Overview - Yara rules

import "hash"

rule PickleC2 {
	meta:
		description = "PickleC2 - powershell.ps1"
		sha256 = "3a29a9b0f0e5ff1b61fa052a2173987b9f990616043791826e7426df603c43d1"
	strings:
		$s1 = "function Execute($key,$ip,$port,$implant_name,$sleep_time){" ascii fullword
		$s2 = "Execute $key $ip $port $implant_name $sleep_time" ascii fullword
		$s3 = "    $LocalIPs = \"LocalIPs(\" + (([System.Net.Dns]::GetHostByName($NULL).AddressList | Select IPAddressToString | findstr \".*.*"
		$s4 = "        $process.startInfo.UseShellExecute = $false" ascii fullword
		$s5 = "    $Hostname = \"Machine_Name(\"+ [System.Net.Dns]::GetHostByName($NULL).Hostname + \")\"" ascii fullword
		$s6 = "            $data = (Invoke-WebRequest -UseBasicParsing -Uri $file_download -Method 'POST').Content" ascii fullword
		$s7 = "    $unencryptedData = $decryptor.TransformFinalBlock($bytes, 16, $bytes.Length - 16);" ascii fullword
		$s8 = "    $LocalIPs = \"LocalIPs(\" + (([System.Net.Dns]::GetHostByName($NULL).AddressList | Select IPAddressToString | findstr \".*.*"
		$s9 = "        $process.StandardOutput.ReadToEnd() + $process.StandardError.ReadToEnd() " ascii fullword
		$s10 = "            $cmd = \"cmd.exe\"" ascii fullword
		$s11 = "    $file_download = \"ht\" + 'tp:' + \"//\" + $ip + \":$port/task/$implant_name/file.ret\"" ascii fullword
		$s12 = "        elseif ($binary -eq \"execute\"){" ascii fullword
		$s13 = " -join ',').replace('IPAddressToString,-----------------,','').replace(\" \",\"\") + \")\"" ascii fullword
		$s14 = "            $cmd = \"powershell.exe\"" ascii fullword
		$s15 = "function Decrypt-String($key, $encryptedStringWithIV) {" ascii fullword
		$s16 = "        $task_req = (Invoke-WebRequest -UseBasicParsing -Uri $task -Method 'GET').Content" ascii fullword
		$s17 = "    $task = \"ht\" + \"tp:\" + \"//\" + $ip + \":$port/task/$implant_name\"" ascii fullword
		$s18 = "    $result = \"ht\" + \"tp:\" + \"//\" + $ip + \":$port/result/$implant_name\"" ascii fullword
		$s19 = "        $process.startInfo.RedirectStandardError = $true" ascii fullword
		$s20 = "            $results = Encrypt-String $key \"Downloaded\"" ascii fullword
	condition:
		hash.sha256(0, filesize) == "3a29a9b0f0e5ff1b61fa052a2173987b9f990616043791826e7426df603c43d1" or uint16(0) == 0x7566 and filesize < 20KB and 8 of them
}

import "hash"

rule PoshC2_DynamicCode {
	meta:
		description = "PoshC2 - DynamicCode.exe"
		sha256 = "8ce3b90e96a7cfabb6b2b4fc692ea7ca8da105754eb06f662b572e5f549f280f"
	strings:
		$s1 = "DynamicCode.exe" ascii fullword
		$s2 = "Dynamic Code executed successfully" wide fullword
		$s3 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/>" ascii fullword
		$s4 = "  <assemblyIdentity version=\"1.0.0.0\" name=\"MyApplication.app\"/>" ascii fullword
		$s5 = "Microsoft.CodeAnalysis" ascii fullword
		$s6 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\">" ascii fullword
		$s7 = "      <requestedPrivileges xmlns=\"urn:schemas-microsoft-com:asm.v3\">" ascii fullword
		$s8 = "Program" ascii fullword
		$s9 = "Console" ascii fullword
		$s10 = "RefSafetyRulesAttribute" ascii fullword
		$s11 = "  </trustInfo>" ascii fullword
		$s12 = "EmbeddedAttribute" ascii fullword
		$s13 = "PoshC2DynamicCode" ascii fullword
		$s14 = "System.Runtime.CompilerServices" ascii fullword
		$s15 = "System" ascii fullword
		$s16 = "      </requestedPrivileges>" ascii fullword
	condition:
		hash.sha256(0, filesize) == "8ce3b90e96a7cfabb6b2b4fc692ea7ca8da105754eb06f662b572e5f549f280f" or uint16(0) == 0x5a4d and filesize < 10KB and 8 of them
}

rule pentest_tool_botb {
	meta:
		description = "Detects Break Out The Box"
		author = " [email protected] "
		date = "2021-06-28"
		license = "Apache License 2.0"
		hash1 = "3aae4a2bf41aedaa3b12a2a97398fa89a9818b4bec433c20b4e724505277af83"
	strings:
		$ = "github.com/brompwnie/botb" ascii wide
		$ = "/Users/cleroy/go/src" ascii wide
		$ = "Data uploaded to" ascii wide
		$ = "Break Out The Box" ascii wide
	condition:
		all of them
}

import "hash"

rule PoshC2_Pbind {
	meta:
		description = "PoshC2 - pbind.exe"
		sha256 = "fc02c496d646b60fd70e2ad4be6e35b3f16aaf6c34ee47a7fb81d00cd54ab383"
	strings:
		$s1 = "pbind.exe" ascii fullword
		$s2 = "[+] Running task in background, run get-bg to get background output." wide fullword
		$s3 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"/>" ascii fullword
		$s4 = "ParseCommandLineArgs" ascii fullword
		$s5 = "run-dll-background" wide fullword
		$s6 = "[*] Only run one task in the background at a time per implant." wide fullword
		$s7 = "  <assemblyIdentity version=\"1.0.0.0\" name=\"MyApplication.app\"/>" ascii fullword
		$s8 = "#REPLACEPBINDPIPENAME#" wide fullword
		$s9 = "CreateEncryptionAlgorithm" ascii fullword
		$s10 = "run-dll" wide fullword
		$s11 = "run-exe Core.Program Core " wide fullword
		$s12 = "$[-] Cannot read from pipe" wide fullword
		$s13 = "loadmodule" wide fullword
		$s14 = "[-] No output" wide fullword
		$s15 = "Microsoft.CodeAnalysis" ascii fullword
		$s16 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v2\">" ascii fullword
		$s17 = "GzipCompress" ascii fullword
		$s18 = "#REPLACEKEY#" wide fullword
		$s19 = "Error loading modules {0}" wide fullword
		$s20 = "run-exe-background" wide fullword
		$s21 = "Invoke" wide fullword
	condition:
		hash.sha256(0, filesize) == "fc02c496d646b60fd70e2ad4be6e35b3f16aaf6c34ee47a7fb81d00cd54ab383" or uint16(0) == 0x5a4d and filesize < 40KB and 8 of them
}

import "pe"
import "hash"

rule PoshC2_Dropper {
	meta:
		description = "PoshC2 - dropper.exe"
		sha256 = "9062d8c9e744b3963ea16f1df295fdf9e463902bfe37b8bae376a21a441851b4"
	strings:
		$s1 = "AppPolicyGetProcessTerminationMethod" ascii fullword
		$s2 = " Type Descriptor'" ascii fullword
		$s3 = "operator co_await" ascii fullword
		$s4 = "operator<=>" ascii fullword
		$s5 = ".data$rs" ascii fullword
		$s6 = "api-ms-win-appmodel-runtime-l1-1-2" wide fullword
		$s7 = " Class Hierarchy Descriptor'" ascii fullword
		$s8 = " Base Class Descriptor at (" ascii fullword
		$s9 = " Complete Object Locator'" ascii fullword
		$s10 = "__swift_3" ascii fullword
		$s11 = "__swift_2" ascii fullword
		$s12 = ".rdata$voltmd" ascii fullword
		$s13 = "xWI96tRI" ascii fullword
		$s14 = " delete[]" ascii fullword
		$s15 = "__swift_1" ascii fullword
		$s16 = "vKfffff" ascii fullword
		$s17 = "D$0@8{" ascii fullword
		$s18 = "api-ms-win-core-file-l1-2-4" wide fullword
		$s19 = "api-ms-win-core-file-l1-2-2" wide fullword
		$s20 = " delete" ascii fullword
	condition:
		hash.sha256(0, filesize) == "9062d8c9e744b3963ea16f1df295fdf9e463902bfe37b8bae376a21a441851b4" or pe.sections[4].name == "_RDATA" and pe.imports("kernel32.dll", "WriteProcessMemory") and pe.imports("kernel32.dll", "CreateRemoteThread") and pe.imports("kernel32.dll", "OpenProcess") and pe.imports("kernel32.dll", "TerminateProcess") and uint16(0) == 0x5a4d and filesize < 300KB and 8 of them
}

import "hash"

rule PoshC2_DropperPy {
	meta:
		description = "PoshC2 - dropper.py"
		sha256 = "33827cd5a6e15bbaf99e65f767e65e1b639f48d6b6bb7a6e9e8c8cf02355a1e7"
	strings:
		$s1 = "if hh[0]: headers = ({'Host':hh[0],'User-Agent':ua,'Cookie':'SessionID=%s' % encsid.decode(\"utf-8\")})" ascii fullword
		$s2 = "if hh[0]:r=urllib2.Request(url2,headers={'Host':hh[0],'User-agent':ua,'Cookie':'SessionID=%s' % encsid})" ascii fullword
		$s3 = "if hh[0]: r=urllib2.Request(url,headers={'Host':hh[0],'User-agent':ua})" ascii fullword
		$s4 = "else: headers = ({'User-Agent':ua,'Cookie':'SessionID=%s' % encsid.decode(\"utf-8\")})" ascii fullword
		$s5 = "else:r=urllib2.Request(url2,headers={'User-agent':ua,'Cookie':'SessionID=%s' % encsid})" ascii fullword
		$s6 = "encsid=encrypt(key, '%s;%s;%s;%s;%s;%s;%s' % (un,hn,hn,arch,pid,procname,urlid))" ascii fullword
		$s7 = "encsid=encrypt(key, '%s;%s;%s;%s;%s;%s;%s' % (un,hn,hn,arch,pid,pname,urlid))" ascii fullword
		$s8 = "else: r=urllib2.Request(url,headers={'User-agent':ua})" ascii fullword
		$s9 = "hn=socket.gethostname();o=urllib2.build_opener()" ascii fullword
		$s10 = "exec(base64.b64decode(x))" ascii fullword
		$s11 = "html = response.read().decode('utf-8');x=decrypt(key, html)" ascii fullword
		$s12 = "ua=\"#REPLACEUSERAGENT#\"" ascii fullword
		$s13 = "url=serverclean[0]+\"#REPLACEQUICKCOMMAND#\"" ascii fullword
		$s14 = "res=urllib2.urlopen(r);html=res.read();x=decrypt(key, html).rstrip('\\0');" ascii fullword
		$s15 = "serverclean=[#REPLACEHOSTPORT#]" ascii fullword
		$s16 = "pykey=\"#REPLACESPYTHONKEY#\"" ascii fullword
		$s17 = "if pykey in b and pyhash == s and cstr < kdn: " ascii fullword
		$s18 = "import os,sys,base64,ssl,socket,pwd,hashlib,time" ascii fullword
		$s19 = "kdn=time.strptime(\"#REPLACEKILLDATE#\",\"%Y-%m-%d\")" ascii fullword
		$s20 = "cstr=time.strftime(\"%Y-%m-%d\",time.gmtime());cstr=time.strptime(cstr,\"%Y-%m-%d\")" ascii fullword
	condition:
		hash.sha256(0, filesize) == "33827cd5a6e15bbaf99e65f767e65e1b639f48d6b6bb7a6e9e8c8cf02355a1e7" or uint16(0) == 0x6d69 and filesize < 6KB and 8 of them
}

import "hash"

rule PoshC2_ImplantCorePs1 {
	meta:
		description = "PoshC2 - Implant-Core.ps1"
		sha256 = "6d520463f8563d6a296d22b6824c690c9b6de8121c9b6f08307947874667c5f2"
	strings:
		$x1 = "$payloadraw = \"powershell -exec bypass -Noninteractive -windowstyle hidden -e $($EncodedPayloadScript)\"" ascii fullword
		$s2 = "$EncodedPayloadScript = [Convert]::ToBase64String($UnicodeEncoder.GetBytes($NewScript))" ascii fullword
		$s3 = "$NewScript = \"sal a New-Object;iex(a IO.StreamReader((a IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64Stri"
		$s4 = "$ScriptBytes = ([Text.Encoding]::ASCII).GetBytes($payloadclear)" ascii fullword
		$s5 = "g(`\"$EncodedCompressedScript`\"),[IO.Compression.CompressionMode]::Decompress)),[Text.Encoding]::ASCII)).ReadToEnd()\"" ascii fullword
		$s6 = "    $unencryptedData = $decryptor.TransformFinalBlock($bytes, 16, $bytes.Length - 16)" ascii fullword
		$s7 = "    $unencryptedData = $decryptor.TransformFinalBlock($bytes, 16, $bytes.Length - 16);" ascii fullword
		$s8 = "$EncodedCompressedScript = [Convert]::ToBase64String($CompressedScriptBytes)" ascii fullword
		$s9 = "$payload = $payloadraw -replace \"`n\", \"\"" ascii fullword
		$s10 = "$NewScript = \"sal a New-Object;iex(a IO.StreamReader((a IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64Stri"
		$s11 = "    [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([System.Text.Encoding]::UTF8.GetString($unencrypte"
		$s12 = "    [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([System.Text.Encoding]::UTF8.GetString($unencrypte"
		$s13 = "                      $splitcmd = $ReadCommandClear -replace \"multicmd\",\"\"" ascii fullword
		$s14 = "    $output = (New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$unencrypte"
		$s15 = "                                  if ($ReadCommandClear -match (\"(.+)Base64\")) { $result = $Matches[0] } # $result doesn't app"
		$s16 = "    $output = (New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$unencrypte"
		$s17 = "                                  if ($ReadCommandClear -match (\"(.+)Base64\")) { $result = $Matches[0] } # $result doesn't app"
		$s18 = "function Decrypt-String($key, $encryptedStringWithIV) {" ascii fullword
		$s19 = "dData)), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd()" ascii fullword
		$s20 = "          if (($ReadCommandClear) -and ($ReadCommandClear -ne \"fvdsghfdsyyh\")) {" ascii fullword
	condition:
		hash.sha256(0, filesize) == "6d520463f8563d6a296d22b6824c690c9b6de8121c9b6f08307947874667c5f2" or uint16(0) == 0x6b24 and filesize < 40KB and 1 of ($x*) and 4 of them
}

rule mi_mimikatz_11462 {
	meta:
		description = "Mimikatz - file mi.ps1"
		author = "The DFIR Report"
		reference = "https://thedfirreport.com"
		date = "2022-05-01"
		hash1 = "d00edf5b9a9a23d3f891afd51260b3356214655a73e1a361701cda161798ea0b"
	strings:
		$x1 = "$best64code = \"==gCNkydtdnbrpXbttmc01mazp2bkgCWFlkCNkSKoo3ZtNnatpHayBHJuMXb3RHanNne1FXarhGJo4Wa0R3b3Fnerl3a3RiLr5GcnBHcutmcnpGd"
		$s2 = "lFM5cmbFVFMatSYLlTdTN2QCdXZyg2QsJVYGFEZiJERBV3T0ZVaYJGZZx2Kx4GSXxGdll1LSJ2R5F2d5J3N3VjSRtUZzgDUmpFOap1TwI3bKpHVDFlNL9GUQJTdwYUUr"
		$s3 = "JFT0omerhFawNXbDVVcIdXZ1REOyMUVXBHVZpWZvUGN6dUMp9ycysCbtBXY5IUVSFVbiNXVtJUYVRFeD5mVYtEMIt0SiB3blZmTHlUWrUmV4RXdr80bw12QuVTQtx2LV"
		$s4 = "x0dGlHUFpUYhV1YXVjR4N1b3p0cVRTTj10TxRFNxhnVEdHd5lGWPNTNFdjexRkNzl2MPtie0RWcnJXQ3djbIN0didHMzJTM5NmS01GaB50Z2VGSJVFOyZGd5hlN1BDMR"
		$s5 = "R1TVhlRO10QXtiU4s2UrNEeXp1QDFzblRHb2UmZLFTdsJFR2BDcmdVesdnQKVWZ21GOQ5kaTdGTRJ1UXNzMVdDU4NHa0p0V3MDeEVFaExEcpBVQzQlY5g0bRV0N1lkQq"
		$s6 = "RUUERUNw5UdSZ3bpp0cVVmeRpVVMx2R1ETZIZzYGhEd6J3VidHT3IUMUhHasR3cwAnM2sST5pUZiNVcjFlcSR3cTJkcmdzKZhkTzNGWzJmZ5N1a6lGbZFXSvEzMFBzRa"
		$s7 = "lnMkxERH9EMiRmW4k2doBDS6dXdLlDM4VmRrlTWwMmSmFnNCV1YLdjN0sCUp9WST9SYHlkYaRWb5R3L0oVNn50am9EU6hkV0InYCNmWv4WTktUSxdnW0gET25GNxsWO4"
		$s8 = "NzTyIXSJdFMip1ZrNVY1VzQStCVatEdm92ZU1Wc09SYNt0LRBnYPlEchV1RJN3ZLBlVtRlM2FDNWR0RSZ3d30mUNpHWD52SQFTNQtiS2kEalx0dll3UzQ2NGVEVIl0YT"
		$s9 = "hzQ0QVYxhXWNdDN2lzd0JUR582TUhzaCJmVQhHaLp0c5VkWpNnQhh2QhJDO3oVSwczUkR0MyMkcwAldwJDbOd0SNJEVil0QVF3NGFkez5UYMZUQzgUM3gFOGhGRzU2Vw"
		$s10 = "5mMnVDcohGWUVmbjlDWHFmVv8SY3ZGTrdja3k2TOd3KMBlUstmWrNzYyQzKwIzKzknQYlzKrknYlJndTFleDdnWV5Uc04kNYRldll3LaJjckBTMVp0cPZlZ1Y0MpZkS1"
		$s11 = "F0KtlDetp0c4BnaBVXWERnczUWRPN2KDVTMkh1dFdFaKNmYKRGMrMHan5UbrRGMzIXcvlFe1J0Z0dUMPRFSvlndo9mSkpWQTV1SyNFZLFHRnVWRP5EcjJGcBp3L1c3am"
		$s12 = "QWb5Z0UhJFUwgETQdGMxATdUdXcXRHcTVTMrQEe6JEWBxUTVhGR1hGULp1Vx8UQLRncYBnaN9mVDBFazcnbRFTSJpXTuZDS4dTd0l0ZGJTUYlUSwIEcIFDcnF0Zip0cJ"
		$s13 = "RVUm9GcjV0MwQGV3NGWxMWVSRDMNJHevdUMpFHVxMXQyp3VrcHVJdGeJtUQvMXb3dUZ4cERUdHN3FFSQ5kdL9kap5ENmJ3TDVESHN0SCZlQXJDc2BDOIlmNxxUY0RkN2"
		$s14 = "FzUZxWejZWMmV2ZpdjTxg3arMnQCB1LvoXY4kVdkFEeM1GcwB3TDllMFZGeTF3Z4MzRSR2KTBFaz8EWzBlQlJ0ckNHTpd2KwkURpBXQWF1ZjRTRqlVNvImYmF0bmtUYV"
		$s15 = "NnW3oHNkZ3NY9mMTtmbNJTQx8WdNl3NCtCZGpVOMdUT2BzUWFTW5UjZu9CRIdHcLJzNoZTThhkVwgDOGdXM2B1dLlzUI9SQrllTqVkbst0TywmUwcXTPJmRvFFTPhEeh"
		$s16 = "JUbL5WZxMXQux2bMNFNHhkVh1mY59UQP50Kp52N2FHa1ZHexcXN1oHRMhkes9icpZXU0VTc050VGZDOidUMPZDW0NkNwNjWxVHNrUUVvJmQ4p1LY10ZyFHTBBXcIZ2aZ"
		$s17 = "FmN44kQz9yMRZTQKp1UmVFaOdnSSR3THdkSHJDdO5WRT90SSpHZjZVT3NUZwFkWWhlNpJzN04UZpRzLERnTtVGM4JTbyFGeTRXUwgHeyEmWTVlUr8kU4tyL2JnNTZENv"
		$s18 = "d0aZ1WOFp1YTRWZ4tUVrN0Q5AVQEV3a3UnV2U0QkR3L3hEU3o3LJFWQnZzdzEUO4hFbBJDTUJGeopkclNjMFJDZ6lHa4o1LUVGShp0cup3L5dWZxpmS11mcix2VV5ERv"
		$s19 = "9CNqJmSVRUZjFDR3B1VGhUNZNkQxNmS18WRwpHc2lUYBN1RYNXcntEZWNFeyEzMiRWQr8WOLRVZyg0QiF0QI1Gbr0mZvkmdyxUb4p3Kph2dadGb5EjSRFFdq9WSutydi"
		$s20 = "dUb2JDZLdVVvpFe2YVS1lzSvl1MnlGdv92KKZWdWZGahxUaipGWypUeEZ3dyZWONJFTUdjTx5GR4p0KwYXaSZ2dLl2cRxGS4ZWdZFTNvoEeQpWRKJWQahkaTZWcz9iNa"
	condition:
		uint16(0) == 0x6224 and filesize < 10000KB and 1 of ($x*) and 4 of them
}

import "hash"

rule RedditC2_ImplantUNIX {
	meta:
		description = "RedditC2 - implant.py"
		sha256 = "dba80b543f6d39f2d0631f6cfebef961259746e6f70fb0cf1431e85343ba7d32"
	strings:
		$s1 = "    listener_session = subprocess.getoutput('hostname')" ascii fullword
		$s2 = "                    if(\"in:\" in top_level_comment.body and top_level_comment.id not in self.processed_comments):" ascii fullword
		$s3 = "    i = Implant(client_id, client_secret, username, password, subreddit, listener_session, user_agent, xor_key)" ascii fullword
		$s4 = "    output = subprocess.getoutput(command)" ascii fullword
		$s5 = "    def __init__(self, client_id, client_secret, username, password, subreddit_name, listener_name, user_agent, xor_key):" ascii fullword
		$s6 = "def runTask(command):" ascii fullword
		$s7 = "            ciphertext = \"powershell.exe \" + ciphertext[11:]" ascii fullword
		$s8 = "def decrypt(encoded_text, key):" ascii fullword
		$s9 = "                        self.processed_comments.append(top_level_comment.id)" ascii fullword
		$s10 = "        print(\"[+] Received task to execute: \" + ciphertext)" ascii fullword
		$s11 = "        self.processed_comments = []" ascii fullword
		$s12 = "        if(command[:8] == \"download\"):" ascii fullword
		$s13 = "    user_agent = \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/"
		$s14 = "def encrypt(plaintext, key):" ascii fullword
		$s15 = "def xor_encrypt(plaintext, key):" ascii fullword
		$s16 = "    user_agent = \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/"
		$s17 = "        new_comment_body = comment_body.replace('in', 'executed')" ascii fullword
		$s18 = "        self.subreddit.submit(self.listener_name, selftext=postContent)" ascii fullword
		$s19 = "def base64_decode(encoded_text):" ascii fullword
		$s20 = "            output = runTask(command)" ascii fullword
	condition:
		hash.sha256(0, filesize) == "dba80b543f6d39f2d0631f6cfebef961259746e6f70fb0cf1431e85343ba7d32" or uint16(0) == 0x6d69 and filesize < 20KB and 8 of them
}

rule cryptomining_malware_xmrig_config {
	meta:
		description = "Detects XMRig Config File"
		author = " [email protected] "
		date = "2021-06-28"
		license = "Apache License 2.0"
		hash1 = "1085c9211f2af8ddf1588adfb150c64c2b3a2b1c7acf4bc445546455f36299c0"
	strings:
		$ = "\"cpu-affinity\"" ascii wide nocase
		$ = "\"autosave\"" ascii wide nocase
		$ = "\"log-file\"" ascii wide nocase
		$ = "\"max-cpu-usage\"" ascii wide nocase
		$ = "\"donate-level\"" ascii wide nocase
		$ = "\"huge-pages\"" ascii wide nocase
		$ = "\"cpu-priority\"" ascii wide nocase
	condition:
		filesize < 500KB and 5 of them
}

rule pentest_tool_peirates {
	meta:
		description = "Detects Peirates"
		author = " [email protected] "
		date = "2021-06-28"
		license = "Apache License 2.0"
		hash1 = "a0418d568cfe788fe3d2d0558d70fb6d0e7769a2314c58ca04b57cc3225fe532"
	strings:
		$ = "/var/run/secrets/kubernetes.io/serviceaccount/" ascii wide nocase
		$ = "List of comma-seperated Pods" ascii wide nocase
		$ = "github.com/aws/aws-sdk-go/service/s3" ascii wide nocase
		$ = "S3).ListBucketsRequest" ascii wide nocase
	condition:
		all of them
}

rule pentest_tool_dopwn {
	meta:
		description = "Detects dopwn"
		author = " [email protected] "
		date = "2021-06-28"
		license = "Apache License 2.0"
		hash1 = "6fae4c6c34478fb515b8510d14071fc955a13e6bfb93121220342fec866317d1"
	strings:
		$ = "grab the digitalocean secret and take over the DO account too" ascii wide nocase
		$ = "registry/clusterrolebindings" ascii wide nocase
		$ = "k8s-ca-cert" ascii wide nocase
	condition:
		all of them
}

rule suspicious_cloud_credentials {
	meta:
		description = "Detects file containing a number of cloud credentials"
		author = " [email protected] "
		date = "2021-06-28"
		license = "Apache License 2.0"
		hash1 = "b58cf43cb4b000cb63334a8e20ca53e0112037daa178062c876a395092e1d8ca"
	strings:
		$ = ".aws/credentials" ascii wide nocase
		$ = ".config/gcloud/access_tokens.db" ascii wide nocase
		$ = ".azure/credentials" ascii wide nocase
	condition:
		all of them
}