17 lines
600 B
Text
17 lines
600 B
Text
|
rule pony {
|
||
|
|
meta:
|
||
|
|
author = "Brian Wallace @botnet_hunter"
|
||
|
|
author_email = "bwall@ballastsecurity.net"
|
||
|
|
date = "2014-08-16"
|
||
|
|
description = "Identify Pony"
|
||
|
|
strings:
|
||
|
|
$s1 = "{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}"
|
||
|
|
$s2 = "YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0"
|
||
|
|
$s3 = "POST %s HTTP/1.0"
|
||
|
|
$s4 = "Accept-Encoding: identity, *;q=0"
|
||
|
|
|
||
|
|
//$useragent1 = "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)"
|
||
|
|
//$useragent2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0)"
|
||
|
|
condition:
|
||
|
|
$s1 and $s2 and $s3 and $s4
|
||
|
|
}
|