Kathy Satterlee
08/11/2022, 4:15 PMGuillaume
08/11/2022, 4:18 PMgit clone -b defcon <https://github.com/ksatter/fleet-docker.git>
Kathy Satterlee
08/11/2022, 4:30 PMGuillaume
08/11/2022, 4:46 PMDEFCON2022workshop!
- your usernames are on the card I gave you - if you don’t have one yet pick it up by the projector!Kathy Satterlee
08/11/2022, 5:14 PMGuillaume
08/11/2022, 6:32 PMsql
SELECT * FROM yara WHERE path like ‘/root/%%’ AND sigrule IN (
‘rule eicar {
strings:
$s1 = “X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*” fullword ascii
condition:
all of them
}’
) AND matches=‘eicar’;