hatman_mftmsr

private rule hatman_mftmsr : hatman {
    meta:
        id = "56b400d4-2989-5c34-9e8a-0a14b0bf0af1"
    strings:
        $mfmsr_be   = { 7c 63 00 a6 }
        $mfmsr_le   = { a6 00 63 7c }
        $mtmsr_be   = { 7c 63 01 24 }
        $mtmsr_le   = { 24 01 63 7c }
    condition:
        ($mfmsr_be and $mtmsr_be) or ($mfmsr_le and $mtmsr_le)
}