34 lines
957 B
Text
34 lines
957 B
Text
rule LINUX_MEM_RAINBOW_TOOL_RUNTIME
|
|
{
|
|
meta:
|
|
author = "defensive"
|
|
description = "Linux memory: runtime strings indicating rainbow table tool execution"
|
|
severity = "high"
|
|
fix_notes = "FP fix: rimossa $e1='.rt' (troppo breve e generica), condizione ora richiede .rtc o .rti che sono estensioni specifiche dei file rainbow table"
|
|
|
|
strings:
|
|
$s1 = "rtgen" nocase ascii
|
|
$s2 = "rcrack" nocase ascii
|
|
$s3 = "rtsort" nocase ascii
|
|
$s4 = "ophcrack" nocase ascii
|
|
$s5 = "load tables" nocase ascii
|
|
$s6 = "table path" nocase ascii
|
|
$s7 = "chain length" nocase ascii
|
|
$s8 = "chain count" nocase ascii
|
|
$s9 = "reduction" nocase ascii
|
|
|
|
$h1 = "NTLM" ascii
|
|
$h2 = "LM" ascii
|
|
$h3 = "MD5" ascii
|
|
$h4 = "SHA1" ascii
|
|
$h5 = "SHA-1" ascii
|
|
|
|
$e2 = ".rtc" ascii
|
|
$e3 = ".rti" ascii
|
|
|
|
condition:
|
|
(1 of ($s1,$s2,$s3,$s4)) and
|
|
(2 of ($s5,$s6,$s7,$s8,$s9)) and
|
|
(1 of ($h*)) and
|
|
(1 of ($e2,$e3))
|
|
}
|