SUSP_ELF_SPARC_Hunting_SBZ_UniqueStrings

rule SUSP_ELF_SPARC_Hunting_SBZ_UniqueStrings {
   meta:
      description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
      author = "netadr, modified by Florian Roth for performance reasons"
      reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
      date = "2023-04-02"
      modified = "2023-05-08"
      score = 60

      id = "d2f70d10-412e-5e83-ba4f-eac251012dc1"
   strings:
      $s1 = "<%u>[%s] Event #%u: "
      /* $s2 = "ofn" */
      $s2 = "lprc:%08X" ascii fullword

      // suggested by https://twitter.com/adulau/status/1553401532514766848
      $s3 = "diuXxobB" 
      $s4 = "CHM_FW"

   condition:
      2 of ($*)
}