Detect OutDebugStringA API

Detect OutDebugStringA API

Detect OutDebugStringA API
ec06ead1 · Yara Rules · 5f94e04a · ec06ead1
Commit ec06ead1 authored Apr 20, 2015 by Yara Rules
Hide whitespace changes
Inline Side-by-side

Showing with 10 additions and 0 deletions

antidebug.yar antidebug.yar +10 -0

No files found.
--- a/antidebug.yar
+++ b/antidebug.yar
@@ -534,6 +534,16 @@ rule Check_UserNames
 }


+rule Check_OutputDebugStringA_iat
+{
+
+	meta:
+		Author = "http://twitter.com/j0sm1"
+		Description = "Detect in IAT OutputDebugstringA"
+		Date = "20/04/2015"

+	condition:
+		pe.imports("kernel32.dll","OutputDebugStringA")
+}