Skip to content

Instantly share code, notes, and snippets.

@chrisdoman

chrisdoman/cannon.rule

Created September 2, 2019 17:32
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save chrisdoman/2e82f7207489a648f9cd96bbf3c16cdd to your computer and use it in GitHub Desktop.
Save chrisdoman/2e82f7207489a648f9cd96bbf3c16cdd to your computer and use it in GitHub Desktop.
Download ZIP
Raw
cannon.rule
rule hunt_great_cannon {
strings:
$ = "requesttime_list" nocase wide ascii
$ = "responsetime_list" nocase wide ascii
$ = "cloudflare_js_validate_url" nocase wide ascii
$ = "116.255.226.154" nocase wide ascii
$ = "responsetime-requesttime>TIMEGAP" nocase wide ascii
condition:
any of them
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment