Commit e523343c by Marc Rivero López Committed by GitHub

Update MALW_CAP_HookExKeylogger.yar

parent 9e912d75
...@@ -2,17 +2,19 @@ ...@@ -2,17 +2,19 @@
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/ */
rule CAP_HookExKeylogger rule CAP_HookExKeylogger
{ {
meta: meta:
author = "Brian C. Bell -- @biebsmalwareguy" author = "Brian C. Bell -- @biebsmalwareguy"
reference = "https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar" reference = "https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar"
strings: strings:
$str_Win32hookapi = "SetWindowsHookEx" nocase $str_Win32hookapi = "SetWindowsHookEx" nocase
$str_Win32llkey = "WH_KEYBOARD_LL" nocase $str_Win32llkey = "WH_KEYBOARD_LL" nocase
$str_Win32key = "WH_KEYBOARD" nocase $str_Win32key = "WH_KEYBOARD" nocase
condition: condition:
2 of them 2 of them
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment