ico injections

Hestat · May 18, 2018 · 9a8bb36 · 9a8bb36
1 parent ac42f7d
commit 9a8bb36
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/includes/ico-injection.yar b/includes/ico-injection.yar
@@ -0,0 +1,17 @@
+rule ico_injection_detected
+{
+
+    meta:
+       author = "Brian Laskowski"
+       info = " general ico injection 05/18/18 "
+
+    strings:
+    
+	$s1="<?php"
+	$s2="@include"
+	$s3="ic\x6f"
+
+    condition:
+    all of them
+}
+
diff --git a/lw-rules_index.yar b/lw-rules_index.yar
@@ -23,3 +23,4 @@ include "./includes/alfa-shell.yar"
 include "./includes/php-gen-2.yar"
 include "./includes/alfa-perl.yar"
 include "./includes/me0w-js-miner.yar"
+include "./includes/ico-injection.yar"