Skip to content

Instantly share code, notes, and snippets.

@itsreallynick
Last active November 19, 2019 18:09
Show Gist options
  • Save itsreallynick/79841d4e9a50e0e0d086801441e88983 to your computer and use it in GitHub Desktop.
Save itsreallynick/79841d4e9a50e0e0d086801441e88983 to your computer and use it in GitHub Desktop.
Making this rule public
rule Hunting_InstallUtil_ProbablePayload
{
meta:
author = "Nick Carr - @itsreallynick"
description = "2019-05-22 - Focusing on the underlying structure that largely cannot change outside of obfuscation"
strings:
$installutil = "System.Configuration.Install" nocase ascii wide
$override_func1 = "public override string HelpText" nocase ascii wide
$override_func2 = "public override void Uninstall" nocase ascii wide
$override_func3 = "public override void Install" nocase ascii wide
condition:
$installutil and any of ($override*) and new_file
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment