ReversingLabs unknown stable yara

Win32_Exploit_CVE20200601 [exploit]

Yara rule that detects CVE-2020-0601 exploit.

View Source

Detection Logic

uint16(0) == 0x5A4D and
        (
            $oid_prime_explicit
        ) and
        (
            any of ($ecc_public_key_*)
        ) and
        (
            pe.number_of_signatures > 0
        )

Field Validations

Loading…

Comments (0)

Loading comments...