From 5a11fef9d2412158fabfb16f89c5c5d540431a4d Mon Sep 17 00:00:00 2001 From: mmorenog Date: Tue, 29 Mar 2016 13:18:40 +0200 Subject: [PATCH] Update email_Ukraine_BE_powerattack.yar --- email/email_Ukraine_BE_powerattack.yar | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/email/email_Ukraine_BE_powerattack.yar b/email/email_Ukraine_BE_powerattack.yar index 5d74fec9..9fdf21e9 100644 --- a/email/email_Ukraine_BE_powerattack.yar +++ b/email/email_Ukraine_BE_powerattack.yar @@ -3,7 +3,7 @@ long as you use it under this license. */ -rule email_Ukraine_power_attack_content { +rule email_Ukraine_power_attack_content : mail { meta: author = "@mmorenog,@yararules" description = "Detects a possible .eml used in the Ukraine BE power attack" @@ -19,7 +19,7 @@ rule email_Ukraine_power_attack_content { condition: 3 of them } -rule email_Ukraine_power_attack_attachment { +rule email_Ukraine_power_attack_attachment : mail { meta: author = " @yararules" description = "Detects a possible .eml used in the Ukraine BE power attack"