15 lines
219 B
Markdown
15 lines
219 B
Markdown
|
|
|
|
```
|
|
rule ShellJSP {
|
|
strings:
|
|
$s1 = "decrypt(fpath)"
|
|
$s2 = "decrypt(fcontext)"
|
|
$s3 = "decrypt(commandEnc)"
|
|
$s4 = "upload failed!"
|
|
$s5 = "aes.encrypt(allStr)"
|
|
$s6 = "newid"
|
|
condition:
|
|
filesize < 50KB and 4 of them
|
|
}
|
|
``` |