15 lines
547 B
Text
15 lines
547 B
Text
|
rule ElMachete_doc
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
author = "CPR"
|
||
|
|
reference = "https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/"
|
||
|
|
hash1 = "8E1360CC27E95FC47924D9BA3EF84CB8FA9E142CFD16E1503C5277D0C16AE241"
|
||
|
|
strings:
|
||
|
|
$s1 = "You want to continue with the Document" ascii
|
||
|
|
$s2 = "certutil -decode" ascii
|
||
|
|
$s3 = /C:\\ProgramData\\.{1,20}\.txt/
|
||
|
|
$s4 = /C:\\ProgramData\\.{1,20}\.vbe/
|
||
|
|
condition:
|
||
|
|
uint16be(0) == 0xD0CF and 2 of ($s*)
|
||
|
|
}
|