13 lines
376 B
Text
13 lines
376 B
Text
|
rule Check_Qemu_DeviceMap
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
Author = "Nick Hoffman"
|
||
|
|
Description = "Checks for Qemu reg keys"
|
||
|
|
Sample = "de1af0e97e94859d372be7fcf3a5daa5"
|
||
|
|
strings:
|
||
|
|
$key = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
|
||
|
|
$value = "Identifier" nocase wide ascii
|
||
|
|
$data = "QEMU" wide nocase ascii
|
||
|
|
condition:
|
||
|
|
all of them
|
||
|
|
}
|