rule ZeroDay_Generic_Heuristic
{
    meta:
        description = "Regola euristica per rilevamento generico di potenziali Zero-Day"
        author = "BastionGuard"
        date = "2025-10-07"
        level = "high"

    strings:
        $api_suspicious = /VirtualAlloc|WriteProcessMemory|CreateRemoteThread/i
        $packer_strings = /UPX|MPRESS|ASPack|NSPack|Enigma/i
        $powershell_cmd = /powershell(\.exe)?\s+.*-enc/i
        $script_dropper = /cmd\.exe\s+\/c\s+(copy|echo|type).*\.(exe|dll|bat)/i

    condition:
        (uint16(0) == 0x5A4D or filesize < 2MB) and
        (1 of ($api_suspicious*) or 1 of ($packer_strings*) or
         $powershell_cmd or $script_dropper)
}