valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 18:15:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

False Positive Reduction

Browse Source
This commit is contained in:
Florian Roth 2018-02-08 22:59:08 +01:00
parent 308861a508
commit b1924d6cde
1 changed files with 0 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
yara/apt_eqgrp.yar
View File

@ -121,26 +121,6 @@ rule EQGRP_false {
uint16(0) == 0x5a4d and filesize < 50KB and $s1
}
rule EQGRP_bc_genpkt {
meta:
description = "Detects tool from EQGRP toolset - file bc-genpkt"
author = "Florian Roth"
reference = "Research"
date = "2016-08-15"
score = 75
strings:
$x1 = "load auxiliary object=%s requested by file=%s" fullword ascii
$x2 = "size of new packet, should be %d <= size <= %d bytes" fullword ascii
$x3 = "verbosity - show lengths, packet dumps, etc" fullword ascii
$s1 = "%s: error while loading shared libraries: %s%s%s%s%s" fullword ascii
$s2 = "cannot dynamically load executable" fullword ascii
$s3 = "binding file %s to %s: %s symbol `%s' [%s]" fullword ascii
$s4 = "randomize the initiator cookie" fullword ascii
condition:
uint16(0) == 0x457f and filesize < 1000KB and ( 1 of ($x*) and 3 of them )
}
rule EQGRP_dn_1_0_2_1 {
meta:
description = "Detects tool from EQGRP toolset - file dn.1.0.2.1.linux"