25 lines
No EOL
534 B
Text
25 lines
No EOL
534 B
Text
rule Molerats_certs
|
|
|
|
{
|
|
|
|
meta:
|
|
|
|
author = "FireEye Labs"
|
|
|
|
description = "this rule detections code signed with certificates used by the Molerats actor"
|
|
|
|
reference = "https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html"
|
|
|
|
strings:
|
|
|
|
$cert1 = {06 50 11 A5 BC BF 83 C0 93 28 16 5E 7E 85 27 75}
|
|
$cert2 = {03 e1 e1 aa a5 bc a1 9f ba 8c 42 05 8b 4a bf 28}
|
|
$cert3 = {0c c0 35 9c 9c 3c da 00 d7 e9 da 2d c6 ba 7b 6d}
|
|
|
|
|
|
|
|
condition:
|
|
|
|
1 of ($cert*)
|
|
|
|
} |