Common Information
Type Value
Value
rule M_Hunting_Win_VPNEngine_PDB_1 {
	meta:
		author = "Mandiant"
		description = "Rule looks for VPN or Proxy PDB."
		md5 = "2bf422e19e721b461f9e98271fb28ad3"
	strings:
		$pdb = /RSDS[\x00-\xFF]{20}[a-zA-Z]:\\[\x00-\xFF]{0,500}(vpn|proxy)[\x00-\xFF]{0,500}\.pdb\x00/ ascii wide nocase
	condition:
		filesize < 5MB and uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and $pdb
}
Category
Type Yara Rule
Misp Type
Description
Details Published Attributes CTI Title
Details Website 2022-06-29 106 Burrowing your way into VPNs, Proxies, and Tunnels | Mandiant