mirror of
https://github.com/roadwy/DefenderYara
synced 2026-06-21 14:08:27 +00:00
roadwy
11 lines
384 B
Plaintext
11 lines
384 B
Plaintext
|
|
rule HackTool_Linux_CredsShellcode_A{
|
|
meta:
|
|
description = "HackTool:Linux/CredsShellcode.A,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {48 b8 2f 62 69 6e 2f 73 68 00 99 50 54 5f 52 66 68 2d 63 54 5e 52 e8 10 00 00 00 63 61 74 20 2f 65 74 63 2f 70 61 73 73 77 64 00 56 57 54 5e 6a 3b 58 0f 05 } //1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
} |