Common Information
| Type | Value |
|---|---|
| Value |
rule RShell {
meta:
author = "Snorre Fagerland, NortonLifeLock Inc"
strings:
$ = "Begin gethostbyname"
$ = "End gethostbyname"
$ = "Software\\CLASSES\\KmpiPlayer" wide
$ = "[RS5] WAIT_TIMEOUT"
condition:
all of them
}
|
| Category | |
| Type | Yara Rule |
| Misp Type | |
| Description |