rule Windows_Trojan_RudeBird {
	meta:
		author = "Elastic Security"
		creation_date = "2023-05-09"
		last_modified = "2023-06-13"
		threat_name = "Windows.
Trojan.RudeBird"
		license = "Elastic License v2"
		os = "windows"
	strings:
		$a1 = { 40 53 48 83 EC 20 48 8B D9 B9 D8 00 00 00 E8 FD C1 FF FF 48 8B C8 33 C0 48 85 C9 74 05 E8 3A F2 }
	condition:
		all of them
}