Skip to content

R
rules
Commit dfcc4930 by mmorenog Committed by GitHub
Options

Update virustotal.yar

parent 1747c46e
Showing with 2 additions and 1 deletions
utils/virustotal.yar
//Rule to Catch Intelligence files in the meta of files uploaded. Current rule looks for NSA and MOSAD in meta of samples. //Rule to Catch Intelligence files in the meta of files uploaded. Current rule looks for NSA and MOSAD in meta of samples.
rule catch_intelligence_files /* rule catch_intelligence_files
{ {
meta: meta:
author = "@abhinavbom" author = "@abhinavbom"
...@@ -87,3 +87,4 @@ strings: ...@@ -87,3 +87,4 @@ strings:
condition: condition:
$magic at 0 and tags contains "exploit-kit" and positives >3 $magic at 0 and tags contains "exploit-kit" and positives >3
} }
*/
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment