diff --git a/rules/generic/MalScript_Tricks.yar b/rules/generic/MalScript_Tricks.yar index c70e847..fc5ad5a 100644 --- a/rules/generic/MalScript_Tricks.yar +++ b/rules/generic/MalScript_Tricks.yar @@ -12,7 +12,7 @@ rule MalScript_Tricks source = "BARTBLAZE" author = "@bartblaze" description = "Identifies tricks often seen in malicious scripts such as moving the window off-screen or resizing it to zero." - category = "MALWARE" + category = "INFO" strings: $s1 = "window.moveTo -" ascii wide nocase @@ -22,4 +22,4 @@ rule MalScript_Tricks condition: ( all of ($s*) or all of ($x*)) and filesize <50KB -} \ No newline at end of file +}