Skip to content

Instantly share code, notes, and snippets.

@idiom

idiom/cve_2017_8759.yar

Created September 12, 2017 23:48
Show Gist options
  • Save idiom/002694dd385e193e690693c415fb3a24 to your computer and use it in GitHub Desktop.
Save idiom/002694dd385e193e690693c415fb3a24 to your computer and use it in GitHub Desktop.
Download ZIP
Quick Rule for CVE-2017-8759
Raw
cve_2017_8759.yar
rule cve_2017_8759{
meta:
sample = "0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684"
strings:
$header = "{\\rt"
$wsdl = "7700730064006C003D006800740074007000"
condition:
$header in (0..50) and $wsdl
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment