<!--
 - YARA decoders
 - Created by SOCFortress.
 - https://www.socfortress.co
 - info@socfortress.co.
-->

<decoder name="yara">
  <prematch>wazuh-yara: </prematch>
</decoder>

<!--
wazuh-yara: info: Hacktool_Strings_p0wnedShell [description="p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs",license="https://creativecommons.org/licenses/by-nc/4.0/",author="Florian Roth",reference="https://github.com/Cn33liz/p0wnedShell",date="2017-01-14",hash1="e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60"] /tmp/atomic-red-team/.git/objects/pack/pack-ac8e332a09d2b8b1b0793d7cafcd1faca4c9f705.pack
-->
<decoder name="yara">
  <parent>yara</parent>
  <regex offset="after_parent">info: (\S+) [(\.+)] (\.+)</regex>
  <order>yara_info,yara_metadata,file</order>
</decoder>
<!--
ALERT:
**Phase 2: Completed decoding.
       decoder: 'yara'
       yara_info: 'Hacktool_Strings_p0wnedShell'
       yara_metadata: 'description="p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs",license="https://creativecommons.org/licenses/by-nc/4.0/",author="Florian Roth",reference="https://github.com/Cn33liz/p0wnedShell",date="2017-01-14",hash1="e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60"'
       file: '/tmp/atomic-red-team/.git/objects/pack/pack-ac8e332a09d2b8b1b0793d7cafcd1faca4c9f705.pack'

**Phase 3: Completed filtering (rules).
       Rule id: '200103'
       Level: '12'
       Description: 'YARA  detected.'
-->
