27 lines
630 B
Text
27 lines
630 B
Text
|
rule AVIDVIPER_APT_BACKDOOR {
|
||
|
|
|
||
|
|
meta:
|
||
|
|
|
||
|
|
author = "Proofpoint Staff"
|
||
|
|
|
||
|
|
info = "avid viper update"
|
||
|
|
|
||
|
|
reference = "https://www.proofpoint.com/us/threat-insight/post/Operation-Arid-Viper-Slithers-Back-Into-View"
|
||
|
|
|
||
|
|
|
||
|
|
strings:
|
||
|
|
|
||
|
|
$s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-/"
|
||
|
|
|
||
|
|
$s2 = "SELECT * FROM Win32_DiskDrive" wide ascii
|
||
|
|
|
||
|
|
$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide ascii
|
||
|
|
|
||
|
|
$s4 = "\\dd\\vctools\\vc7libs\\ship\\atlmfc" wide ascii
|
||
|
|
|
||
|
|
condition:
|
||
|
|
|
||
|
|
$s4 and 2 of ($s1,$s2,$s3)
|
||
|
|
|
||
|
|
}
|