Auto-generated detection artifacts

2026-06-08 12:21:31 +00:00 · 2024-02-09 17:53:34 +00:00
parent b7fecf20e7
commit 13b979f2c4
4 changed files with 60 additions and 6 deletions
@@ -1,11 +1,11 @@
 name,status,source,description,references,date,author,issuer,timestamp,serial
-msi_leaked_certificate,revoked,leaked,Leaked certificate from MicroStar International (MSI) driver package.
-,https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html,31-08-2023,WithSecure,DigiCert SHA2 Assured ID Code Signing CA,,0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75
-lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.
-,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5
-lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.
-,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
 hangil_it_leaked_certificate,revoked,leaked,Leaked Hangil IT Co., Ltd certificate utilised by various malware.
 ,,15-11-2023,Riccardo Ancarani,Sectigo Public Code Signing CA R36,,01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45
 anydesk_leaked_certificate,revoked,leaked,AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement 
 ,https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar,07-02-2024,Florian Roth,DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,1706486400,0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8
+lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.
+,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5
+lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS.
+,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18
+msi_leaked_certificate,revoked,leaked,Leaked certificate from MicroStar International (MSI) driver package.
+,https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html,31-08-2023,WithSecure,DigiCert SHA2 Assured ID Code Signing CA,,0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75
@@ -0,0 +1,18 @@
+import "pe"
+
+rule leaked_anydesk_leaked_certificate {
+   meta:
+      status = "revoked"
+      source = "leaked"
+      description = "AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement"
+      references = "https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar"
+      date = "07-02-2024"
+      author = "Florian Roth"
+      
+   condition:
+      uint16(0) == 0x5a4d and pe.timestamp > 1706486400 and
+      for any i in (0 .. pe.number_of_signatures) : (
+         pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and
+         pe.signatures[i].serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8"
+      )
+}
@@ -0,0 +1,18 @@
+import "pe"
+
+rule malicious_hacking_team_malicious_certificate {
+   meta:
+      status = "expired"
+      source = "malicious"
+      description = "Certificate utilised by Hacking Team."
+      references = "https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days"
+      date = "15-11-2023"
+      author = "WithSecure"
+      
+   condition:
+      uint16(0) == 0x5a4d and 
+      for any i in (0 .. pe.number_of_signatures) : (
+         pe.signatures[i].issuer contains "VeriSign Class 3 Code Signing 2010 CA" and
+         pe.signatures[i].serial == "0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d"
+      )
+}
@@ -0,0 +1,18 @@
+import "pe"
+
+rule leaked_hangil_it_leaked_certificate {
+   meta:
+      status = "revoked"
+      source = "leaked"
+      description = "Leaked Hangil IT Co., Ltd certificate utilised by various malware."
+      references = ""
+      date = "15-11-2023"
+      author = "Riccardo Ancarani"
+      
+   condition:
+      uint16(0) == 0x5a4d and 
+      for any i in (0 .. pe.number_of_signatures) : (
+         pe.signatures[i].issuer contains "Sectigo Public Code Signing CA R36" and
+         pe.signatures[i].serial == "01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45"
+      )
+}