Skip to content

Instantly share code, notes, and snippets.

@stvemillertime

stvemillertime/Methodology_ELF_Modbus.yar

Last active April 29, 2019 20:52
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save stvemillertime/60f3d31a0199305588b1caf7d509fc94 to your computer and use it in GitHub Desktop.
Save stvemillertime/60f3d31a0199305588b1caf7d509fc94 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Methodology_ELF_Modbus.yar
rule Methodology_ELF_Modbus
{
meta:
author = "@stvemillertime"
description = "A hilariously simple rule to create a smallllll haystack of ELFs with potential modbus interests, such as the VPNFILTER packet sniffer/logger module."
md5 = "97444b5209278ed611e6a94076e814c8"
strings:
$a1 = "modbus" nocase ascii wide
condition:
uint16(0) == 0x457f and filesize < 3MB and $a1
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment