Hello World!
\\n // Hello World! {0}\\n \\n\"\n 0x0000028E 280600000A IL_001A: call string [mscorlib]System.Environment::get_NewLine()\n 0x00000293 72B2000070 IL_001F: ldstr \"\\n\"\n 0x00000298 280700000A IL_0024: call instance string [mscorlib]System.String::Replace(string, string)\n 0x0000029D 0B IL_0029: stloc.1\n 0x0000029E 72E9010070 IL_002A: ldstr \"gruntsvc\"\n 0x000002A3 0C IL_002F: stloc.2\n 0x000002A4 72FB010070 IL_0030: ldstr \"382f94aac1\"\n 0x000002A9 0D IL_0035: stloc.3\n 0x000002AA 280800000A IL_0036: call valuetype [mscorlib]System.Guid [mscorlib]System.Guid::NewGuid()\n 0x000002AF 1322 IL_003B: stloc.s V_34\n 0x000002B1 1222 IL_003D: ldloca.s V_34\n 0x000002B3 FE160C000001 IL_003F: constrained. [mscorlib]System.Guid\n 0x000002B9 6F0900000A IL_0045: callvirt instance string [mscorlib]System.Object::ToString()\n 0x000002BE 7211020070 IL_004A: ldstr \"-\"\n 0x000002C3 7215020070 IL_004F: ldstr \"\"\n 0x000002C8 6F0700000A IL_0054: callvirt instance string [mscorlib]System.String::Replace(string, string)\n 0x000002CD 16 IL_0059: ldc.i4.0\n 0x000002CE 1F0A IL_005A: ldc.i4.s 10\n 0x000002D0 6F0A00000A IL_005C: callvirt instance string [mscorlib]System.String::Substring(int32, int32)\n 0x000002D5 1304 IL_0061: stloc.s V_4\n 0x000002D7 7217020070 IL_0063: ldstr \"8QQIxBwir7uLNN9P4V7k890bUL9QukjzVSIA+8IvBEY=\"\n 0x000002DC 280B00000A IL_0068: call uint8[] [mscorlib]System.Convert::FromBase64String(string)\n 0x000002E1 1305 IL_006D: stloc.s V_5\n */\n $msil_smb = {\n 72 [4] // ldstr \"i=a19ea23062db990386a3a478cb89d52e&data={0}&session=75db-99b1-25fe4e9afbe58696-320bea73\"\n 28 [4] // call string [mscorlib]System.Environment::get_NewLine()\n 72 [4] // ldstr \"\\n\"\n 28 [4] // call instance string [mscorlib]System.String::Replace(string, string)\n 0A // stloc.0\n 72 [4] // ldstr \"\\n \\nHello World!
\\n // Hello World! {0}\\n \\n\"\n 28 [4] // call string [mscorlib]System.Environment::get_NewLine()\n 72 [4] // ldstr \"\\n\"\n 28 [4] // call instance string [mscorlib]System.String::Replace(string, string)\n 0B // stloc.1\n 72 [4] // ldstr \"gruntsvc\"\n 0C // stloc.2\n 72 [4] // ldstr \"382f94aac1\"\n 0D // stloc.3\n 28 [4] // call valuetype [mscorlib]System.Guid [mscorlib]System.Guid::NewGuid()\n 13 22 // stloc.s V_34\n 12 22 // ldloca.s V_34\n FE [5] // constrained. [mscorlib]System.Guid\n 6F [4] // callvirt instance string [mscorlib]System.Object::ToString()\n 72 [4] // ldstr \"-\"\n 72 [4] // ldstr \"\"\n 6F [4] // callvirt instance string [mscorlib]System.String::Replace(string, string)\n 16 // ldc.i4.0\n 1F 0A // ldc.i4.s 10\n 6F [4] // callvirt instance string [mscorlib]System.String::Substring(int32, int32)\n 13 04 // stloc.s V_4\n 72 [4] // ldstr \"8QQIxBwir7uLNN9P4V7k890bUL9QukjzVSIA+8IvBEY=\"\n 28 [4] // call uint8[] [mscorlib]System.Convert::FromBase64String(string)\n 13 05 // stloc.s V_5\n }\n\n condition:\n uint16(0) == 0x5a4d and filesize < 50KB and (\n (all of ($strings*)) or ($msil_http) or ($msil_smb)\n )\n}\n", "rule_count": 1, "rule_names": [ "windows_hacktool_covenant" ], "rule_creation_date": "2021-11-17", "rule_modified_date": "2025-03-03", "rule_os": [ "windows" ], "rule_classifications": [ "Windows.HackTool.Covenant" ], "rule_tactic_tags": [ "attack.command_and_control" ], "rule_technique_tags": [ "attack.t1071.001" ], "rule_score": 100, "rule_context": [ "file.pe", "process" ], "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645" } { "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_keylogger_screencapdll_yar", "test_maturity_current_count": 0, "test_maturity_delay": 7, "test_maturity_threshold": 10, "global_state": "alert", "effective_state": "alert", "rule_effective_level": "critical", "rule_effective_confidence": "strong", "alert_count": 0, "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645", "rule_level_overridden": false, "last_modifier": { "id": 1, "username": "system_supervisor" }, "origin_stack": { "id": "b8e2fe4fc90e4d08", "name": null, "is_current": false, "is_supervisor": true, "is_tenant": false }, "tenant": "b8e2fe4fc90e4d08", "origin_stack_id": "b8e2fe4fc90e4d08", "last_update": "2026-03-23T11:46:25.583388Z", "creation_date": "2026-03-23T11:46:25.583391Z", "enabled": true, "block_on_agent": false, "quarantine_on_agent": false, "endpoint_detection": true, "hl_status": "stable", "hl_testing_start_time": "2026-03-23T11:46:25.583398Z", "rule_level": "critical", "rule_level_override": null, "rule_confidence": "strong", "rule_confidence_override": null, "references": [ "https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/" ], "name": "windows_keylogger_screencapdll.yar", "content": "rule windows_keylogger_screencapdll {\n meta:\n title = \"ScreenCapDll Keylogger and Screen Recorder\"\n id = \"5017f379-68a3-41a1-9d58-223b6795170c\"\n description = \"Detects the ScreenCapDll keylogger and screen recorder.\\nScreenCapDll is a keylogging and screen recording malware associated with the WIP19 threat group.\\nThis malware is known for its ability to capture keystrokes and record screen activity, which can be used for unauthorized access and espionage.\\nWIP19 is a Chinese-speaking advanced persistent threat (APT) group that targets IT service providers and telecommunication companies. The group is known for using signed malware to maintain persistence and carry out espionage activities.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n references = \"https://www.sentinelone.com/labs/wip19-espionage-new-chinese-apt-targets-it-service-providers-and-telcos-with-signed-malware/\"\n date = \"2022-11-22\"\n modified = \"2025-03-17\"\n author = \"HarfangLab\"\n tags = \"attack.credential_access;attack.t1056.001\"\n classification = \"Windows.Keylogger.ScreenCapDLL\"\n context = \"process,file.pe\"\n os = \"Windows\"\n score = 100\n confidence = \"strong\"\n\n strings:\n // Detection for these samples:\n // 421b71ac924938e9b47291f38233d9e4b8116c1f4ec8db523d229535c8c12212\n // 4d36c9713955062e870b29aadeee7a3e9f064041e4a74e349ce58e3937c7526e\n // 2511271a0ec23acb028ec678fcf301ac4befa14c79daf308919082569e68acf5\n // 72353ee98cd3926d8f14d5b7118b7bb0465f72ca9e3d28397a1bcf2cb0fc3edb\n\n $dll_name_1 = \"ScreenCapDll_x64.dll\" ascii\n $dll_name_2 = \"ScreenCapDll.dll\" ascii\n\n $archive_names_1 = \"%s\\\\%s_%d_%d_%d_%d_%d_%d.AVI\" ascii\n $archive_names_2 = \"%s\\\\%s_%d_%d_%d_%d_%d_%d.RAR\" ascii\n $archive_names_3 = \"%s a -hp%s -m5 \\\"%s\\\" \\\"%s\" ascii\n $archive_names_4 = \"%s\\\\%s_%04d%02d%02d.ax\" ascii\n\n condition:\n uint16(0) == 0x5a4d and (\n 1 of ($dll_name_*) or 3 of ($archive_names_*)\n )\n}\n", "rule_count": 1, "rule_names": [ "windows_keylogger_screencapdll" ], "rule_creation_date": "2022-11-22", "rule_modified_date": "2025-03-17", "rule_os": [ "windows" ], "rule_classifications": [ "Windows.Keylogger.ScreenCapDLL" ], "rule_tactic_tags": [ "attack.credential_access" ], "rule_technique_tags": [ "attack.t1056.001" ], "rule_score": 100, "rule_context": [ "file.pe", "process" ], "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645" } { "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_malware_loader_termite_yar", "test_maturity_current_count": 0, "test_maturity_delay": 7, "test_maturity_threshold": 10, "global_state": "alert", "effective_state": "alert", "rule_effective_level": "critical", "rule_effective_confidence": "strong", "alert_count": 0, "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645", "rule_level_overridden": false, "last_modifier": { "id": 1, "username": "system_supervisor" }, "origin_stack": { "id": "b8e2fe4fc90e4d08", "name": null, "is_current": false, "is_supervisor": true, "is_tenant": false }, "tenant": "b8e2fe4fc90e4d08", "origin_stack_id": "b8e2fe4fc90e4d08", "last_update": "2026-03-23T11:46:25.577917Z", "creation_date": "2026-03-23T11:46:25.577919Z", "enabled": true, "block_on_agent": false, "quarantine_on_agent": false, "endpoint_detection": true, "hl_status": "stable", "hl_testing_start_time": "2026-03-23T11:46:25.577924Z", "rule_level": "critical", "rule_level_override": null, "rule_confidence": "strong", "rule_confidence_override": null, "references": [ "https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware" ], "name": "windows_malware_loader_termite.yar", "content": "rule termite_loader {\n meta:\n title = \"Termite Loader\"\n id = \"362c275a-503b-44d5-b3c4-57992782df74\"\n description = \"Detects the malicious malware loader Termite.\\nTermite is a malware loader identified by Mandiant that contains encrypted shellcode. It is used by several malicious groups, including UNC2596, to inject malicious code into legitimate processes. This loader is often used for persistence and lateral movement within a compromised environment.\\nIt is recommended to isolate the affected process and check for any signs of suspicious code injection.\"\n references = \"https://www.mandiant.com/resources/blog/unc2596-cuba-ransomware\"\n date = \"2022-09-27\"\n modified = \"2025-03-17\"\n author = \"HarfangLab\"\n tags = \"attack.execution;attack.t1059.001\"\n classification = \"Windows.Loader.Termite\"\n context = \"process,memory,thread,file.pe\"\n os = \"Windows\"\n score = 100\n confidence = \"strong\"\n\n strings:\n // Decryption loop used in a lot of samples\n\n // Detection for EXE sample :\n $op1 = {\n 33 D2 // xor edx, edx\n 33 C0 // xor eax, eax\n 33 C2 // xor eax, edx\n 0F B7 01 // movzx eax, word ptr [ecx]\n 66 2B 05 [4] // sub ax, word_401052\n 66 F7 35 [4] // div word_401054\n 8B D2 // mov edx, edx\n 88 06 // mov [esi], al\n 8B D2 // mov edx, edx\n 46 // inc esi\n 8B D2 // mov edx, edx\n 43 // inc ebx\n 8B D2 // mov edx, edx\n 83 C1 02 // add ecx, 2\n 4F // dec edi\n 8B D7 // mov edx, edi\n 85 FA // test edx, edi\n\n }\n\n // Detection for this sample:\n // 1842ddc55b4bf9c71606451d404a21f7f3da8e54c56318010c80ba4f571bd8f5\n $op2 = {\n 33 D2 // xor edx, edx\n 8B 01 // mov eax, [ecx]\n 33 D2 // xor edx, edx\n 2B 05 [4] // sub eax, ds:dword_402004\n 33 D2 // xor edx, edx\n F7 35 [4] // div ds:dword_402008\n 33 D2 // xor edx, edx\n 88 06 // mov [esi], al\n 33 D2 // xor edx, edx\n 46 // inc esi\n 33 D2 // xor edx, edx\n 43 // inc ebx\n 33 D2 // xor edx, edx\n 83 C1 04 // add ecx, 4\n 33 D2 // xor edx, edx\n 3B DF // cmp ebx, edi\n }\n\n // Detection for this sample:\n // 811bb84e1e9f59279f844a040bf68d25ad29a756fbc07cffd7308f8490a15329\n $op3 = {\n 51 // push ecx\n 8B C8 // mov ecx, eax\n 33 DB // xor ebx, ebx\n 8B 01 // mov eax, [ecx]\n 33 D2 // xor edx, edx\n 2B 05 [4] // sub eax, ds:dword_402004\n F7 35 [4] // div ds:dword_402008\n 88 06 // mov [esi], al\n 46 // inc esi\n 43 // inc ebx\n 83 C1 04 // add ecx, 4\n 3B DF // cmp ebx, edi\n 7C E5 // jl short loc_4010A5\n 59 // pop ecx\n }\n\n // Detection for this sample:\n // 7f357ab4ac225e14a6967f89f20926e9e0db15dca5b8fe058c120a365570b783\n $op4 = {\n 8B 2D [4] // mov ebp, dword ptr ds:byte_40A034+10h\n 8B FA // mov edi, edx\n 89 1C 24 // mov [esp+14h+var_14], ebx\n 33 F6 // xor esi, esi\n 85 D2 // test edx, edx\n 7E 16 // jle short loc_4090CE\n 8B CB // mov ecx, ebx\n 8B D8 // mov ebx, eax\n 8B 03 // mov eax, [ebx]\n 33 D2 // xor edx, edx\n F7 F5 // div ebp\n 41 // inc ecx\n 83 C3 04 // add ebx, 4\n 46 // inc esi\n 88 51 FF // mov [ecx-1], dl\n 3B F7 // cmp esi, edi\n 7C EE // jl short loc_4090BC\n 8B 04 24 // mov eax, [esp+14h+var_14]\n 89 2D // mov dword ptr ds:byte_40A034+10h, ebp\n }\n\n // Detection for this sample:\n // d1e14b5f02fb020db4e215cb5c3abc6a7b1589443bccd6f03b77ee124ca72b5c\n $op5 = {\n 33 D2 // xor edx, edx\n 0F B7 01 // movzx eax, word ptr [ecx]\n 33 D2 // xor edx, edx\n 66 2B 05 [4] // sub ax, word_401052\n 33 D2 // xor edx, edx\n 66 F7 35 [4] // div word_401054\n 33 D2 // xor edx, edx\n 88 06 // mov [esi], al\n 33 D2 // xor edx, edx\n 46 // inc esi\n 33 D2 // xor edx, edx\n 43 // inc ebx\n 33 D2 // xor edx, edx\n 83 C1 02 // add ecx, 2\n 33 D2 // xor edx, edx\n 3B DF // cmp ebx, edi\n }\n\n // Detection for this sample:\n // 7b2144f2b5d722a1a8a0c47a43ecaf029b434bfb34a5cffe651fda2adf401131\n $op6 = {\n 8B 2D [4] // mov ebp, dword ptr ds:byte_40A034+10h\n 89 04 24 // mov [esp+18h+var_18], eax\n 8B FA // mov edi, edx\n 8B C3 // mov eax, ebx\n 89 5C 24 04 // mov [esp+18h+var_14], ebx\n 33 F6 // xor esi, esi\n 85 D2 // test edx, edx\n 7E 17 // jle short loc_4090C5\n 8B CB // mov ecx, ebx\n 8B 1C 24 // mov ebx, [esp+18h+var_18]\n 8B 03 // mov eax, [ebx]\n 33 D2 // xor edx, edx\n F7 F5 // div ebp\n 41 // inc ecx\n 83 C3 04 // add ebx, 4\n 46 // inc esi\n 88 51 FF // mov [ecx-1], dl\n 3B F7 // cmp esi, edi\n 7C EE // jl short loc_4090B3\n 8B 44 24 04 // mov eax, [esp+18h+var_14]\n 89 2D // mov dword ptr ds:byte_40A034+10h, ebp\n }\n\n condition:\n any of them\n\n}\n", "rule_count": 1, "rule_names": [ "termite_loader" ], "rule_creation_date": "2022-09-27", "rule_modified_date": "2025-03-17", "rule_os": [ "windows" ], "rule_classifications": [ "Windows.Loader.Termite" ], "rule_tactic_tags": [ "attack.execution" ], "rule_technique_tags": [ "attack.t1059.001" ], "rule_score": 100, "rule_context": [ "thread", "memory", "file.pe", "process" ], "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645" } { "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_malware_powershell_launcher_a0fa8f48772b_yar", "test_maturity_current_count": 0, "test_maturity_delay": 7, "test_maturity_threshold": 10, "global_state": "alert", "effective_state": "alert", "rule_effective_level": "critical", "rule_effective_confidence": "strong", "alert_count": 0, "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645", "rule_level_overridden": false, "last_modifier": { "id": 1, "username": "system_supervisor" }, "origin_stack": { "id": "b8e2fe4fc90e4d08", "name": null, "is_current": false, "is_supervisor": true, "is_tenant": false }, "tenant": "b8e2fe4fc90e4d08", "origin_stack_id": "b8e2fe4fc90e4d08", "last_update": "2026-03-23T11:46:25.585251Z", "creation_date": "2026-03-23T11:46:25.585253Z", "enabled": true, "block_on_agent": false, "quarantine_on_agent": false, "endpoint_detection": true, "hl_status": "stable", "hl_testing_start_time": "2026-03-23T11:46:25.585259Z", "rule_level": "critical", "rule_level_override": null, "rule_confidence": "strong", "rule_confidence_override": null, "references": [ "Internal Research" ], "name": "windows_malware_powershell_launcher_a0fa8f48772b.yar", "content": "rule malware_unknown_powershell_launcher_a0fa8f48772b {\n meta:\n title = \"PowerShell Launcher (a0fa8f48772b)\"\n id = \"2a47f9c6-0b0c-46db-9171-a0fa8f48772b\"\n description = \"Detects a malicious launcher sample that launch PowerShell.\\nThis rule identifies a malicious PowerShell launcher known to attempt execution via PowerShell scripts or related tools.\\nIt is recommended to investigate PowerShell event for suspicious activities.\"\n references = \"Internal Research\"\n date = \"2021-12-20\"\n modified = \"2025-03-18\"\n author = \"HarfangLab\"\n tags = \"attack.execution;attack.t1059.001\"\n classification = \"Windows.Malware.UnknownPowershellLauncher\"\n context = \"process,file.pe\"\n os = \"Windows\"\n score = 100\n confidence = \"strong\"\n\n strings:\n // Suspicious APIs imported\n $api_import1 = \"RtlVirtualUnwind\" ascii\n $api_import2 = \"CorBindToRuntimeEx\" ascii\n $api_import3 = \"CoCreateInstance\" ascii\n $api_import4 = \"CoInitialize\" ascii\n $api_import5 = \"CoUninitialize\" ascii\n\n // Suspicious strings related\n $sus_string1 = \"%systemroot%\\\\system32\\\\windowspowershell\\\\v1.0\\\\powershell_ise.exe\" wide\n $sus_string2 = \"%ProgramData%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Accessories\\\\Windows PowerShell\\\\Windows PowerShell (x86).lnk\" wide\n $sus_string3 = \"%ProgramData%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Accessories\\\\Windows PowerShell\\\\Windows PowerShell.lnk\" wide\n $sus_string4 = \"%windir%\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\" wide\n $sus_string5 = \"WindowsPowerShellHelp.chm\" wide\n $sus_string6 = \"%systemroot%\\\\hh.exe\" wide\n\n // Powershell Unmanaged Entrypoint\n $powershell_unamanged_entry = \"Microsoft.PowerShell.UnmanagedPSEntry\" wide\n\n $wks_clr_binding = {\n 45 8D 45 ?? // lea r8d, [r13 + 0xXX]\n 48 8D 15 ?? ?? ?? ?? // lea rdx, [rip + 0xXXXXXXXX] // 'wks'\n 48 8B CB // mov rcx, rbx\n E8 ?? ?? ?? ?? // call CorBindToRuntimeEx\n 3D 00 17 13 80 // cmp eax, CLR_E_SHIM_RUNTIMELOAD\n }\n\n condition:\n uint16(0) == 0x5A4D and filesize < 200KB and ((all of ($sus_string*) and $powershell_unamanged_entry) or (all of ($api_import*) and 2 of ($sus_string*) and $powershell_unamanged_entry and $wks_clr_binding))\n}\n", "rule_count": 1, "rule_names": [ "malware_unknown_powershell_launcher_a0fa8f48772b" ], "rule_creation_date": "2021-12-20", "rule_modified_date": "2025-03-18", "rule_os": [ "windows" ], "rule_classifications": [ "Windows.Malware.UnknownPowershellLauncher" ], "rule_tactic_tags": [ "attack.execution" ], "rule_technique_tags": [ "attack.t1059.001" ], "rule_score": 100, "rule_context": [ "file.pe", "process" ], "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645" } { "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_trojan_chromeloader_yar", "test_maturity_current_count": 0, "test_maturity_delay": 7, "test_maturity_threshold": 10, "global_state": "alert", "effective_state": "alert", "rule_effective_level": "critical", "rule_effective_confidence": "strong", "alert_count": 0, "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645", "rule_level_overridden": false, "last_modifier": { "id": 1, "username": "system_supervisor" }, "origin_stack": { "id": "b8e2fe4fc90e4d08", "name": null, "is_current": false, "is_supervisor": true, "is_tenant": false }, "tenant": "b8e2fe4fc90e4d08", "origin_stack_id": "b8e2fe4fc90e4d08", "last_update": "2026-03-23T11:46:25.569368Z", "creation_date": "2026-03-23T11:46:25.569370Z", "enabled": true, "block_on_agent": false, "quarantine_on_agent": false, "endpoint_detection": true, "hl_status": "stable", "hl_testing_start_time": "2026-03-23T11:46:25.569376Z", "rule_level": "critical", "rule_level_override": null, "rule_confidence": "strong", "rule_confidence_override": null, "references": [ "https://blogs.blackberry.com/en/2022/11/chromeloader-infects-the-browser-by-loading-malicious-extension" ], "name": "windows_trojan_chromeloader.yar", "content": "rule chromeloader {\n meta:\n title = \"ChromeLoader Malware\"\n id = \"981d0da6-5454-45fe-a2ee-a18b1058ae35\"\n description = \"Detects ChromeLoader Malware.\\nChromeLoader is a malware designed to compromise popular browsers such as Google Chrome. It modifies browser settings to redirect traffic to malicious advertising sites and can hijack browsers to steal sensitive information like passwords.\"\n references = \"https://blogs.blackberry.com/en/2022/11/chromeloader-infects-the-browser-by-loading-malicious-extension\"\n date = \"2022-11-10\"\n modified = \"2025-03-17\"\n author = \"HarfangLab\"\n tags = \"attack.execution;attack.t1059;attack.persistence;attack.t1112;attack.t1176\"\n classification = \"Windows.Trojan.ChromeLoader\"\n context = \"process,file.pe\"\n os = \"Windows\"\n score = 100\n confidence = \"strong\"\n\n strings:\n // Detection for this sample:\n // ded20df574b843aaa3c8e977c2040e1498ae17c12924a19868df5b12dee6dfdd\n\n $s1 = \"Z:\\\\bundle_installer\\\\CS_installer\\\\obj\\\\Release\\\\net48\\\\win7-x86\\\\CS_installer.pdb\" ascii\n $s2 = \"powershell -ExecutionPolicy Bypass -WindowStyle Hidden -E\" ascii wide\n $s3 = \"Install Error, incompatible system\" ascii wide\n $s4 = \"ChromeLoader\" ascii wide\n $s5 = \"CS_installer.exe\" ascii wide\n $s6 = \"$taskName = \\\"ChromeLoader\\\"\" wide base64wide base64\n $s7 = \"if($_ -Match \\\"load-extension\\\")\" wide base64wide base64\n $s8 = \"(Get-WmiObject Win32_Process -Filter \\\"name='chrome.exe'\\\") | Select-Object CommandLine | ForEach-Object\" wide base64wide base64\n\n condition:\n uint16(0) == 0x5a4d and 6 of ($s*)\n}\n", "rule_count": 1, "rule_names": [ "chromeloader" ], "rule_creation_date": "2022-11-10", "rule_modified_date": "2025-03-17", "rule_os": [ "windows" ], "rule_classifications": [ "Windows.Trojan.ChromeLoader" ], "rule_tactic_tags": [ "attack.execution", "attack.persistence" ], "rule_technique_tags": [ "attack.t1059", "attack.t1176", "attack.t1112" ], "rule_score": 100, "rule_context": [ "file.pe", "process" ], "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645" } { "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_trojan_cyclops_yar", "test_maturity_current_count": 0, "test_maturity_delay": 7, "test_maturity_threshold": 10, "global_state": "alert", "effective_state": "alert", "rule_effective_level": "critical", "rule_effective_confidence": "strong", "alert_count": 0, "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645", "rule_level_overridden": false, "last_modifier": { "id": 1, "username": "system_supervisor" }, "origin_stack": { "id": "b8e2fe4fc90e4d08", "name": null, "is_current": false, "is_supervisor": true, "is_tenant": false }, "tenant": "b8e2fe4fc90e4d08", "origin_stack_id": "b8e2fe4fc90e4d08", "last_update": "2026-03-23T11:46:25.568815Z", "creation_date": "2026-03-23T11:46:25.568817Z", "enabled": true, "block_on_agent": false, "quarantine_on_agent": false, "endpoint_detection": true, "hl_status": "stable", "hl_testing_start_time": "2026-03-23T11:46:25.568822Z", "rule_level": "critical", "rule_level_override": null, "rule_confidence": "strong", "rule_confidence_override": null, "references": [ "https://harfanglab.io/insidethelab/cyclops-replacement-bellaciao/\nhttps://malpedia.caad.fkie.fraunhofer.de/actor/charming_kitten\nhttps://attack.mitre.org/techniques/T1071/004/" ], "name": "windows_trojan_cyclops.yar", "content": "rule charmingkitten_cyclops {\n meta:\n title = \"Cyclops Trojan\"\n id = \"bb25e38e-52ff-496d-87bc-6b9e848c81de\"\n description = \"Detects the Cyclops Trojan.\\nCyclops is a Golang-based malware associated with the Charming Kitten threat group. Charming Kitten, also known as APT 35, Phosphorus, Parastoo, and Newscaster, is a suspected Iranian-linked actor targeting government, defense technology, military, and diplomatic sectors. The group is known for sophisticated cyber espionage activities.\\nIt is recommended to investigate the context around this alert to look for malicious actions.\"\n references = \"https://harfanglab.io/insidethelab/cyclops-replacement-bellaciao/\\nhttps://malpedia.caad.fkie.fraunhofer.de/actor/charming_kitten\\nhttps://attack.mitre.org/techniques/T1071/004/\"\n date = \"2024-07-31\"\n modified = \"2025-03-17\"\n author = \"HarfangLab\"\n tags = \"attack.command_and_control;attack.t1071.004\"\n classification = \"Windows.Trojan.Cyclops\"\n context = \"process,file.pe\"\n os = \"Windows\"\n arch = \"x86,x64,arm,arm64\"\n score = 100\n confidence = \"strong\"\n\n strings:\n // Detection for this sample:\n // fafa68e626f1b789261c4dd7fae692756cf71881c7273260af26ca051a094a69\n\n $go = \" Go build ID: \\\"\" ascii\n $a1 = \"dep\\tback-service\\t(devel)\" ascii fullword\n $a2 = \"/brain-loader-enc.go\\x00\" ascii\n $a3 = \"back-service/go-mux/api\" ascii\n $a4 = \"/JD-M42KItJncJfqb38qh/\" ascii\n\n condition:\n filesize > 2MB and filesize < 20MB\n and (uint16(0) == 0x5A4D)\n and $go\n and (2 of ($a*))\n}\n", "rule_count": 1, "rule_names": [ "charmingkitten_cyclops" ], "rule_creation_date": "2024-07-31", "rule_modified_date": "2025-03-17", "rule_os": [ "windows" ], "rule_classifications": [ "Windows.Trojan.Cyclops" ], "rule_tactic_tags": [ "attack.command_and_control" ], "rule_technique_tags": [ "attack.t1071.004" ], "rule_score": 100, "rule_context": [ "file.pe", "process" ], "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645" } { "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_trojan_dllpasswordfilterimplant_yar", "test_maturity_current_count": 0, "test_maturity_delay": 7, "test_maturity_threshold": 10, "global_state": "alert", "effective_state": "alert", "rule_effective_level": "critical", "rule_effective_confidence": "strong", "alert_count": 0, "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645", "rule_level_overridden": false, "last_modifier": { "id": 1, "username": "system_supervisor" }, "origin_stack": { "id": "b8e2fe4fc90e4d08", "name": null, "is_current": false, "is_supervisor": true, "is_tenant": false }, "tenant": "b8e2fe4fc90e4d08", "origin_stack_id": "b8e2fe4fc90e4d08", "last_update": "2026-03-23T11:46:25.587972Z", "creation_date": "2026-03-23T11:46:25.587974Z", "enabled": true, "block_on_agent": false, "quarantine_on_agent": false, "endpoint_detection": true, "hl_status": "stable", "hl_testing_start_time": "2026-03-23T11:46:25.587980Z", "rule_level": "critical", "rule_level_override": null, "rule_confidence": "strong", "rule_confidence_override": null, "references": [ "https://github.com/GoSecure/DLLPasswordFilterImplant" ], "name": "windows_trojan_dllpasswordfilterimplant.yar", "content": "rule LSA_DLLPasswordFilterImplant {\n meta:\n title = \"LSA Notification Package (DLLPasswordFilterImplant.dll)\"\n id = \"90be38e5-3c61-4e34-8039-3139310adda6\"\n description = \"Detects the DLLPasswordFilterImplant project, a suspicious LSA Notification Package.\\nThis project demonstrates how an attacker can inject a malicious DLL into the Local Security Authority (LSA) subsystem to capture user credentials during authentication. The LSA Notification Package can be used to intercept sensitive information, such as passwords, at the time of authentication.\\nIt is recommended to perform a thorough investigation of LSA-related processes and registry entries.\"\n references = \"https://github.com/GoSecure/DLLPasswordFilterImplant\"\n date = \"2022-05-05\"\n modified = \"2025-03-17\"\n author = \"HarfangLab\"\n tags = \"attack.credential_access;attack.t1556.002\"\n classification = \"Windows.Trojan.LSAPackage\"\n context = \"process,file.pe\"\n os = \"Windows\"\n score = 100\n confidence = \"strong\"\n\n strings:\n // Detection for this sample :\n // 9bb375cbc99beb2420a600555e14724b19a36a85fa320037bb9927d6ece195d2\n\n $s1 = \"BCRYPT_SUCCESS(res) || !\\\"BCryptOpenAlgorithmProvider\\\"\" fullword wide\n $s2 = \"buffer && buffer->data\" fullword wide\n $s3 = \"SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\" fullword wide\n $s4 = \"InitializeChangeNotify\" fullword ascii\n $s5 = \"PasswordChangeNotify\" fullword ascii\n $s6 = \"PasswordFilter\" fullword ascii\n $s7 = \"%wZ:%wZ\" fullword ascii\n\n condition:\n (uint16(0) == 0x5a4d) and filesize < 2MB and all of them\n}\n", "rule_count": 1, "rule_names": [ "LSA_DLLPasswordFilterImplant" ], "rule_creation_date": "2022-05-05", "rule_modified_date": "2025-03-17", "rule_os": [ "windows" ], "rule_classifications": [ "Windows.Trojan.LSAPackage" ], "rule_tactic_tags": [ "attack.credential_access" ], "rule_technique_tags": [ "attack.t1556.002" ], "rule_score": 100, "rule_context": [ "file.pe", "process" ], "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645" } { "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_trojan_oceanmap_yar", "test_maturity_current_count": 0, "test_maturity_delay": 7, "test_maturity_threshold": 10, "global_state": "alert", "effective_state": "alert", "rule_effective_level": "critical", "rule_effective_confidence": "strong", "alert_count": 0, "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645", "rule_level_overridden": false, "last_modifier": { "id": 1, "username": "system_supervisor" }, "origin_stack": { "id": "b8e2fe4fc90e4d08", "name": null, "is_current": false, "is_supervisor": true, "is_tenant": false }, "tenant": "b8e2fe4fc90e4d08", "origin_stack_id": "b8e2fe4fc90e4d08", "last_update": "2026-03-23T11:46:25.583843Z", "creation_date": "2026-03-23T11:46:25.583845Z", "enabled": true, "block_on_agent": false, "quarantine_on_agent": false, "endpoint_detection": true, "hl_status": "stable", "hl_testing_start_time": "2026-03-23T11:46:25.583851Z", "rule_level": "critical", "rule_level_override": null, "rule_confidence": "strong", "rule_confidence_override": null, "references": [ "https://cert.gov.ua/article/6276894\nhttps://attack.mitre.org/techniques/T1059/003\nhttps://attack.mitre.org/techniques/T1071/003" ], "name": "windows_trojan_oceanmap.yar", "content": "rule masepie_campaign_oceanmap {\n meta:\n title = \"OCEANMAP RAT\"\n id = \"a1706a25-e2e8-459f-a6d0-d61c98475dee\"\n description = \"Detects the OCEANMAP RAT.\\nOCEANMAP is a RAT-type implant discovered by CERT-UA. It uses IMAP/S as a command and control channel. The rule identifies IMAP commands and indicators related to credential handling and process management.\\nIt is recommended to isolate the affected system and investigate network traffic for IMAP-based C2 communication.\"\n references = \"https://cert.gov.ua/article/6276894\\nhttps://attack.mitre.org/techniques/T1059/003\\nhttps://attack.mitre.org/techniques/T1071/003\"\n date = \"2024-01-26\"\n modified = \"2025-03-17\"\n author = \"HarfangLab\"\n tags = \"attack.execution;attack.t1059.003;attack.command_and_control;attack.t1071.003\"\n classification = \"Windows.Trojan.OCEANMAP\"\n context = \"process,file.pe\"\n os = \"Windows\"\n score = 100\n confidence = \"strong\"\n\n strings:\n // Detection for these samples:\n // 24fd571600dcc00bf2bb8577c7e4fd67275f7d19d852b909395bebcbb1274e04\n // 50b000a7d61885591ba4ec9df1a0a223dbceb1ac2facafcef3d65c8cbbd64d46\n\n $dotNet = \".NETFramework,Version\" ascii fullword\n\n $a1 = \"$ SELECT INBOX.Drafts\" wide fullword\n $a2 = \"$ SELECT Drafts\" wide fullword\n $a3 = \"$ UID SEARCH subject \\\"\" wide fullword\n $a4 = \"$ APPEND INBOX {\" wide fullword\n $a5 = \"+FLAGS (\\\\Deleted)\" wide fullword\n $a6 = \"$ EXPUNGE\" wide fullword\n $a7 = \"BODY.PEEK[text]\" wide fullword\n\n $t1 = \"change_time\" ascii fullword\n $t2 = \"ReplaceBytes\" ascii fullword\n $t3 = \"fcreds\" ascii fullword\n $t4 = \"screds\" ascii fullword\n $t5 = \"r_creds\" ascii fullword\n $t6 = \"comp_id\" ascii fullword\n $t7 = \"changesecond\" wide fullword\n $t8 = \"taskkill /F /PID\" wide fullword\n $t9 = \"cmd.exe\" wide fullword\n\n condition:\n filesize > 8KB and filesize < 100KB\n and (uint16be(0) == 0x4D5A)\n and $dotNet\n and (3 of ($a*))\n and (2 of ($t*))\n}\n", "rule_count": 1, "rule_names": [ "masepie_campaign_oceanmap" ], "rule_creation_date": "2024-01-26", "rule_modified_date": "2025-03-17", "rule_os": [ "windows" ], "rule_classifications": [ "Windows.Trojan.OCEANMAP" ], "rule_tactic_tags": [ "attack.command_and_control", "attack.execution" ], "rule_technique_tags": [ "attack.t1071.003", "attack.t1059.003" ], "rule_score": 100, "rule_context": [ "file.pe", "process" ], "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645" } { "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_trojan_putty_yar", "test_maturity_current_count": 0, "test_maturity_delay": 7, "test_maturity_threshold": 10, "global_state": "alert", "effective_state": "alert", "rule_effective_level": "critical", "rule_effective_confidence": "strong", "alert_count": 0, "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645", "rule_level_overridden": false, "last_modifier": { "id": 1, "username": "system_supervisor" }, "origin_stack": { "id": "b8e2fe4fc90e4d08", "name": null, "is_current": false, "is_supervisor": true, "is_tenant": false }, "tenant": "b8e2fe4fc90e4d08", "origin_stack_id": "b8e2fe4fc90e4d08", "last_update": "2026-03-23T11:46:25.569398Z", "creation_date": "2026-03-23T11:46:25.569400Z", "enabled": true, "block_on_agent": false, "quarantine_on_agent": false, "endpoint_detection": true, "hl_status": "stable", "hl_testing_start_time": "2026-03-23T11:46:25.569406Z", "rule_level": "critical", "rule_level_override": null, "rule_confidence": "strong", "rule_confidence_override": null, "references": [ "https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing" ], "name": "windows_trojan_putty.yar", "content": "import \"pe\"\n\nrule trojanized_putty {\n meta:\n title = \"Trojanized PuTTY\"\n id = \"de7a91bc-d607-47c9-bac4-22020ed64a9b\"\n description = \"Detects a trojanized version of PuTTY used by the UNC4034 threat actor.\\nThis rule identifies a malicious variant of the PuTTY remote access tool, specifically associated with the UNC4034 threat actor. The trojanized PuTTY was observed in a July 2022 campaign where it was used to drop a malicious payload to disk before executing it.\\nIt is recommended to analyze the payload file for malicious content.\"\n references = \"https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing\"\n date = \"2022-09-27\"\n modified = \"2025-03-17\"\n author = \"HarfangLab\"\n tags = \"attack.execution;attack.t1204.002\"\n classification = \"Windows.Trojan.PuTTY\"\n context = \"process,file.pe\"\n os = \"Windows\"\n score = 100\n confidence = \"strong\"\n\n condition:\n // Detection for these samples:\n // 1492fa04475b89484b5b0a02e6ba3e52544c264c294b57210404b96b65e63266\n // cf22964951352c62d553b228cf4d2d9efe1ccb51729418c45dc48801d36f69b4\n // a14a74c3a56fa40bc87bd997cddbbd2239f505a4a29d1d4e0ea6ed51d2574159\n // 35b3aa459b7f7d1bf7351bb3a3e37b544ad6056152ac2fc6dc525b70b1d46154\n // d62d2888067b3dab7d93cba362202c4a17c086c531949b071f9758866b4c9d6b\n // a88998b7b275d866ea3aec24b45488299384a2d8e0f2db60447f26bd550856ce\n\n (uint16(0) == 0x5a4d) and\n filesize < 8MB and\n filesize > 2MB and\n pe.version_info[\"OriginalFilename\"] == \"PuTTY\" and\n pe.number_of_signatures == 0 and\n for any i in (0 .. pe.number_of_sections) : (\n pe.sections[i].name == \".data\" and pe.sections[i].raw_data_size > 200KB\n )\n}\n", "rule_count": 1, "rule_names": [ "trojanized_putty" ], "rule_creation_date": "2022-09-27", "rule_modified_date": "2025-03-17", "rule_os": [ "windows" ], "rule_classifications": [ "Windows.Trojan.PuTTY" ], "rule_tactic_tags": [ "attack.execution" ], "rule_technique_tags": [ "attack.t1204.002" ], "rule_score": 100, "rule_context": [ "file.pe", "process" ], "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645" } { "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-windows_trojan_securefilter_yar", "test_maturity_current_count": 0, "test_maturity_delay": 7, "test_maturity_threshold": 10, "global_state": "alert", "effective_state": "alert", "rule_effective_level": "critical", "rule_effective_confidence": "strong", "alert_count": 0, "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645", "rule_level_overridden": false, "last_modifier": { "id": 1, "username": "system_supervisor" }, "origin_stack": { "id": "b8e2fe4fc90e4d08", "name": null, "is_current": false, "is_supervisor": true, "is_tenant": false }, "tenant": "b8e2fe4fc90e4d08", "origin_stack_id": "b8e2fe4fc90e4d08", "last_update": "2026-03-23T11:46:25.583886Z", "creation_date": "2026-03-23T11:46:25.583888Z", "enabled": true, "block_on_agent": false, "quarantine_on_agent": false, "endpoint_detection": true, "hl_status": "stable", "hl_testing_start_time": "2026-03-23T11:46:25.583893Z", "rule_level": "critical", "rule_level_override": null, "rule_confidence": "strong", "rule_confidence_override": null, "references": [ "https://www.sentinelone.com/labs/moshen-dragons-triad-and-error-approach-abusing-security-software-to-sideload-plugx-and-shadowpad/" ], "name": "windows_trojan_securefilter.yar", "content": "rule LSA_SecureFilter {\n meta:\n title = \"LSA Notification Package (SecureFilter.dll)\"\n id = \"f5376de6-1851-45d6-9af5-696c050c2127\"\n description = \"Detects the malicious LSA Notification Package SecureFilter.dll associated with Moshen Dragon, a China-linked APT group. This DLL is designed to intercept user authentication processes and steal credentials.\"\n references = \"https://www.sentinelone.com/labs/moshen-dragons-triad-and-error-approach-abusing-security-software-to-sideload-plugx-and-shadowpad/\"\n date = \"2022-05-05\"\n modified = \"2025-03-17\"\n author = \"HarfangLab\"\n tags = \"attack.credential_access;attack.t1556.002\"\n classification = \"Windows.Trojan.LSAPackage\"\n context = \"process,file.pe\"\n os = \"Windows\"\n score = 100\n confidence = \"strong\"\n\n strings:\n // Detection for this sample :\n // c249fca04f5f362bb43731b5ae9e7e85a76f6c1472e1c41c40496ab05b513230\n\n $s1 = \"InitializeChangeNotify\" fullword ascii\n $s2 = \"PasswordChangeNotify\" fullword ascii\n $s3 = \"PasswordFilter\" fullword ascii\n $s4 = \"%wZ :: %wZ\" fullword wide\n\n condition:\n (uint16(0) == 0x5a4d) and filesize < 50KB and all of them\n}\n", "rule_count": 1, "rule_names": [ "LSA_SecureFilter" ], "rule_creation_date": "2022-05-05", "rule_modified_date": "2025-03-17", "rule_os": [ "windows" ], "rule_classifications": [ "Windows.Trojan.LSAPackage" ], "rule_tactic_tags": [ "attack.credential_access" ], "rule_technique_tags": [ "attack.t1556.002" ], "rule_score": 100, "rule_context": [ "file.pe", "process" ], "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645" } { "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-wingtbcli_yar", "test_maturity_current_count": 0, "test_maturity_delay": 7, "test_maturity_threshold": 10, "global_state": "alert", "effective_state": "alert", "rule_effective_level": "high", "rule_effective_confidence": "strong", "alert_count": 0, "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645", "rule_level_overridden": false, "last_modifier": { "id": 1, "username": "system_supervisor" }, "origin_stack": { "id": "b8e2fe4fc90e4d08", "name": null, "is_current": false, "is_supervisor": true, "is_tenant": false }, "tenant": "b8e2fe4fc90e4d08", "origin_stack_id": "b8e2fe4fc90e4d08", "last_update": "2026-03-23T11:46:25.570825Z", "creation_date": "2026-03-23T11:46:25.570827Z", "enabled": true, "block_on_agent": false, "quarantine_on_agent": false, "endpoint_detection": true, "hl_status": "stable", "hl_testing_start_time": "2026-03-23T11:46:25.570833Z", "rule_level": "high", "rule_level_override": null, "rule_confidence": "strong", "rule_confidence_override": null, "references": [ "https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\nhttps://asec.ahnlab.com/en/87804/\nhttps://threats.wiz.io/all-incidents/larva-25003-iis-native-module-malware-used-in-targeted-web-server-attacks" ], "name": "wingtbcli.yar", "content": "rule wingtb_cli {\n meta:\n title = \"WingtbCLI HackTool\"\n id = \"5c34dabc-eeb7-4122-9c71-5856c23b4e2b\"\n description = \"Detects WingtbCLI.exe, a tool used to interact with an hidden rootkit driver.\\nThis driver is specialized in process, registry key, file and directory hidding and its main role is to conceal a malicious IIS module from security products.\\nThis tool is used to interact with this driver to specify the objects to hide.\\nIt is recommended to analyze the context around this alert and investigate further suspicious actions.\"\n references = \"https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\\nhttps://asec.ahnlab.com/en/87804/\\nhttps://threats.wiz.io/all-incidents/larva-25003-iis-native-module-malware-used-in-targeted-web-server-attacks\"\n date = \"2025-09-02\"\n modified = \"2025-10-24\"\n author = \"HarfangLab\"\n tags = \"attack.defense_evasion;attack.t1564.001;attack.t1562\"\n classification = \"Windows.HackTool.WingtbCLI\"\n context = \"process,memory,file.pe\"\n os = \"Windows\"\n arch = \"x86,x64\"\n score = 70\n confidence = \"strong\"\n\n strings:\n // Detection for this sample:\n // 913431f1d36ee843886bb052bfc89c0e5db903c673b5e6894c49aabc19f1e2fc\n\n $debug_message00 = \"Error, invalid target ruleid for command 'unprotect'\" wide\n $debug_message01 = \"Internal error, invalid type for command 'unprotect'\" wide\n $debug_message02 = \"Error, command 'unprotect' rejected\" wide\n $debug_message03 = \"Command 'unprotect' successful\" wide\n $debug_message04 = \"Error, invalid target pid for command 'query'\" wide\n $debug_message05 = \"Error, invalid object type for command 'query'\" wide\n $debug_message06 = \"Error, query state rejected\" wide\n $debug_message07 = \"Error, query ignored state rejected\" wide\n $debug_message08 = \"Error, query protected state rejected\" wide\n $debug_message09 = \"Error, query hidden state rejected\" wide\n $debug_message10 = \"Error, mismatched argument #1 for command 'unprotect'\" wide\n $debug_message11 = \"Error, mismatched argument #2 for command 'unprotect'\" wide\n $debug_message12 = \"Error, invalid target ruleid for command 'unprotect'\" wide\n $debug_message13 = \"Internal error, invalid type for command 'unprotect'\" wide\n $debug_message14 = \"Error, mismatched argument #1 for command 'protect'\" wide\n $debug_message15 = \"Error, invalid object type in command 'protect'\" wide\n $debug_message16 = \"Internal error, invalid type for command 'protect'\" wide\n $debug_message17 = \"Error, command 'protect' rejected\" wide\n $debug_message18 = \"Command 'protect' successful\" wide\n $debug_message19 = \"Error, install/uninstall mode isn't supported for this command\" wide\n $debug_message20 = \"Error, mismatched argument #1 for command 'unignore'\" wide\n $debug_message21 = \"Error, mismatched argument #2 for command 'unignore'\" wide\n $debug_message22 = \"Error, invalid target ruleid for command 'unignore'\" wide\n $debug_message23 = \"Error, mismatched argument #1 for command 'unhide'\" wide\n $debug_message24 = \"Error, mismatched argument #2 for command 'unhide'\" wide\n $debug_message25 = \"Error, invalid argument for command 'unhide'\" wide\n $debug_message26 = \"Error, invalid target objid for command 'unhide'\" wide\n $debug_message27 = \"Internal error #1, invalid type for command 'unhide'\" wide\n $debug_message28 = \"Internal error #2, invalid type for command 'unhide'\" wide\n $debug_message29 = \"Error, command 'unhide' rejected\" wide\n $debug_message30 = \"Command 'unhide' successful\" wide\n $debug_message31 = \"Error, invalid argument for command 'hide'\" wide\n $debug_message32 = \"Internal error, invalid type for command 'hide'\" wide\n $debug_message33 = \"Error, command 'hide' rejected\" wide\n $debug_message34 = \"Command 'hide' successful\" wide\n $debug_message35 = \"Error, mismatched argument #1 for command 'delete'\" wide\n $debug_message36 = \"Error, mismatched argument #2 for command 'delete'\" wide\n $debug_message37 = \"Error, invalid target pid for command\" wide\n\n condition:\n 10 of ($debug*)\n}\n", "rule_count": 1, "rule_names": [ "wingtb_cli" ], "rule_creation_date": "2025-09-02", "rule_modified_date": "2025-10-24", "rule_os": [ "windows" ], "rule_classifications": [ "Windows.HackTool.WingtbCLI" ], "rule_tactic_tags": [ "attack.defense_evasion" ], "rule_technique_tags": [ "attack.t1564.001", "attack.t1562" ], "rule_score": 70, "rule_context": [ "file.pe", "memory", "process" ], "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645" } { "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-wingtb_rootkit_driver_yar", "test_maturity_current_count": 0, "test_maturity_delay": 7, "test_maturity_threshold": 10, "global_state": "alert", "effective_state": "alert", "rule_effective_level": "critical", "rule_effective_confidence": "strong", "alert_count": 0, "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645", "rule_level_overridden": false, "last_modifier": { "id": 1, "username": "system_supervisor" }, "origin_stack": { "id": "b8e2fe4fc90e4d08", "name": null, "is_current": false, "is_supervisor": true, "is_tenant": false }, "tenant": "b8e2fe4fc90e4d08", "origin_stack_id": "b8e2fe4fc90e4d08", "last_update": "2026-03-23T11:46:25.576753Z", "creation_date": "2026-03-23T11:46:25.576755Z", "enabled": true, "block_on_agent": false, "quarantine_on_agent": false, "endpoint_detection": true, "hl_status": "stable", "hl_testing_start_time": "2026-03-23T11:46:25.576760Z", "rule_level": "critical", "rule_level_override": null, "rule_confidence": "strong", "rule_confidence_override": null, "references": [ "https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\nhttps://asec.ahnlab.com/en/87804/\nhttps://threats.wiz.io/all-incidents/larva-25003-iis-native-module-malware-used-in-targeted-web-server-attacks" ], "name": "wingtb_rootkit_driver.yar", "content": "rule wingtb_rootkit_driver {\n meta:\n title = \"Wingtb Rootkit Driver\"\n id = \"23bdff04-a77c-4e1a-8ef0-9645e976fa63\"\n description = \"Detects a hidden rootkit driver written in C++ and called Winkbj.sys.\\nThis driver is specialized in process, registry key, file and directory hidding and its main role is to conceal a malicious IIS module from security products.\\nA specific binary named WingtbCLI.exe is used to interact with this driver to specify the objects to hide.\\nIt is recommended to analyze the context around this alert and investigate further suspicious actions or network connections.\"\n references = \"https://harfanglab.io/insidethelab/rudepanda-owns-iis-servers-like-2003/\\nhttps://asec.ahnlab.com/en/87804/\\nhttps://threats.wiz.io/all-incidents/larva-25003-iis-native-module-malware-used-in-targeted-web-server-attacks\"\n date = \"2025-09-02\"\n modified = \"2025-10-24\"\n author = \"HarfangLab\"\n tags = \"attack.defense_evasion;attack.t1564.001;attack.t1562\"\n classification = \"Windows.Rootkit.WingtbDriver\"\n context = \"process,memory,thread,file.pe\"\n os = \"Windows\"\n arch = \"x86,x64\"\n score = 100\n confidence = \"strong\"\n\n strings:\n // Detection for these samples:\n // f9dd0b57a5c133ca0c4cab3cca1ac8debdc4a798b452167a1e5af78653af00c1\n // 88fd3c428493d5f7d47a468df985c5010c02d71c647ff5474214a8f03d213268\n\n $debug_msg00 = \"CleanFileFullDirectoryInformation\"\n $debug_msg01 = \"CleanFileBothDirectoryInformation\"\n $debug_msg02 = \"CleanFileDirectoryInformation\"\n $debug_msg03 = \"CleanFileIdFullDirectoryInformation\"\n $debug_msg04 = \"CleanFileIdBothDirectoryInformation\"\n $debug_msg05 = \"CleanFileNamesInformation\"\n $debug_msg06 = \"InitAddHiddenFile\"\n $debug_msg07 = \"AddHiddenFile\"\n $debug_msg08 = \"RemoveHiddenFile\"\n $debug_msg09 = \"RemoveAllHiddenFiles\"\n $debug_msg10 = \"InitAddHiddenDir\"\n $debug_msg11 = \"AddHiddenDir\"\n $debug_msg12 = \"RemoveHiddenDir\"\n $debug_msg13 = \"RemoveAllHiddenDirs\"\n $debug_msg14 = \"Added hidden file:%wZ\"\n $debug_msg15 = \"Adding hidden file failed with code:%08x, path:%wZ\"\n $debug_msg16 = \"Can't remove hidden file, code:%08x, id:%lld\"\n $debug_msg17 = \"All hidden files are removed\"\n $debug_msg18 = \"Can't remove all hidden files, code:%08x\"\n $debug_msg19 = \"Added hidden dir:%wZ\"\n $debug_msg20 = \"Adding hidden dir failed with code:%08x, path:%wZ\"\n $debug_msg21 = \"Can't remove hidden dir, code:%08x, id:%lld\"\n $debug_msg22 = \"All hidden dirs are removed\"\n $debug_msg23 = \"Can't remove all hidden dirs, code:%08x\"\n $debug_msg24 = \"Process object operation, destPid:%Iu, srcTid:%Iu, oper: %s, space: %s\"\n $debug_msg25 = \"Allow protected process access from %Iu to %Iu\"\n $debug_msg26 = \"Disallow protected process access from %Iu to %Iu\"\n $debug_msg27 = \"Thread object operation, destPid:%Iu, destTid:%Iu, srcPid:%Iu, oper:%s, space:%s\"\n $debug_msg28 = \"Allow protected thread access from %Iu to %Iu\"\n $debug_msg29 = \"Disallow protected thread access from %Iu to %Iu\"\n $debug_msg30 = \"Error, can't get active process links list, eprocess:%p\"\n $debug_msg31 = \"Error, can't find active system process\"\n $debug_msg32 = \"PID %Iu has been removed from PspCidTable, entry:%p, object:%p, access:%08x\"\n $debug_msg33 = \"PID %Iu has been restored to PspCidTable, entry:%p, object:%p, access:%08x\"\n $debug_msg34 = \"Warning, can't add process(pid:%Iu) to process table\"\n $debug_msg35 = \"Warning, can't remove process(pid:%Iu) from process table\"\n $debug_msg36 = \"Registry key is hidden: %wZ\"\n $debug_msg37 = \"Registry key is going to be hidden in: %wZ (inc: %d)\"\n $debug_msg38 = \"Registry value is going to be hidden in: %wZ (inc: %d)\"\n $debug_msg39 = \"Registry value has been hidden: %wZ\\\\%wZ (inc: %d)\"\n\n condition:\n 5 of ($debug_msg*)\n}\n", "rule_count": 1, "rule_names": [ "wingtb_rootkit_driver" ], "rule_creation_date": "2025-09-02", "rule_modified_date": "2025-10-24", "rule_os": [ "windows" ], "rule_classifications": [ "Windows.Rootkit.WingtbDriver" ], "rule_tactic_tags": [ "attack.defense_evasion" ], "rule_technique_tags": [ "attack.t1564.001", "attack.t1562" ], "rule_score": 100, "rule_context": [ "thread", "memory", "file.pe", "process" ], "source": "215dd4e5-9cb3-4e8e-805c-9e96809b7645" } { "id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645-winpeas_yar", "test_maturity_current_count": 0, "test_maturity_delay": 7, "test_maturity_threshold": 10, "global_state": "alert", "effective_state": "alert", "rule_effective_level": "high", "rule_effective_confidence": "strong", "alert_count": 0, "source_id": "215dd4e5-9cb3-4e8e-805c-9e96809b7645", "rule_level_overridden": false, "last_modifier": { "id": 1, "username": "system_supervisor" }, "origin_stack": { "id": "b8e2fe4fc90e4d08", "name": null, "is_current": false, "is_supervisor": true, "is_tenant": false }, "tenant": "b8e2fe4fc90e4d08", "origin_stack_id": "b8e2fe4fc90e4d08", "last_update": "2026-03-23T11:46:25.563414Z", "creation_date": "2026-03-23T11:46:25.563417Z", "enabled": true, "block_on_agent": false, "quarantine_on_agent": false, "endpoint_detection": true, "hl_status": "stable", "hl_testing_start_time": "2026-03-23T11:46:25.563426Z", "rule_level": "high", "rule_level_override": null, "rule_confidence": "strong", "rule_confidence_override": null, "references": [ "https://attack.mitre.org/techniques/T1082/\nhttps://attack.mitre.org/techniques/T1592/\nhttps://attack.mitre.org/tactics/TA0004/\nhttps://github.com/carlospolop/PEASS-ng/tree/master/winPEAS" ], "name": "winpeas.yar", "content": "rule winpeas_binaries {\n meta:\n title = \"WinPEAS Tool\"\n id = \"3282873a-3d94-4c4d-a315-5fc362d43d95\"\n description = \"Detects WinPEAS precompiled binaries.\\nWinPEAS is a popular open-source enumeration tool for privilege escalation. This tool can be used by attackers to enumerate privilege escalation vectors on a host.\\nIt is recommended to investigate the context around the execution of WinPEAS as well as to look for further malicious actions on the host.\"\n references = \"https://attack.mitre.org/techniques/T1082/\\nhttps://attack.mitre.org/techniques/T1592/\\nhttps://attack.mitre.org/tactics/TA0004/\\nhttps://github.com/carlospolop/PEASS-ng/tree/master/winPEAS\"\n date = \"2022-10-19\"\n modified = \"2025-03-07\"\n author = \"HarfangLab\"\n tags = \"attack.discovery;attack.t1082;attack.reconnaissance;attack.t1592.001;attack.t1592.002;attack.t1592.004;attack.privilege_escalation\"\n classification = \"Windows.Tool.WinPEAS\"\n context = \"process,file.pe\"\n os = \"Windows\"\n arch = \"x86,x64\"\n score = 70\n confidence = \"strong\"\n\n strings:\n // Detection for these samples :\n // 911b27e9c68ba088aeef0b8042155332973a592346d92e5c4dafbdef4555ab42\n // 680fb130d71da2d424488e0a34d188e5045d43d79278767d5bb35e694c7b9926\n // 1a2d90a23fd42c352a89507306d91908fd318f9a2c63c2005d2125191bd5609f\n // b6a7bd6e96b3acb6cc248b736ceb8feb392cfbbe8f71417c731a43ad34e35b61\n // c49455b579f01a01dd8b1f6d37419238abd9e720bc4ed355d38fe3999321b917\n // 470a29e8a06dfb6db4c057b30d0866ebb538a3525342e7a5468141a8659f39e8\n\n $ascii_pea_1 = \" {0}(({1}#######(,.***.,(###################(..***.{2}*******{0}(((((\" wide ascii\n $ascii_pea_2 = \" {0}(({1}#######*(#####((##################((######/({2}*****{0}(((((\" wide ascii\n $ascii_pea_3 = \" {0}(({1}###################(/***********(##############({0})(((((\" wide ascii\n $ascii_pea_4 = \" {0}((({1}#####################/*******(################{0})((((((\" wide ascii\n $ascii_pea_5 = \" {0}(((({1}############################################{0})((((((\" wide ascii\n\n $hacktricks_link = \"https://book.hacktricks.xyz/\" ascii\n $internal_struct = \"winPEAS.\" ascii\n\n $cve_pocs_1 = \"https://exploit-db.com/exploits/46718\" fullword ascii\n $cve_pocs_2 = \"https://github.com/apt69/COMahawk\" fullword ascii\n $cve_pocs_3 = \"https://github.com/danigargu/CVE-2020-0796 (smbghost)\" fullword ascii\n $cve_pocs_4 = \"https://github.com/padovah4ck/\" ascii\n $cve_pocs_5 = \"https://github.com/rogue-kdc/CVE-2019-0841\" fullword ascii\n $cve_pocs_6 = \"https://github.com/S3cur3Th1sSh1t/SharpByeBear\" fullword ascii\n\n $general_1 = \"DwinPEAS.Info.FilesInfo.Office.Office+