We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent 8568556 commit eb79c3eCopy full SHA for eb79c3e
blog/mozin-about/mozi-obfuscation-technique.yara
@@ -1,14 +1,14 @@
1
rule MoziObfuscationTechnique
2
{
3
- meta:
4
- author = "Elastic Security, Lars Wallenborn (@larsborn)"
5
- description = "Detects obfuscation technique used by Mozi botnet."
+ meta:
+ author = "Elastic Security, Lars Wallenborn (@larsborn)"
+ description = "Detects obfuscation technique used by Mozi botnet."
6
strings:
7
- $a = { 55 50 58 21
8
- [4]
9
- 00 00 00 00
10
11
- 00 00 00 00 }
+ $a = { 55 50 58 21
+ [4]
+ 00 00 00 00
+ 00 00 00 00 }
12
condition:
13
- all of them
+ all of them
14
}
0 commit comments