Signature Base unknown stable yara

VULN_LNX_OMI_RCE_CVE_2021_386471_Sep21 [yara]

Detects a Linux OMI version vulnerable to CVE-2021-38647 (OMIGOD) which enables an unauthenticated RCE

View Source

Detection Logic

uint32be(0) == 0x7f454c46
      and $a1
      and 1 of ($s*)

Field Validations

Loading…

Comments (0)

Loading comments...