Common Information
Type | Value |
---|---|
Value |
rule M_Hunting_Win_VPNEngine_PDB_1 { meta: author = "Mandiant" description = "Rule looks for VPN or Proxy PDB." md5 = "2bf422e19e721b461f9e98271fb28ad3" strings: $pdb = /RSDS[\x00-\xFF]{20}[a-zA-Z]:\\[\x00-\xFF]{0,500}(vpn|proxy)[\x00-\xFF]{0,500}\.pdb\x00/ ascii wide nocase condition: filesize < 5MB and uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and $pdb } |
Category | |
Type | Yara Rule |
Misp Type | |
Description |