12 lines
211 B
Text
12 lines
211 B
Text
|
rule tarsip_eclipse : apt
|
||
|
|
{
|
||
|
|
strings:
|
||
|
|
$a = "Eclipse"
|
||
|
|
$b = "PIGG"
|
||
|
|
$c = "WAKPDT"
|
||
|
|
$d = "show.asp?"
|
||
|
|
$e = "flink?"
|
||
|
|
condition:
|
||
|
|
filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
|
||
|
|
}
|