Signature Base unknown stable yara

EXPL_HKTL_macOS_Switcharoo_CVE_2022_46689_Dec22 [yara]

Detects POCs that exploit privilege escalation vulnerability CVE-2022-46689 on macOS

View Source

Detection Logic

( filesize < 400KB and 1 of ($x*) ) or
      (
         ( uint16(0) == 0xfacf or ( uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca ) ) and 
         filesize < 400KB and
         2 of them
      )

Field Validations

Loading…

Comments (0)

Loading comments...