Last active
November 19, 2021 21:27
-
-
Save stvemillertime/200295215ef2270323508a2a683554e2 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rule ELF_Methodology_RareEquities_Pcap | |
{ | |
meta: | |
author = "@stvemillertime" | |
description = "This is a wide catchall rule looking for executables with pcap equities. Matches on this rule may have built-in pcap collection, sniffing capability such as in MESSAGETAP, RATSNIF, etc." | |
ref_md5 = "8d3b3d5b68a1d08485773d70c186d877" | |
strings: | |
$a1 = "pcap_" | |
condition: | |
(uint32(0) == 0x464c457f) and int8(0x10) == 0x02 and $a1 | |
} | |
rule PE_Methodology_RareEquities_Pcap | |
{ | |
meta: | |
author = "@stvemillertime" | |
description = "This is a wide catchall rule looking for executables with pcap equities. Matches on this rule may have built-in pcap collection, sniffing capability such as in MESSAGETAP, RATSNIF, etc." | |
ref_md5 = "8d3b3d5b68a1d08485773d70c186d877" | |
strings: | |
$a1 = "pcap_" | |
condition: | |
(uint16(0) == 0x5A4D) and uint32(uint32(0x3C)) == 0x00004550 and $a1 | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment