Volatility3 MCP Server

/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. */ rule ChickenDOS { meta: author = "Jason Jones <jasonjones@arbor.net>" description = "Win32-variant of Chicken ident for both dropper and dropped file" source = "https://github.com/arbor/yara/blob/master/chicken.yara" strings: $pdb1 = "\\Chicken\\Release\\svchost.pdb" $pdb2 = "\\IntergrateCHK\\Release\\IntergrateCHK.pdb" $str2 = "fake.cf" $str3 = "8.8.8.8" $str4 = "Processor(%d)\\" $str5 = "DbProtectSupport" $str1 = "dm1712/`jvpnpkte/bpl" $str6 = "InstallService NPF %d" $str7 = "68961" $str8 = "InstallService DbProtectSupport %d" $str9 = "C:\\Program Files\\DbProtectSupport\\npf.sys" condition: ($pdb1 or $pdb2) and 5 of ($str*) } rule ChickenDOS_Linux { meta: author = "Jason Jones <jasonjones@arbor.net>" description = "Linux-variant of Chicken ident for both dropper and dropped file" source = "https://github.com/arbor/yara/blob/master/chicken.yara" strings: $cfg = "fake.cfg" $file1 = "ThreadAttack.cpp" $file2 = "Fake.cpp" $str1 = "dns_array" $str2 = "DomainRandEx" $str3 = "cpu %llu %llu %llu %llu" $str4 = "[ %02d.%02d %02d:%02d:%02d.%03ld ] [%lu] [%s] %s" ascii condition: $cfg and all of ($file*) and 3 of ($str*) }