Linux_Generic_Threat_c19ca8e5

rule Linux_Generic_Threat_c19ca8e5 {
    meta:
        author = "Elastic Security"
        id = "c19ca8e5-eed0-4c92-abb3-2ff800e68c99"
        fingerprint = "1fb27f4b77439494bda58a2d805208f1953ea03aead4aafd04513cf76f490d45"
        creation_date = "2025-01-08"
        last_modified = "2026-05-22"
        threat_name = "Linux.Generic.Threat"
        reference_sample = "e2c06dfd108cd48e6f3a9bd18c0812fa3e7b03fc422a4756a281aeb410116c5d"
        severity = 50
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "linux"
    strings:
        $a1 = { D0 4D E2 01 60 A0 E1 01 30 D5 E4 09 00 53 E3 20 00 53 13 03 40 A0 E1 FA FF FF 0A 0A 00 53 E3 F8 FF FF 0A 2D 00 53 E3 39 00 00 0A 2B 00 53 E3 01 40 D5 04 02 71 E0 E3 00 A0 A0 E3 07 00 A0 E1 06 }
    condition:
        all of them
}