search for credit card data

rule:
  meta:
    name: search for credit card data
    namespace: collection/credit-card
    authors:
      - matthew.williams@mandiant.com
    scopes:
      static: function
      dynamic: unsupported  # requires mnemonic features
  features:
    - and:
      - instruction:
        - mnemonic: cmp
        - number: 0x5E = '^' (Track 1 separator)
      - instruction:
        - mnemonic: cmp
        - number: 0x3D = '=' (Track 2 separator)
      - instruction:
        - mnemonic: cmp
        # seen in 518185ED134F93DF708590E74473DA8E and 05B2D1AF23CF96E295BBBFC6CDC76E1F
        - number: 0x44 = 'D' (Unknown separator)
      - match: read process memory