Sneed-Reactivity/yara-mikesxrs/malc0de/cookiebag_apt1.yar

11 lines
211 B
Text
Raw Normal View History

rule cookiebag : apt
{
strings:
$a = "?ID="
$b = ".asp"
$c = "clientkey"
$d = "GetCommand"
$e = "Set-Cookie:"
condition:
filesize < 100KB and (5 of ($a,$b,$c,$d,$e))
}