HackInBoSafeEdition/hackibo.yar at master · thesp0nge/HackInBoSafeEdition · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

rule SimpleExecVe
{
    meta:
        sourceOrg = "Giovanni Analista"
        sourcePath = "basi_di_ceh.txt"
    strings:
        $string = {31c050682f2f7368682f62696e89e331c931d2b00bcd80}
    condition:
        $string
}
rule Msfvenom
{
    meta:
        sourceOrg = "Giovanni Analista"
        sourcePath = "basi_di_ceh.txt"
    strings:
        $string = { 6a0b58995266682d6389e7682f736800682f62696e89e352e8080000002f62696e2f736800575389e1cd80 }
    condition:
        $string
}
rule Msfvenom2
{
    meta:
        sourceOrg = "Giovanni Analista"
        sourcePath = "basi_di_ceh.txt"
    strings:
        $string = { bd401fc04edbd3d97424f45f33c9b10b316f1583effc036f11e2b575cb16acd8adcee3bfb8e89310c89e6307013d0ab9d4229eadefa41e2edfc677403074ef9c1929667d684d  }
    condition:
        $string
}

rule Msfvenom3
{
    meta:
        sourceOrg = "Giovanni Analista"
        sourcePath = "basi_di_ceh.txt"
    strings:
        $string = { f33f6a2b  }
    condition:
        $string
}

rule BinSh
{
    meta:
        sourceOrg = "Giovanni Analista"
        sourcePath = "basi_di_ceh.txt"
    strings:
        $string = { 682f2f7368682f62696e}
    condition:
        $string

}
rule Int80
{
    meta:
        sourceOrg = "Giovanni Analista"
        sourcePath = "basi_di_ceh.txt"
    strings:
        $string = { cd80}
    condition:
        $string

}