Minor changes

yara/apt_derusbi.yar

@@ -6,6 +6,13 @@
 	Identifier: Derusbi Dez 2015
 */
 
+private rule PEFILE {
+   meta:
+      description = "Detects portable executable files in a fuzzy way only by detecting the MZ header and not checking for a PE header"
+   condition:
+      uint16(0) == 0x5A4D
+}
+
 rule derusbi_kernel
 {
     meta:
@@ -17,9 +24,8 @@ rule derusbi_kernel
         $token2 = "Wrod--$$$"
         $cfg = "XXXXXXXXXXXXXXX"
         $class = ".?AVPCC_BASEMOD@@"
-        $MZ = "MZ"
     condition:
-        $MZ at 0 and $token1 and $token2 and $cfg and $class
+        PEFILE and $token1 and $token2 and $cfg and $class
 }
 
 rule derusbi_linux

yara/thor-hacktools.yar

@@ -17,6 +17,13 @@
 
 */
 
+private rule PEFILE {
+   meta:
+      description = "Detects portable executable files in a fuzzy way only by detecting the MZ header and not checking for a PE header"
+   condition:
+      uint16(0) == 0x5A4D
+}
+
 /* WCE */
 
 rule WindowsCredentialEditor
@@ -2712,10 +2719,9 @@ rule CN_Portscan : APT
         confidential = false
 		score = 70
     strings:
-    	$s1 = "MZ"
 		$s2 = "TCP 12.12.12.12"
     condition:
-        ($s1 at 0) and $s2
+        PEFILE and $s2
 }
 
 rule WMI_vbs : APT
@@ -2822,11 +2828,10 @@ rule DarkComet_Keylogger_File
 		date = "25.07.14"
 		score = 50
 	strings:
-		$magic = "::"
 		$entry = /\n:: [A-Z]/
 		$timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/
 	condition:
-		($magic at 0) and #entry > 10 and #timestamp > 10
+		uint16(0) == 0x3A3A and #entry > 10 and #timestamp > 10
 }
 
 /* Mimikatz */