Signature Base unknown stable yara

SUSP_APT_3CX_Regtrans_Anomaly_Apr23 [yara]

Detects suspicious .regtrans-ms files with suspicious size or contents

Detection Logic

extension == ".regtrans-ms" and (
         filesize < 100KB
         and not 1 of ($fp*)
      )

Loading…

Loading comments...