Yara Rule - 난독 화 된 스크립트에서 발견되는 특성을 감지 (백도어 XZ 패키지에서 사용되지만 다른 사람들과도 일치 할 수 있음)
Yara 정의.
Yara Rule - Detects characteristics found in obfuscated script (used in the backdoored XZ package, but could match on others, too)
Yara definition.
Author: Florian Roth
https://www.openwall.com/lists/oss-security/2024/03/29/4/1
date = "2024-04-06"
score = 60
$s1 = "eval $"
uint8(1) == 0x3d // an equal sign at byte 2 ; means that the variable is only 1 character long```
[https://github.com/Neo23x0/signature-base/commit/68868de978bceab6d383d5eda02eae2124cdcc88](https://github.com/Neo23x0/signature-base/commit/68868de978bceab6d383d5eda02eae2124cdcc88)