Relax houdini match condition

2026-06-08 13:49:35 +00:00 · 2024-05-28 16:28:05 +03:00
parent 3e5b6d03c7
commit 7c2d40d839
1 changed files with 1 additions and 1 deletions
@@ -11703,5 +11703,5 @@ rule MALWARE_Win_Houdini {
         $pl2 = "plugin_url_init" fullword wide
         $pl3 = "plugin_stop" fullword wide
     condition:
-         uint16(0) == 0x5a4d and 8 of them
+         uint16(0) == 0x5a4d and 4 of them
 }