11 lines
234 B
Text
11 lines
234 B
Text
rule calendar : apt
|
|
{
|
|
strings:
|
|
$a = "DownRun success"
|
|
$b = "GoogleLogin auth="
|
|
$c = "%s@gmail.com"
|
|
$d = "log command"
|
|
$e = "%s: %s"
|
|
condition:
|
|
filesize < 300KB and (5 of ($a,$b,$c,$d,$e))
|
|
}
|