New answers tagged detection
1
Your rule condition will match if at least 3 of the string found, not the count of all the string found. Because Yara doesn't mix the wildcard identifier(*) with counts(#), you can only use regex to simplified the count.
rule countstr
{
strings:
$a1 = /(string1|string2|string3|string4|string5|string6|string7|string8)/
condition:
#a1 &...
1
Maybe it's too late to come up with an answer here. But, I think I should write this to present my approach which might be helpful to the beginners trying to find the catch.
Snort can be configured only as a Network IDS and not Host IDS considering the fact that it's only capable of watching the network traffic and not what happens inside of the HOST.
You ...
0
The assumption behind "rules based" detection of malware is that malware often behave in a certain manner that would be anomalous for clean, legitimate programs. Examples of rules or behavior that may tell a a system is infected by malware are below.
A system process that drops various malware executables (e.g: Dropper)
A system process that reaches out to ...
1
You can dump the memory on your running server and do the analysis using volatility. If this server has not rebooted then you might find something interesting such as command history, strange processes, network connection ... using existing modules. I can not go into details because this is a long story and training skills to do this.
Actually, people in ...
Top 50 recent answers are included
