Yara Rule for CVE-2010-1885
Posted: June 11th, 2010 | Author: xanda | Filed under: IT Related | Tags: CVE-2010-1885, jsunpack, Windows Help and Support Center, yara | 3 Comments »rule HelpSupportCenter { meta: ref = "CVE-2010-1885" hide = true impact = 5 strings: $cve20101885 = /hcp:\/\/.*?(%u?[A-F]{1,4}.*?){90}/ condition: all of them } |
abg nan, kalau attacker guna “%B%%B%%B” xdetect lah kan? kui3
@adik nan
nanti aku tambah
@adik nan
ok updated… thanks