Methodology_LNK_Github

rule methodology_lnk_with_github
{
meta:
author = "smiller"
version = "1.0"
date = "4/5/2018"
description = "Generic LNK files or docs with LNK and also Github domains, as possible download URL"
reference_hash = "dbd6c4cb1f9b090aec34723000a602af"
strings:
$a01 = "github.com" nocase ascii wide
$a02 = "githubusercontent.com" nocase ascii wide 
$header = { 4C 00 00 00 01 14 02 }
        condition:
    (($header at 0) or ((uint32(0) == 0xE011CFD0) and $header)) and (1 of ($a*))
}