derusbi_kernel

Description

Derusbi Driver version

Query · yara

strings:
        $token1 = "$$$--Hello"
        $token2 = "Wrod--$$$"
        $class = ".?AVPCC_BASEMOD@@"
    condition:
        uint16(0) == 0x5A4D and $token1 and $token2 and $class
Raw source derusbi_kernel · YARA
Esc
Published by Neo23x0/signature-base ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
rule derusbi_kernel
{
    meta:
        description = "Derusbi Driver version"
        date = "2015-12-09"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
        id = "a60ab93a-e2be-53ee-a7da-56c763bc5533"
    strings:
        $token1 = "$$$--Hello"
        $token2 = "Wrod--$$$"
        $class = ".?AVPCC_BASEMOD@@"
    condition:
        uint16(0) == 0x5A4D and $token1 and $token2 and $class
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.