FP: sublime package - recon commands

ndolle · Feb 26, 2019 · fe92bee · fe92bee
1 parent cb46d0e
commit fe92bee
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/yara/gen_recon_keywords.yar b/yara/gen_recon_keywords.yar
@@ -42,6 +42,7 @@ rule Recon_Commands_Windows_Gen1 {
 
       $fp1 = "avdapp.dll" fullword wide
       $fp2 = "keyword.command.batchfile" ascii
+      $fp3 = ".sublime-settings" ascii
    condition:
       filesize < 1000KB and 4 of them
       and not 1 of ($fp*)