diff --git a/tests/samples/L4-005_005_sample.txt b/tests/samples/L4-005_005_sample.txt index 45e7f9d..3e1e009 100644 --- a/tests/samples/L4-005_005_sample.txt +++ b/tests/samples/L4-005_005_sample.txt @@ -1 +1,4 @@ -rule hotload test \ No newline at end of file +This is a hot-reload test sample for MeshSafe YARA engine. +The payload below should trigger Newly_Added_Rule_Test rule: + +meshsafe-hot-reload-test-string diff --git a/tests/samples/L4-010_010_sample.txt b/tests/samples/L4-010_010_sample.txt index b134165..ecbcfcf 100644 --- a/tests/samples/L4-010_010_sample.txt +++ b/tests/samples/L4-010_010_sample.txt @@ -1 +1,5 @@ -regex pattern shell \ No newline at end of file +# MeshSafe YARA regex rule test sample +# This should trigger Regex_Shell_Pattern + +attacker payload: +powershell -enc SQBFAFgAIAAoACgAbgBlAHcALQAtAG8AYgBqAGUAYwB0ACAA