Commit 819cd8d7 by mmorenog

Update sqlite.yar

parent d66337e7
......@@ -13,16 +13,3 @@ rule with_sqlite : sqlite
condition:
all of them
}
rule without_sqlite : nosqlite
{
meta:
author = "Julian J. Gonzalez <info@seguridadparatodos.es>"
reference = "http://www.st2labs.com"
description = "Rule to detect the presence of SQLite data in raw image"
strings:
$hex_string = {53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00}
condition:
not $hex_string
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment