203890c3e60ccd4e05a2f9b1a784b010bb2d42d6.yar

rule netd_TorDomainPath {  meta:  author = "NCSC"  description = "Tor hostname path string found in netd"  date = "2023-08-31"  strings:  $ = "/data/local/prx/hs/hostname"  condition:  uint32(0) == 0x464C457F and any of them }