DefenderYara/Exploit/Win32/ShellCode/Exploit_Win32_ShellCode_T.yar

rule Exploit_Win32_ShellCode_T{
	meta:
		description = "Exploit:Win32/ShellCode.T,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
		
	strings :
		$a_03_0 = {d9 e1 d9 34 24 58 58 58 58 33 db b3 ?? 03 c3 31 c9 66 81 e9 ?? ?? 80 30 ?? 40 e2 fa } //1
	condition:
		((#a_03_0  & 1)*1) >=1
 
}