Last active
June 10, 2024 20:22
-
-
Save latonis/fb1c6c84e5454fb4d6db657340ce2390 to your computer and use it in GitHub Desktop.
YARA-X rule for recent LightSpy variant from https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import "macho" | |
rule macho_libframework_suspicious { | |
meta: | |
description = "Detects on LightSpy variant dylibs" | |
author = "Jacob Latonis @jacoblatonis" | |
date = "2024-04-25" | |
condition: | |
macho.has_dylib("/usr/lib/libsqlite3.dylib") and macho.has_dylib("/usr/local/lib/libframework.dylib") | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment