diff --git a/yara/gen_fireeye_redteam_tools.yar b/yara/gen_fireeye_redteam_tools.yar index 3ebe2c1..a8b2d60 100644 --- a/yara/gen_fireeye_redteam_tools.yar +++ b/yara/gen_fireeye_redteam_tools.yar @@ -1301,11 +1301,11 @@ rule APT_Builder_PY_REDFLARE_2 rev = 1 author = "FireEye" strings: - $1 = "<510sxxII" - $2 = "0x43,0x00,0x3a,0x00,0x5c,0x00,0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00," - $3 = "parsePluginOutput" + $s1 = "<510sxxII" + $s2 = "0x43,0x00,0x3a,0x00,0x5c,0x00,0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00," + $s3 = "parsePluginOutput" condition: - all of them and #2 == 2 + all of them and #s2 == 2 } rule APT_Loader_Win32_DShell_3 {