Sneed-Reactivity/yara-mikesxrs/alienvault/APT1_WEBC2_ADSPACE.yar

12 lines
251 B
Text
Raw Normal View History

rule APT1_WEBC2_ADSPACE
{
meta:
author = "AlienVault Labs"
info = "CommentCrew-threat-apt1"
strings:
$1 = "<!---HEADER ADSPACE style=" wide ascii
$2 = "ERSVC.DLL" wide ascii
condition:
all of them
}