Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs
This commit is contained in:
SsSnake
273
data/ioc/yara/rules.yara
Normal file
273
data/ioc/yara/rules.yara
Normal file
@@ -0,0 +1,273 @@
|
||||
rule powershell_dropper {
|
||||
meta:
|
||||
author = "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$a = "$decentID = [System.Convert]::FromBase64String($indecentID)"
|
||||
$b = "if($tmp[1].CPU -gt 0) {} else {[ReverseTCPShell]::run()}"
|
||||
$c = "function Get-RSACode()"
|
||||
$d = "-file %temp%\\233.ps1"
|
||||
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule dropper_strings {
|
||||
meta:
|
||||
author = "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$a = "bitsadmin /canceft\\windows\\currebitsadmin /addfibitsadmin /Resumbitsadmin /SetNosoftware"
|
||||
$b = "\\microsotifyCmdLine %s rle %s c:\\windowsbitsadmin /creat\\system32\\net.ex"
|
||||
$c = "rundll32.exe %s Main"
|
||||
$d = "d1fasg34"
|
||||
$e = "FindResource %s error"
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and 2 of them
|
||||
}
|
||||
|
||||
rule payload_wab32res_strings {
|
||||
meta:
|
||||
author = "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$a1 = "%02d%02d%02d%02d%02d%03d"
|
||||
$a2 = "459B2-3311-54C3- /Processid:{712"
|
||||
$a3 = "CreateProcess %s"
|
||||
$a4 = "FakeRun.dll"
|
||||
$a5 = "Release\\FakeRun.pdb"
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and 2 of them
|
||||
}
|
||||
|
||||
rule pcnt_cert {
|
||||
meta:
|
||||
author = "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$a = "MIIDWjCCAkICCQCdeJZhGKJakTANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJV"
|
||||
$b = "UzERMA8GA1UECAwITmVicmFza2ExEDAOBgNVBAcMB0xpbmNvbG4xDTALBgNVBAoM"
|
||||
$c = "BFBDTlQxDTALBgNVBAsMBFBDTlQxHTAbBgkqhkiG9w0BCQEWDnBjbnRAZ21haWwu"
|
||||
$d = "Y29tMB4XDTE4MDEwNjA2MDMyMloXDTI4MDEwNDA2MDMyMlowbzELMAkGA1UEBhMC"
|
||||
$e = "VVMxETAPBgNVBAgMCE5lYnJhc2thMRAwDgYDVQQHDAdMaW5jb2xuMQ0wCwYDVQQK"
|
||||
$f = "DARQQ05UMQ0wCwYDVQQLDARQQ05UMR0wGwYJKoZIhvcNAQkBFg5wY250QGdtYWls"
|
||||
$g = "LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK+ihHezE6jjS2Vl"
|
||||
$h = "/rIIQsrczmbjU/4KYDiLiCcrxN0tht6GzL281KGoW13IiQvKILANmx02IAy5tzij"
|
||||
$i = "0W9ZvFAIRRYVDpoSU+EyXz4LjHgXvw6VeG9v3HV99iSmphkq7mLYee0EPYP6wSdB"
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and all of them
|
||||
}
|
||||
|
||||
rule custom_decryption {
|
||||
meta:
|
||||
author = "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$encrypt = { 8b d6 81 e2 07 00 00 80 79 05 4a 83 ca f8 42 8a 04 1e 0f be 0c 95 28 7e 46 00 34 01 0f be c0 0f af c8 80 f1 67 88 0c 1e 46 3b f7 7c d3 }
|
||||
$encrypt2 = { 8A 0C 30 8B D0 83 E2 07 80 F1 01 0F BE C9 0F BE 54 95 D0 0F AF D1 80 F2 85 88 14 30 40 }
|
||||
$decrypt_file1 = { 0f b6 01 8b d6 83 e2 07 34 01 0f be c0 83 c6 04 0f be }
|
||||
$decrypt_file2 = { 0f af d0 0f b6 41 01 34 01 0f be c0 88 11 8d 14 0f 83 e2 07 0f be }
|
||||
$decrypt_file3 = { 0f af d0 0f b6 41 02 34 01 0f be c0 88 51 01 8d 14 0b 83 e2 07 0f be }
|
||||
$decrypt_file4 = { 0f af d0 0f b6 41 03 34 01 0f be c0 88 51 02 8b 55 fc 03 d1 83 e2 07 0f be }
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and ($encrypt or $encrypt2 or all of ($decrypt_file*))
|
||||
}
|
||||
|
||||
rule tclient_strings {
|
||||
meta:
|
||||
author = "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$a = "sdf81msdf7"
|
||||
$b = "software\\klive"
|
||||
$c = "\\Registry\\User\\%s\\Software\\KLive"
|
||||
$d = "%s\\wab32res.dll"
|
||||
$e = "[!]NtDeleteValueKey Error:%ul"
|
||||
$f = "%sDebugLog.TXT"
|
||||
$g = "Server connect to [%s:%d] Sucesse! token = %s"
|
||||
$h = "192.168.70.1"
|
||||
$i = "Start %d connect %s:%d"
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and 3 of them
|
||||
}
|
||||
|
||||
rule tclient_string {
|
||||
meta:
|
||||
author= "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$a = "showgodmoney1gz"
|
||||
$b = "MDDEFGEGETGIZ"
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and 2 of them
|
||||
}
|
||||
|
||||
rule dsng_installer_dll_characteristics {
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$s1 = "dsng.dll"
|
||||
$s2 = "InstallD" fullword
|
||||
$s3 = "InstallZ" fullword
|
||||
|
||||
condition:
|
||||
//MZ header
|
||||
uint16(0) == 0x5A4D and
|
||||
|
||||
//PE signature
|
||||
uint32(uint32(0x3C)) == 0x00004550 and
|
||||
|
||||
all of them
|
||||
}
|
||||
|
||||
rule dsng_installer_dll_stringset {
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$s1 = "KCOM Server Security Guard"
|
||||
$s2 = "LoadFlgDllFun"
|
||||
$s3 = "Installv" fullword
|
||||
$s4 = "Dll path %s"
|
||||
$s5 = "MainFunVvv"
|
||||
$s6 = "http://dsas.asdf.com/"
|
||||
|
||||
condition:
|
||||
//MZ header
|
||||
uint16(0) == 0x5A4D and
|
||||
//PE signature
|
||||
uint32(uint32(0x3C)) == 0x00004550 and
|
||||
2 of them
|
||||
}
|
||||
|
||||
rule tibetan_indecent_rtf_meta {
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$operator = "{\\operator Windows \\'d3\\'c3\\'bb\\'a7}"
|
||||
|
||||
condition:
|
||||
any of them
|
||||
}
|
||||
|
||||
rule tibetan_indecent_ppsx_meta
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$createdby = "<dc:creator>Windows User</dc:creator>"
|
||||
$createdate = "<dcterms:created xsi:type=\"dcterms:W3CDTF\">2017-10-23T00:57:05Z</dcterms:created>"
|
||||
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
|
||||
rule tibetan_indecent_powershell
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$decents1 = "$indecentID" ascii wide
|
||||
$decents2 = "$decentID" ascii wide
|
||||
$decents3 = "powershell" ascii wide nocase
|
||||
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
|
||||
rule tibetan_indecent_pe_loader_pdb
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
//C:\Users\learn\Desktop\免杀\
|
||||
$pdb = {43 3a 5c 55 73 65 72 73 5c 6c 65 61 72 6e 5c 44 65 73 6b 74 6f 70 5c e5 85 8d e6 9d 80}
|
||||
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
|
||||
rule tibetan_indecent_powershell_tcpshell_funcs
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$class = "public class ReverseTCPShell" ascii wide nocase
|
||||
$func1 = "public static void run" ascii wide nocase
|
||||
$func2 = "public static void runth" ascii wide nocase
|
||||
$func3 = "public static void start" ascii wide nocase
|
||||
$func4 = "public static bool isOnline" ascii wide nocase
|
||||
$func5 = "public static void startCmd" ascii wide nocase
|
||||
$func6 = "public static void CmdExited" ascii wide nocase
|
||||
$func7 = "public static void DataReceived" ascii wide nocase
|
||||
$func8 = "public static void FileReceive" ascii wide nocase
|
||||
$func9 = "public static void CmdManager" ascii wide nocase
|
||||
$func10 = "public static void SortOutputHandler" ascii wide nocase
|
||||
$func11 = "public static void SendLoginInfo" ascii wide nocase
|
||||
$func12 = "public static void Send" ascii wide nocase
|
||||
$func13 = "public static int SendWithSplit" ascii wide nocase
|
||||
|
||||
condition:
|
||||
6 of them
|
||||
|
||||
}
|
||||
|
||||
rule tibetan_indecent_infrastructure_strings
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$cc1 = "103.55.24.196" ascii wide nocase
|
||||
$cc2 = "118.99.59.105" ascii wide nocase
|
||||
$cc3 = "27.126.186.222" ascii wide nocase
|
||||
$cc4 = "45.127.97.222" ascii wide nocase
|
||||
$cc5 = "comemail.email" ascii wide nocase
|
||||
$cc6 = "commail.co" ascii wide nocase
|
||||
$cc7 = "daynew.today" ascii wide nocase
|
||||
$cc8 = "daynews.today" ascii wide nocase
|
||||
$cc9 = "tibetfrum.info" ascii wide nocase
|
||||
$cc10 = "tibethouse.info" ascii wide nocase
|
||||
$cc11 = "tibetnews.info" ascii wide nocase
|
||||
$cc12 = "tibetnews.today" ascii wide nocase
|
||||
|
||||
condition:
|
||||
any of them
|
||||
|
||||
}
|
||||
|
||||
rule silent_ppk_strings
|
||||
{
|
||||
meta:
|
||||
author = "Geoff Alexander <geoff@citizenlab.ca>"
|
||||
|
||||
strings:
|
||||
$s1 = "MainCommandJobSub"
|
||||
$s2 = "MainFun002"
|
||||
$s3 = "mRecvPkgFun"
|
||||
$s4 = "while -- ClientConnect"
|
||||
$s5 = "svsdll.log"
|
||||
$s6 = "ppk.dat"
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and 4 of ($s*)
|
||||
}
|
||||
Reference in New Issue
Block a user