Signature Base unknown stable yara

SUSP_Email_Suspicious_OneNote_Attachment_Jan23_1 [yara]

Detects suspicious OneNote attachment that embeds suspicious payload, e.g. an executable (FPs possible if the PE is attached separately)

View Source

Detection Logic

filesize < 5MB
      and 1 of ($ge*)
      and 1 of ($s*)

Field Validations

Loading…

Comments (0)

Loading comments...