Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
rule hunt_great_cannon {
strings:
$ = "requesttime_list" nocase wide ascii
$ = "responsetime_list" nocase wide ascii
$ = "cloudflare_js_validate_url" nocase wide ascii
$ = "116.255.226.154" nocase wide ascii
$ = "responsetime-requesttime>TIMEGAP" nocase wide ascii
condition:
any of them
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment