Commit 1f8c2e21 by Antonio S

Generic SMS Fraud rule

parent 0e0bd14c
rule genericSMS : smsFraud
{
meta:
author = "https://twitter.com/plutec_net"
reference = "https://koodous.com/"
sample = "e6ef34577a75fc0dc0a1f473304de1fc3a0d7d330bf58448db5f3108ed92741b"
strings:
$a = "SHA1-Digest: +RsrTx5SNjstrnt7pNaeQAzY4kc="
$b = "SHA1-Digest: Rt2oRts0wWTjffGlETGfFix1dfE="
$c = "http://image.baidu.com/wisebrowse/index?tag1=%E6%98%8E%E6%98%9F&tag2=%E5%A5%B3%E6%98%8E%E6%98%9F&tag3=%E5%85%A8%E9%83%A8&pn=0&rn=10&fmpage=index&pos=magic#/channel"
$d = "pitchfork=022D4"
condition:
all of them
}
\ No newline at end of file
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment