Signature Base unknown stable yara

Recon_Commands_Windows_Gen1 [yara]

Detects a set of reconnaissance commands on Windows systems

View Source

Detection Logic

filesize < 1000KB and 4 of them
      and not 1 of ($fp*)

Field Validations

Loading…

Comments (0)

Loading comments...