elf_invalid_version.yara

rule elf_invalid_version {
    meta:
        desc = "Identify ELF file that has mangled header info."
        author = "@shellcromancer"
        version = "1.0"
        last_modified = "2023.01.01"
		reference = "https://n0.lol/ebm/1.html"
		reference = "https://tmpout.sh/1/1.html"
    condition:
        (
			uint32(0) == 0x464c457f
			and uint8(0x6) > 1 // ELF Version is greater value than in spec.
		)
}