15 lines
398 B
Text
15 lines
398 B
Text
|
rule FE_PCAPs
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
author = "@patrickrolsen"
|
||
|
|
maltype = "N/A"
|
||
|
|
version = "0.1"
|
||
|
|
description = "Find FireEye PCAPs uploaded to Virus Total"
|
||
|
|
date = "12/30/2013"
|
||
|
|
strings:
|
||
|
|
$magic = {D4 C3 B2 A1}
|
||
|
|
$ip1 = {0A 00 00 ?? C7 10 C7 ??} // "10.0.0.?? -> 199.16.199.??
|
||
|
|
$ip2 = {C7 10 C7 ?? 0A 00 00 ??} // "199.16.199.?? -> 10.0.0.??"
|
||
|
|
condition:
|
||
|
|
$magic at 0 and all of ($ip*)
|
||
|
|
}
|