Sneed-Reactivity/yara-mikesxrs/Nick Hoffman/Check_VBox_DeviceMap.yar

13 lines
377 B
Text
Raw Normal View History

rule Check_VBox_DeviceMap
{
meta:
Author = "Nick Hoffman"
Description = "Checks Vbox registry keys"
Sample = "de1af0e97e94859d372be7fcf3a5daa5"
strings:
$key = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
$value = "Identifier" nocase wide ascii
$data = "VBOX" nocase wide ascii
condition:
all of them
}