16 lines
443 B
Text
16 lines
443 B
Text
|
rule APT1_WEBC2_UGX
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
author = "AlienVault Labs"
|
||
|
|
info = "CommentCrew-threat-apt1"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$persis = "SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN" wide ascii
|
||
|
|
$exe = "DefWatch.exe" wide ascii
|
||
|
|
$html = "index1.html" wide ascii
|
||
|
|
$cmd1 = "!@#tiuq#@!" wide ascii
|
||
|
|
$cmd2 = "!@#dmc#@!" wide ascii
|
||
|
|
$cmd3 = "!@#troppusnu#@!" wide ascii
|
||
|
|
condition:
|
||
|
|
3 of them
|
||
|
|
}
|