Signature Base unknown stable yara

SUSP_OneNote_Embedded_FileDataStoreObject_Type_Jan23_2 [yara]

Detects suspicious embedded file types in OneNote files

View Source

Detection Logic

filesize < 5MB
      and $a1 
      and 1 of ($s*)

Field Validations

Loading…

Comments (0)

Loading comments...