CN GUI Scanner Tool Yara Rule
rule CN_GUI_Scanner {
meta:
description = "Detects an unknown GUI scanner tool - CN background"
author = "Florian Roth"
hash = "3c67bbb1911cdaef5e675c56145e1112"
score = 65
date = "04.10.2014"
strings:
$s1 = "good.txt" fullword ascii
$s2 = "IP.txt" fullword ascii
$s3 = "xiaoyuer" fullword ascii
$s0w = "ssh(" fullword wide
$s1w = ").exe" fullword wide
condition:
all of them
}
Comments
0 B
|👍
/👎