Commit 8bd1abda by j0sm1

Add APT_DeputyDog from nyx0 PR

Add APT_DeputyDog
Commit:  b6994ffa563084d121b5d9e718583d9406e51f2c
parent 9c4a998d
...@@ -18,3 +18,19 @@ strings: ...@@ -18,3 +18,19 @@ strings:
condition: condition:
any of them any of them
} }
rule APT_DeputyDog
{
meta:
Author = "FireEye Labs"
Date = "2013/09/21"
Description = "detects string seen in samples used in 2013-3893 0day attacks"
Reference = "https://www.fireeye.com/blog/threat-research/2013/09/operation-deputydog-zero-day-cve-2013-3893-attack-against-japanese-targets.html"
strings:
$mz = {4d 5a}
$a = "DGGYDSYRL"
condition:
($mz at 0) and $a
}
\ No newline at end of file
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment