YARA rules for Havij
1 rules · scoped to tool · back to Havij
YARA rules whose family, name, or description matches this tool or its tooling. Use these for binary-pattern hunts.
rule CN_Honker_Havij_Havij {
meta:
description = "Sample from CN Honker Pentest Toolset - file Havij.exe"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "Disclosed CN Honker Pentest Toolset"
date = "2015-06-23"
score = 70
hash = "0d8b275bd1856bc6563dd731956f3b312e1533cd"
id = "b3640a32-b546-58c9-abb1-3da60dc6633c"
strings:
$s1 = "User-Agent: %Inject_Here%" fullword wide /* PEStudio Blacklist: strings */
$s2 = "BACKUP database master to disk='d:\\Inetpub\\wwwroot\\1.zip'" fullword ascii /* PEStudio Blacklist: strings */
condition:
uint16(0) == 0x5a4d and filesize < 3000KB and all of them
}