valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-07 02:25:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

rule: xor hunting Mozilla

Browse Source
This commit is contained in:
Florian Roth 2019-10-28 13:25:30 +01:00
parent e5dfec4e2f
commit 284229b854
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
yara/gen_xor_hunting.yar Normal file
View File

@ -0,0 +1,14 @@
rule SUSP_XORed_Mozilla {
meta:
description = "Detects suspicious XORed keyword - Mozilla/5.0"
author = "Florian Roth"
reference = "Internal Research"
date = "2019-10-28"
score = 65
strings:
$xo1 = "Mozilla/5.0" xor ascii wide
$xof1 = "Mozilla/5.0" ascii wide
condition:
$xo1 and not $xof1
}