Q&A

rule Multi_String_IOC : threat_hunting high_confidence{ meta: description = "Detects artifacts of a known threat by counting IOC strings." threat_actor = "APT-42" strings: $s1 = "persistence_key_01" ascii $s2 = "network_beacon_host_id" ascii $s3 = { 5A 4C 53 52 45 42 } // Binary marker 'ZL SREB' $s4 = "data_exfiltration_tag" wide condition: // The condition requires at least 3 of the 4 defined strings to be present #s1 + #s2 + #s3 + #s4 >= 3 // Note: #sX counts the number of occurrences of string sX.}skl

New bug with status

Conversation

test conversation Croatian in recently active 

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Phasellus cursus interdum dolor, sit amet ullamcorper diam consectetur et. Duis in nisl et sapien fringilla vestibulum a nec dui. Sed vitae lectus laoreet, luctus velit in, ultrices ligula. Nam ac sem scelerisque neque finibus auctor sed vel purus. Donec porta nec diam at consequat. Sed justo enim, mattis at commodo a, egestas vitae dui. Mauris sed orci eu lacus consequat dapibus sed eget odio. Nunc id tincidunt massa. Nullam malesuada vestibulum sagittis. Donec tincidunt non purus in sodales. Nullam luctus ac ante vel commodo. Mauris semper lectus fringilla, mollis ipsum non, luctus dui. Morbi suscipit est ut felis ullamcorper venenatis. Pellentesque non blandit risus, in posuere mi. Donec suscipit, massa a congue luctus, nibh sem auctor ipsum, et vestibulum metus arcu eget diam.Praesent vitae enim convallis, porttitor mauris non, fringilla neque. Vivamus sit amet quam consequat, varius massa quis, condimentum felis. Donec ultri