mirror of
https://github.com/roadwy/DefenderYara
synced 2026-06-21 14:08:27 +00:00
roadwy
14 lines
573 B
Plaintext
14 lines
573 B
Plaintext
|
|
rule Exploit_Linux_Agent_D_xp{
|
|
meta:
|
|
description = "Exploit:Linux/Agent.D!xp,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {50 54 52 41 43 45 5f 41 54 54 41 43 48 } //1 PTRACE_ATTACH
|
|
$a_01_1 = {64 6f 5f 76 69 63 74 69 6d } //1 do_victim
|
|
$a_01_2 = {63 68 65 63 6b 5f 65 78 65 63 76 65 } //1 check_execve
|
|
$a_01_3 = {62 75 67 20 65 78 70 6c 6f 69 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e } //1 bug exploited successfully.
|
|
condition:
|
|
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=3
|
|
|
|
} |