mirror of
https://github.com/roadwy/DefenderYara
synced 2026-06-21 14:08:27 +00:00
roadwy
14 lines
643 B
Plaintext
14 lines
643 B
Plaintext
|
|
rule Exploit_Linux_Apache_A_xp{
|
|
meta:
|
|
description = "Exploit:Linux/Apache.A!xp,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {2e 2f 61 70 61 63 68 65 5f 6f 70 65 6e 73 73 6c 5f 65 78 70 6c 6f 69 74 } //1 ./apache_openssl_exploit
|
|
$a_01_1 = {61 70 61 63 68 65 20 75 69 64 } //1 apache uid
|
|
$a_01_2 = {2e 2f 61 70 61 63 68 65 5f 73 63 6f 72 65 62 6f 61 72 64 5f 65 78 70 6c 6f 69 74 20 70 69 64 } //1 ./apache_scoreboard_exploit pid
|
|
$a_01_3 = {70 72 6f 63 65 73 73 20 31 32 30 39 37 } //1 process 12097
|
|
condition:
|
|
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1) >=4
|
|
|
|
} |