22 lines
790 B
Text
22 lines
790 B
Text
|
rule MANITSME_APT1 {
|
||
|
|
meta:
|
||
|
|
author = "AlienVault Labs"
|
||
|
|
info = "CommentCrew-threat-apt1"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$s1 = "Install an Service hosted by SVCHOST." wide ascii
|
||
|
|
$s2 = "The Dll file that to be released." wide ascii
|
||
|
|
$s3 = "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
|
||
|
|
$s4 = "svchost.exe" wide ascii
|
||
|
|
|
||
|
|
$e1 = "Man,it's me" wide ascii
|
||
|
|
$e2 = "Oh,shit" wide ascii
|
||
|
|
$e3 = "Hallelujah" wide ascii
|
||
|
|
$e4 = "nRet == SOCKET_ERROR" wide ascii
|
||
|
|
|
||
|
|
$pdb1 = "rouji\\release\\Install.pdb" wide ascii
|
||
|
|
$pdb2 = "rouji\\SvcMain.pdb" wide ascii
|
||
|
|
|
||
|
|
condition:
|
||
|
|
(all of ($s*)) or (all of ($e*)) or $pdb1 or $pdb2
|
||
|
|
}
|