14 lines
904 B
Plaintext
14 lines
904 B
Plaintext
|
|
rule Exploit_Win64_Sandsquarev_C{
|
|
meta:
|
|
description = "Exploit:Win64/Sandsquarev.C,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 04 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_80_0 = {7b 30 61 66 61 63 65 64 31 2d 65 38 32 38 2d 31 31 64 31 2d 39 31 38 37 2d 62 35 33 32 66 31 65 39 35 37 35 64 7d 5c } //{0afaced1-e828-11d1-9187-b532f1e9575d}\ 01 00
|
|
$a_80_1 = {5c 74 61 72 67 65 74 2e 6c 6e 6b } //\target.lnk 01 00
|
|
$a_02_2 = {3c 00 68 00 74 00 6d 00 6c 00 3e 00 3c 00 62 00 6f 00 64 00 79 00 3e 00 3c 00 73 00 63 00 72 00 69 00 70 00 74 00 3e 00 90 02 a0 3c 00 2f 00 73 00 63 00 72 00 69 00 70 00 74 00 3e 00 3c 00 2f 00 62 00 6f 00 64 00 79 00 3e 00 3c 00 2f 00 68 00 74 00 6d 00 6c 00 3e 00 90 00 } //01 00
|
|
$a_02_3 = {3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 3e 90 02 a0 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 90 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |