All_Seeing_Eye_UDP_packets_decoding_encoding_algorithm__32_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule All_Seeing_Eye_UDP_packets_decoding_encoding_algorithm__32_big_1024_ (No description metadata provided).

rule All_Seeing_Eye_UDP_packets_decoding_encoding_algorithm__32_big_1024_ {
  strings:
    $a0 = { 0f f9 71 74 1f 9b d4 68 37 84 99 69 4e 89 ae 73 61 2b f4 20 67 d7 9c 63 6d 77 65 6f 74 5a db 64 7b ea 33 65 83 4c e6 20 89 79 50 69 8f 45 bf 73 96 a8 72 20 9e c2 2f 73 a6 3f ab 74 ac 51 4d 6f b2 67 65 6c b8 41 39 65 bf e2 6c 6e c7 97 b6 20 cc 6a 22 66 cf 2f fb 72 d1 fa 4c 6f d5 eb 43 6d d9 e9 a0 20 dc 48 ca 54 dc b1 b4 68 dd 11 b1 65 dd 7c d6 20 de 4c 6f 41 de d4 9a 6c df 15 56 6c df 5a 89 2d df c1 37 53 e0 18 46 65 e0 52 50 65 e0 7c b9 69 e0 9e 35 6e e0 d3 c8 67 e1 16 bf 20 e1 41 29 45 e1 60 69 79 e1 7b 33 65 e1 a5 9c 20 e1 d8 f4 28 e2 0c 4b 63 e2 36 b4 29 e2 53 b9 20 e2 6e 83 55 e2 aa c8 44 e2 c7 cd 50 e2 f6 ad 20 e3 11 77 53 e3 2e 7c 6f e3 52 33 66 e3 7c 9c 74 e3 9e 18 20 e3 d5 e6 4c e3 f7 62 54 e4 14 67 44 e4 2c f5 2e e4 4e 71 20 e4 6d b1 68 e4 9a 56 74 e4 c2 84 74 e4 df 89 70 e5 01 05 3a e5 19 93 2f e5 34 5c 2f e5 63 3c 77 e5 96 94 77 e5 b1 5d 77 e5 d0 9e 2e e5 eb 67 75 e6 06 30 64 e6 27 ac 70 e6 4d 9f 73 e6 6f 1b 6f e6 85 6d 66 e6 9d fb 74 e6 b8 c4 2e e6 d5 c9 63 e6 ec 1c 6f e7 06 e5 6d e7 1d 38 31 e7 3c 78 80 e7 59 7d 5b e7 6f cf dd e7 9c 74 df e7 b5 02 d4 e7 d4 43 23 e7 ea 95 a4 e8 0c 11 66 e8 24 9f 5b e8 41 a4 36 e8 69 d2 52 e8 80 24 d4 e8 98 b2 c8 e8 b1 40 bd e8 db aa 4c e8 f4 38 41 e9 0a 8a c2 e9 20 dd 44 e9 44 94 79 e9 5a e6 fa e9 77 eb d6 e9 97 2c 24 e9 ad 7e a6 e9 c8 48 0e e9 e5 4c e9 e9 fb 9f 6a ea 14 2d 5f ea 2c bb 54 ea 47 84 bc ea 5d d7 3d ea 74 29 be ea 93 6a 0d ea a9 bc 8f ea c2 4a 83 ea d8 9d 05 ea ee ef 86 eb 05 42 07 eb 1b 94 89 eb 31 e7 0a eb 55 9e 3f eb 6b f0 c1 eb 82 43 42 eb 98 95 c3 eb b5 9a 9f eb cb ed 20 eb e2 3f a1 ec 05 f6 d7 ec 1e 84 cb ec 34 d7 4d ec 4b 29 ce ec 63 b7 c3 ec 7a 0a 44 ec 90 5c c5 ec a6 af 47 ec bd 01 c8 ec d3 54 4a ec e9 a6 cb ec ff f9 4c ed 16 4b ce ed 33 50 a9 ed 49 a3 2a ed 62 31 1f ed 78 83 a0 ed 8e d6 22 ed a5 28 a3 ed bb 7b 24 ed d1 cd a6 ed e8 20 27 ed fe 72 a8 ee 14 c5 2a ee 2b 17 ab ee 41 6a 2c ee 57 bc ae ee 6e 0f 2f ee 84 61 b0 ee 9a b4 32 ee b1 06 b3 ee c7 59 34 ee dd ab b6 ee f3 fe 37 ef 0a 50 b9 ef 20 a3 3a ef 36 f5 bb ef 4d 48 3d ef 63 9a be ef 79 ed 3f ef 90 3f c1 ef a6 92 42 ef bc e4 c3 ef d3 37 45 ef e9 89 c6 ef ff dc 47 f0 16 2e c9 f0 2c 81 4a f0 42 d3 cb f0 59 26 4d f0 6f 78 ce f0 88 06 c3 f0 9e 59 44 f0 b4 ab c5 f0 ca fe 47 f0 e1 50 c8 f0 f7 a3 4a f1 0d f5 cb f1 24 48 4c f1 3a 9a ce f1 50 ed 4f f1 67 3f d0 f1 7d 92 52 f1 98 5b ba f1 ae ae 3b f1 c5 00 bc f1 db 53 3e f1 f1 a5 bf f2 07 f8 40 f2 1e 4a c2 f2 34 9d 43 f2 4a ef c4 f2 61 42 46 f2 77 94 c7 f2 8d e7 48 f2 a4 39 ca f2 ba 8c 4b f2 d0 de cc f2 e7 31 4e f2 fd 83 cf f3 13 d6 50 f3 2a 28 d2 f3 40 7b 53 f3 59 09 48 f3 71 97 3d f3 87 e9 be f3 9e 3c 3f f3 b4 8e c1 f3 cd 1c b5 f3 e3 6f 37 f3 f9 c1 b8 f4 10 14 39 f4 26 66 bb f4 3c b9 3c f4 53 0b bd f4 69 5e 3f f4 7f b0 c0 f4 96 03 41 f4 ac 55 c3 f4 c2 a8 44 f4 d8 fa c5 f4 ef 4d 47 f5 05 9f c8 f5 1b f2 49 f5 32 44 cb f5 48 97 4c f5 5e e9 ce f5 75 3c 4f f5 8b 8e d0 f5 a1 e1 52 f5 b8 33 d3 f5 ce 86 54 f5 e4 d8 d6 f5 fb 2b 57 f6 11 7d d8 f6 27 d0 5a f6 3e 22 db f6 54 75 5c f6 6a c7 de f6 81 1a 5f f6 97 6c e0 f6 ad bf 62 f6 c4 11 e3 f6 da 64 64 ff ff ff ff }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

ce952207-6c16-4386-9bf9-ca50f87c0dd6

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion