mandiant / thiri-notebook Goto Github PK

rule M_Methodology_SwearWord_pe_think_plain {
    meta:
        author="auto-generated"
        description="Auto-generated rule for: think, thinker, thinking, thinks"
        created="2022-04-22"
        md5=""
        sid="1"
        rev="1" 
    strings:
		$filetype= | 50 45 00 00|
		$search_think = /[^A-Za-z]{1}(think|thinker|thinking|thinks)[^A-Za-z]{1}/ ascii nocase wide
		
	condition:
		$filetype at 0x3c and $search_think and not 
}