08e8d462fe
RED PILL 🔴 💊
14 lines
No EOL
333 B
Text
14 lines
No EOL
333 B
Text
rule Proxy_Tool
|
|
|
|
{
|
|
meta:
|
|
author = "US CERT"
|
|
reference = "https://www.us-cert.gov/ncas/alerts/TA14-353A"
|
|
|
|
strings:
|
|
$STR1 = "pmsconfig.msi" wide
|
|
$STR2 = "pmslog.msi" wide
|
|
|
|
condition:
|
|
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and any of them
|
|
} |