win_sliver_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com · GPL-2.0

autogenerated rule brought to you by yara-signator

rule win_sliver_auto {
  meta:
    author             = "Felix Bilstein - yara-signator at cocacoding dot com"
    date               = "2020-10-14"
    version            = "1"
    description        = "autogenerated rule brought to you by yara-signator"
    tool               = "yara-signator v0.5.0"
    signator_config    = "callsandjumps;datarefs;binvalue"
    malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sliver"
    malpedia_rule_date = "20201014"
    malpedia_hash      = "a7e3bd57eaf12bf3ea29a863c041091ba3af9ac9"
    malpedia_version   = "20201014"
    malpedia_license   = "CC BY-SA 4.0"
    malpedia_sharing   = "TLP:WHITE"
  

  strings:
    $sequence_0 = { c3 48 8d 3d 59 91 79 00 48 89 c8 e8 ?? ?? ?? ?? eb e5 e8 ?? ?? ?? ?? eb 80 }
                                    $sequence_1 = { eb d5 31 c0 eb d1 31 c0 eb cd 75 0e 48 83 bc 24 90 01 00 00 01 }
                                    $sequence_2 = { 74 04 48 8b 40 08 0f 57 c0 0f 11 84 24 88 00 00 00 48 89 84 24 88 00 00 00 48 8b 44 24 58 48 89 84 24 90 00 00 00 }
                                    $sequence_3 = { eb 8f 48 8b 4c 24 50 48 8b 54 24 48 e9 ?? ?? ?? ?? 0f b6 73 10 48 8d 3d db 9c 77 00 0f b6 34 3e }
                                    $sequence_4 = { eb d4 48 89 44 24 10 90 48 8d 05 bf 55 3e 00 48 89 04 24 e8 ?? ?? ?? ?? 48 8b 7c 24 08 }
                                    $sequence_5 = { eb ea 90 b8 01 00 00 00 48 8d 0d 17 94 86 00 87 01 48 8b 05 ?? ?? ?? ?? 48 89 04 24 }
                                    $sequence_6 = { eb ae 48 89 4c 24 58 48 89 5c 24 48 48 89 44 24 40 48 8d 05 0b 97 23 00 48 89 04 24 4c 89 44 24 08 }
                                    $sequence_7 = { eb d1 90 48 8d 05 f9 14 0d 00 48 89 04 24 e8 ?? ?? ?? ?? 48 8b 7c 24 08 48 c7 47 08 4a 00 00 00 }
                                    $sequence_8 = { eb 94 48 83 f8 0c 75 0d 48 8b 8c 24 68 01 00 00 48 8b 01 eb 81 90 }
                                    $sequence_9 = { e9 ?? ?? ?? ?? 65 48 8b 0c 25 28 00 00 00 48 8b 89 00 00 00 00 48 3b 61 10 0f 86 ca 00 00 00 48 83 ec 50 48 89 6c 24 48 }
                
  condition:
    7 of them and filesize < 18211840
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c7253079-01f6-4372-ba73-2c2bdea0c4e5

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion