|
|
|
rule Exploit_Win32_ShellCode_T{
|
|
meta:
|
|
description = "Exploit:Win32/ShellCode.T,SIGNATURE_TYPE_PEHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_03_0 = {d9 e1 d9 34 24 58 58 58 58 33 db b3 ?? 03 c3 31 c9 66 81 e9 ?? ?? 80 30 ?? 40 e2 fa } //1
|
|
condition:
|
|
((#a_03_0 & 1)*1) >=1
|
|
|
|
} |