31 lines
867 B
Text
31 lines
867 B
Text
|
rule MTI_Hunting_AsRockDriver_Exploit_PDB
|
||
|
|
|
||
|
|
{
|
||
|
|
|
||
|
|
meta:
|
||
|
|
|
||
|
|
author = "Mandiant"
|
||
|
|
|
||
|
|
date = "03-23-2022"
|
||
|
|
|
||
|
|
description = "Searching for executables containing strings associated with AsRock driver Exploit."
|
||
|
|
|
||
|
|
reference = "https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"
|
||
|
|
|
||
|
|
|
||
|
|
strings:
|
||
|
|
|
||
|
|
$dos_stub = "This program cannot be run in DOS mode"
|
||
|
|
|
||
|
|
$pdb_bad = "dev projects\\SignSploit1\\x64\\Release\\AsrDrv_exploit.pdb"
|
||
|
|
|
||
|
|
$pdb_good = "c:\\asrock\\work\\asrocksdk_v0.0.69\\asrrw\\src\\driver\\src\\objfre_win7_amd64\\amd64\\AsrDrv103.pdb"
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
condition:
|
||
|
|
|
||
|
|
all of them and (@pdb_bad < @dos_stub[2]) and (#dos_stub == 2) and (@pdb_good > @dos_stub[2])
|
||
|
|
|
||
|
|
}
|