(YARA) Detect OutputDebugString Usage

Download Raw

import "pe"

rule Detect_OutputDebugStringA_iat: AntiDebug
{
	meta:
		Author = "http://twitter.com/j0sm1"
		Description = "Detect in IAT OutputDebugstringA"
		Date = "20/04/2015"

	condition:
		pe.imports("kernel32.dll","OutputDebugStringA")
}

Associated Techniques

Technique Name	Technique ID's	Categories	Snippet(s)
OutputDebugString	U0117 B0001.016

Matching Samples 10 most recent