rule P0_Hunting_Common_TeamTNT_CredHarvesterOutputBanner_1 {
	meta:
		description = "Detecting presence of known credential harvester scripts (commonly used by TeamTNT) containing specific section banner output commands"
		author = "daniel.bohannon@permiso.io (@danielhbohannon)"
		date = "2023-07-12"
		reference = "https://permiso.io/blog/s/agile-approach-to-mass-cloud-cred-harvesting-and-cryptomining/"
		md5_01 = "b9113ccc0856e5d44bab8d3374362a06"
		md5_02 = "d9ecceda32f6fa8a7720e1bf9425374f"
		md5_03 = "0855b8697c6ebc88591d15b954bcd15a"
		md5_04 = "f7df739f865448ac82da01b3b1a97041"
		md5_05 = "1a37f2ef14db460e5723f3c0b7a14d23"
		md5_06 = "99f0102d673423c920af1abc22f66d4e"
		md5_07 = "99f0102d673423c920af1abc22f66d4e"
		md5_08 = "5daace86b5e947e8b87d8a00a11bc3c5"
	strings:
		$sectionBanner_01 = "-------- AWS INFO ------------------------------------------"
		$sectionBanner_02 = "-------- EC2 USERDATA -------------------------------------------"
		$sectionBanner_03 = "-------- GOOGLE DATA --------------------------------------"
		$sectionBanner_04 = "-------- AZURE DATA --------------------------------------"
		$sectionBanner_05 = "-------- IAM USERDATA -------------------------------------------"
		$sectionBanner_06 = "-------- AWS ENV DATA --------------------------------------"
		$sectionBanner_07 = "-------- PROC VARS -----------------------------------"
		$sectionBanner_08 = "-------- DOCKER CREDS -----------------------------------"
		$sectionBanner_09 = "-------- CREDS FILES -----------------------------------"
	condition:
		(5 of them)
}