description = "Detects ShimRat and the ShimRat loader"
...
...
@@ -26,7 +26,7 @@ rule shimrat
($dll and $dat and $headersig and $datasig) or ($datamarker1 and $datamarker2) or ($cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec) or ($dll and $dat and $shim_func1 and $shim_func2 and $shim_func3)