mirror of
https://github.com/roadwy/DefenderYara
synced 2026-06-21 14:08:27 +00:00
roadwy@gmail.com
57 lines
2.2 KiB
Plaintext
57 lines
2.2 KiB
Plaintext
|
|
rule Exploit_Win32_ShellCode_AD{
|
|
meta:
|
|
description = "Exploit:Win32/ShellCode.AD,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 03 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {77 69 6e 69 c7 90 02 03 6e 65 74 2e c7 90 02 03 64 6c 6c 00 90 00 } //01 00
|
|
$a_03_1 = {4c 77 26 07 90 02 04 e8 90 00 } //01 00
|
|
$a_03_2 = {b9 58 a4 53 e5 8b d8 e8 90 01 04 6a 40 68 00 10 00 00 68 00 00 10 00 33 f6 56 ff d0 90 00 } //00 00
|
|
$a_00_3 = {78 7b } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
}
|
|
rule Exploit_Win32_ShellCode_AD_2{
|
|
meta:
|
|
description = "Exploit:Win32/ShellCode.AD,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {89 6c 24 24 ff 54 24 48 8b 44 24 14 6a 40 68 00 30 00 00 40 50 57 6a ff ff 54 24 34 } //01 00
|
|
$a_03_1 = {77 69 6e 69 c7 90 02 03 6e 65 74 2e c7 90 02 03 64 6c 6c 00 90 00 } //01 00
|
|
$a_03_2 = {70 6f 77 65 c7 90 02 03 72 73 68 65 c7 90 02 03 6c 6c 20 2d 90 00 } //01 00
|
|
$a_03_3 = {3a 56 79 a7 90 02 0c e8 90 00 } //01 00
|
|
$a_03_4 = {4c 77 26 07 90 02 04 e8 90 00 } //00 00
|
|
$a_00_5 = {78 8c } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
}
|
|
rule Exploit_Win32_ShellCode_AD_3{
|
|
meta:
|
|
description = "Exploit:Win32/ShellCode.AD,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 05 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {2e 64 6c 6c 88 44 24 90 01 01 c7 44 24 90 01 01 77 69 6e 69 90 00 } //01 00
|
|
$a_03_1 = {6c 2e 64 6c 66 c7 44 24 90 01 01 6c 00 c7 90 02 06 68 74 74 70 c7 90 00 } //01 00
|
|
$a_03_2 = {6e 65 74 2e c7 44 24 90 01 01 64 6c 6c 00 c7 44 24 90 01 01 68 74 74 70 90 00 } //01 00
|
|
$a_03_3 = {b9 3a 56 79 a7 e8 90 01 04 b9 77 87 7a f0 90 00 } //01 00
|
|
$a_01_4 = {78 3a 43 6c 61 73 73 3d 22 65 73 69 6c 76 65 72 2e 41 70 70 22 } //00 00
|
|
$a_00_5 = {c5 6b } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
}
|
|
rule Exploit_Win32_ShellCode_AD_4{
|
|
meta:
|
|
description = "Exploit:Win32/ShellCode.AD,SIGNATURE_TYPE_ARHSTR_EXT,04 00 04 00 04 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {89 6c 24 24 ff 54 24 48 8b 44 24 14 6a 40 68 00 30 00 00 40 50 57 6a ff ff 54 24 34 } //01 00
|
|
$a_03_1 = {77 69 6e 69 c7 90 02 03 6e 65 74 2e c7 90 02 03 64 6c 6c 00 90 00 } //01 00
|
|
$a_03_2 = {70 6f 77 65 c7 90 02 03 72 73 68 65 c7 90 02 03 6c 6c 20 2d 90 00 } //01 00
|
|
$a_03_3 = {3a 56 79 a7 90 02 0c e8 90 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |