18 lines
598 B
Text
18 lines
598 B
Text
|
rule Linux_Wiper_SOLOSHRED {
|
||
|
|
meta:
|
||
|
|
description = "Detects SOLOSHRED wiper used against Ukrainian ICS"
|
||
|
|
reference = "https://github.com/cado-security/DFIR_Resources_Industroyer2"
|
||
|
|
author = "mmuir@cadosecurity.com"
|
||
|
|
date = "2022-04-12"
|
||
|
|
license = "Apache License 2.0"
|
||
|
|
hash = "87ca2b130a8ec91d0c9c0366b419a0fce3cb6a935523d900918e634564b88028"
|
||
|
|
strings:
|
||
|
|
$a = "printenv | grep -i \"ora\"" ascii
|
||
|
|
$b = "shred" ascii
|
||
|
|
$c = "--no-preserve-root" ascii
|
||
|
|
$d = "/dev/dsk" ascii
|
||
|
|
$e = "$(ls /)" ascii
|
||
|
|
condition:
|
||
|
|
all of them
|
||
|
|
}
|