36 lines
1.7 KiB
Text
36 lines
1.7 KiB
Text
|
/*
|
||
|
|
Author: NCCIC Partner
|
||
|
|
Date: 2018-03-28
|
||
|
|
Identifier: HiddenCobra
|
||
|
|
Reference: https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf
|
||
|
|
*/
|
||
|
|
|
||
|
|
rule HiddenCobra_r4_wiper_1 {
|
||
|
|
meta:
|
||
|
|
author = "NCCIC Partner"
|
||
|
|
date = "2017-12-12"
|
||
|
|
description = "Detects HiddenCobra Wiper"
|
||
|
|
reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
|
||
|
|
id = "4978c190-7b66-5cea-96df-809f85620986"
|
||
|
|
strings:
|
||
|
|
$mbr_code = { 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 5D 7C 33 C9 41 81 F9 00 ?? 74 24 B4 43 B0 00 CD 13 FE C2 80 FA 84 7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 83 55 06 00 EB D5 BE 4D 7C B4 43 B0 00 CD 13 33 C9 BE 5D 7C EB C5 }
|
||
|
|
$controlServiceFoundlnBoth = { 83 EC 1C 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 44 8B 44 24 24 53 56 6A 24 50 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 1C 8D 4C 24 0C 51 6A 01 56 FF 15 ?? ?? ?? ?? 68 E8 03 00 00 FF 15 ?? ?? ?? ?? 56 FF D3 57 FF D3 5E 5B 33 C0 5F 83 C4 1C C3 33 C0 5F 83 C4 1C C3 }
|
||
|
|
condition:
|
||
|
|
uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and any of them
|
||
|
|
}
|
||
|
|
|
||
|
|
rule HiddenCobra_r4_wiper_2 {
|
||
|
|
meta:
|
||
|
|
author = "NCCIC Partner"
|
||
|
|
date = "2017-12-12"
|
||
|
|
description = "Detects HiddenCobra Wiper"
|
||
|
|
reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
|
||
|
|
id = "75acc3cb-90dd-58e8-b094-ed3f28650b1b"
|
||
|
|
strings:
|
||
|
|
// BIOS Extended Write
|
||
|
|
$PhysicalDriveSTR = "\\\\.\\PhysicalDrive" wide
|
||
|
|
$ExtendedWrite = { B4 43 B0 00 CD 13 }
|
||
|
|
condition:
|
||
|
|
uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and all of them
|
||
|
|
}
|