24 lines
737 B
Text
24 lines
737 B
Text
rule TrojanChangeStartPageSampleA
|
|
{
|
|
meta:
|
|
Description = "Trojan.CStartPage.sm"
|
|
ThreatLevel = "5"
|
|
|
|
strings:
|
|
$ = "chrome.exe" ascii wide
|
|
$ = "urls_to_restore_on_startup" ascii wide
|
|
$ = "restore_on_startup" ascii wide
|
|
$ = "restore_on_startup_migrated" ascii wide
|
|
$ = "urls_to_restore_on_startup" ascii wide
|
|
$ = "translate_accepted_count" ascii wide
|
|
$ = "translate_denied_count" ascii wide
|
|
$ = "translate_site_blacklist" ascii wide
|
|
$ = "netsh firewall add allowedprogram" ascii wide
|
|
$ = "homepage_is_newtabpage" ascii wide
|
|
$ = "Start Page" ascii wide
|
|
$ = "user_pref(%cbrowser.startup.homepage%c" ascii wide
|
|
$ = "%ws\\mozilla\\firefox\\profiles" ascii wide
|
|
$ = "c:\\windows\\sms.exe" ascii wide
|
|
condition:
|
|
3 of them
|
|
}
|