valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 10:05:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

refactor: date cleanup

Browse Source
This commit is contained in:
Florian Roth 2019-07-21 12:04:41 +02:00
parent 3a36eabb3f
commit b4ef6f503e
3 changed files with 46 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
yara/crime_corkow_dll.yar
View File

@ -4,7 +4,7 @@ rule CorkowDLL {
meta: meta:
description = "Rule to detect the Corkow DLL files" description = "Rule to detect the Corkow DLL files"
author = "Group IB" author = "Group IB"
date = "2016/02" date = "01.02.2016"
referenced = "https://www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf" referenced = "https://www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf"
strings: strings:
$binary1 = { 60 [0-8] 9C [0-8] BB ?? ?? ?? ?? [0-8] 81 EB ?? ?? ?? ?? [0-8] E8 ?? 00 00 00 [0-8] 58 [0-8] 2B C3 } $binary1 = { 60 [0-8] 9C [0-8] BB ?? ?? ?? ?? [0-8] 81 EB ?? ?? ?? ?? [0-8] E8 ?? 00 00 00 [0-8] 58 [0-8] 2B C3 }

84
yara/gen_rats_malwareconfig.yar
View File

@ -2,7 +2,7 @@ rule RAT_AAR
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects AAR RAT" description = "Detects AAR RAT"
reference = "http://malwareconfig.com/stats/AAR" reference = "http://malwareconfig.com/stats/AAR"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -26,7 +26,7 @@ rule RAT_Adzok
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
description = "Detects Adzok RAT" description = "Detects Adzok RAT"
Versions = "Free 1.0.0.3," Versions = "Free 1.0.0.3,"
date = "2015/05" date = "01.05.2015"
reference = "http://malwareconfig.com/stats/Adzok" reference = "http://malwareconfig.com/stats/Adzok"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
filetype = "jar" filetype = "jar"
@ -50,7 +50,7 @@ rule RAT_Ap0calypse
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
description = "Detects Ap0calypse RAT" description = "Detects Ap0calypse RAT"
date = "2014/04" date = "01.04.2014"
reference = "http://malwareconfig.com/stats/Ap0calypse" reference = "http://malwareconfig.com/stats/Ap0calypse"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
filetype = "exe" filetype = "exe"
@ -70,7 +70,7 @@ rule RAT_Arcom
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Arcom RAT" description = "Detects Arcom RAT"
reference = "http://malwareconfig.com/stats/Arcom" reference = "http://malwareconfig.com/stats/Arcom"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -92,7 +92,7 @@ rule RAT_Bandook
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Bandook RAT" description = "Detects Bandook RAT"
reference = "http://malwareconfig.com/stats/bandook" reference = "http://malwareconfig.com/stats/bandook"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -118,7 +118,7 @@ rule RAT_BlackNix
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects BlackNix RAT" description = "Detects BlackNix RAT"
reference = "http://malwareconfig.com/stats/BlackNix" reference = "http://malwareconfig.com/stats/BlackNix"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -139,7 +139,7 @@ rule RAT_BlackShades
{ {
meta: meta:
author = "Brian Wallace (@botnet_hunter)" author = "Brian Wallace (@botnet_hunter)"
date = "2014/04" date = "01.04.2014"
description = "Detects BlackShades RAT" description = "Detects BlackShades RAT"
reference = "http://blog.cylance.com/a-study-in-bots-blackshades-net" reference = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
family = "blackshades" family = "blackshades"
@ -157,7 +157,7 @@ rule RAT_BlueBanana
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects BlueBanana RAT" description = "Detects BlueBanana RAT"
reference = "http://malwareconfig.com/stats/BlueBanana" reference = "http://malwareconfig.com/stats/BlueBanana"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -179,7 +179,7 @@ rule RAT_Bozok
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Bozok RAT" description = "Detects Bozok RAT"
reference = "http://malwareconfig.com/stats/Bozok" reference = "http://malwareconfig.com/stats/Bozok"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -200,7 +200,7 @@ rule RAT_ClientMesh
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)" author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
date = "2014/06" date = "01.06.2014"
description = "Detects ClientMesh RAT" description = "Detects ClientMesh RAT"
reference = "http://malwareconfig.com/stats/ClientMesh" reference = "http://malwareconfig.com/stats/ClientMesh"
family = "torct" family = "torct"
@ -222,7 +222,7 @@ rule RAT_CyberGate
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects CyberGate RAT" description = "Detects CyberGate RAT"
reference = "http://malwareconfig.com/stats/CyberGate" reference = "http://malwareconfig.com/stats/CyberGate"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -246,7 +246,7 @@ rule RAT_DarkComet
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects DarkComet RAT" description = "Detects DarkComet RAT"
reference = "http://malwareconfig.com/stats/DarkComet" reference = "http://malwareconfig.com/stats/DarkComet"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -273,7 +273,7 @@ rule RAT_DarkRAT
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects DarkRAT" description = "Detects DarkRAT"
reference = "http://malwareconfig.com/stats/DarkRAT" reference = "http://malwareconfig.com/stats/DarkRAT"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -296,7 +296,7 @@ rule RAT_Greame
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Greame RAT" description = "Detects Greame RAT"
reference = "http://malwareconfig.com/stats/Greame" reference = "http://malwareconfig.com/stats/Greame"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -320,7 +320,7 @@ rule RAT_HawkEye
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2015/06" date = "01.06.2015"
description = "Detects HawkEye RAT" description = "Detects HawkEye RAT"
reference = "http://malwareconfig.com/stats/HawkEye" reference = "http://malwareconfig.com/stats/HawkEye"
maltype = "KeyLogger" maltype = "KeyLogger"
@ -345,7 +345,7 @@ rule RAT_Imminent
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Imminent RAT" description = "Detects Imminent RAT"
reference = "http://malwareconfig.com/stats/Imminent" reference = "http://malwareconfig.com/stats/Imminent"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -376,7 +376,7 @@ rule RAT_Infinity
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Infinity RAT" description = "Detects Infinity RAT"
reference = "http://malwareconfig.com/stats/Infinity" reference = "http://malwareconfig.com/stats/Infinity"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -400,7 +400,7 @@ rule RAT_JavaDropper
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)" author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
date = "2015/10" date = "01.10.2015"
description = "Detects JavaDropper RAT" description = "Detects JavaDropper RAT"
reference = "http://malwareconfig.com/stats/JavaDropper" reference = "http://malwareconfig.com/stats/JavaDropper"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -422,7 +422,7 @@ rule RAT_LostDoor
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects LostDoor RAT" description = "Detects LostDoor RAT"
reference = "http://malwareconfig.com/stats/LostDoor" reference = "http://malwareconfig.com/stats/LostDoor"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -448,7 +448,7 @@ rule RAT_LuminosityLink
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects LuminosityLink RAT" description = "Detects LuminosityLink RAT"
reference = "http://malwareconfig.com/stats/LuminosityLink" reference = "http://malwareconfig.com/stats/LuminosityLink"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -475,7 +475,7 @@ rule RAT_LuxNet
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects LuxNet RAT" description = "Detects LuxNet RAT"
reference = "http://malwareconfig.com/stats/LuxNet" reference = "http://malwareconfig.com/stats/LuxNet"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -498,7 +498,7 @@ rule RAT_NanoCore
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects NanoCore RAT" description = "Detects NanoCore RAT"
reference = "http://malwareconfig.com/stats/NanoCore" reference = "http://malwareconfig.com/stats/NanoCore"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -526,7 +526,7 @@ rule RAT_NetWire
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net> & David Cannings" author = "Kevin Breen <kevin@techanarchy.net> & David Cannings"
date = "2014/04" date = "01.04.2014"
description = "Detects NetWire RAT" description = "Detects NetWire RAT"
reference = "http://malwareconfig.com/stats/NetWire" reference = "http://malwareconfig.com/stats/NetWire"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -549,7 +549,7 @@ rule RAT_Pandora
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Pandora RAT" description = "Detects Pandora RAT"
reference = "http://malwareconfig.com/stats/Pandora" reference = "http://malwareconfig.com/stats/Pandora"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -578,7 +578,7 @@ rule RAT_Paradox
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Paradox RAT" description = "Detects Paradox RAT"
reference = "http://malwareconfig.com/stats/Paradox" reference = "http://malwareconfig.com/stats/Paradox"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -601,7 +601,7 @@ rule RAT_Plasma
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Plasma RAT" description = "Detects Plasma RAT"
reference = "http://malwareconfig.com/stats/Plasma" reference = "http://malwareconfig.com/stats/Plasma"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -626,7 +626,7 @@ rule RAT_PoisonIvy
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects PoisonIvy RAT" description = "Detects PoisonIvy RAT"
reference = "http://malwareconfig.com/stats/PoisonIvy" reference = "http://malwareconfig.com/stats/PoisonIvy"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -648,7 +648,7 @@ rule RAT_PredatorPain
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects PredatorPain RAT" description = "Detects PredatorPain RAT"
reference = "http://malwareconfig.com/stats/PredatorPain" reference = "http://malwareconfig.com/stats/PredatorPain"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -677,7 +677,7 @@ rule RAT_Punisher
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Punisher RAT" description = "Detects Punisher RAT"
reference = "http://malwareconfig.com/stats/Punisher" reference = "http://malwareconfig.com/stats/Punisher"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -700,7 +700,7 @@ rule RAT_PythoRAT
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Python RAT" description = "Detects Python RAT"
reference = "http://malwareconfig.com/stats/PythoRAT" reference = "http://malwareconfig.com/stats/PythoRAT"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -724,7 +724,7 @@ rule RAT_QRat
{ {
meta: meta:
author = "Kevin Breen @KevTheHermit" author = "Kevin Breen @KevTheHermit"
date = "2015/08" date = "01.08.2015"
description = "Detects QRAT" description = "Detects QRAT"
reference = "http://malwareconfig.com" reference = "http://malwareconfig.com"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -788,7 +788,7 @@ rule RAT_ShadowTech
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects ShadowTech RAT" description = "Detects ShadowTech RAT"
reference = "http://malwareconfig.com/stats/ShadowTech" reference = "http://malwareconfig.com/stats/ShadowTech"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -811,7 +811,7 @@ rule RAT_SmallNet
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects SmallNet RAT" description = "Detects SmallNet RAT"
reference = "http://malwareconfig.com/stats/SmallNet" reference = "http://malwareconfig.com/stats/SmallNet"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -832,7 +832,7 @@ rule RAT_SpyGate
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects SpyGate RAT" description = "Detects SpyGate RAT"
reference = "http://malwareconfig.com/stats/SpyGate" reference = "http://malwareconfig.com/stats/SpyGate"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -860,7 +860,7 @@ rule RAT_Sub7Nation
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)" author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
date = "2014/04" date = "01.04.2014"
description = "Detects Sub7Nation RAT" description = "Detects Sub7Nation RAT"
reference = "http://malwareconfig.com/stats/Sub7Nation" reference = "http://malwareconfig.com/stats/Sub7Nation"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -882,7 +882,7 @@ rule RAT_Vertex
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Vertex RAT" description = "Detects Vertex RAT"
reference = "http://malwareconfig.com/stats/Vertex" reference = "http://malwareconfig.com/stats/Vertex"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -906,7 +906,7 @@ rule RAT_VirusRat
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects VirusRAT" description = "Detects VirusRAT"
reference = "http://malwareconfig.com/stats/VirusRat" reference = "http://malwareconfig.com/stats/VirusRat"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -934,7 +934,7 @@ rule RAT_Xtreme
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Xtreme RAT" description = "Detects Xtreme RAT"
reference = "http://malwareconfig.com/stats/Xtreme" reference = "http://malwareconfig.com/stats/Xtreme"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -956,7 +956,7 @@ rule RAT_adWind
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects Adwind RAT" description = "Detects Adwind RAT"
reference = "http://malwareconfig.com/stats/adWind" reference = "http://malwareconfig.com/stats/adWind"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -976,7 +976,7 @@ rule RAT_njRat
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects njRAT" description = "Detects njRAT"
reference = "http://malwareconfig.com/stats/njRat" reference = "http://malwareconfig.com/stats/njRat"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -1000,7 +1000,7 @@ rule RAT_unrecom
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects unrecom RAT" description = "Detects unrecom RAT"
reference = "http://malwareconfig.com/stats/unrecom" reference = "http://malwareconfig.com/stats/unrecom"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"
@ -1021,7 +1021,7 @@ rule RAT_xRAT
{ {
meta: meta:
author = "Kevin Breen <kevin@techanarchy.net>" author = "Kevin Breen <kevin@techanarchy.net>"
date = "2014/04" date = "01.04.2014"
description = "Detects xRAT" description = "Detects xRAT"
reference = "http://malwareconfig.com/stats/xRat" reference = "http://malwareconfig.com/stats/xRat"
maltype = "Remote Access Trojan" maltype = "Remote Access Trojan"

6
yara/thor-hacktools.yar
View File

@ -122,7 +122,7 @@ rule Fierce2
license = "https://creativecommons.org/licenses/by-nc/4.0/" license = "https://creativecommons.org/licenses/by-nc/4.0/"
author = "Florian Roth" author = "Florian Roth"
description = "This signature detects the Fierce2 domain scanner" description = "This signature detects the Fierce2 domain scanner"
date = "07/2014" date = "01.07.2014"
score = 60 score = 60
strings: strings:
$s1 = "$tt_xml->process( 'end_domainscan.tt', $end_domainscan_vars," $s1 = "$tt_xml->process( 'end_domainscan.tt', $end_domainscan_vars,"
@ -136,7 +136,7 @@ rule Ncrack
license = "https://creativecommons.org/licenses/by-nc/4.0/" license = "https://creativecommons.org/licenses/by-nc/4.0/"
author = "Florian Roth" author = "Florian Roth"
description = "This signature detects the Ncrack brute force tool" description = "This signature detects the Ncrack brute force tool"
date = "07/2014" date = "01.07.2014"
score = 60 score = 60
strings: strings:
$s1 = "NcrackOutputTable only supports adding up to 4096 to a cell via" $s1 = "NcrackOutputTable only supports adding up to 4096 to a cell via"
@ -150,7 +150,7 @@ rule SQLMap
license = "https://creativecommons.org/licenses/by-nc/4.0/" license = "https://creativecommons.org/licenses/by-nc/4.0/"
author = "Florian Roth" author = "Florian Roth"
description = "This signature detects the SQLMap SQL injection tool" description = "This signature detects the SQLMap SQL injection tool"
date = "07/2014" date = "01.07.2014"
score = 60 score = 60
strings: strings:
$s1 = "except SqlmapBaseException, ex:" $s1 = "except SqlmapBaseException, ex:"