From 13b979f2c40d8cb1cb5795cd0e8e951172939c61 Mon Sep 17 00:00:00 2001 From: "GitHub Actions [Bot]" Date: Fri, 9 Feb 2024 17:53:34 +0000 Subject: [PATCH] Auto-generated detection artifacts --- csv/leaked.csv | 12 ++++++------ yara/anydesk_leaked_certificate.yar | 18 ++++++++++++++++++ yara/hacking_team_malicious_certificate.yar | 18 ++++++++++++++++++ yara/hangil_it_leaked_certificate.yar | 18 ++++++++++++++++++ 4 files changed, 60 insertions(+), 6 deletions(-) create mode 100644 yara/anydesk_leaked_certificate.yar create mode 100644 yara/hacking_team_malicious_certificate.yar create mode 100644 yara/hangil_it_leaked_certificate.yar diff --git a/csv/leaked.csv b/csv/leaked.csv index dae00de..a323b5d 100644 --- a/csv/leaked.csv +++ b/csv/leaked.csv @@ -1,11 +1,11 @@ name,status,source,description,references,date,author,issuer,timestamp,serial -msi_leaked_certificate,revoked,leaked,Leaked certificate from MicroStar International (MSI) driver package. -,https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html,31-08-2023,WithSecure,DigiCert SHA2 Assured ID Code Signing CA,,0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75 -lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS. -,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5 -lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS. -,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18 hangil_it_leaked_certificate,revoked,leaked,Leaked Hangil IT Co., Ltd certificate utilised by various malware. ,,15-11-2023,Riccardo Ancarani,Sectigo Public Code Signing CA R36,,01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45 anydesk_leaked_certificate,revoked,leaked,AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement ,https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar,07-02-2024,Florian Roth,DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,1706486400,0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8 +lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS. +,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5 +lapsus_nvidia_leaked_certificate,revoked,leaked,Leaked NVIDIA certificate utilised by LAPSUS. +,https://www.malwarebytes.com/blog/news/2022/03/stolen-nvidia-certificates-used-to-sign-malware-heres-what-to-do,31-08-2023,Florian Roth,VeriSign Class 3 Code Signing 2010 CA,1646092800,14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18 +msi_leaked_certificate,revoked,leaked,Leaked certificate from MicroStar International (MSI) driver package. +,https://thehackernews.com/2023/05/msi-data-breach-private-code-signing.html,31-08-2023,WithSecure,DigiCert SHA2 Assured ID Code Signing CA,,0b:88:60:32:86:1d:95:53:c6:8f:80:33:13:a9:89:75 diff --git a/yara/anydesk_leaked_certificate.yar b/yara/anydesk_leaked_certificate.yar new file mode 100644 index 0000000..5211fae --- /dev/null +++ b/yara/anydesk_leaked_certificate.yar @@ -0,0 +1,18 @@ +import "pe" + +rule leaked_anydesk_leaked_certificate { + meta: + status = "revoked" + source = "leaked" + description = "AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement" + references = "https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar" + date = "07-02-2024" + author = "Florian Roth" + + condition: + uint16(0) == 0x5a4d and pe.timestamp > 1706486400 and + for any i in (0 .. pe.number_of_signatures) : ( + pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and + pe.signatures[i].serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" + ) +} \ No newline at end of file diff --git a/yara/hacking_team_malicious_certificate.yar b/yara/hacking_team_malicious_certificate.yar new file mode 100644 index 0000000..b021a2f --- /dev/null +++ b/yara/hacking_team_malicious_certificate.yar @@ -0,0 +1,18 @@ +import "pe" + +rule malicious_hacking_team_malicious_certificate { + meta: + status = "expired" + source = "malicious" + description = "Certificate utilised by Hacking Team." + references = "https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days" + date = "15-11-2023" + author = "WithSecure" + + condition: + uint16(0) == 0x5a4d and + for any i in (0 .. pe.number_of_signatures) : ( + pe.signatures[i].issuer contains "VeriSign Class 3 Code Signing 2010 CA" and + pe.signatures[i].serial == "0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d" + ) +} \ No newline at end of file diff --git a/yara/hangil_it_leaked_certificate.yar b/yara/hangil_it_leaked_certificate.yar new file mode 100644 index 0000000..140e6c7 --- /dev/null +++ b/yara/hangil_it_leaked_certificate.yar @@ -0,0 +1,18 @@ +import "pe" + +rule leaked_hangil_it_leaked_certificate { + meta: + status = "revoked" + source = "leaked" + description = "Leaked Hangil IT Co., Ltd certificate utilised by various malware." + references = "" + date = "15-11-2023" + author = "Riccardo Ancarani" + + condition: + uint16(0) == 0x5a4d and + for any i in (0 .. pe.number_of_signatures) : ( + pe.signatures[i].issuer contains "Sectigo Public Code Signing CA R36" and + pe.signatures[i].serial == "01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45" + ) +} \ No newline at end of file