14 lines
No EOL
446 B
Text
14 lines
No EOL
446 B
Text
rule LIGHTDART_APT1 {
|
|
meta:
|
|
author = "AlienVault Labs"
|
|
info = "CommentCrew-threat-apt1"
|
|
|
|
strings:
|
|
$s1 = "ret.log" wide ascii
|
|
$s2 = "Microsoft Internet Explorer 6.0" wide ascii
|
|
$s3 = "szURL Fail" wide ascii
|
|
$s4 = "szURL Successfully" wide ascii
|
|
$s5 = "%s&sdate=%04ld-%02ld-%02ld" wide ascii
|
|
condition:
|
|
all of them
|
|
} |