16 lines
481 B
Text
16 lines
481 B
Text
|
rule AURIGA_driver_APT1 {
|
||
|
|
meta:
|
||
|
|
author = "AlienVault Labs"
|
||
|
|
info = "CommentCrew-threat-apt1"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$s1 = "Services\\riodrv32" wide ascii
|
||
|
|
$s2 = "riodrv32.sys" wide ascii
|
||
|
|
$s3 = "svchost.exe" wide ascii
|
||
|
|
$s4 = "wuauserv.dll" wide ascii
|
||
|
|
$s5 = "arp.exe" wide ascii
|
||
|
|
$pdb = "projects\\auriga" wide ascii
|
||
|
|
|
||
|
|
condition:
|
||
|
|
all of ($s*) or $pdb
|
||
|
|
}
|