hatman_nullsub

private rule hatman_nullsub : hatman {
    meta:
        id = "feaf2242-1db8-5a30-a420-d826b9038266"
    strings:
        $nullsub     = { ff ff 60 38  02 00 00 44  20 00 80 4e }
    condition:
        $nullsub
}