Last active
March 1, 2021 11:14
-
-
Save timb-machine/ee7e0573a999c91d1afe3f9fde45d3fe to your computer and use it in GitHub Desktop.
adonunix2.yara
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| rule adonunix2 { | |
| meta: | |
| author = "Tim Brown @timb_machine" | |
| description = "AD on UNIX" | |
| strings: | |
| $quest = "/quest" | |
| $sss = "/sss" | |
| $pbis = "/pbis" | |
| $ipa = "/ipa" | |
| $samba = "/samba" | |
| $krb5 = "/krb5" | |
| condition: | |
| $quest or $sss or $pbis or $ipa or $samba or $krb5 | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment