cve-2025-0282

cve-2023-46805

dsupgrade.pm

log.events

libsocks5.so

liblogblock.so

dsauth.pm

scanner.py

cgi.bak

audit.log

e7d24813535f74187db31d4114f607a1

d18e5425ecd9608ecb992606b974e15d

UNC5337

rule M_APT_Installer_SPAWNSNAIL_1 {
	meta:
		author = "Mandiant"
		description = "Detects SPAWNSNAIL. SPAWNSNAIL is an SSH 
backdoor targeting Ivanti devices. It has an ability to inject a specified 
binary to other process, running local SSH backdoor when injected to 
dsmdm process, as well as injecting additional malware to dslogserver"
		md5 = "e7d24813535f74187db31d4114f607a1"
	strings:
		$priv = "PRIVATE KEY-----" ascii fullword
		$key1 = "%d/id_ed25519" ascii fullword
		$key2 = "%d/id_ecdsa" ascii fullword
		$key3 = "%d/id_rsa" ascii fullword
		$sl1 = "[selinux] enforce" ascii fullword
		$sl2 = "DSVersion::getReleaseStr()" ascii fullword
		$ssh1 = "ssh_set_server_callbacks" ascii fullword
		$ssh2 = "ssh_handle_key_exchange" ascii fullword
		$ssh3 = "ssh_add_set_channel_callbacks" ascii fullword
		$ssh4 = "ssh_channel_close" ascii fullword
	condition:
		uint32(0) == 0x464c457f and $priv and any of ($key*) and any of ($sl*) and any of ($ssh*)
}

rule M_APT_Tunneler_SPAWNMOLE_1 {
	meta:
		author = "Mandiant"
		description = "Detects a specific comparisons in SPAWNMOLE 
tunneler, which allow malware to filter put its own traffic . 
SPAWNMOLE is a tunneler written in C and compiled as an ELF32 
executable. The sample is capable of hijacking a process on the 
compromised system with a specific name and hooking into its 
communication capabilities in order to create a proxy server for 
tunneling traffic."
		md5 = "4f79c70cce4207d0ad57a339a9c7f43c"
	strings:
		$comparison1 = { 3C 16 74 [1] 0F B6 [2] 3C 03 74 [1] 0F B6 [2] 3C 01 0F 85 }
		$comparison2 = { 81 [2] E2 E3 49 FB 0F 85 [4] 81 [2] 61 83 C3 1B 0F 85 }
	condition:
		uint32(0) == 0x464c457f and all of them
}

rule M_Credtheft_DRYHOOK_1 {
	meta:
		author = "Mandiant"
		description = "Hunting rule looking for strings identified in 
the DRYHOOK credential stealer"
		md5 = "d4e46eed76ad86f08a40993c3e340bab"
	strings:
		$str1 = "/home/perl/DSAuth.pm"
		$str2 = "replace_content"
		$str3 = "replace1_content"
		$str4 = "replace2_content"
		$str5 = "pkill cgi-server"
		$str6 = "setPrompt ="
		$str7 = "runSignin = \\*DSAuthc::RealmSignin_runSignin"
		$str8 = "/bin/mount -o remount,rw / > /dev/null 2>&1"
		$str9 = { 64 61 74 61 20 3D 20 72 65 2E 73 75 62 28 62 22 5C 2A 72 75 6E 53 69 67 6E 69 6E 45 42 53 4C 20 3D 2E 2A 3B 22 2C 62 61 73 65 36 34 2E 62 36 34 64 65 63 6F 64 65 28 72 65 70 6C 61 63 65 32 5F 63 6F 6E 74 65 6E 74 2E 65 6E 63 6F 64 65 28 29 29 2E 64 65 63 6F 64 65 28 29 2E 65 6E 63 6F 64 65 28 22 75 6E 69 63 6F 64 65 5F 65 73 63 61 70 65 22 29 2C 64 61 74 61 29 }
	condition:
		8 of them and filesize < 20KB
}