admin/elastic-protections-artifacts
1
0
Fork 0
mirror of https://github.com/elastic/protections-artifacts synced 2026-06-08 14:02:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updating artifacts

Browse Source
This commit is contained in:
protectionsmachine
2025-10-14 10:07:12 +00:00
parent 0d52fa9af8
commit b5a0c1956d
7 changed files with 159 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
yara/rules/Windows_Ransomware_Stop.yar
+3 -3
View File
@@ -2,9 +2,9 @@ rule Windows_Ransomware_Stop_1e8d48ff {
meta:
author = "Elastic Security"
id = "1e8d48ff-e0ab-478d-8268-a11f2e87ab79"
fingerprint = "715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb"
fingerprint = "bef9770e8deb4a5ba76cea1050ca0de1ef9ab6a6aa53f071126c3f0dacf368fd"
creation_date = "2021-06-10"
last_modified = "2021-08-23"
last_modified = "2025-09-26"
threat_name = "Windows.Ransomware.Stop"
reference_sample = "821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3"
severity = 100
@@ -14,7 +14,7 @@ rule Windows_Ransomware_Stop_1e8d48ff {
os = "windows"
strings:
$a = "E:\\Doc\\My work (C++)\\_Git\\Encryption\\Release\\encrypt_win_api.pdb" ascii fullword
$b = { 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF }
$b = { 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF FF FF C6 45 FC 01 50 FF D3 85 F6 79 36 56 68 }
condition:
any of them
}
yara/rules/Windows_Trojan_AveMaria.yar
+29
View File
@@ -30,3 +30,32 @@ rule Windows_Trojan_AveMaria_31d2bce9 {
8 of ($a*)
}
rule Windows_Trojan_AveMaria_e01305a0 {
meta:
author = "Elastic Security"
id = "e01305a0-724e-420a-99af-38a3c6436095"
fingerprint = "52acf71c9a53a56337722c43d9bba34957815b8c2c6fe52bea9b38e343dae803"
creation_date = "2025-08-18"
last_modified = "2025-09-19"
threat_name = "Windows.Trojan.AveMaria"
reference_sample = "21f1e24abcda47e08ba3e6bf19c0b2d9adb52b908f625c4a08f74ade5b863bf9"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "windows"
strings:
$a = "SOFTWARE\\_rptls" wide fullword
$b = "-w %ws -d C -f %s" fullword
$c = "RDPClip" wide fullword
$d = "ExplorerIdentifier" wide fullword
$e = "WM_FIND" wide fullword
$f = "WM_DISP" wide fullword
$g = "MsgBox.exe" wide fullword
$h = "Hey I'm Admin" wide fullword
$i = "/n:%temp%\\ellocnak.xml" wide fullword
$j = "CommandHandler::handleStartVncCommand() Start VNC on port : %d" wide fullword
condition:
7 of them
}
yara/rules/Windows_Trojan_CastleLoader.yar
+24
View File
@@ -0,0 +1,24 @@
rule Windows_Trojan_CastleLoader_173548b8 {
meta:
author = "Elastic Security"
id = "173548b8-ff11-4528-8ef6-7e9f7d738e6c"
fingerprint = "a894955aebf7db79279c58fa3800a21ec9c4cf44dcb6e516825824439931cc15"
creation_date = "2025-08-14"
last_modified = "2025-09-19"
threat_name = "Windows.Trojan.CastleLoader"
reference_sample = "1b6befc65b19a63b4131ce5bcc6e8c0552fe1e1d136ab94bc7d81b3924056156"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "windows"
strings:
$a = { 8B 34 BA 33 DB 03 F1 BA AA AA AA AA 38 1E 74 ?? 0F BE 0C 1E 8B C2 F6 C3 01 75 ?? C1 E8 03 0F AF C1 8B CA C1 E1 07 33 C1 EB ?? C1 E8 05 33 C1 8B CA C1 E1 0B 03 C1 F7 D0 43 33 D0 }
$b = { 8D 42 ?? 83 E0 03 0F B6 80 ?? ?? ?? ?? 66 33 44 0C ?? 66 89 84 0C ?? ?? ?? ?? 8D 42 ?? 83 E0 03 0F B6 80 ?? ?? ?? ?? 66 33 44 0C ?? 66 89 84 0C }
$c = { 3D 20 6C 72 70 75 ?? 81 7D F8 65 70 79 68 75 ?? 81 7D F4 20 20 76 72 75 ?? B9 01 }
$d = { 69 C0 6D 4E C6 41 05 39 30 00 00 }
$e = { 83 7C 24 ?? 20 0F 85 ?? ?? ?? ?? 80 7C 24 ?? B8 0F 85 ?? ?? ?? ?? B9 01 00 00 00 C7 44 24 ?? B8 BB 00 00 C7 44 24 ?? C0 C2 10 00 C7 44 24 ?? 00 00 00 00 }
condition:
4 of them
}
yara/rules/Windows_Trojan_HiddenCli.yar
+21
View File
@@ -0,0 +1,21 @@
rule Windows_Trojan_HiddenCli_a9aa62d1 {
meta:
author = "Elastic Security"
id = "a9aa62d1-f131-42c4-a62a-0172db697996"
fingerprint = "f546cfc4530294a778db94e5295227bb61e39af54526605da7f8224811ba5a3c"
creation_date = "2025-10-02"
last_modified = "2025-10-13"
threat_name = "Windows.Trojan.HiddenCli"
reference_sample = "913431f1d36ee843886bb052bfc89c0e5db903c673b5e6894c49aabc19f1e2fc"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "windows"
strings:
$b_1 = { 48 8B 0A 48 8D 45 E7 33 FF 4C 8D 45 EB 48 89 7C 24 38 BA 04 20 22 00 48 89 44 24 30 48 8D 45 27 }
$unicode_1 = { 43 00 6F 00 6D 00 6D 00 61 00 6E 00 64 00 20 00 27 00 73 00 74 00 61 00 74 00 65 00 27 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6C 00 00 00 }
condition:
1 of them
}
yara/rules/Windows_Trojan_HiddenDriver.yar
+25
View File
@@ -0,0 +1,25 @@
rule Windows_Trojan_HiddenDriver_e26590fd {
meta:
author = "Elastic Security"
id = "e26590fd-a560-4312-ba2f-4131f5817410"
fingerprint = "fe876e1cc0663fd41742a93807a4d49972fb92c3abf6560e323d1e31f8a9eb69"
creation_date = "2025-10-02"
last_modified = "2025-10-13"
threat_name = "Windows.Trojan.HiddenDriver"
reference_sample = "f9dd0b57a5c133ca0c4cab3cca1ac8debdc4a798b452167a1e5af78653af00c1"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "windows"
strings:
$activeProcessLinksOffsets = { C7 44 24 20 E8 00 00 00 C7 44 24 24 88 01 00 00 C7 44 24 28 E8 02 00 00 C7 44 24 2C F0 02 00 00 C7 44 24 30 48 04 00 00 }
$alloc_table = { 48 83 63 78 00 48 8D 8B 88 00 00 00 83 A3 80 00 00 00 00 B8 01 00 00 00 8B D0 48 89 43 68 45 33 C0 89 43 70 }
$str_0 = "InitializePsMonitor"
$str_1 = "image load notify registartion failed with code:%08x"
$str_2 = "file-system mini-filter haven't started"
$str_3 = "can't activate stealth mode"
condition:
$activeProcessLinksOffsets or $alloc_table or (all of ($str_*))
}
yara/rules/Windows_Trojan_Stealc.yar
+25
View File
@@ -69,3 +69,28 @@ rule Windows_Trojan_Stealc_5d3f297c {
all of them
}
rule Windows_Trojan_Stealc_41db1d4d {
meta:
author = "Elastic Security"
id = "41db1d4d-d19f-441b-82c3-5ae94ef2baab"
fingerprint = "be16274bf7c8fe038b19700aaae47ff0ffcf9cbb98ac93adb7e228c5854b782c"
creation_date = "2025-07-16"
last_modified = "2025-09-19"
threat_name = "Windows.Trojan.Stealc"
reference_sample = "a68bc167669c7c98b6742209acea111be61e6002aa652a7b8116af47b284b084"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "windows"
strings:
$a1 = "C:\\builder_v2\\stealc\\json.h" wide fullword
$a2 = "%08lX-%04hX-%04hX-%02hhX%02hhX-%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX" fullword
$a3 = "/c timeout /t 5 & del /f /q \"" fullword
$b1 = { 0F B7 C8 81 E9 19 04 00 00 74 14 83 E9 09 74 0F 83 E9 01 74 0A 83 E9 1C 74 05 83 F9 04 75 08 33 C9 FF }
$b2 = { 22 74 6F 74 61 6C 5F 70 61 72 74 73 22 3A 20 00 2C 20 00 00 00 00 00 00 22 70 61 72 74 5F 69 6E 64 65 78 22 3A 20 }
$b3 = { 48 89 5C 24 10 57 48 83 EC ?? 0F 57 C0 48 8D 3D [3] 00 0F 11 01 48 C7 41 10 00 00 00 00 48 8B D9 48 C7 41 18 0F 00 00 00 C6 01 00 8A 05 [3] 00 EB }
condition:
3 of them
}
yara/rules/Windows_Trojan_Tollbooth.yar
+32
View File
@@ -0,0 +1,32 @@
rule Windows_Trojan_Tollbooth_85bfcc68 {
meta:
author = "Elastic Security"
id = "85bfcc68-f375-4e19-817d-31ec43eac7eb"
fingerprint = "ce6b26e974a82a180f1e924f47279a1312557f7e379da4cd2cf80c7923b4e814"
creation_date = "2025-10-08"
last_modified = "2025-10-13"
threat_name = "Windows.Trojan.Tollbooth"
reference_sample = "c1ca053e3c346513bac332b5740848ed9c496895201abc734f2de131ec1b9fb2"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "windows"
strings:
$a = "sitemapRangeBegin" ascii wide fullword
$b = "seoGroupHijackbotUaMatchRules" ascii wide fullword
$c = "clean?type=conf" ascii wide fullword
$d = "/landpage?seoConfigId=" ascii wide fullword
$e = "<!- GP -->" ascii wide fullword
$f = "gooqlebot" ascii wide fullword
$g = "GetRandomLinesFromMultipleResources" ascii wide fullword
$h = "hj-plugin-iis-cpp-v"
$i = "hj-iis-cim-v" wide
$j = "<form action='/scjg' method='POST'"
$k = "AffLinkServer" ascii wide
$l = { 7B E6 9C AC E5 9C B0 E5 8F 8B E9 93 BE 7D }
$m = { 7B 00 2C 67 30 57 CB 53 FE 94 7D 00 }
condition:
7 of them
}