16 lines
422 B
Text
16 lines
422 B
Text
rule Linux_Ransomware_Note_Strict
|
|
{
|
|
meta:
|
|
description = "Ransom note embedded. Zero FP su file non ELF."
|
|
author = "BastionGuard"
|
|
|
|
strings:
|
|
$msg1 = "All your files have been encrypted" wide ascii
|
|
$msg2 = "To recover your files" wide ascii
|
|
$msg3 = "bitcoin" ascii
|
|
|
|
condition:
|
|
uint32(0) == 0x7f454c46 and // NON MATCHA MAI .zsh_history
|
|
any of ($msg*)
|
|
}
|
|
|