37 lines
1.1 KiB
Text
37 lines
1.1 KiB
Text
rule LINUX_POSSIBLE_RAINBOW_TABLE_ARCHIVE
|
|
{
|
|
meta:
|
|
author = "defensive"
|
|
description = "Linux: archive/container likely related to rainbow tables (heuristic)"
|
|
severity = "medium"
|
|
fix_notes = "FP fix: 'reduction' sostituito con 'reduction function' (piu' specifico); LM e NTLM ora fullword per evitare match in parole come 'algorithm'"
|
|
|
|
strings:
|
|
$kw1 = "rainbow table" nocase ascii
|
|
$kw2 = "rainbowtable" nocase ascii
|
|
$kw3 = "precomputed" nocase ascii
|
|
$kw4 = "chain length" nocase ascii
|
|
$kw5 = "chain count" nocase ascii
|
|
$kw6 = "reduction function" nocase ascii
|
|
$kw7 = "rtgen" nocase ascii
|
|
$kw8 = "rcrack" nocase ascii
|
|
$kw9 = "ophcrack" nocase ascii
|
|
|
|
$h1 = "LM" fullword ascii
|
|
$h2 = "NTLM" fullword ascii
|
|
$h3 = "MD5" ascii
|
|
$h4 = "SHA1" ascii
|
|
$h5 = "SHA-1" ascii
|
|
$h6 = "SHA256" ascii
|
|
$h7 = "SHA-256" ascii
|
|
|
|
$zip = { 50 4B 03 04 }
|
|
$rar = { 52 61 72 21 1A 07 }
|
|
$7z = { 37 7A BC AF 27 1C }
|
|
|
|
condition:
|
|
(any of ($zip,$rar,$7z)) and
|
|
(2 of ($kw*)) and
|
|
(1 of ($h*)) and
|
|
filesize > 1MB
|
|
}
|