Signature Base unknown stable yara

SUSP_Email_Suspicious_OneNote_Attachment_Jan23_2 [yara]

Detects suspicious OneNote attachment that has a file name often used in phishing attacks

View Source

Detection Logic

filesize < 5MB 
      and $hc1 
      and 1 of ($x*)

Field Validations

Loading…

Comments (0)

Loading comments...