rule HackTool_MacOS_Metasploit_P2{
	meta:
		description = "HackTool:MacOS/Metasploit.P2,SIGNATURE_TYPE_MACHOHSTR_EXT,0e 00 0e 00 07 00 00 "
		
	strings :
		$a_00_0 = {42 00 80 d2 43 00 82 d2 e4 03 3f aa e5 03 1f aa d0 07 00 58 01 00 00 d4 } //2
		$a_00_1 = {40 00 80 d2 21 00 80 d2 02 00 80 d2 b0 06 00 58 01 00 00 d4 } //2
		$a_00_2 = {01 05 00 10 21 00 40 f9 e1 8f 1f f8 e1 03 00 91 02 02 80 d2 f0 05 00 58 01 00 00 d4 } //2
		$a_00_3 = {03 08 80 d2 e4 03 1f aa e5 03 1f aa 30 05 00 58 01 00 00 d4 } //2
		$a_00_4 = {e0 03 0c aa 01 29 80 d2 a2 00 80 d2 d0 04 00 58 01 00 00 d4 } //2
		$a_00_5 = {63 00 40 f9 e3 0b bf a9 e4 03 00 91 02 00 80 d2 03 00 80 d2 10 03 00 58 } //2
		$a_01_6 = {5f 6d 6d 61 70 00 5f 6d 70 72 6f 74 65 63 74 00 } //2 浟慭p浟牰瑯捥t
	condition:
		((#a_00_0  & 1)*2+(#a_00_1  & 1)*2+(#a_00_2  & 1)*2+(#a_00_3  & 1)*2+(#a_00_4  & 1)*2+(#a_00_5  & 1)*2+(#a_01_6  & 1)*2) >=14
 
}