14 lines
491 B
Text
14 lines
491 B
Text
|
rule SAFFRON_ROSE_PDB_PATH
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
Author = "@X0RC1SM"
|
||
|
|
Description = "Looking for unique pdb path"
|
||
|
|
Reference = "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-operation-saffron-rose.pdf"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$PDB1 = "d:\\svn\\Stealer\\source\\Stealer\\Stealer\\obj\\x86\\Release\\Stealer.pdb"
|
||
|
|
$PDB2 = "f:\\Projects\\C#\\Stealer\\source\\Stealer\\Stealer\\obj\\x86\\Release\\Stealer.pdb"
|
||
|
|
condition:
|
||
|
|
any of them
|
||
|
|
}
|