FP: svchost.exe size

ndolle · Feb 19, 2019 · 0448d97 · 0448d97
1 parent 8f7335c
commit 0448d97
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/yara/generic_anomalies.yar b/yara/generic_anomalies.yar
@@ -166,7 +166,7 @@ rule Suspicious_Size_svchost_exe {
     condition:
         uint16(0) == 0x5a4d
         and filename == "svchost.exe"
-        and ( filesize < 14KB or filesize > 75KB )
+        and ( filesize < 14KB or filesize > 100KB )
 }
 
 rule Suspicious_Size_winlogon_exe {