20 lines
590 B
Text
20 lines
590 B
Text
|
|
||
|
|
rule ce_enfal_cmstar_debug_msg {
|
||
|
|
meta:
|
||
|
|
author = "rfalcone"
|
||
|
|
description = "Detects the static debug strings within CMSTAR"
|
||
|
|
reference = "http://goo.gl/JucrP9"
|
||
|
|
hash = "9b9cc7e2a2481b0472721e6b87f1eba4faf2d419d1e2c115a91ab7e7e6fc7f7c"
|
||
|
|
date = "5/10/2015"
|
||
|
|
id = "2c483f20-4fa8-5246-9dcb-8868db64b6e3"
|
||
|
|
strings:
|
||
|
|
$d1 = "EEE\x0d\x0a" fullword
|
||
|
|
$d2 = "TKE\x0d\x0a" fullword
|
||
|
|
$d3 = "VPE\x0d\x0a" fullword
|
||
|
|
$d4 = "VPS\x0d\x0a" fullword
|
||
|
|
$d5 = "WFSE\x0d\x0a" fullword
|
||
|
|
$d6 = "WFSS\x0d\x0a" fullword
|
||
|
|
$d7 = "CM**\x0d\x0a" fullword
|
||
|
|
condition:
|
||
|
|
uint16(0) == 0x5a4d and all of ($d*)
|
||
|
|
}
|