11 lines
393 B
Plaintext
11 lines
393 B
Plaintext
|
|
rule Trojan_Linux_MsfShellBin_E{
|
|
meta:
|
|
description = "Trojan:Linux/MsfShellBin.E,SIGNATURE_TYPE_ELFHSTR_EXT,01 00 01 00 01 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {31 db 53 43 53 6a 0a 89 e1 6a 66 58 cd 80 96 99 68 90 01 04 68 90 01 04 68 90 01 04 68 90 01 04 68 90 01 04 52 66 68 90 01 02 66 68 0a 00 89 e1 6a 1c 51 56 89 e1 43 43 6a 66 58 90 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |