rule pygmy_goat_magic_strings {
	meta:
		author = "NCSC"
		description = "Pygmy Goat magic byte sequences used in C2 comms"
		date = "2024-10-22"
		hash1 = "71f70d61af00542b2e9ad64abd2dda7e437536ff"
	strings:
		$c2_magic_handshake = ",bEB3?=o"
		$fake_ssh_banner = "SSH-2.0-D8pjE"
		$fake_ed25519_key = { 29 CC F0 CC 16 C5 46 6E 52 19 82 8E 86 65 42 8C 1F 1A D4 C3 A5 B1 CB FC C0 26 6C 31 3C 5C 90 3A 24 7D E4 D3 57 6D DA 8E CB F4 66 D1 CB 81 4F 63 FD 4A FA 06 E4 7E 4C A0 95 91 BD CB 97 A4 B3 0F }
	condition:
		(uint32(0) == 0x464c457f) and any of them
}