valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 10:05:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

PowerShell Caret Obfuscation Rule

Browse Source
This commit is contained in:
Florian Roth 2019-07-21 12:04:56 +02:00
parent b4ef6f503e
commit 8af28e0fff
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
yara/gen_powershell_obfuscation.yar
View File

@ -37,3 +37,16 @@ rule SUSP_Obfuscted_PowerShell_Code {
condition:
#s1 > 11 and #s2 > 10 and #s3 > 10
}
rule SUSP_PowerShell_Caret_Obfuscation_2 {
meta:
description = "Detects powershell keyword obfuscated with carets"
author = "Florian Roth"
reference = "Internal Research"
date = "2019-07-20"
strings:
$r1 = /p[\^]?o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l\^l/ ascii wide nocase fullword
$r2 = /p\^o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l[\^]?l/ ascii wide nocase fullword
condition:
1 of them
}