From 0afa4987f05aa31f2fd60ce40e804eab3301c3a2 Mon Sep 17 00:00:00 2001 From: j0sm1 Date: Tue, 20 Oct 2015 17:07:27 +0200 Subject: [PATCH] We have deleted duplicated rule We have deleted duplicated rule --- malware/Miscelanea.yar | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/malware/Miscelanea.yar b/malware/Miscelanea.yar index 7195db7..3c4990d 100644 --- a/malware/Miscelanea.yar +++ b/malware/Miscelanea.yar @@ -602,17 +602,6 @@ rule OrcaRAT $MZ at 0 and filesize < 500KB and (all of ($apptype*) and 1 of ($err*)) } -rule mimikatz_lsass_mdmp -{ - meta: - description = "LSASS minidump file for mimikatz" - author = "Benjamin DELPY (gentilkiwi)" - strings: - $lsass = "System32\\lsass.exe" wide nocase - condition: - (uint32(0) == 0x504d444d) and $lsass -} - rule EmiratesStatement { meta: