16 lines
590 B
Plaintext
16 lines
590 B
Plaintext
rule Test_Fixture_Invoice2024 {
|
|
meta:
|
|
description = "Detects the benign PE test fixture built by tests/make_pe.py"
|
|
author = "malware-analysis-skills test harness"
|
|
reference = "tests/make_pe.py"
|
|
note = "Fixture only — not a real malware signature"
|
|
strings:
|
|
$mz = { 4D 5A }
|
|
$c2 = "update-cdn.example.test/gate.php" ascii
|
|
$ua = "TestUA/1.0" ascii
|
|
$mtx = "Global\\TestFixtureMutex_9f2a" ascii
|
|
$tag = "BENIGN TEST FIXTURE" ascii
|
|
condition:
|
|
$mz at 0 and 3 of ($c2, $ua, $mtx, $tag)
|
|
}
|