Skip to content

Commit 483459d

Browse files
octo-sts[bot]github-actions[bot]
octo-sts[bot]
and
github-actions[bot]
authored
Update third-party rules as of 2025-07-27 (#1060)
Co-authored-by: Update third-party rules <41898282+github-actions[bot]@users.noreply.github.com>
1 parent e7d9568 commit 483459d

9 files changed

Lines changed: 276 additions & 5 deletions

File tree

‎third_party/yara/bartblaze/APT/StormDNS.yar‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
rule StormDNS
2+
{
3+
meta:
4+
id = "75nX2TPCk53RAhU55yBeFd"
5+
fingerprint = "v1_sha256_542a8af37bd4bc18218190cd82495146a4daa5d01db24804b9ff16ff04023a5a"
6+
version = "1.0"
7+
date = "2025-07-24"
8+
modified = "2025-07-24"
9+
status = "RELEASED"
10+
sharing = "TLP:WHITE"
11+
source = "BARTBLAZE"
12+
author = "@bartblaze"
13+
description = "Identifies StormDNS, a DNS shell used by Storm-260 to receive and execute commands from a C2."
14+
category = "MALWARE"
15+
malware = "STORMDNS"
16+
malware_type = "WEBSHELL"
17+
reference = "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities"
18+
hash = "1eb914c09c873f0a7bcf81475ab0f6bdfaccc6b63bf7e5f2dbf19295106af192"
19+
20+
strings:
21+
$str_a = "Slept for %d seconds"
22+
$str_b = "Failed to allocate memory"
23+
$str_c = "cmd.exe /c %s 2>&1"
24+
$str_d = "Failed to execute command"
25+
$str_e = "Failed to reallocate memory"
26+
$str_f = "Command executed with no output"
27+
$str_g = "fragment_received"
28+
$str_h = "result_received"
29+
$str_i = "s%st%04zup%04zu"
30+
31+
$pdb_part = "\\work\\tools\\ak47c2\\"
32+
$pdb_full = "C:\\Users\\Administrator\\Desktop\\work\\tools\\ak47c2\\dnsclinet-c\\dnsclient\\x64\\Release\\dnsclient.pdb"
33+
34+
condition:
35+
8 of ($str_*) or any of ($pdb_*)
36+
}

‎third_party/yara/bartblaze/RELEASE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
255135e922b571965ab942554fcd7b9b6162f091
1+
063fb36a398f8bec668ab715b17dc4596fdadb0f

‎third_party/yara/bartblaze/hacktools/Extract_MachineKey_SharePoint.yar‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
import "dotnet"
2+
rule Extract_MachineKey_SharePoint
3+
{
4+
meta:
5+
id = "5rgC2cpznLmamBSQ9etlFh"
6+
fingerprint = "v1_sha256_267976231782f0458c369172e8d922508daf670089ef3c91ad2570fe3600d6c4"
7+
version = "1.0"
8+
date = "2025-07-25"
9+
modified = "2025-07-25"
10+
status = "RELEASED"
11+
sharing = "TLP:WHITE"
12+
source = "BARTBLAZE"
13+
author = "@bartblaze"
14+
description = "Identifies webshell that extracts SharePoint's MachineKey configuration."
15+
category = "TOOL"
16+
tool = "WEBSHELL"
17+
reference = "https://x.com/Gi7w0rm/status/1948027800591466773"
18+
hash = "3461da3a2ddcced4a00f87dcd7650af48f97998a3ac9ca649d7ef3b7332bd997"
19+
20+
strings:
21+
$xml = "<?xml" nocase
22+
23+
$httpcontext = "HttpContext" fullword
24+
$validation = "MachineKeyValidation"
25+
26+
$mks_a = "MachineKeySection"
27+
$mks_b = "System.Web.Configuration.MachineKeySection"
28+
29+
$str_a = "-------------------- .NET Properties --------------------"
30+
$str_b = "Number of Logical Drives:"
31+
$str_c = "List of Logical Drives:"
32+
$str_d = "Computer Name:"
33+
$str_e = "Full path of the system directory:"
34+
$str_f = "Current Directory:"
35+
$str_g = "Number of processors on this machine:"
36+
$str_h = "Number of milliseconds since system start:"
37+
$str_i = "Username of the user currently logged onto the operating system:"
38+
$str_j = "Operating System Version:"
39+
$str_k = ".NET Version:"
40+
$str_l = "-------------------- Environment Variables --------------------"
41+
42+
condition:
43+
not $xml in (0..10) and (
44+
($httpcontext and $validation and any of ($mks_*)) or (any of ($mks_*, $validation) and 8 of ($str_*)) or
45+
dotnet.guids[0]=="64c708ee-5f26-4eef-b474-651321a0e469" or
46+
dotnet.guids[0]=="a253a3d9-f7e6-484e-b392-685b0b7a9c5d" or
47+
dotnet.guids[0]=="ab423cff-901e-4882-9939-bf1b54eddffb" or
48+
dotnet.guids[0]=="63e8005d-08a3-423d-ab6b-53cc05629d457" or
49+
dotnet.guids[0]=="de37ec6b-4312-4073-81ea-903f0a340a11"
50+
)
51+
}

‎third_party/yara/bartblaze/hacktools/GhostShell_SharePoint.yar‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
import "dotnet"
2+
rule GhostShell_SharePoint
3+
{
4+
meta:
5+
id = "3L2nePhWiYOjRbQGFIZjdc"
6+
fingerprint = "v1_sha256_f5b1a1f487e7af2f315825c0a6657a84088bbfcdf57f3523de14c36e608bf287"
7+
version = "1.0"
8+
date = "2025-07-25"
9+
modified = "2025-07-25"
10+
status = "RELEASED"
11+
sharing = "TLP:WHITE"
12+
source = "BARTBLAZE"
13+
author = "@bartblaze"
14+
description = "Identifies compiled Ghostfile.aspx, simple reverse shell / backdoor as also seen in the ToolShell (SharePoint) attacks."
15+
category = "TOOL"
16+
tool = "GHOSTSHELL"
17+
reference = "https://x.com/marius_benthin/status/1948761502334267478"
18+
hash = "7e9b77da1f51d03ee2f96bc976f6aeb781f801cf633862a4b8c356cbb555927d"
19+
20+
strings:
21+
$aspx = ".aspx" ascii wide nocase
22+
23+
$cmd_a = "Usage: ?cmd=command" ascii wide
24+
25+
/*
26+
string text2 = string.Concat(new string[] { "c", "m", "d", ".", "exe" });
27+
string text3 = string.Join("", new string[] { "/c ", text });
28+
*/
29+
$cmd_b = {7209000070A2110717720D000070A21107187211000070A21107197215000070A211071A7219000070A21107280C00000A0B7221000070188D1300000113071107167223000070A211071706A21107280D00000A}
30+
31+
$layout_a = "/_layouts/" ascii wide nocase
32+
$layout_b = "/layouts/" ascii wide nocase
33+
34+
35+
condition:
36+
$aspx and any of ($cmd_*) and any of ($layout_*) or
37+
dotnet.guids[0]=="5497bdc1-57e4-4c5b-81eb-9dc7ca8b5aec" or
38+
dotnet.guids[0]=="cbcef74f-0a3d-4d87-8c6a-7044755c24f8"
39+
}

‎third_party/yara/bartblaze/hacktools/IIS_Backdoor.yar‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
import "dotnet"
2+
rule IIS_Backdoor
3+
{
4+
meta:
5+
id = "4yJbnKKjfmtotBMpm2zK4F"
6+
fingerprint = "v1_sha256_4c2d7551e42e643a2265a821c6e629b83cbbbf903afc5ab9577ab13197dd4daa"
7+
version = "1.0"
8+
date = "2025-07-24"
9+
modified = "2025-07-24"
10+
status = "RELEASED"
11+
sharing = "TLP:WHITE"
12+
source = "BARTBLAZE"
13+
author = "@bartblaze"
14+
description = "Identifies an IIS backdoor used by Storm-2603."
15+
category = "TOOL"
16+
tool = "IISBACKDOOR"
17+
reference = "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities"
18+
reference = "https://github.com/WBGlIl/IIS_backdoor"
19+
hash = "6f6db63ece791c6dc1054f1e1231b5bbcf6c051a49bad0784569271753e24619"
20+
21+
strings:
22+
$iis_module = "IHttpModule"
23+
$str_cmd = "cmd.exe"
24+
$str_cookie = "sets-cookie"
25+
$str_dll = "IIS_Server_dll"
26+
27+
$pdb_part = "\\david8866\\Desktop\\toolsnew\\"
28+
$pdb_full = "C:\\Users\\david8866\\Desktop\\toolsnew\\backdoor\\IIS-backdoor\\method1-module\\module-backdoor\\IIS-module-cmd\\IIS_Server_dll.pdb"
29+
30+
condition:
31+
($iis_module and 2 of ($str_*)) or
32+
any of ($pdb_*) or
33+
dotnet.guids[0]=="05b57f52-968e-4f0f-a3e7-dd0bc7376fc5" or
34+
dotnet.guids[0]=="3fda4aa9-6fc1-473f-9048-7edc058c4f65"
35+
}

‎third_party/yara/bartblaze/hacktools/PowerTool.yar‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,14 @@ rule PowerTool
88
version = "1.0"
99
creation_date = "2021-07-01"
1010
first_imported = "2021-12-30"
11-
last_modified = "2025-03-10"
11+
last_modified = "2025-07-24"
1212
status = "RELEASED"
1313
sharing = "TLP:WHITE"
1414
source = "BARTBLAZE"
1515
author = "@bartblaze"
1616
description = "Identifies PowerTool, sometimes used by attackers to disable security software."
17-
category = "MALWARE"
18-
malware = "POWERTOOL"
17+
category = "TOOL"
18+
tool = "POWERTOOL"
1919
reference = "https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml"
2020

2121

@@ -30,4 +30,4 @@ rule PowerTool
3030
3131
condition:
3232
any of them
33-
}
33+
}

‎third_party/yara/bartblaze/hacktools/SharpAdidnsdump.yar‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
import "dotnet"
2+
rule SharpAdidnsdump
3+
{
4+
meta:
5+
id = "6rWYf0SwQzWanysjEs2F3h"
6+
fingerprint = "v1_sha256_81a0841b64b31da7c8e6f601913eaabbcf2d03868c46b6d5acf2da532964c200"
7+
version = "1.0"
8+
date = "2025-07-24"
9+
modified = "2025-07-24"
10+
status = "RELEASED"
11+
sharing = "TLP:WHITE"
12+
source = "BARTBLAZE"
13+
author = "@bartblaze"
14+
description = "Identifies SharpAdidnsdump, which allows for AD integrated DNS dumping and also abused by attackers such as Storm-2603."
15+
category = "TOOL"
16+
tool = "SHARPAPIDNSDUMP"
17+
reference = "https://github.com/b4rtik/SharpAdidnsdump"
18+
reference = "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities"
19+
hash = "f01675f9ca00da067bdb1812bf829f09ccf5658b87d3326d6fddd773df352574"
20+
21+
strings:
22+
$str_a = "IPAddress"
23+
$str_b = "DirectorySearcher"
24+
$str_c = "SearchResult"
25+
$str_d = "IPHostEntry"
26+
$str_e = "GetHostEntry"
27+
$str_f = "DirectoryEntry"
28+
29+
$clear_a = "Error retriving data"
30+
$clear_b = "dNSTombstoned"
31+
$clear_c = "Running enumeration against"
32+
33+
$SharpAdidnsdump = "SharpAdidnsdump" fullword
34+
35+
condition:
36+
(3 of ($str_*) and any of ($clear_*)) or
37+
$SharpAdidnsdump or
38+
dotnet.guids[0]=="8f985494-906c-485c-b3b3-0e90aa7d3ca7"
39+
}

‎third_party/yara/bartblaze/hacktools/SharpHostInfo.yar‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
rule SharpHostInfo
2+
{
3+
meta:
4+
id = "6pYAh7DjfYOnvcl9PJGDjY"
5+
fingerprint = "v1_sha256_a9973815c925b2c564ef1f4c2d4019e2d7a854d398a2378a0d86e6e4c3feadb4"
6+
version = "1.0"
7+
date = "2025-07-24"
8+
modified = "2025-07-24"
9+
status = "RELEASED"
10+
sharing = "TLP:WHITE"
11+
source = "BARTBLAZE"
12+
author = "@bartblaze"
13+
description = "Identifies SharpHostInfo, a tool used for quickly detecting intranet host information and also abused by attackers such as Storm-2603."
14+
category = "TOOL"
15+
tool = "SHARPHOSTINFO"
16+
reference = "https://github.com/shmilylty/SharpHostInfo"
17+
reference = "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities"
18+
hash = "d6da885c90a5d1fb88d0a3f0b5d9817a82d5772d5510a0773c80ca581ce2486d"
19+
20+
strings:
21+
$str_a = "[!] Failed:"
22+
$str_b = "[!] Error:"
23+
$str_c = "manuf.json" fullword
24+
$str_d = "Detect target:"
25+
$str_e = "Detect Service:"
26+
$str_f = "Detect thead:"
27+
$str_g = "Detect timeout:"
28+
$str_h = "The parsed detection target is empty"
29+
$str_i = "An exception occurred while reading the file list!"
30+
$str_j = "ParsingSocketStremResponse"
31+
32+
$sharphost = "SharpHostInfo" fullword
33+
34+
condition:
35+
8 of ($str_*) or $sharphost
36+
}

‎third_party/yara/bartblaze/ransomware/Warlock.yar‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
rule Warlock
2+
{
3+
meta:
4+
id = "4jggrARzQ2bsxiH62DEQRz"
5+
fingerprint = "v1_sha256_bae361b7df9cc56f933d73b72104c43f766f964dedd05603acc1249b23e1de6f"
6+
version = "1.0"
7+
date = "2025-07-24"
8+
modified = "2025-07-24"
9+
status = "RELEASED"
10+
sharing = "TLP:WHITE"
11+
source = "BARTBLAZE"
12+
author = "@bartblaze"
13+
description = "Identifies Warlock ransomware used by Storm-2603. It is also known as x2anylock ransomware and is a Lockbit (Black) derivative."
14+
category = "MALWARE"
15+
malware = "WARLOCK"
16+
malware_type = "RANSOMWARE"
17+
reference = "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities"
18+
hash = "abb0fa128d3a75e69b59fe0391c1158eb84a799ddb0abc55d2d6be3511ef0ea1"
19+
20+
strings:
21+
$str_pw = "replacethispassword" fullword
22+
$str_id = "Your decrypt ID:"
23+
$str_qtox = "QTox ID Support:"
24+
$str_email = "Email Support:"
25+
$str_contact = "You can contact us in email or qtox."
26+
$str_decrypt = "How to decrypt my data.log"
27+
28+
$ext = ".x2anylock" fullword
29+
$pdb_part_work = "\\work\\tools\\ai\\ak47\\"
30+
$pdb_part_end = "\\My7zdllhijacked.pdb"
31+
$pdb_full = "C:\\Users\\Administrator\\Desktop\\work\\tools\\ai\\ak47\\cpp\\7zdllhijacked\\7zdllhijacked\\x64\\Release\\My7zdllhijacked.pdb"
32+
33+
condition:
34+
5 of ($str_*) or $ext or any of ($pdb_*)
35+
}

0 commit comments

Comments
 (0)