16 lines
537 B
Text
16 lines
537 B
Text
rule Linux_Ransomware_Behavior_Minimal
|
|
{
|
|
meta:
|
|
description = "Ransomware behavior: cifratura iterativa minimi FP"
|
|
author = "BastionGuard"
|
|
|
|
strings:
|
|
$loop1 = { E8 ?? ?? ?? ?? 48 8B 55 ?? 48 8B 4D ?? 48 8B 45 ?? } // crypto loop
|
|
$aes1 = { 66 0F 38 DB } // AES-NI encrypt
|
|
$rsa1 = { 30 82 ?? ?? 02 01 00 } // header RSA embedded
|
|
|
|
condition:
|
|
uint32(0) == 0x7f454c46 and
|
|
any of ($loop1, $aes1, $rsa1)
|
|
}
|
|
|