Signature Base unknown stable yara

PowerShell_Case_Anomaly [yara]

Detects obfuscated PowerShell hacktools

View Source

Detection Logic

filesize < 800KB and (
         // find all 'powershell' occurrences and ignore the expected cases
         ( #s1 > #sn1 + #sn2 + #sn3 + #sn4 + #sn5 + #sn6 + #sn7 ) or
         ( #a1 > #an1 + #an2 ) or
         // find all '-noprofile' occurrences and ignore the expected cases
         ( #k1 > #kn1 + #kn2 + #kn3 + #kn4 + #kn5 )
      ) and not 1 of ($fp*)

Field Validations

Loading…

Comments (0)

Loading comments...