YARA · SecuInfra Falcon Team
SECUINFRA_SUSP_Netsh_Firewall_Command
No description has been set in the source file - SecuInfra
- Author
- SECUINFRA Falcon Team
- Date
- 2022-02-27
- Score / Quality
- 65 / 70
What this rule detects
No description has been set in the source file - SecuInfra
Targets: Windows PE.
It defines 2 patterns (2 text, 0 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from SecuInfra Falcon Team, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
References
Licence & attribution
Author: SECUINFRA Falcon Team
Source repository: SecuInfra Falcon Team @ 2d7c66d7d1
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: c62cbe3f-9585-56c0-bb09-83a36437abda
Related rules
- SECUINFRA_SUSP_Discord_Attachments_URLMetadata onlySuspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19
- SECUINFRA_OBFUS_Powershell_ExecutionMetadata onlySuspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
- SECUINFRA_OBFUS_Powershell_Replace_TildeMetadata onlySuspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-10-02
- SECUINFRA_OBFUS_VBS_Reverse_StartupMetadata onlySuspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
- SECUINFRA_SUSP_LNK_Staging_DirectoryMetadata onlySuspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
- SECUINFRA_SUSP_Powershell_Download_Temp_RundllMetadata onlySuspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
- SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Metadata onlySuspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
- SECUINFRA_SUSP_Reverse_Run_KeyMetadata onlySuspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27