valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 18:15:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

False Positive Reduction

Browse Source 
https://github.com/Neo23x0/signature-base/issues/54
This commit is contained in:
Florian Roth 2019-01-24 11:03:01 +01:00
parent b5f6c82040
commit 7564e6e8e6
2 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
iocs/filename-iocs.txt
View File

@ -635,7 +635,6 @@ AppData\\adobe\\adobe\.dat;65
\\firef0x\.exe;45
\\firefly\.exe;45
\\firefo\.exe;45
\\firefox_\.exe;45
\\firefox2\.exe;45
\\firefox32\.exe;45
\\firefoxe\.exe;45

2
yara/gen_elf_file_anomalies.yar
View File

@ -11,5 +11,5 @@ rule SUSP_ELF_LNX_UPX_Compressed_File {
$s1 = "PROT_EXEC|PROT_WRITE failed." fullword ascii
$s3 = "$Id: UPX" fullword ascii
condition:
uint16(0) == 0x457f and filesize < 2000KB and filesize > 30KB and all of them
uint32be(0) == 0x7f454c46 and filesize < 2000KB and filesize > 30KB and all of them
}