13 lines
885 B
Plaintext
13 lines
885 B
Plaintext
|
|
rule Trojan_Linux_E2E_CmdLineTest{
|
|
meta:
|
|
description = "Trojan:Linux/E2E_CmdLineTest,SIGNATURE_TYPE_CMDHSTR_EXT,0b 00 0a 00 03 00 00 "
|
|
|
|
strings :
|
|
$a_00_0 = {6c 00 69 00 6e 00 75 00 78 00 5f 00 6d 00 61 00 6c 00 77 00 61 00 72 00 65 00 } //1 linux_malware
|
|
$a_00_1 = {61 00 61 00 64 00 36 00 30 00 31 00 66 00 37 00 2d 00 64 00 37 00 36 00 64 00 2d 00 34 00 64 00 64 00 63 00 2d 00 61 00 62 00 31 00 65 00 2d 00 33 00 37 00 61 00 62 00 34 00 63 00 33 00 65 00 37 00 65 00 36 00 66 00 } //10 aad601f7-d76d-4ddc-ab1e-37ab4c3e7e6f
|
|
$a_00_2 = {61 00 62 00 63 00 39 00 64 00 63 00 34 00 62 00 2d 00 30 00 64 00 66 00 61 00 2d 00 34 00 32 00 66 00 33 00 2d 00 62 00 62 00 63 00 31 00 2d 00 64 00 66 00 66 00 38 00 64 00 65 00 39 00 36 00 30 00 39 00 37 00 37 00 } //8 abc9dc4b-0dfa-42f3-bbc1-dff8de960977
|
|
condition:
|
|
((#a_00_0 & 1)*1+(#a_00_1 & 1)*10+(#a_00_2 & 1)*8) >=10
|
|
|
|
} |