Update and rename Equation.yar to APT_Equation.yar

malware/Equation.yar → malware/APT_Equation.yar

@@ -7,7 +7,7 @@ import "pe"
 
 /* Equation APT ------------------------------------------------------------ */
 
-rule apt_equation_exploitlib_mutexes {
+rule apt_equation_exploitlib_mutexes : mutex {
     meta:
         copyright = "Kaspersky Lab"
         description = "Rule to detect Equation group's Exploitation library http://goo.gl/ivt8EW"
@@ -59,7 +59,7 @@ rule apt_equation_equationlaser_runtimeclasses {
 	    any of them
 }
 
-rule apt_equation_cryptotable {
+rule apt_equation_cryptotable : crypto {
 	meta:
 	    copyright = "Kaspersky Lab"
 	    description = "Rule to detect the crypto library used in Equation group malware"