Signature Base unknown stable yara

SUSP_ELF_Invalid_Version [yara]

View Source

Detection Logic

(
         uint32(0) == 0x464c457f
         and uint8(0x6) > 1 // ELF Version is greater value than in spec.
      )

Field Validations

Loading…

Comments (0)

Loading comments...