/*
    Source: research.ohiiho.com/arsenal/rintod/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule tool_rintod_uploader {
    meta:
        description = "rintod/toolol minimal uploader (330 bytes)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/rintod/"

    strings:
        $upload    = "move_uploaded_file" ascii
        $tmp_name  = "$_FILES" ascii
        $form      = "multipart/form-data" ascii
        $input     = "<input" ascii nocase

    condition:
        filesize < 1KB
        and $upload
        and $tmp_name
        and ($form or $input)
}