26 lines
923 B
Text
26 lines
923 B
Text
/*
|
|
Rules generated from APT Report NetTraveler
|
|
http://www.securelist.com/en/blog/8105/NetTraveler_is_Running_Red_Star_APT_Attacks_Compromise_High_Profile_Victims
|
|
*/
|
|
rule APT_Malware_BAT_Contents {
|
|
meta: description = "APT Malware Batch File Contents" threat_level = 10 score = 60
|
|
strings:
|
|
$a1 = ">nul del"
|
|
$a2 = "service.exe"
|
|
$a3 = "service.dll"
|
|
condition: all of them
|
|
}
|
|
rule APT_Malware_NetTraveler_Saker {
|
|
meta: description = "APT Malware NetTraveler Saker" threat_level = 10 score = 50
|
|
strings:
|
|
$a1 = "JustTempFun" fullword
|
|
$a2 = "servicemain" nocase fullword
|
|
condition: all of them
|
|
}
|
|
rule APT_Malware_NetTraveler_Trojan {
|
|
meta: description = "APT Malware NetTraveler Trojan" threat_level = 10 score = 65
|
|
strings:
|
|
$a1 = "Get From IEOption!"
|
|
$a2 = "Get From Reg!"
|
|
condition: all of them
|
|
}
|