rule M_Hunting_AscensionEngine_GithubVPNProxy_1 {
	meta:
		author = "Mandiant"
		description = "Rule looks for binaries that include vpn/proxy/tunnel github links"
	strings:
		$r1 = /github.com\/[^\/]+\/[^\/]*(vpn|VPN|proxy|Proxy|tunnel|Tunnel)[^\/]*\//
		$vpn = "vpn" nocase fullword
		$proxy = "proxy" nocase fullword
		$tunnel = "tunnel" nocase fullword
	condition:
		((uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) or (uint32(0) == 0x464c457f)) and filesize < 20MB and $r1 and ($vpn or $proxy or $tunnel)
}