSASS minidump file for mimikatz" - author = "Benjamin DELPY (gentilkiwi)" - strings: - $lsass = "System32\\lsass.exe" wide nocase - condition: - (uint32(0) == 0x504d444d) and $lsass -} - rule EmiratesStatement { meta: