Yara Rule - Windows 테마 파일에서 도메인 또는 IP 배치를 감지
Yara 정의.
Yara Rule - Detects domain or IP placement in Windows theme files
Yara definition.
Author: @m_haggis, @nas_bench
https://github.com/gabe-k/themebleed
date = "2023-09-13"
score = 75
$s1 = /Path=\\\\[0-9a-zA-Z\.-]{1,20}\\/
$s2 = "[VisualStyles]"
$s3 = "[Theme]"```
[https://github.com/Neo23x0/signature-base/commit/543f14f403be51fb241d7365dbdc7c997a8eb70c](https://github.com/Neo23x0/signature-base/commit/543f14f403be51fb241d7365dbdc7c997a8eb70c)