roadwy-DefenderYara/Exploit/Linux/Agent/Exploit_Linux_Agent_D_xp.yar

rule Exploit_Linux_Agent_D_xp{
	meta:
		description = "Exploit:Linux/Agent.D!xp,SIGNATURE_TYPE_ELFHSTR_EXT,03 00 03 00 04 00 00 01 00 "
		
	strings :
		$a_01_0 = {50 54 52 41 43 45 5f 41 54 54 41 43 48 } //01 00 
		$a_01_1 = {64 6f 5f 76 69 63 74 69 6d } //01 00 
		$a_01_2 = {63 68 65 63 6b 5f 65 78 65 63 76 65 } //01 00 
		$a_01_3 = {62 75 67 20 65 78 70 6c 6f 69 74 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e } //00 00 
		$a_00_4 = {5d 04 00 } //00 2e 
	condition:
		any of ($a_*)
 
}