Skip to content

R
rules
Commit 5a11fef9 by mmorenog
Options

Update email_Ukraine_BE_powerattack.yar

parent ba695c61
Showing with 2 additions and 2 deletions
email/email_Ukraine_BE_powerattack.yar
...@@ -3,7 +3,7 @@ ...@@ -3,7 +3,7 @@
long as you use it under this license. long as you use it under this license.
*/ */
rule email_Ukraine_power_attack_content { rule email_Ukraine_power_attack_content : mail {
meta: meta:
author = "@mmorenog,@yararules" author = "@mmorenog,@yararules"
description = "Detects a possible .eml used in the Ukraine BE power attack" description = "Detects a possible .eml used in the Ukraine BE power attack"
...@@ -19,7 +19,7 @@ rule email_Ukraine_power_attack_content { ...@@ -19,7 +19,7 @@ rule email_Ukraine_power_attack_content {
condition: condition:
3 of them 3 of them
} }
rule email_Ukraine_power_attack_attachment { rule email_Ukraine_power_attack_attachment : mail {
meta: meta:
author = " @yararules" author = " @yararules"
description = "Detects a possible .eml used in the Ukraine BE power attack" description = "Detects a possible .eml used in the Ukraine BE power attack"
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment