Signature Base unknown stable yara

SUSP_LNX_Base64_Exec_Apr24 [yara]

Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)

View Source

Detection Logic

filesize < 800KB
      and 1 of ($s*) 
      and not $mirai
      and not 1 of ($fp*)

Field Validations

Loading…

Comments (0)

Loading comments...