Signature Base unknown stable yara

ALFA_SHELL [yara]

Detects web shell often used by Iranian APT groups

View Source

Detection Logic

( filesize < 900KB and 2 of ($x*) or $f1 at (filesize-22) )

Field Validations

Loading…

Comments (0)

Loading comments...