Skip to content

Commit a841df9

Browse files
octo-sts-8[bot]github-actions[bot]
octo-sts-8[bot]
and
github-actions[bot]
authored
Update third-party rules as of 2026-05-07 (#1509)
Co-authored-by: Update third-party rules <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 00b9cb2 commit a841df9

14 files changed

Lines changed: 404 additions & 1 deletion

‎third_party/yara/elastic/RELEASE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
d131ea8191d1999855d61d13b708392d8c2e6a6b
1+
4e4cb2c4499c24c12a86ec7ef8c30bb2b7e9467a

‎third_party/yara/elastic/Windows_Trojan_AuraStealer.yar‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
rule Windows_Trojan_AuraStealer_5dd9a496 {
2+
meta:
3+
author = "Elastic Security"
4+
id = "5dd9a496-f14f-4d96-a5e9-77432077374e"
5+
fingerprint = "a3213eaab576c626cbb0ba99c4486ba184df6bbe4b33eca66184257597157285"
6+
creation_date = "2026-04-09"
7+
last_modified = "2026-05-05"
8+
threat_name = "Windows.Trojan.AuraStealer"
9+
reference_sample = "b06c1fe3b5f6577b03053b7ada25dc592e6e2c62e6c5d6d14799be1f955ad5aa"
10+
severity = 100
11+
arch_context = "x86"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$a1 = { 8B 45 10 31 FF 85 C0 BE 06 00 00 00 0F 49 F0 83 7D 0C 00 0F 95 C0 89 F3 81 E3 00 04 00 00 0F 94 C2 20 C2 0F BA E6 10 0F B6 C2 8D 14 C5 00 00 00 00 }
17+
$b2 = { 8A 1C 82 88 1C 81 8A 5C 82 01 88 5C 81 01 8A 5C 82 02 88 5C 81 02 8A 5C 82 03 88 5C 81 03 40 83 F8 08 75 DC B8 08 00 00 00 8A 7C 81 FC }
18+
condition:
19+
all of them
20+
}
21+

‎third_party/yara/elastic/Windows_Trojan_BrushLogger.yar‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
rule Windows_Trojan_BrushLogger_304ee146 {
2+
meta:
3+
author = "Elastic Security"
4+
id = "304ee146-8abf-4d4d-8b50-df90a641f400"
5+
fingerprint = "bd66e7980779c7065a544d3578a685007fb00d6990320001ef8869a1d0ad969e"
6+
creation_date = "2026-03-25"
7+
last_modified = "2026-05-05"
8+
threat_name = "Windows.Trojan.BrushLogger"
9+
reference_sample = "4f1ea5ed6035e7c951e688bd9c2ec47a1e184a81e9ae783d4a0979501a1985cf"
10+
severity = 100
11+
arch_context = "x86"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$a = "%02d-%02d-%d %02d:%02d " fullword
17+
$b = { 81 ?? ?? A1 00 00 00 74 09 81 ?? ?? A0 00 00 00 75 09 6A 00 6A 10 E8 }
18+
condition:
19+
all of them
20+
}
21+

‎third_party/yara/elastic/Windows_Trojan_BrushWorm.yar‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
rule Windows_Trojan_BrushWorm_7c2098ef {
2+
meta:
3+
author = "Elastic Security"
4+
id = "7c2098ef-a426-4331-8b04-e96fa8b42cb6"
5+
fingerprint = "931842bcd7cfa1afcaf5313a9f18097bc733ed52679ad9459d0e872319f85afd"
6+
creation_date = "2026-03-25"
7+
last_modified = "2026-05-05"
8+
threat_name = "Windows.Trojan.BrushWorm"
9+
reference_sample = "89891aa3867c1a57512d77e8e248d4a35dd32e99dcda0344a633be402df4a9a7"
10+
severity = 100
11+
arch_context = "x86"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$a = "internetCheckDomain" wide fullword
17+
$b = { B8 00 00 00 40 33 C9 0F A2 48 8D ?? ?? ?? 89 07 89 5F 04 89 4F 08 89 57 0C 45 33 C0 }
18+
condition:
19+
all of them
20+
}
21+

‎third_party/yara/elastic/Windows_Trojan_CristalLoaders.yar‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
rule Windows_Trojan_CristalLoaders_652f19ab {
2+
meta:
3+
author = "Elastic Security"
4+
id = "652f19ab-4c8c-48d0-a7a8-fdf592ea29f1"
5+
fingerprint = "f6f83fe8f20a1e9780e57c58b09786403663f6fd65f3d52d47e10bb98020d899"
6+
creation_date = "2026-03-18"
7+
last_modified = "2026-05-05"
8+
threat_name = "Windows.Trojan.CristalLoaders"
9+
reference_sample = "af92ec050ba5115a057c01365af3f154336921c1891a39a0186ac4ab7d45394f"
10+
severity = 100
11+
arch_context = "x86"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$a1 = { 51 52 41 50 41 51 41 52 41 53 48 83 EC 20 B9 5D 68 FA 3C BA }
17+
$a2 = { 51 52 41 50 41 51 41 52 41 53 48 83 EC 20 B9 5B BC 4A 6A BA }
18+
$a3 = { 41 51 52 41 52 41 50 41 53 48 83 EC 20 B9 5B BC 4A 6A BA }
19+
$b1 = { 51 52 41 50 41 51 41 52 41 53 48 83 EC 20 }
20+
$b2 = { 41 5B 41 5A 41 59 41 58 5A 59 FF D0 }
21+
condition:
22+
1 of ($a*) or all of ($b*)
23+
}
24+

‎third_party/yara/elastic/Windows_Trojan_NodeKeylogger.yar‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
rule Windows_Trojan_NodeKeylogger_ffc7db41 {
2+
meta:
3+
author = "Elastic Security"
4+
id = "ffc7db41-c3a2-4fb7-98db-d8d93a607ef4"
5+
fingerprint = "cbaa7c21cbf33754b22b820554e7f0a355f6ea76e4799dd47ff905a0ba851b01"
6+
creation_date = "2026-03-22"
7+
last_modified = "2026-05-05"
8+
threat_name = "Windows.Trojan.NodeKeylogger"
9+
reference_sample = "e58864cc22cd8ec17ae35dd810455d604aadab7c3f145b6c53b3c261855a4bb1"
10+
severity = 100
11+
arch_context = "x86"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$a0 = "%s,%s,%i,%i,%ld,%ld,%i" fullword
17+
$a1 = "MOUSE" fullword
18+
$a2 = "KEYBOARD" fullword
19+
$a3 = "DOWN" fullword
20+
$b0 = { 81 7D 08 08 02 00 00 [6] 81 7D 08 01 02 00 00 73 ?? 81 7D 08 05 01 00 00 74 ?? 81 7D 08 05 01 00 00 [6] 81 7D 08 04 01 00 00 }
21+
condition:
22+
all of them
23+
}
24+

‎third_party/yara/elastic/Windows_Trojan_PhantomPull.yar‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
rule Windows_Trojan_PhantomPull_e5dfd651 {
2+
meta:
3+
author = "Elastic Security"
4+
id = "e5dfd651-5fd3-4d88-8de7-96ed5706f553"
5+
fingerprint = "73d8dde2e57a9c883470c47a115ceeb194ebd39b01a1f5200b8677b25350b897"
6+
creation_date = "2026-04-13"
7+
last_modified = "2026-05-05"
8+
threat_name = "Windows.Trojan.PhantomPull"
9+
reference_sample = "70bbb38b70fd836d66e8166ec27be9aa8535b3876596fc80c45e3de4ce327980"
10+
severity = 100
11+
arch_context = "x86"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$GetTickCount = { 48 83 C4 80 FF 15 ?? ?? ?? ?? 83 F8 FE 75 }
17+
$djb2 = { 45 8B 0C 83 41 BA A7 C6 67 4E 49 01 C9 45 8A 01 }
18+
$mutex = { 48 89 EB 83 E3 ?? 45 8A 2C 1C 45 32 2C 2E 45 0F B6 FD }
19+
$str_decrypt = { 39 C2 7E ?? 49 89 C1 41 83 E1 ?? 47 8A 1C 0A 44 32 1C 01 45 88 1C 00 48 FF C0 }
20+
$payload_decrypt = { 4C 89 C8 83 E0 0F 41 8A 14 02 43 30 14 0F 49 FF C1 44 39 CB }
21+
$url = "/v1/updates/check?build=payloads" ascii fullword
22+
condition:
23+
3 of them
24+
}
25+

‎third_party/yara/elastic/Windows_Trojan_PhantomPulse.yar‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
rule Windows_Trojan_PhantomPulse_eaaa34fb {
2+
meta:
3+
author = "Elastic Security"
4+
id = "eaaa34fb-eb17-433a-ba0c-f5245cb581b4"
5+
fingerprint = "36f5a16a014b315dc04c4c8f59bc3b653b17d0f67b5723a6b662b58709845008"
6+
creation_date = "2026-04-13"
7+
last_modified = "2026-05-05"
8+
threat_name = "Windows.Trojan.PhantomPulse"
9+
reference_sample = "9e3890d43366faec26523edaf91712640056ea2481cdefe2f5dfa6b2b642085d"
10+
severity = 100
11+
arch_context = "x86"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$a = "[UNINSTALL 2/6] Removing Scheduled Task..." fullword
17+
$b = "PhantomInject: host PID=%lu" fullword
18+
$c = "inject: shellcode detected -> InjectShellcodePhantom" fullword
19+
$d = "inject: shellcode detected, using phantom section hijack" fullword
20+
condition:
21+
all of them
22+
}
23+

‎third_party/yara/elastic/Windows_Trojan_Remus.yar‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
rule Windows_Trojan_Remus_7a39fb15 {
2+
meta:
3+
author = "Elastic Security"
4+
id = "7a39fb15-e7d0-47a6-a817-f79dcdb82ed5"
5+
fingerprint = "c1d3e07becc94ad265b6014f27403229e2e37bf5da3caccfdc5eda05006c5c67"
6+
creation_date = "2026-04-08"
7+
last_modified = "2026-05-05"
8+
threat_name = "Windows.Trojan.Remus"
9+
reference_sample = "0a8f734f10400f7ae8fef591147e78dab6350089683be84c1cb6c82113cb1319"
10+
severity = 100
11+
arch_context = "x86"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$a1 = "# REMUS LOG" ascii fullword
17+
$b1 = { 48 83 EC 10 4C 89 14 24 4C 89 5C 24 08 4D 31 DB 4C 8D 54 24 18 49 29 C2 4D 0F 42 DA 65 4C 8B 1C 25 10 00 00 00 4D 39 DA 73 ?? 66 ?? ?? ?? ?? ?? 4D 8D 9B 00 F0 FF FF 45 84 1B 4D 39 DA }
18+
$b2 = { 81 3C D1 7C 65 E0 52 74 ?? 48 FF C2 48 39 D0 75 EF }
19+
condition:
20+
2 of them
21+
}
22+

‎third_party/yara/elastic/Windows_Trojan_Stealc.yar‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,3 +94,23 @@ rule Windows_Trojan_Stealc_41db1d4d {
9494
3 of them
9595
}
9696

97+
rule Windows_Trojan_Stealc_df3cdc7e {
98+
meta:
99+
author = "Elastic Security"
100+
id = "df3cdc7e-a9ef-4719-90ce-a45106166f00"
101+
fingerprint = "71c93f3ff9248b5d13bd01cfedf2f5999e39689b7553fc606a623a9beca7d281"
102+
creation_date = "2026-03-16"
103+
last_modified = "2026-05-05"
104+
threat_name = "Windows.Trojan.Stealc"
105+
reference_sample = "503879c9c294cd7a2b7b13c643b93d8a8e7ae00af5b2b56fcbb90e6c096f40d6"
106+
severity = 100
107+
arch_context = "x86"
108+
scan_context = "file, memory"
109+
license = "Elastic License v2"
110+
os = "windows"
111+
strings:
112+
$a = { 48 8B E8 48 8D 48 FF 48 83 F9 ?? ?? ?? ?? ?? ?? 00 48 8D 54 24 48 48 8B C8 FF 15 30 4E 01 00 85 C0 74 52 39 74 24 4C 75 4C 8B 5C 24 48 8D 4E 40 8B D3 FF 15 2F 4E 01 00 48 8B F8 48 85 C0 74 3E }
113+
condition:
114+
all of them
115+
}
116+

0 commit comments

Comments
 (0)