mirror of
https://github.com/ditekshen/detection
synced 2026-06-08 13:49:35 +00:00
Add and updates rules in malware and office
This commit is contained in:
ditekshen
@@ -73,14 +73,15 @@ rule INDICATOR_RTF_EXPLOIT_CVE_2017_11882_1 {
|
||||
description = "Detects RTF documents potentially exploiting CVE-2017-11882"
|
||||
author = "ditekSHen"
|
||||
strings:
|
||||
// 0002CE02-0000-0000-C000-000000000046: Equation
|
||||
// CVE-2017-11882 or CVE-2018-0802
|
||||
$s1 = "02ce020000000000c000000000000046" ascii nocase
|
||||
// 0002CE02-0000-0000-C000-000000000046: Equation <> CVE-2017-11882 or CVE-2018-0802
|
||||
$s1 = { 32[0-20](43|63)[0-20](45|65)[0-20]30[0-20]32[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20](43|63)[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]34[0-20]36}
|
||||
// Root Entry
|
||||
$s2 = "52006f006f007400200045006e00740072007900" ascii nocase
|
||||
// bin0
|
||||
$s3 = "\\bin0" ascii nocase
|
||||
// OLE Signature
|
||||
$ole1 = "d0cf11e0a1b11ae1" ascii nocase
|
||||
$olex = { (64|44)[0-1]30[0-1](63|43)[0-1](66|46)[0-1]31[0-1]31[0-1](65|45)[0-1]30[0-1](61|41)[0-1]31[0-1](62|42)[0-1]31[0-1]31[0-1](61|41) }
|
||||
$ole = { (64|44)[0-20]30[0-20](63|43)[0-20](66|46)[0-20]31[0-20]31[0-20](65|45)[0-20]30[0-20](61|41)[0-20]31[0-20](62|42)[0-20]31[0-20]31[0-20](61|41) }
|
||||
//$ole1 = "d0cf11e0a1b11ae1" ascii nocase
|
||||
//$ole2 = { 6430 [0-1] 6366 [0-1] 3131 [0-1] 6530 [0-1] 6131 [0-1] 6231 [0-1] 3161 }
|
||||
//$ole3 = { 4430 [0-1] 4346 [0-1] 3131 [0-1] 4530 [0-1] 4131 [0-1] 4231 [0-1] 3141 }
|
||||
//$ole4 = { 64[0-1]30[0-1]63[0-1]66[0-1]31[0-1]31[0-1]65[0-1]30[0-1]61[0-1]31[0-1]62[0-1]31[0-1]31[0-1]61 }
|
||||
@@ -93,7 +94,7 @@ rule INDICATOR_RTF_EXPLOIT_CVE_2017_11882_1 {
|
||||
$obj5 = "\\objautlink" ascii
|
||||
$obj6 = "\\objlink" ascii
|
||||
condition:
|
||||
uint32(0) == 0x74725c7b and all of ($s*) and 1 of ($ole*) and 2 of ($obj*)
|
||||
uint32(0) == 0x74725c7b and 2 of ($s*) and $ole and 2 of ($obj*)
|
||||
}
|
||||
|
||||
rule INDICATOR_RTF_EXPLOIT_CVE_2017_11882_2 {
|
||||
@@ -106,6 +107,7 @@ rule INDICATOR_RTF_EXPLOIT_CVE_2017_11882_2 {
|
||||
$eq1 = "02ce020000000000c000000000000046" ascii nocase
|
||||
$eq2 = "equation." ascii nocase
|
||||
$eq3 = "6551754174496f4e2e33" ascii nocase
|
||||
$eq4 = { 32[0-20](43|63)[0-20](45|65)[0-20]30[0-20]32[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20](43|63)[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]34[0-20]36 }
|
||||
// Embedded Objects
|
||||
$obj1 = "\\objhtml" ascii
|
||||
$obj2 = "\\objdata" ascii
|
||||
@@ -132,10 +134,12 @@ rule INDICATOR_RTF_EXPLOIT_CVE_2017_11882_3 {
|
||||
// Ole10Native
|
||||
$ole1 = "4f006c006500310030004e00410054004900760065" ascii nocase
|
||||
$ole2 = { (3666|3466) (3663|3463) (3635|3435) 3331 3330 (3665|3465) (3631|3431) (3734|3534) (3639|3439) (3736|3536) (3635|3435) }
|
||||
$ole3 = { (4f|6f)[0-5](4c|6c)[0-5](45|65)[0-5]30[0-5](4e|6e)[0-5](41|61)[0-5](54|74)[0-5](49|69)[0-5](56|76)[0-5](45|65) }
|
||||
// CVE-2017-11882 or CVE-2018-0802
|
||||
// 0002CE02-0000-0000-C000-000000000046: Equation
|
||||
$clsid1 = "2ce020000000000c000000000000046" ascii nocase
|
||||
$clsid2 = { 32 (43|63) (45|65) 30 32 30 30 30 30 30 30 30 30 30 30 (43|63) 30 30 30 30 30 30 30 30 30 30 30 30 30 34 36 }
|
||||
$clsid3 = { 32[0-20](43|63)[0-20](45|65)[0-20]30[0-20]32[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20](43|63)[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]34[0-20]36 }
|
||||
// Root Entry
|
||||
$re = "52006f006f007400200045006e00740072007900" ascii nocase
|
||||
// Embedded Objects
|
||||
@@ -157,8 +161,9 @@ rule INDICATOR_RTF_EXPLOIT_CVE_2017_11882_4 {
|
||||
strings:
|
||||
// equation.3 manipulated
|
||||
// is slowing down scanning, but good detection rate
|
||||
$s1 = { (36|34)[0-5]35[0-5](37|35)[0-5]31[0-5](37|35)[0-5]35[0-5](36|34)[0-5]31[0-5](37|35)[0-5]34[0-5](36|34)[0-5]39[0-5](36|34)[0-5]66[0-5](36|34)[0-5]65[0-5]32[0-5]65[0-5]33[0-5]33 }
|
||||
$s2 = { (7d|5c|2b|24)[0-5](37|35)[0-5]31[0-5](37|35)[0-5]35[0-5](36|34)[0-5]31[0-5](37|35)[0-5]34[0-5](36|34)[0-5]39[0-5](36|34)[0-5]66[0-5](36|34)[0-5]65[0-5]32[0-5]65[0-5]33[0-5]33 }
|
||||
$s1 = { (36|34)[0-50]35[0-50](37|35)[0-50]31[0-50](37|35)[0-50]35[0-50](36|34)[0-50]31[0-50](37|35)[0-50]34[0-50](36|34)[0-50]39[0-50](36|34)[0-50]66[0-50](36|34)[0-50]65[0-50]32[0-50]65[0-50]33[0-50]33 }
|
||||
$s2 = { (7d|5c|2b|24)[0-50](37|35)[0-50]31[0-50](37|35)[0-50]35[0-50](36|34)[0-50]31[0-50](37|35)[0-50]34[0-50](36|34)[0-50]39[0-50](36|34)[0-50]66[0-50](36|34)[0-50]65[0-50]32[0-50]65[0-50]33[0-50]33 }
|
||||
$s3 = { 32[0-20](43|63)[0-20](45|65)[0-20]30[0-20]32[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20](43|63)[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]30[0-20]34[0-20]36 }
|
||||
// NOT slowing down scanning, but FN prone
|
||||
// $s3 = { (36|34)[0-1]35[0-1](37|35)[0-1]31[0-1](37|35)[0-1]35[0-1](36|34)[0-1]31[0-1](37|35)[0-1]34[0-1](36|34)[0-1]39[0-1](36|34)[0-1]66[0-1](36|34)[0-1]65[0-1]3265[0-1]3333 }
|
||||
//$s4 = { (7d|5c|2b|24)[0-1](37|35)[0-1]31[0-1](37|35)[0-1]35[0-1](36|34)[0-1]31[0-1](37|35)[0-1]34[0-1](36|34)[0-1]39[0-1](36|34)[0-1]66[0-1](36|34)[0-1]65[0-1]3265[0-1]3333 }
|
||||
|
||||
@@ -11317,3 +11317,43 @@ rule MALWARE_Win_PWSHDLLDL {
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and pe.is_dll() and 5 of them
|
||||
}
|
||||
|
||||
rule MALWARE_Win_NPPSpy {
|
||||
meta:
|
||||
author = "ditekShen"
|
||||
description = "Detects NPPSpy / Ntospy"
|
||||
strings:
|
||||
$s1 = "ntskrnl.dll" fullword ascii
|
||||
$s2 = "PasswordStealing.dll" fullword ascii
|
||||
$s3 = "ntoskrnl.dll" fullword ascii
|
||||
$s4 = "\\programdata\\packag~" ascii
|
||||
$s5 = "NPPSPY.dll" fullword ascii
|
||||
$s6 = "MSControll.dll" fullword ascii
|
||||
$s7 = "\\Windows\\Temp\\" ascii
|
||||
$s8 = "\\NPPSpy\\" ascii
|
||||
// hunt
|
||||
$s9 = "NPGetCaps" fullword ascii
|
||||
$s10 = "NPLogonNotify" fullword ascii
|
||||
// C:\Users\GrzegorzTworek\source\repos\NPPSpy\x64\Release\NPPSPY.pdb
|
||||
$path = "\\GrzegorzTworek\\" ascii
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and ((pe.is_dll() and filesize < 110KB and pe.number_of_exports == 2 and ((pe.exports("NPGetCaps") and pe.exports("NPLogonNotify")) or (1 of ($s*) and (pe.exports("NPGetCaps") or pe.exports("NPLogonNotify"))))) or (($path) and any of ($s*)))
|
||||
}
|
||||
|
||||
rule MALWARE_Win_AgentRacoon {
|
||||
meta:
|
||||
author = "ditekShen"
|
||||
description = "Detects AgentRacoon. Not Raccoon"
|
||||
strings:
|
||||
$s1 = "UdpClient" fullword ascii
|
||||
$s2 = "IPEndPoint" fullword ascii
|
||||
$s3 = "get_Client" fullword ascii
|
||||
$s4 = "set_ReceiveTimeout" fullword ascii
|
||||
$s5 = "Command failed:" wide
|
||||
$s6 = "uploaded" wide
|
||||
$s7 = "downloaded" wide
|
||||
$s8 = ".telemetry." wide
|
||||
$s9 = "xn--" wide
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and 4 of them
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user