Add signatures

clamav/indicator_rmm.ldb

@@ -10,3 +10,4 @@ ditekSHen.INDICATOR.Win.RMM.PulseWay;Engine:51-255,Target:1;(0|1|2|3|4|5|6|7|8)>
 ditekSHen.INDICATOR.Win.RMM.ManageEngine-ZohoMeeting;Engine:51-255,Target:1;0&1&2&3&4&5&6&7;55454d53202d2052656d6f746520436f6e74726f6c::w;4167656e74486f6f6b2e646c6c::w;62696e5c436c69656e744175746848616e646c65722e646c6c::w;496e7374616c6c20686f6f6b2e2e2e2e::w;696e6469612e616476656e746e65742e636f6d2f6d6565742e7361733f6b3d;6463546370536f636b65743a3a;25732f25733f636c69656e7449643d25732673657373696f6e49643d257326636c69656e744e616d653d2573267469636b65743d257326636f6e6e656374696f6e49643d2573;2e5c656e67696e65735c6363676f73745c676f73745f
 ditekSHen.INDICATOR.Win.RMM.Atera;Engine:51-255,Target:1;(0&1&2&3&4)>2;534f4654574152455c4154455241204e6574776f726b735c416c7068614167656e74::w;416c706861436f6e74726f6c4167656e745c6f626a5c52656c656173655c41746572614167656e742e706462;416c706861436f6e74726f6c4167656e742e436c6f75644c6f67734d616e616765722b3c3e;4d6f6e69746f72696e672026204d616e6167656d656e74204167656e74206279204154455241::aw;6167656e742d6170692d7b307d2e61746572612e636f6d::w
 ditekSHen.INDICATOR.Win.RMM.SplashtopStreamer;Engine:51-255,Target:1;(0&1&2&3&4&5)>3;5c736c6176655c776f726b73706163655c4749545f57494e5f5352535f466f726d616c5c536f757263655c697269737365727665725c;536f6674776172655c53706c617368746f7020496e632e5c53706c617368746f70::w;2e6170692e73706c617368746f702e636f6d::w;726573746172746564207468652073747265616d65722e256e4170702076657273696f6e3a202531::w;53706c617368746f702d53706c617368746f702053747265616d65722d::w;5b52656d6f766553747265616d65725d2053656e64206d7367203220636c6f75642825643a25643a256429::w
+ditekSHen.INDICATOR.Win.RMM.AeroAdmin;Engine:51-255,Target:1;(0&1&2&3&4&5&6)>3;5c4165726f41646d696e::w;2e6165726f61646d696e2e636f6d::w;584165726f61646d696e417070526573746172746572::w;5c4e6574776f726b5c4165726f61646d696e53657276696365::w;4165726f41646d696e207b7d;464165726f41646d696e2e637070;504f5354202f73696d732f73696d735f6e65772e706870

yara/indicator_rmm.yar

@@ -417,3 +417,45 @@ rule INDICATOR_RMM_SplashtopStreamer_CERT {
             pe.signatures[i].subject contains "Splashtop Inc."
         )
 }
+
+rule INDICATOR_RMM_AeroAdmin {
+    meta:
+        author = "ditekSHen"
+        description = "Detects AeroAdmin. Review RMM Inventory"
+        clamav1 = "INDICATOR.Win.RMM.AeroAdmin"
+        reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv"
+        reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a"
+        reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf"
+        reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+    strings:
+        $s1 = "\\AeroAdmin" wide
+        $s2 = ".aeroadmin.com" ascii wide
+        $s3 = "XAeroadminAppRestarter" wide
+        $s4 = "SYSTEM\\ControlSet001\\Control\\SafeBoot\\Network\\AeroadminService" wide
+        $s5 = "AeroAdmin {}" ascii
+        $s6 = "FAeroAdmin.cpp" fullword ascii
+        $s7 = "Referer: http://900100.net" ascii
+        $s8 = "POST /sims/sims_new.php" ascii
+        $s9 = "aeroadmin.pdb" ascii
+    condition:
+        uint16(0) == 0x5a4d and 4 of them
+}
+
+rule INDICATOR_RMM_AeroAdmin_CERT {
+    meta:
+        author = "ditekSHen"
+        description = "Detects AeroAdmin by certificate. Review RMM Inventory"
+        clamav1 = "INDICATOR.Win.RMM.AeroAdmin"
+        reference1 = "https://github.com/ditekshen/detection/blob/master/RMM_Inventory.csv"
+        reference2 = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a"
+        reference3 = "https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf"
+        reference4 = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+    condition:
+        uint16(0) == 0x5a4d and
+        for any i in (0..pe.number_of_signatures): (
+            pe.signatures[i].issuer contains "GlobalSign" and (
+                pe.signatures[i].subject contains "Aeroadmin LLC" or
+                pe.signatures[i].subject contains "@aeroadmin.com"
+            )
+        )
+}

yara/indicator_tools.yar

@@ -1737,3 +1737,19 @@ rule INDICATOR_TOOL_SharpLDAP {
     condition:
         uint16(0) == 0x5a4d and ((1 of ($x*) and 4 of ($s*)) or (5 of ($s*)))
 }
+
+rule INDICATOR_TOOL_Pandora {
+    meta:
+        author = "ditekSHen"
+        description = "Detects Pandora tool to extract credentials from password managers"
+    strings:
+        $s1 = "process PID:" fullword wide
+        $s2 = "Dump file created:" fullword wide
+        $s3 = "System.Security.AccessControl.FileSystemAccessRule('Everyone', 'FullControl', 'Allow')" ascii
+        $s4 = "{[math]::Round($_.PrivateMemorySize64" ascii
+        $s5 = "rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump $" ascii
+        $s6 = "\"payload\":{\"logins\":" ascii
+        $s7 = "\\pandora.pdb" ascii
+    condition:
+        uint16(0) == 0x5a4d and 5 of them
+}

yara/malware.yar

@@ -11184,3 +11184,23 @@ rule MALWARE_Win_VenomRAT {
     condition:
        uint16(0) == 0x5a4d and (1 of ($x*) and 2 of ($s*))
 }
+
+rule MALWARE_Win_SapphireStealer {
+    meta:
+        author = "ditekSHen"
+        description = "Detects SapphireStealer"
+    strings:
+       $s1 = "Sapphire.Modules." ascii
+       $s2 = "sapphire\\" wide
+       $s3 = "by r3vengerx0" wide
+       $s4 = "Sapphire\\obj\\" ascii
+       $s5 = "[ERROR_GETSECRETKEY_METHOD]" fullword wide
+       $s6 = "[ERROR_CANT_GET_PASSWORD]" fullword wide
+       $s7 = "<h2>------NEW LOGS------</h2>" wide
+       $s8 = "[ERROR] can't create grab directory" wide
+       $s9 = "<UploadToTelegram>d__" ascii
+       $s10 = "UploadToTelegram" ascii
+       $s11 = ".SendLog+<UploadToTelegram>d__" ascii
+    condition:
+       uint16(0) == 0x5a4d and 5 of them
+}