DFIR SANS360 Talks

Example Rule
private rule MFT_Hit
{
meta:
description = "Using the MFT module"
strings:
$mft = "Log2t::input::mft"
condition:
$mft
}