SEKOIA.IO unknown stable yara

apt_apt29_malicious_rdp_file [yara_rules]

Detects malicious RDP files

View Source

Detection Logic

uint16be(0) == 0xFFFE and
        all of them and filesize < 20KB

Field Validations

Loading…

Comments (0)

Loading comments...