17 lines
No EOL
581 B
Text
17 lines
No EOL
581 B
Text
rule APT1_WEBC2_CLOVER
|
|
{
|
|
meta:
|
|
author = "AlienVault Labs"
|
|
info = "CommentCrew-threat-apt1"
|
|
|
|
strings:
|
|
$msg1 = "BUILD ERROR!" wide ascii
|
|
$msg2 = "SUCCESS!" wide ascii
|
|
$msg3 = "wild scan" wide ascii
|
|
$msg4 = "Code too clever" wide ascii
|
|
$msg5 = "insufficient lookahead" wide ascii
|
|
$ua1 = "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT 5.1; SV1)" wide ascii
|
|
$ua2 = "Mozilla/5.0 (Windows; Windows NT 5.1; en-US; rv:1.8.0.12) Firefox/1.5.0.12" wide ascii
|
|
condition:
|
|
2 of ($msg*) and 1 of ($ua*)
|
|
} |