YARA · Samir Bousseaden (YaraHunts)
SBOUSSEADEN_Shad0W_Beacon
Shad0w beacon default suspicous strings
- Author
- SBousseaden
- Date
- 2020-06-04
- Modified
- 2020-06-05
- Score / Quality
- 75 / 73
What this rule detects
Shad0w beacon default suspicous strings
Targets: Windows PE.
It defines 3 patterns (2 text, 1 hex, 0 regex). YARA modules used: pe.
YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Samir Bousseaden (YaraHunts), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
References
Licence & attribution
Author: SBousseaden
Source repository: Samir Bousseaden (YaraHunts) @ 71b27a2a7c
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: e725172d-dd07-5027-ac85-86d366881856
Tags:FILE
Related rules
- SBOUSSEADEN_Mimikatz_KiwikeyMetadata onlyHack toolSamir Bousseaden (YaraHunts)· SBousseaden· 2020-08-08
- SBOUSSEADEN_Adsync_Creddump_V64Metadata onlyGenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08
- SBOUSSEADEN_Adsync_Creddump_XorMetadata onlyGenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08
- SBOUSSEADEN_Adsync_Creddump_XwideMetadata onlyGenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08
- SBOUSSEADEN_APT_Solarwind_Backdoor_Encoded_StringsMetadata onlyAPT / threat actorSamir Bousseaden (YaraHunts)· SBousseaden· 2020-12-14
- SBOUSSEADEN_APT_Xdsspy_XduploadMetadata onlyAPT / threat actorSamir Bousseaden (YaraHunts)· SBousseaden· 2020-05-10
- SBOUSSEADEN_Cve_2019_1458Metadata onlyExploitSamir Bousseaden (YaraHunts)· SBousseaden· 2020-10-22
- SBOUSSEADEN_GosliverMetadata onlyGenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-10-11