Signature Base unknown stable yara

SUSP_MacOS_Plist_Suspicious [yara]

Suspicious PLIST files in MacOS (possible malware persistence)

View Source

Detection Logic

filesize < 20KB
      and uint32be(0) == 0x3c3f786d
      and all of ($sr*)
      and @sr2[1] < 0x100
      and ( 
        1 of ($v*) 
        or all of ($p*) 
      )
      and not 1 of ($fp*)

Field Validations

Loading…

Comments (0)

Loading comments...