Commit e523343c by Marc Rivero López Committed by GitHub

Update MALW_CAP_HookExKeylogger.yar

parent 9e912d75
......@@ -2,17 +2,19 @@
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
rule CAP_HookExKeylogger
{
meta:
author = "Brian C. Bell -- @biebsmalwareguy"
reference = "https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar"
strings:
$str_Win32hookapi = "SetWindowsHookEx" nocase
$str_Win32llkey = "WH_KEYBOARD_LL" nocase
$str_Win32key = "WH_KEYBOARD" nocase
strings:
$str_Win32hookapi = "SetWindowsHookEx" nocase
$str_Win32llkey = "WH_KEYBOARD_LL" nocase
$str_Win32key = "WH_KEYBOARD" nocase
condition:
2 of them
condition:
2 of them
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment