Merge pull request #3 from jonaslejon/master

Add new mimkatz yara-signature

yara/gen_kirbi_mimkatz.yar

@@ -0,0 +1,22 @@
+/*
+	Yara Rule Set
+	Author: Didier Stevens
+	Date: 2016-08-13
+	Identifier: KiRBi ticket for mimikatz
+*/
+
+/* Rule Set ----------------------------------------------------------------- */
+
+rule mimikatz_kirbi_ticket
+{
+	meta:
+		description		= "KiRBi ticket for mimikatz"
+		author			= "Benjamin DELPY (gentilkiwi); Didier Stevens"
+
+	strings:
+		$asn1			= { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 }
+		$asn1_84		= { 76 84 ?? ?? ?? ?? 30 84 ?? ?? ?? ?? a0 84 00 00 00 03 02 01 05 a1 84 00 00 00 03 02 01 16 }
+
+	condition:
+		$asn1 at 0 or $asn1_84 at 0
+}