SEKOIA.IO unknown stable yara

apt_apt28_htmlsmuggling_disclosing_ip [yara_rules]

Detects some kind of HTMLSmuggling used by APT28

View Source

Detection Logic

$s1 and $s2 and $s3 and filesize < 5000

Field Validations

Loading…

Comments (0)

Loading comments...