mirror of
https://github.com/ditekshen/detection
synced 2026-06-08 13:49:35 +00:00
Disable FP until fixed
This commit is contained in:
@@ -10979,6 +10979,7 @@ rule MALWARE_Win_ToxicEye {
|
||||
uint16(0) == 0x5a4d and 7 of them
|
||||
}
|
||||
|
||||
/*
|
||||
rule MALWARE_Win_RDPCredsStealer {
|
||||
meta:
|
||||
author = "ditekSHen"
|
||||
@@ -10995,6 +10996,7 @@ rule MALWARE_Win_RDPCredsStealer {
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and (2 of ($x*) or (1 of ($x*) and 2 of ($s*)) or 3 of ($s*))
|
||||
}
|
||||
*/
|
||||
|
||||
rule MALWARE_Win_RDPCredsStealerInjector {
|
||||
meta:
|
||||
|
||||
Reference in New Issue
Block a user