Skip to content

Instantly share code, notes, and snippets.

@meeehow

meeehow/rules.yar

Created October 31, 2022 11:32
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save meeehow/cf57f10c31ce701b54fa9f51a813f6c7 to your computer and use it in GitHub Desktop.
Save meeehow/cf57f10c31ce701b54fa9f51a813f6c7 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
rules.yar
rule executables_ELF
{
strings:
$a = { 7F 45 4C 46 }
condition:
$a at 0
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment