SEKOIA.IO unknown stable yara

apt_apt28_wayzgoose_exploit_string [yara_rules]

Detects APT28's Wayzgoose exploit strings

View Source

Detection Logic

uint16be(0) == 0x4d5a and 4 of them
        and filesize < 500KB

Field Validations

Loading…

Comments (0)

Loading comments...