GCTI icon indicating copy to clipboard operation
GCTI copied to clipboard

Published 20 hours ago • verified publisher icon chronicle

desc: meta data clean-up, fix: Sliver rule FPs with CloudFoundry, refactor: avoid AV detection

Open Neo23x0 opened this issue 1 year ago • 0 comments

  • I've cleaned up and extended the meta data. This PR is just an offer. Pull it if you find the changes useful.
  • I've also handled a false positive triggered by the Sliver rules on CloudFoundry clients
  • I've also modified the rules so that they don't get detected and removed by Kaspersky and Avast AV engines

Sample with FPs : https://www.virustotal.com/gui/file/bab4a6db5d52a55b82cefccfa94c1a084f20d6adc7f94e9586a59919beb15185/detection

Neo23x0 avatar Nov 19 '22 08:11 Neo23x0