28 lines
685 B
Text
28 lines
685 B
Text
|
/*
|
||
|
|
Yara Rule Set
|
||
|
|
Author: Florian Roth
|
||
|
|
Date: 2015-05-14
|
||
|
|
Identifier: CVE-2015-1674
|
||
|
|
*/
|
||
|
|
|
||
|
|
/* Rule Set ----------------------------------------------------------------- */
|
||
|
|
|
||
|
|
rule CVE_2015_1674_CNGSYS {
|
||
|
|
meta:
|
||
|
|
description = "Detects exploits for CVE-2015-1674"
|
||
|
|
author = "Florian Roth"
|
||
|
|
reference = "http://www.binvul.com/viewthread.php?tid=508"
|
||
|
|
date = "2015-05-14"
|
||
|
|
hash = "af4eb2a275f6bbc2bfeef656642ede9ce04fad36"
|
||
|
|
strings:
|
||
|
|
$s1 = "\\Device\\CNG" fullword wide
|
||
|
|
|
||
|
|
$s2 = "GetProcAddress" fullword ascii
|
||
|
|
$s3 = "LoadLibrary" ascii
|
||
|
|
$s4 = "KERNEL32.dll" fullword ascii
|
||
|
|
$s5 = "ntdll.dll" fullword ascii
|
||
|
|
condition:
|
||
|
|
uint16(0) == 0x5a4d and filesize < 60KB and all of them
|
||
|
|
}
|
||
|
|
|