Updated and renamed name file APT_FIN7

malware/APT_FIN7.yar → malware/APT_Cobalt.yar

@@ -2,14 +2,14 @@
     This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
 
 */
-rule fin7_functions
+rule Cobalt_functions
 {
 
     meta:
 
         author="@j0sm1"
         url="https://www.securityartwork.es/2017/06/16/analisis-del-powershell-usado-fin7/"
-        description="Detect functions coded with ROR edi,D"
+        description="Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT"
 
     strings: