roadwy-DefenderYara/Exploit/Linux/FakeJavaDropout/Exploit_Linux_FakeJavaDropout_A.yar

rule Exploit_Linux_FakeJavaDropout_A{
	meta:
		description = "Exploit:Linux/FakeJavaDropout.A,SIGNATURE_TYPE_ELFHSTR_EXT,3d 00 3d 00 08 00 00 "
		
	strings :
		$a_81_0 = {65 78 65 63 76 65 40 47 4c 49 42 43 } //50 execve@GLIBC
		$a_81_1 = {73 79 73 74 65 6d 40 47 4c 49 42 43 } //50 system@GLIBC
		$a_81_2 = {67 65 74 75 69 64 40 47 4c 49 42 43 } //10 getuid@GLIBC
		$a_81_3 = {6c 6f 67 34 6a } //1 log4j
		$a_81_4 = {4c 4f 47 34 4a } //1 LOG4J
		$a_81_5 = {73 70 72 69 6e 67 2d 63 6f 72 65 } //1 spring-core
		$a_81_6 = {6c 69 62 6a 6c 69 } //-100 libjli
		$a_81_7 = {4a 4c 49 5f 49 6e 69 74 41 72 67 50 72 6f 63 65 73 73 69 6e 67 } //-100 JLI_InitArgProcessing
	condition:
		((#a_81_0  & 1)*50+(#a_81_1  & 1)*50+(#a_81_2  & 1)*10+(#a_81_3  & 1)*1+(#a_81_4  & 1)*1+(#a_81_5  & 1)*1+(#a_81_6  & 1)*-100+(#a_81_7  & 1)*-100) >=61
 
}