Exploit_Win32_Senglot_K

YARA detection rule by roadwy

Exploit:Win32/Senglot.K,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00

rule Exploit_Win32_Senglot_K{
	meta:
		description = "Exploit:Win32/Senglot.K,SIGNATURE_TYPE_PEHSTR_EXT,04 00 04 00 04 00 00 "
		
	strings :
		$a_01_0 = {30 70 00 43 90 90 90 90 90 90 ba 42 41 42 41 81 f2 11 11 11 11 41 39 11 75 fb 8b f1 8b f8 57 33 c9 66 b9 27 01 fc f3 a4 5f ff e7 90 53 50 53 50 90 33 c0 33 c9 eb 12 5e 66 b9 05 01 8b fe 80 2e 05 80 36 03 46 e2 f7 eb 05 e8 e9 ff ff ff ed 5c 8d 7b 44 8d 7c 32 80 05 fb 5a 8d 7a 28 05 fb 35 } 		$a_01_1 = {cf 4f 47 b3 35 dd 3a 11 c2 1c 30 40 f6 7c 10 c7 cd 13 05 de 48 ed f1 3d e1 7b e9 62 8d 62 2c 05 e3 6a 8d 14 4d 8d 62 24 05 e3 8d 0c 8d 05 cb c5 5b 56 54 53 51 52 32 4c 54 54 08 45 3e 64 79 32 6b 80 6b 08 35 c8 6c 05 48 38 80 14 8d 48 14 8d } 		$a_01_2 = {78 24 b3 8d 48 10 ed 0f 8d 48 3c 93 48 84 8d 48 44 9b c1 92 52 12 f4 f0 8c 01 01 01 85 f4 0c 85 34 2c 44 01 d8 9b 58 c1 3a 1e 31 78 f0 71 01 01 01 8d 5c 2c 04 93 56 be 35 dd 55 55 56 ed 2c 55 01 d8 63 c1 a0 02 8e 12 f0 55 01 01 01 85 f4 0c } 		$a_01_3 = {85 34 2c 66 01 d8 c1 82 e0 e6 75 f0 48 01 01 01 56 01 d8 f0 d9 01 01 01 70 7c 7c 78 3e 31 31 79 79 79 32 66 7b 75 6f 72 6b 75 75 69 7b 6f 6c 6b 3c 7b 32 65 71 73 31 6f 6b 38 3a 38 37 32 65 69 6f 41 6b 80 78 74 71 6f 7c 43 53 55 38 3b 33 38 3b 3c 08 00 } 	condition:
		((#a_01_0  & 1)*1+(#a_01_1  & 1)*1+(#a_01_2  & 1)*1+(#a_01_3  & 1)*1) >=4
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

72d33192-08cb-4f49-a1d0-a1b703396cc9

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion