valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 10:05:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: FPs with Webshell rule on memory

Browse Source
This commit is contained in:
Florian Roth 2021-03-18 15:06:42 +01:00
parent 7ea1473302
commit 0dab84da9d
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
yara/gen_webshells.yar
View File

@ -2860,7 +2860,8 @@ rule webshell_asp_runtime_compile
hash = "e826c4139282818d38dcccd35c7ae6857b1d1d01"
hash = "e20e078d9fcbb209e3733a06ad21847c5c5f0e52"
hash = "57f758137aa3a125e4af809789f3681d1b08ee5b"
type = "file"
strings:
$payload_reflection1 = "System.Reflection" nocase wide ascii
$payload_reflection2 = "Assembly" fullword nocase wide ascii