14 lines
486 B
Plaintext
14 lines
486 B
Plaintext
|
|
rule Backdoor_Linux_Gafgyt_AC_MTB{
|
|
meta:
|
|
description = "Backdoor:Linux/Gafgyt.AC!MTB,SIGNATURE_TYPE_ELFHSTR_EXT,04 00 04 00 04 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {4b 69 6c 6c 65 72 20 69 73 20 6f 6e } //01 00 Killer is on
|
|
$a_01_1 = {52 65 70 6f 72 74 20 4b 69 6c 6c 73 20 69 73 20 6f 6e } //01 00 Report Kills is on
|
|
$a_01_2 = {4c 6f 63 6b 65 72 20 69 73 20 6f 6e } //01 00 Locker is on
|
|
$a_00_3 = {62 6f 74 6b 69 6c 6c } //00 00 botkill
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |