mirror of
https://github.com/valitydev/signature-base.git
synced 2024-11-06 18:15:20 +00:00
164 lines
6.8 KiB
Plaintext
164 lines
6.8 KiB
Plaintext
/*
|
|
YARA Rule Set
|
|
Author: Florian Roth
|
|
Date: 2019-02-18
|
|
Identifier: Compromise of the Australian Parliament House network
|
|
Reference: https://cyber.gov.au/government/news/parliament-house-network-compromise/
|
|
https://twitter.com/cyb3rops/status/1097423665472376832
|
|
*/
|
|
|
|
/* Rule Set ----------------------------------------------------------------- */
|
|
|
|
rule APT_WebShell_Tiny_1 {
|
|
meta:
|
|
description = "Detetcs a tiny webshell involved in the Australian Parliament House network compromise"
|
|
author = "Florian Roth"
|
|
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
|
|
date = "2019-02-18"
|
|
strings:
|
|
$x1 = "eval(" ascii wide
|
|
condition:
|
|
( uint16(0) == 0x3f3c or uint16(0) == 0x253c ) and filesize < 40 and $x1
|
|
}
|
|
|
|
rule APT_WebShell_AUS_Tiny_2 {
|
|
meta:
|
|
description = "Detetcs a tiny webshell involved in the Australian Parliament House network compromise"
|
|
author = "Florian Roth"
|
|
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
|
|
date = "2019-02-18"
|
|
hash1 = "0d6209d86f77a0a69451b0f27b476580c14e0cda15fa6a5003aab57a93e7e5a5"
|
|
strings:
|
|
$x1 = "Request.Item[System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"[password]\"))];" ascii
|
|
$x2 = "eval(arguments,System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"" ascii
|
|
condition:
|
|
( uint16(0) == 0x3f3c or uint16(0) == 0x253c ) and filesize < 1KB and 1 of them
|
|
}
|
|
|
|
rule APT_WebShell_AUS_JScript_3 {
|
|
meta:
|
|
description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
|
|
author = "Florian Roth"
|
|
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
|
|
date = "2019-02-18"
|
|
hash1 = "7ac6f973f7fccf8c3d58d766dec4ab7eb6867a487aa71bc11d5f05da9322582d"
|
|
strings:
|
|
$s1 = "<%@ Page Language=\"Jscript\" validateRequest=\"false\"%><%try{eval(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String" ascii
|
|
$s2 = ".Item[\"[password]\"])),\"unsafe\");}" ascii
|
|
condition:
|
|
uint16(0) == 0x6568 and filesize < 1KB and all of them
|
|
}
|
|
|
|
|
|
rule APT_WebShell_AUS_4 {
|
|
meta:
|
|
description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
|
|
author = "Florian Roth"
|
|
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
|
|
date = "2019-02-18"
|
|
hash1 = "83321c02339bb51735fbcd9a80c056bd3b89655f3dc41e5fef07ca46af09bb71"
|
|
strings:
|
|
$s1 = "wProxy.Credentials = new System.Net.NetworkCredential(pusr, ppwd);" fullword ascii
|
|
$s2 = "{return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(" ascii
|
|
$s3 = ".Equals('User-Agent', StringComparison.OrdinalIgnoreCase))" ascii
|
|
$s4 = "gen.Emit(System.Reflection.Emit.OpCodes.Ret);" fullword ascii
|
|
condition:
|
|
uint16(0) == 0x7566 and filesize < 10KB and 3 of them
|
|
}
|
|
|
|
rule APT_Script_AUS_4 {
|
|
meta:
|
|
description = "Detetcs a script involved in the Australian Parliament House network compromise"
|
|
author = "Florian Roth"
|
|
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
|
|
date = "2019-02-18"
|
|
hash1 = "fdf15f388a511a63fbad223e6edb259abdd4009ec81fcc87ce84f0f2024c8057"
|
|
strings:
|
|
$x1 = "myMutex = CreateMutex(0, 1, \"teX23stNew\")" fullword ascii
|
|
$x2 = "mmpath = Environ(appdataPath) & \"\\\" & \"Microsoft\" & \"\\\" & \"mm.accdb\"" fullword ascii
|
|
$x3 = "Dim mmpath As String, newmmpath As String, appdataPath As String" fullword ascii
|
|
$x4 = "'MsgBox \"myMutex Created\" Do noting" fullword ascii
|
|
$x5 = "appdataPath = \"app\" & \"DatA\"" fullword ascii
|
|
$x6 = ".DoCmd.Close , , acSaveYes" fullword ascii
|
|
condition:
|
|
filesize < 7KB and 1 of them
|
|
}
|
|
|
|
rule APT_WebShell_AUS_5 {
|
|
meta:
|
|
description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
|
|
author = "Florian Roth"
|
|
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
|
|
date = "2019-02-18"
|
|
hash1 = "54a17fb257db2d09d61af510753fd5aa00537638a81d0a8762a5645b4ef977e4"
|
|
strings:
|
|
$a1 = "function DEC(d){return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(d));}" fullword ascii
|
|
$a2 = "function ENC(d){return Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(d));}" fullword ascii
|
|
|
|
$s1 = "var hash=DEC(Request.Item['" ascii
|
|
$s2 = "Response.Write(ENC(SET_ASS_SUCCESS));" fullword ascii
|
|
$s3 = "hashtable[hash] = assCode;" fullword ascii
|
|
$s4 = "Response.Write(ss);" fullword ascii
|
|
$s5 = "var hashtable = Application[CachePtr];" fullword ascii
|
|
condition:
|
|
uint16(0) == 0x7566 and filesize < 2KB and 4 of them
|
|
}
|
|
|
|
rule HKTL_LazyCat_LogEraser {
|
|
meta:
|
|
description = "Detetcs a tool used in the Australian Parliament House network compromise"
|
|
author = "Florian Roth"
|
|
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
|
|
date = "2019-02-18"
|
|
hash1 = "1c113dce265e4d744245a7c55dadc80199ae972a9e0ecbd0c5ced57067cf755b"
|
|
hash2 = "510375f8142b3651df67d42c3eff8d2d880987c0e057fc75a5583f36de34bf0e"
|
|
strings:
|
|
$x1 = "LazyCat.dll" ascii wide fullword
|
|
$x2 = ".local_privilege_escalation.rotten_potato" ascii wide
|
|
$x3 = "LazyCat.Extension" ascii wide
|
|
$x4 = " MEOWof" ascii wide
|
|
$x5 = "VirtualSite: {0}, Address: {1:X16}, Name: {2}, Handle: {3:X16}, LogPath: {4}" fullword wide
|
|
|
|
$s1 = "LazyCat" fullword ascii wide
|
|
$s2 = "$e3ff37f2-85d7-4b24-a385-7eeb1f5a9562"
|
|
$s3 = "local -> remote {0} bytes"
|
|
$s4 = "remote -> local {0} bytes"
|
|
condition:
|
|
3 of them
|
|
}
|
|
|
|
rule HKTL_PowerKatz_Feb19_1 {
|
|
meta:
|
|
description = "Detetcs a tool used in the Australian Parliament House network compromise"
|
|
author = "Florian Roth"
|
|
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
|
|
date = "2019-02-18"
|
|
strings:
|
|
$x1 = "Powerkatz32" ascii wide fullword
|
|
$x2 = "Powerkatz64" ascii wide
|
|
|
|
$s1 = "GetData: not found taskName" fullword ascii wide
|
|
$s2 = "GetRes Ex:" fullword ascii wide
|
|
condition:
|
|
1 of ($x*) and 1 of ($s*)
|
|
}
|
|
|
|
rule HKTL_Unknown_Feb19_1 {
|
|
meta:
|
|
description = "Detetcs a tool used in the Australian Parliament House network compromise"
|
|
author = "Florian Roth"
|
|
reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
|
|
date = "2019-02-18"
|
|
strings:
|
|
$x1 = "not a valid timeout format!" ascii wide fullword
|
|
$x2 = "host can not be empty!" ascii wide fullword
|
|
$x3 = "not a valid port format!" ascii wide fullword
|
|
$x4 = "{0} - {1} TTL={2} time={3}" ascii wide fullword
|
|
$x5 = "ping count is not a correct format!" ascii wide fullword
|
|
|
|
$s1 = "The result is too large,program store to '{0}'.Please download it manully." fullword ascii wide
|
|
$s2 = "C:\\Windows\\temp\\" ascii wide
|
|
condition:
|
|
1 of ($x*) or 2 of them
|
|
}
|