import "hash"
import "pe"

rule PoshC2_Csc {
	meta:
		description = "PoshC2 - csc.exe"
		sha256 = "df8474fe610372aff283b0429626e1663b27e7c651242fbc7687ca6fd2d45caa"
	strings:
		$s1 = "csc.exe" ascii fullword
		$s2 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/>" ascii fullword
		$s3 = "  <assemblyIdentity version=\"1.0.0.0\" name=\"MyApplication.app\"/>" ascii fullword
		$s4 = "Microsoft.CodeAnalysis" ascii fullword
		$s5 = "lpThreadId" ascii fullword
		$s6 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\">" ascii fullword
		$s7 = "      <requestedPrivileges xmlns=\"urn:schemas-microsoft-com:asm.v3\">" ascii fullword
		$s8 = "lpAddress" ascii fullword
		$s9 = "Protection" ascii fullword
		$s10 = "Program" ascii fullword
		$s11 = "lpStartAddress" ascii fullword
		$s12 = "RefSafetyRulesAttribute" ascii fullword
		$s13 = "flNewProtect" ascii fullword
		$s14 = "lpflOldProtect" ascii fullword
		$s15 = "  </trustInfo>" ascii fullword
		$s16 = "EmbeddedAttribute" ascii fullword
		$s17 = "dwStackSize" ascii fullword
		$s18 = "#REPLACEME64#" wide fullword
		$s19 = "#REPLACEME32#" wide fullword
		$s20 = "System.Runtime.CompilerServices" ascii fullword
		$s21 = "FromBase64String" ascii fullword
	condition:
		hash.sha256(0, filesize) == "df8474fe610372aff283b0429626e1663b27e7c651242fbc7687ca6fd2d45caa" or uint16(0) == 0x5a4d and filesize < 20KB and 8 of them
}