admin/ditekshen-detection
1
0
Fork 0
mirror of https://github.com/ditekshen/detection synced 2026-06-08 13:49:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

FP: Disable INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Browse Source
This commit is contained in:
diˈtekSHən
2024-06-08 11:46:45 +03:00
committed by GitHub
parent 7c2d40d839
commit 2ddbbe14ee
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
yara/indicator_suspicious.yar
+2
View File
@@ -986,6 +986,7 @@ rule INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File {
uint16(0) == 0x5a4d and 1 of them
}
/*
rule INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL {
meta:
author = "ditekSHen"
@@ -997,6 +998,7 @@ rule INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL {
condition:
uint16(0) == 0x5a4d and (($url1 and $raw) or ($url2))
}
*/
rule INDICATOR_SUSPICIOUS_EXE_RawPaste_URL {
meta: