Common Information
| Type | Value |
|---|---|
| Value |
rule image_bash {
strings:
$imgpng = { 89 50 4E 47 0D 0A }
$imgjpg = { FF D8 FF }
$shell = "!/bin/sh"
condition:
(($shell) and ($imgpng at 0 or $imgjpg at 0))
}
|
| Category | |
| Type | Yara Rule |
| Misp Type | |
| Description |