13 lines
423 B
Text
13 lines
423 B
Text
rule NK_GOLDBACKDOOR_generic_shellcode
|
|
{
|
|
meta:
|
|
author= "Silas Cutler (silas@Stairwell.com)"
|
|
description = "Generic detection for shellcode used to drop GOLDBACKDOOR"
|
|
reference = "https://stairwell.com/news/threat-research-the-ink-stained-trail-of-goldbackdoor/"
|
|
version = "0.1"
|
|
strings:
|
|
$ = { B9 8E 8A DD 8D 8B F0 E8 ?? ?? ?? ?? FF D0 }
|
|
$ = { B9 8E AB 6F 40 [1-10] 50 [1-10] E8 ?? ?? ?? ?? FF D0 }
|
|
condition:
|
|
all of them
|
|
}
|