Linux_Generic_Threat_661c9789

rule Linux_Generic_Threat_661c9789 {
    meta:
        author = "Elastic Security"
        id = "661c9789-2509-4cdc-83b5-0fe7795c19f9"
        fingerprint = "408b14366612e2e765252a0b7b72dffb528f4205dd911b2980393c65e6e04052"
        creation_date = "2025-01-08"
        last_modified = "2026-05-22"
        threat_name = "Linux.Generic.Threat"
        reference_sample = "9beae633892a4072df6c972f02ec50bd75dfa4f266abc768d5b5c6e083a02f43"
        severity = 50
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "linux"
    strings:
        $a1 = { D0 4D E2 18 00 0B E5 1C 10 0B E5 18 30 1B E5 83 31 A0 E1 03 20 A0 E1 3C 30 9F E5 03 30 82 E0 10 30 0B E5 1C 30 1B E5 00 00 53 E3 04 00 00 0A 10 30 1B E5 B4 30 D3 E1 03 20 A0 E1 1C 30 1B E5 00 }
    condition:
        all of them
}