nuclei-templates/file/malware/linux-tsunami-malware.yaml

23 lines
595 B
YAML

id: linux-tsunami-malware
info:
name: Linux Tsunami Malware - Detect
author: daffainfo
severity: info
reference:
- https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Miscelanea_Linux.yar
- http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483
tags: malware,file
file:
- extensions:
- all
matchers:
- type: word
part: raw
words:
- "PRIVMSG %s :[STD]Hitting %s"
- "NOTICE %s :TSUNAMI <target> <secs>"
- "NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually."