Yara Rule - Windows 테마 파일에서 도메인 또는 IP 배치를 감지
Yara 정의.
Yara Rule - Detects domain or IP placement in Windows theme files
Yara definition.
Author: @m_haggis, @nas_bench
https://github.com/gabe-k/themebleed
date = "2023-09-13"
score = 75
$s1 = /Path=\\\\[0-9a-zA-Z\.-]{1,20}\\/
$s2 = "[VisualStyles]"
$s3 = "[Theme]"```
[https://github.com/Neo23x0/signature-base/commit/d55425fde0f370a3b58fb7d6368fe2e25232e632](https://github.com/Neo23x0/signature-base/commit/d55425fde0f370a3b58fb7d6368fe2e25232e632)