Linux_Generic_Threat_0ea505fa

rule Linux_Generic_Threat_0ea505fa {
    meta:
        author = "Elastic Security"
        id = "0ea505fa-53d3-4c3a-9d24-ef6d9c371aa0"
        fingerprint = "c986e6284bda5cb30b9b3aba141cee27b735e4831d0b9384daeb4bf542d5ded1"
        creation_date = "2025-01-08"
        last_modified = "2026-05-22"
        threat_name = "Linux.Generic.Threat"
        reference_sample = "2bf1a80e2aab544c3c9df7b36bc9df18371091019804602ded43a0b795d082cb"
        severity = 50
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "linux"
    strings:
        $a1 = { D0 4D E2 00 30 E0 E3 02 00 00 EB 04 D0 8D E2 04 E0 9D E4 1E FF 2F E1 F0 41 2D E9 00 C0 D1 E5 1C 84 9F E5 72 00 5C E3 08 80 8F E0 10 D0 4D E2 00 70 A0 E1 02 50 A0 E1 03 60 A0 E1 12 00 00 0A 77 }
    condition:
        all of them
}