14 lines
411 B
Text
14 lines
411 B
Text
rule APT1_WEBC2_DIV
|
|
{
|
|
meta:
|
|
author = "AlienVault Labs"
|
|
info = "CommentCrew-threat-apt1"
|
|
|
|
strings:
|
|
$1 = "3DC76854-C328-43D7-9E07-24BF894F8EF5" wide ascii
|
|
$2 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide ascii
|
|
$3 = "Hello from MFC!" wide ascii
|
|
$4 = "Microsoft Internet Explorer" wide ascii
|
|
condition:
|
|
3 of them
|
|
}
|