Yara Rule - 합법적 인 것과는 매우 다른 내용 또는 파일 크기를 가진 amsi.dll을 감지
Yara 정의.
Yara Rule - Detects an amsi.dll that has very different contents or file sizes than the legitimate
Yara definition.
Author: Florian Roth
https://twitter.com/eversinc33/status/1666121784192581633?s
date = "2023-06-07"
score = 65
$a1 = "Microsoft.Antimalware.Scan.Interface" ascii
$a2 = "Amsi.pdb" ascii fullword
$a3 = "api-ms-win-core-sysinfo-" ascii
$a4 = "Software\\Microsoft\\AMSI\\Providers" wide
$fp1 = "Wine builtin DLL"
uint16(0) == 0x5a4d
date = "2023-06-07"
score = 65
$a1 = "Microsoft.Antimalware.Scan.Interface" ascii
$a2 = "Amsi.pdb" ascii fullword
$a3 = "api-ms-win-core-sysinfo-" ascii
$a4 = "Software\\Microsoft\\AMSI\\Providers" wide
uint16(0) == 0x5a4d
and filename == "amsi.dll"```
[https://github.com/Neo23x0/signature-base/commit/201df6bd10b56a4775aa4ced223751919ae6d210](https://github.com/Neo23x0/signature-base/commit/201df6bd10b56a4775aa4ced223751919ae6d210)