Commit a5eaf2cc by Marc Rivero López Committed by GitHub

Update GEN_PowerShell.yar

parent 423a7046
/*
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
rule GEN_PowerShell
{
rule GEN_PowerShell {
meta:
description = "Generic PowerShell Malware Rule"
author = "https://github.com/interleaved"
strings:
$s1 = "powershell"
$s2 = "-ep bypass" nocase
......@@ -15,6 +21,7 @@ rule GEN_PowerShell {
/*$s7 = "-noninteractive" fullword ascii*/
$s8 = "-enc" nocase
$s9 = "-encodedcommand" nocase
condition:
$s1 and (($s2 or $s3 or $s10) and ($s4 or $s5 or $s11) and ($s8 or $s9))
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment