timb-machine · October 20, 2021 06:34
diff --git a/pscan_or_luckscan.yara b/pscan_or_luckscan.yara
 rule pscan_or_luckscan {
  meta:
    author = "Tim Brown @timb_machine"
    description = "Hunts for references to pscan_or_luckscan"
  strings:
    $getopt = "%s <a-block> <port> [b-block] [c-block]"
    $vulnerable = "Lets try to root the %s"
  condition:
    $getopt or $vulnerable
 }
	rule pscan_or_luckscan {
	meta:
	author = "Tim Brown @timb_machine"
	description = "Hunts for references to pscan_or_luckscan"
	strings:
	$getopt = "%s <a-block> <port> [b-block] [c-block]"
	$vulnerable = "Lets try to root the %s"
	condition:
	$getopt or $vulnerable
	}