mirror of
https://github.com/mandiant/capa-rules.git
synced 2026-10-12 02:18:39 +00:00
@@ -13,6 +13,6 @@ rule:
|
||||
- al-khaser_x86.exe_:0x433490
|
||||
features:
|
||||
- or:
|
||||
- string: /SELECT\s+\*\s+FROM\s+CIM_./
|
||||
- string: /SELECT\s+\*\s+FROM\s+Win32_./
|
||||
- string: /SELECT\s+\*\s+FROM\s+MSAcpi_./
|
||||
- string: /SELECT\s+\*\s+FROM\s+CIM_.+/
|
||||
- string: /SELECT\s+\*\s+FROM\s+Win32_.+/
|
||||
- string: /SELECT\s+\*\s+FROM\s+MSAcpi_.+/
|
||||
|
||||
Reference in New Issue
Block a user