Signature Base unknown stable yara

WScriptShell_Case_Anomaly [yara]

Detects obfuscated wscript.shell commands

View Source

Detection Logic

filesize < 3000KB and
      #s1 > #sn1 + #sn2 + #sn3 + #sn4 + #sn5

Field Validations

Loading…

Comments (0)

Loading comments...