mirror of
https://github.com/valitydev/signature-base.git
synced 2024-11-06 18:15:20 +00:00
12 lines
330 B
Plaintext
12 lines
330 B
Plaintext
|
|
rule SUSP_LNK_Big_Link_File {
|
|
meta:
|
|
description = "Detects a suspiciously big LNK file - maybe with embedded content"
|
|
author = "Florian Roth"
|
|
reference = "Internal Research"
|
|
date = "2018-05-15"
|
|
score = 65
|
|
condition:
|
|
uint16(0) == 0x004c and uint32(4) == 0x00021401 and filesize > 200KB
|
|
}
|