I was looking at some ABCbot samples and noticed that some of them included the golang ssh package. I thought this would be useful to know when looking at new samples.
rule golang_ssh
{
meta:
description = "Golang binary including golang.org/x/crypto/ssh"
reference = "https://pkg.go.dev/golang.org/x/crypto/ssh"
strings:
$ = "golang.org/x/crypto/ssh"
condition:
all of them
}
Pingback: Week 07 – 2022 – This Week In 4n6