rule Linux_Generic_Threat_80dd1c5b {
meta:
author = "Elastic Security"
id = "80dd1c5b-33a0-4689-aee4-c3e1e40b8826"
fingerprint = "bcf593839e8855658f4084f16583f4d5425843b6a170be3b9add94bb54092138"
creation_date = "2025-01-08"
last_modified = "2026-05-22"
threat_name = "Linux.Generic.Threat"
reference_sample = "97632ef95b4bf4bd4c7e7c7f72e530dccc50f52055fa8cea6deeb489bf55bf09"
severity = 50
arch_context = "x86, arm64"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a1 = { D0 4D E2 28 00 0B E5 2C 10 0B E5 34 30 0B E5 BE 22 4B E1 2C 30 1B E5 20 30 0B E5 28 30 1B E5 0C 30 93 E5 1C 30 0B E5 28 30 1B E5 10 30 93 E5 18 30 0B E5 00 30 A0 E3 14 30 0B E5 34 30 1B E5 10 }
condition:
all of them
}