Skip to content

Commit ecb80a9

Browse files
octo-sts[bot]github-actions[bot]egibs
authored
Update third-party rules as of 2025-10-15 (#1167)
Co-authored-by: Update third-party rules <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Evan Gibler <20933572+egibs@users.noreply.github.com>
1 parent 8f69c91 commit ecb80a9

8 files changed

Lines changed: 160 additions & 4 deletions

‎third_party/yara/elastic/RELEASE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
0d52fa9af8c9881639edf793f58a8cb637ece5b7
1+
b5a0c1956d0aa92e2f44156bc9983c25ddc817d1

‎third_party/yara/elastic/Windows_Ransomware_Stop.yar‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ rule Windows_Ransomware_Stop_1e8d48ff {
22
meta:
33
author = "Elastic Security"
44
id = "1e8d48ff-e0ab-478d-8268-a11f2e87ab79"
5-
fingerprint = "715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb"
5+
fingerprint = "bef9770e8deb4a5ba76cea1050ca0de1ef9ab6a6aa53f071126c3f0dacf368fd"
66
creation_date = "2021-06-10"
7-
last_modified = "2021-08-23"
7+
last_modified = "2025-09-26"
88
threat_name = "Windows.Ransomware.Stop"
99
reference_sample = "821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3"
1010
severity = 100
@@ -14,7 +14,7 @@ rule Windows_Ransomware_Stop_1e8d48ff {
1414
os = "windows"
1515
strings:
1616
$a = "E:\\Doc\\My work (C++)\\_Git\\Encryption\\Release\\encrypt_win_api.pdb" ascii fullword
17-
$b = { 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF }
17+
$b = { 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF FF FF C6 45 FC 01 50 FF D3 85 F6 79 36 56 68 }
1818
condition:
1919
any of them
2020
}

‎third_party/yara/elastic/Windows_Trojan_AveMaria.yar‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,32 @@ rule Windows_Trojan_AveMaria_31d2bce9 {
3030
8 of ($a*)
3131
}
3232

33+
rule Windows_Trojan_AveMaria_e01305a0 {
34+
meta:
35+
author = "Elastic Security"
36+
id = "e01305a0-724e-420a-99af-38a3c6436095"
37+
fingerprint = "52acf71c9a53a56337722c43d9bba34957815b8c2c6fe52bea9b38e343dae803"
38+
creation_date = "2025-08-18"
39+
last_modified = "2025-09-19"
40+
threat_name = "Windows.Trojan.AveMaria"
41+
reference_sample = "21f1e24abcda47e08ba3e6bf19c0b2d9adb52b908f625c4a08f74ade5b863bf9"
42+
severity = 100
43+
arch_context = "x86"
44+
scan_context = "file, memory"
45+
license = "Elastic License v2"
46+
os = "windows"
47+
strings:
48+
$a = "SOFTWARE\\_rptls" wide fullword
49+
$b = "-w %ws -d C -f %s" fullword
50+
$c = "RDPClip" wide fullword
51+
$d = "ExplorerIdentifier" wide fullword
52+
$e = "WM_FIND" wide fullword
53+
$f = "WM_DISP" wide fullword
54+
$g = "MsgBox.exe" wide fullword
55+
$h = "Hey I'm Admin" wide fullword
56+
$i = "/n:%temp%\\ellocnak.xml" wide fullword
57+
$j = "CommandHandler::handleStartVncCommand() Start VNC on port : %d" wide fullword
58+
condition:
59+
7 of them
60+
}
61+

‎third_party/yara/elastic/Windows_Trojan_CastleLoader.yar‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
rule Windows_Trojan_CastleLoader_173548b8 {
2+
meta:
3+
author = "Elastic Security"
4+
id = "173548b8-ff11-4528-8ef6-7e9f7d738e6c"
5+
fingerprint = "a894955aebf7db79279c58fa3800a21ec9c4cf44dcb6e516825824439931cc15"
6+
creation_date = "2025-08-14"
7+
last_modified = "2025-09-19"
8+
threat_name = "Windows.Trojan.CastleLoader"
9+
reference_sample = "1b6befc65b19a63b4131ce5bcc6e8c0552fe1e1d136ab94bc7d81b3924056156"
10+
severity = 100
11+
arch_context = "x86"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$a = { 8B 34 BA 33 DB 03 F1 BA AA AA AA AA 38 1E 74 ?? 0F BE 0C 1E 8B C2 F6 C3 01 75 ?? C1 E8 03 0F AF C1 8B CA C1 E1 07 33 C1 EB ?? C1 E8 05 33 C1 8B CA C1 E1 0B 03 C1 F7 D0 43 33 D0 }
17+
$b = { 8D 42 ?? 83 E0 03 0F B6 80 ?? ?? ?? ?? 66 33 44 0C ?? 66 89 84 0C ?? ?? ?? ?? 8D 42 ?? 83 E0 03 0F B6 80 ?? ?? ?? ?? 66 33 44 0C ?? 66 89 84 0C }
18+
$c = { 3D 20 6C 72 70 75 ?? 81 7D F8 65 70 79 68 75 ?? 81 7D F4 20 20 76 72 75 ?? B9 01 }
19+
$d = { 69 C0 6D 4E C6 41 05 39 30 00 00 }
20+
$e = { 83 7C 24 ?? 20 0F 85 ?? ?? ?? ?? 80 7C 24 ?? B8 0F 85 ?? ?? ?? ?? B9 01 00 00 00 C7 44 24 ?? B8 BB 00 00 C7 44 24 ?? C0 C2 10 00 C7 44 24 ?? 00 00 00 00 }
21+
condition:
22+
4 of them
23+
}
24+

‎third_party/yara/elastic/Windows_Trojan_HiddenCli.yar‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
rule Windows_Trojan_HiddenCli_a9aa62d1 {
2+
meta:
3+
author = "Elastic Security"
4+
id = "a9aa62d1-f131-42c4-a62a-0172db697996"
5+
fingerprint = "f546cfc4530294a778db94e5295227bb61e39af54526605da7f8224811ba5a3c"
6+
creation_date = "2025-10-02"
7+
last_modified = "2025-10-13"
8+
threat_name = "Windows.Trojan.HiddenCli"
9+
reference_sample = "913431f1d36ee843886bb052bfc89c0e5db903c673b5e6894c49aabc19f1e2fc"
10+
severity = 100
11+
arch_context = "x86"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$b_1 = { 48 8B 0A 48 8D 45 E7 33 FF 4C 8D 45 EB 48 89 7C 24 38 BA 04 20 22 00 48 89 44 24 30 48 8D 45 27 }
17+
$unicode_1 = { 43 00 6F 00 6D 00 6D 00 61 00 6E 00 64 00 20 00 27 00 73 00 74 00 61 00 74 00 65 00 27 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6C 00 00 00 }
18+
condition:
19+
1 of them
20+
}
21+

‎third_party/yara/elastic/Windows_Trojan_HiddenDriver.yar‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
rule Windows_Trojan_HiddenDriver_e26590fd {
2+
meta:
3+
author = "Elastic Security"
4+
id = "e26590fd-a560-4312-ba2f-4131f5817410"
5+
fingerprint = "fe876e1cc0663fd41742a93807a4d49972fb92c3abf6560e323d1e31f8a9eb69"
6+
creation_date = "2025-10-02"
7+
last_modified = "2025-10-13"
8+
threat_name = "Windows.Trojan.HiddenDriver"
9+
reference_sample = "f9dd0b57a5c133ca0c4cab3cca1ac8debdc4a798b452167a1e5af78653af00c1"
10+
severity = 100
11+
arch_context = "x86"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$activeProcessLinksOffsets = { C7 44 24 20 E8 00 00 00 C7 44 24 24 88 01 00 00 C7 44 24 28 E8 02 00 00 C7 44 24 2C F0 02 00 00 C7 44 24 30 48 04 00 00 }
17+
$alloc_table = { 48 83 63 78 00 48 8D 8B 88 00 00 00 83 A3 80 00 00 00 00 B8 01 00 00 00 8B D0 48 89 43 68 45 33 C0 89 43 70 }
18+
$str_0 = "InitializePsMonitor"
19+
$str_1 = "image load notify registartion failed with code:%08x"
20+
$str_2 = "file-system mini-filter haven't started"
21+
$str_3 = "can't activate stealth mode"
22+
condition:
23+
$activeProcessLinksOffsets or $alloc_table or (all of ($str_*))
24+
}
25+

‎third_party/yara/elastic/Windows_Trojan_Stealc.yar‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,3 +69,28 @@ rule Windows_Trojan_Stealc_5d3f297c {
6969
all of them
7070
}
7171

72+
rule Windows_Trojan_Stealc_41db1d4d {
73+
meta:
74+
author = "Elastic Security"
75+
id = "41db1d4d-d19f-441b-82c3-5ae94ef2baab"
76+
fingerprint = "be16274bf7c8fe038b19700aaae47ff0ffcf9cbb98ac93adb7e228c5854b782c"
77+
creation_date = "2025-07-16"
78+
last_modified = "2025-09-19"
79+
threat_name = "Windows.Trojan.Stealc"
80+
reference_sample = "a68bc167669c7c98b6742209acea111be61e6002aa652a7b8116af47b284b084"
81+
severity = 100
82+
arch_context = "x86"
83+
scan_context = "file, memory"
84+
license = "Elastic License v2"
85+
os = "windows"
86+
strings:
87+
$a1 = "C:\\builder_v2\\stealc\\json.h" wide fullword
88+
$a2 = "%08lX-%04hX-%04hX-%02hhX%02hhX-%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX" fullword
89+
$a3 = "/c timeout /t 5 & del /f /q \"" fullword
90+
$b1 = { 0F B7 C8 81 E9 19 04 00 00 74 14 83 E9 09 74 0F 83 E9 01 74 0A 83 E9 1C 74 05 83 F9 04 75 08 33 C9 FF }
91+
$b2 = { 22 74 6F 74 61 6C 5F 70 61 72 74 73 22 3A 20 00 2C 20 00 00 00 00 00 00 22 70 61 72 74 5F 69 6E 64 65 78 22 3A 20 }
92+
$b3 = { 48 89 5C 24 10 57 48 83 EC ?? 0F 57 C0 48 8D 3D [3] 00 0F 11 01 48 C7 41 10 00 00 00 00 48 8B D9 48 C7 41 18 0F 00 00 00 C6 01 00 8A 05 [3] 00 EB }
93+
condition:
94+
3 of them
95+
}
96+

‎third_party/yara/elastic/Windows_Trojan_Tollbooth.yar‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
rule Windows_Trojan_Tollbooth_85bfcc68 {
2+
meta:
3+
author = "Elastic Security"
4+
id = "85bfcc68-f375-4e19-817d-31ec43eac7eb"
5+
fingerprint = "ce6b26e974a82a180f1e924f47279a1312557f7e379da4cd2cf80c7923b4e814"
6+
creation_date = "2025-10-08"
7+
last_modified = "2025-10-13"
8+
threat_name = "Windows.Trojan.Tollbooth"
9+
reference_sample = "c1ca053e3c346513bac332b5740848ed9c496895201abc734f2de131ec1b9fb2"
10+
severity = 100
11+
arch_context = "x86"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$a = "sitemapRangeBegin" ascii wide fullword
17+
$b = "seoGroupHijackbotUaMatchRules" ascii wide fullword
18+
$c = "clean?type=conf" ascii wide fullword
19+
$d = "/landpage?seoConfigId=" ascii wide fullword
20+
$e = "<!- GP -->" ascii wide fullword
21+
$f = "gooqlebot" ascii wide fullword
22+
$g = "GetRandomLinesFromMultipleResources" ascii wide fullword
23+
$h = "hj-plugin-iis-cpp-v"
24+
$i = "hj-iis-cim-v" wide
25+
$j = "<form action='/scjg' method='POST'"
26+
$k = "AffLinkServer" ascii wide
27+
$l = { 7B E6 9C AC E5 9C B0 E5 8F 8B E9 93 BE 7D }
28+
$m = { 7B 00 2C 67 30 57 CB 53 FE 94 7D 00 }
29+
condition:
30+
7 of them
31+
}
32+

0 commit comments

Comments
 (0)