pdfalyzer 1.16.6__py3-none-any.whl → 1.16.7__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pdfalyzer might be problematic. Click here for more details.
- CHANGELOG.md +5 -0
- pdfalyzer/detection/yaralyzer_helper.py +19 -15
- pdfalyzer/yara_rules/PDF.yara +898 -177
- pdfalyzer/yara_rules/PDF_binary_stream.yara +1 -3
- pdfalyzer/yara_rules/didier_stevens.yara +248 -0
- pdfalyzer/yara_rules/pdf_malware.yara +2996 -0
- {pdfalyzer-1.16.6.dist-info → pdfalyzer-1.16.7.dist-info}/METADATA +5 -7
- {pdfalyzer-1.16.6.dist-info → pdfalyzer-1.16.7.dist-info}/RECORD +11 -9
- {pdfalyzer-1.16.6.dist-info → pdfalyzer-1.16.7.dist-info}/LICENSE +0 -0
- {pdfalyzer-1.16.6.dist-info → pdfalyzer-1.16.7.dist-info}/WHEEL +0 -0
- {pdfalyzer-1.16.6.dist-info → pdfalyzer-1.16.7.dist-info}/entry_points.txt +0 -0
|
@@ -0,0 +1,2996 @@
|
|
|
1
|
+
/* From PDF_MALWARE_ANALYZER */
|
|
2
|
+
|
|
3
|
+
rule RemoteCodeExecutionPDF {
|
|
4
|
+
meta:
|
|
5
|
+
description = "Detects potential Remote Code Execution attempts in PDF files"
|
|
6
|
+
severity = "High"
|
|
7
|
+
author = "kartikey"
|
|
8
|
+
date = "2025-03-29"
|
|
9
|
+
strings:
|
|
10
|
+
$rce1 = "/JavaScript/launch"
|
|
11
|
+
$rce2 = "/JavaScript/openURL"
|
|
12
|
+
$rce3 = "/OpenAction"
|
|
13
|
+
$rce4 = "/JS (ShellExecute)"
|
|
14
|
+
condition:
|
|
15
|
+
(uint16(0) == 0x2550) and (filesize < 2MB) and all of them
|
|
16
|
+
}
|
|
17
|
+
|
|
18
|
+
|
|
19
|
+
rule ExploitPDFReaderVulnerabilities {
|
|
20
|
+
meta:
|
|
21
|
+
description = "Detects potential exploitation of PDF reader vulnerabilities"
|
|
22
|
+
severity = "High"
|
|
23
|
+
author = "kartikey"
|
|
24
|
+
date = "2025-03-29"
|
|
25
|
+
strings:
|
|
26
|
+
$exploit1 = "/Launch"
|
|
27
|
+
$exploit2 = "/Action /Launch"
|
|
28
|
+
$exploit3 = "/AA"
|
|
29
|
+
$exploit4 = "/JavaScript"
|
|
30
|
+
condition:
|
|
31
|
+
(uint16(0) == 0x2550) and (filesize < 2MB) and any of them
|
|
32
|
+
}
|
|
33
|
+
|
|
34
|
+
|
|
35
|
+
rule TrojanDownloaderPDF {
|
|
36
|
+
meta:
|
|
37
|
+
description = "Detects Trojan-Downloader functionality in PDF files"
|
|
38
|
+
severity = "High"
|
|
39
|
+
author = "kartikey"
|
|
40
|
+
date = "2025-03-29"
|
|
41
|
+
strings:
|
|
42
|
+
$trojan1 = "http://malicious-domain.com/download"
|
|
43
|
+
$trojan2 = "/SubmitForm /URL"
|
|
44
|
+
$trojan3 = "/JavaScript /getURL"
|
|
45
|
+
condition:
|
|
46
|
+
(uint16(0) == 0x2550) and any of them
|
|
47
|
+
}
|
|
48
|
+
|
|
49
|
+
|
|
50
|
+
rule BufferOverflowPDF {
|
|
51
|
+
meta:
|
|
52
|
+
description = "Detects Buffer Overflow exploits in PDF files"
|
|
53
|
+
severity = "High"
|
|
54
|
+
author = "kartikey"
|
|
55
|
+
date = "2025-03-29"
|
|
56
|
+
strings:
|
|
57
|
+
$buffer1 = "/stream"
|
|
58
|
+
$buffer2 = "/Length 0xFFFFFFFF"
|
|
59
|
+
$buffer3 = "/Filter /FlateDecode"
|
|
60
|
+
condition:
|
|
61
|
+
(uint16(0) == 0x2550) and all of them
|
|
62
|
+
}
|
|
63
|
+
|
|
64
|
+
|
|
65
|
+
rule JavaScriptFileSystemPDF {
|
|
66
|
+
meta:
|
|
67
|
+
description = "Detects malicious JavaScript manipulating file systems in PDFs"
|
|
68
|
+
severity = "Medium"
|
|
69
|
+
author = "kartikey"
|
|
70
|
+
date = "2025-03-29"
|
|
71
|
+
strings:
|
|
72
|
+
$js1 = "/JavaScript/createFile"
|
|
73
|
+
$js2 = "/JavaScript/deleteFile"
|
|
74
|
+
$js3 = "/JavaScript/writeToFile"
|
|
75
|
+
condition:
|
|
76
|
+
(uint16(0) == 0x2550) and any of them
|
|
77
|
+
}
|
|
78
|
+
|
|
79
|
+
|
|
80
|
+
rule MaliciousMacrosPDF {
|
|
81
|
+
meta:
|
|
82
|
+
description = "Detects presence of malicious macros in PDF files"
|
|
83
|
+
severity = "Medium"
|
|
84
|
+
author = "kartikey"
|
|
85
|
+
date = "2025-03-29"
|
|
86
|
+
strings:
|
|
87
|
+
$macro1 = "/EmbeddedFile"
|
|
88
|
+
$macro2 = "/Macro/"
|
|
89
|
+
$macro3 = "/RichMedia"
|
|
90
|
+
condition:
|
|
91
|
+
(uint16(0) == 0x2550) and any of them
|
|
92
|
+
}
|
|
93
|
+
|
|
94
|
+
|
|
95
|
+
rule MetadataInjectionPDF {
|
|
96
|
+
meta:
|
|
97
|
+
description = "Detects suspicious metadata injections in PDF files"
|
|
98
|
+
severity = "Low"
|
|
99
|
+
author = "kartikey"
|
|
100
|
+
date = "2025-03-29"
|
|
101
|
+
strings:
|
|
102
|
+
$meta1 = "/Title /<script>"
|
|
103
|
+
$meta2 = "/Author /<iframe>"
|
|
104
|
+
$meta3 = "/Keywords /javascript:"
|
|
105
|
+
condition:
|
|
106
|
+
(uint16(0) == 0x2550) and any of them
|
|
107
|
+
}
|
|
108
|
+
|
|
109
|
+
|
|
110
|
+
rule FakeErrorMessagesPDF {
|
|
111
|
+
meta:
|
|
112
|
+
description = "Detects fake error messages in PDF files"
|
|
113
|
+
severity = "Low"
|
|
114
|
+
author = "kartikey"
|
|
115
|
+
date = "2025-03-29"
|
|
116
|
+
strings:
|
|
117
|
+
$error1 = "Error: Your system is compromised"
|
|
118
|
+
$error2 = "Critical update required"
|
|
119
|
+
$error3 = "Click here to fix issues"
|
|
120
|
+
condition:
|
|
121
|
+
(uint16(0) == 0x2550) and any of them
|
|
122
|
+
}
|
|
123
|
+
|
|
124
|
+
|
|
125
|
+
rule PrivilegeEscalationPDF {
|
|
126
|
+
meta:
|
|
127
|
+
description = "Detects attempts at Privilege Escalation via exploits in PDF files"
|
|
128
|
+
severity = "High"
|
|
129
|
+
author = "kartikey"
|
|
130
|
+
date = "2025-03-29"
|
|
131
|
+
strings:
|
|
132
|
+
$privilege1 = "/OpenAction /Launch"
|
|
133
|
+
$privilege2 = "/Launch /WinExec"
|
|
134
|
+
$privilege3 = "/AppLaunch"
|
|
135
|
+
$privilege4 = "/JavaScript (Elevate)"
|
|
136
|
+
$privilege5 = "/SystemCommand"
|
|
137
|
+
condition:
|
|
138
|
+
(uint16(0) == 0x2550) and any of them
|
|
139
|
+
}
|
|
140
|
+
|
|
141
|
+
|
|
142
|
+
rule FilelessMalwareExecutionPDF {
|
|
143
|
+
meta:
|
|
144
|
+
description = "Detects indicators of Fileless Malware Execution within PDF files"
|
|
145
|
+
severity = "High"
|
|
146
|
+
author = "kartikey"
|
|
147
|
+
date = "2025-03-29"
|
|
148
|
+
strings:
|
|
149
|
+
$fileless1 = "/JavaScript /eval"
|
|
150
|
+
$fileless2 = "/JavaScript /runScript"
|
|
151
|
+
$fileless3 = "shellcode"
|
|
152
|
+
$fileless4 = "/Action /executeCommand"
|
|
153
|
+
$fileless5 = "/Stream /encrypted"
|
|
154
|
+
condition:
|
|
155
|
+
(uint16(0) == 0x2550) and (filesize < 2MB) and any of them
|
|
156
|
+
}
|
|
157
|
+
|
|
158
|
+
|
|
159
|
+
|
|
160
|
+
rule RansomwareDeliveryPDF {
|
|
161
|
+
meta:
|
|
162
|
+
description = "Detects indicators of Ransomware Delivery in PDF files"
|
|
163
|
+
severity = "High"
|
|
164
|
+
author = "kartikey"
|
|
165
|
+
date = "2025-03-29"
|
|
166
|
+
strings:
|
|
167
|
+
$ransom1 = "/JavaScript /encrypt"
|
|
168
|
+
$ransom2 = "/JavaScript /decrypt"
|
|
169
|
+
$ransom3 = "/OpenAction /executeCommand"
|
|
170
|
+
$ransom4 = "ransom_note"
|
|
171
|
+
$ransom5 = "/JavaScript /writeToFile"
|
|
172
|
+
condition:
|
|
173
|
+
(uint16(0) == 0x2550) and any of them
|
|
174
|
+
}
|
|
175
|
+
|
|
176
|
+
|
|
177
|
+
rule CommandInjectionPDF {
|
|
178
|
+
meta:
|
|
179
|
+
description = "Detects Command Injection patterns in PDF files"
|
|
180
|
+
severity = "High"
|
|
181
|
+
author = "kartikey"
|
|
182
|
+
date = "2025-03-29"
|
|
183
|
+
strings:
|
|
184
|
+
$cmd1 = "/Launch /executeCommand"
|
|
185
|
+
$cmd2 = "/OpenAction /cmd"
|
|
186
|
+
$cmd3 = "/JavaScript (exec)"
|
|
187
|
+
$cmd4 = "/SystemCommand"
|
|
188
|
+
$cmd5 = "/JavaScript /runCommand"
|
|
189
|
+
condition:
|
|
190
|
+
(uint16(0) == 0x2550) and any of them
|
|
191
|
+
}
|
|
192
|
+
|
|
193
|
+
|
|
194
|
+
rule SystemCommandExecutionPDF {
|
|
195
|
+
meta:
|
|
196
|
+
description = "Detects attempts to execute system commands through PDF files"
|
|
197
|
+
severity = "High"
|
|
198
|
+
author = "kartikey"
|
|
199
|
+
date = "2025-03-29"
|
|
200
|
+
strings:
|
|
201
|
+
$syscmd1 = "/Launch /cmd.exe"
|
|
202
|
+
$syscmd2 = "/OpenAction /ShellExecute"
|
|
203
|
+
$syscmd3 = "/JavaScript /executeCommand"
|
|
204
|
+
$syscmd4 = "/JavaScript /run"
|
|
205
|
+
$syscmd5 = "/SystemCommand /execute"
|
|
206
|
+
condition:
|
|
207
|
+
(uint16(0) == 0x2550) and any of them
|
|
208
|
+
}
|
|
209
|
+
|
|
210
|
+
|
|
211
|
+
rule DenialOfServicePDF {
|
|
212
|
+
meta:
|
|
213
|
+
description = "Detects potential Denial of Service (DoS) attack patterns in PDF files"
|
|
214
|
+
severity = "High"
|
|
215
|
+
author = "kartikey"
|
|
216
|
+
date = "2025-03-29"
|
|
217
|
+
strings:
|
|
218
|
+
$dos1 = "/Length 0xFFFFFFFF"
|
|
219
|
+
$dos2 = "/FlateDecode /stream"
|
|
220
|
+
$dos3 = "/Repeat /LargeObject"
|
|
221
|
+
$dos4 = "/Object /ExtremelyLargeSize"
|
|
222
|
+
$dos5 = "/ExcessiveNestedStreams"
|
|
223
|
+
condition:
|
|
224
|
+
(uint16(0) == 0x2550) and (filesize > 10MB) and any of them
|
|
225
|
+
}
|
|
226
|
+
|
|
227
|
+
|
|
228
|
+
rule KeyloggingViaJavaScriptPDF {
|
|
229
|
+
meta:
|
|
230
|
+
description = "Detects Keylogging attempts using JavaScript in PDF files"
|
|
231
|
+
severity = "Medium"
|
|
232
|
+
author = "kartikey"
|
|
233
|
+
date = "2025-03-29"
|
|
234
|
+
strings:
|
|
235
|
+
$keylog1 = "/JavaScript /keydown"
|
|
236
|
+
$keylog2 = "/JavaScript /keypress"
|
|
237
|
+
$keylog3 = "/EventListener /key"
|
|
238
|
+
$keylog4 = "/JavaScript /captureKeys"
|
|
239
|
+
$keylog5 = "/KeyStroke"
|
|
240
|
+
condition:
|
|
241
|
+
(uint16(0) == 0x2550) and any of them
|
|
242
|
+
}
|
|
243
|
+
|
|
244
|
+
|
|
245
|
+
rule SensitiveInfoExfiltrationPDF {
|
|
246
|
+
meta:
|
|
247
|
+
description = "Detects attempts to exfiltrate sensitive information using PDF files"
|
|
248
|
+
severity = "Medium"
|
|
249
|
+
author = "kartikey"
|
|
250
|
+
date = "2025-03-29"
|
|
251
|
+
strings:
|
|
252
|
+
$exfil1 = "/SubmitForm /URL"
|
|
253
|
+
$exfil2 = "/JavaScript /sendData"
|
|
254
|
+
$exfil3 = "/JavaScript /exfiltrate"
|
|
255
|
+
$exfil4 = "/mailto:"
|
|
256
|
+
$exfil5 = "http://"
|
|
257
|
+
$exfil6 = "https://"
|
|
258
|
+
condition:
|
|
259
|
+
(uint16(0) == 0x2550) and any of them
|
|
260
|
+
}
|
|
261
|
+
|
|
262
|
+
|
|
263
|
+
rule PhishingViaFakeLoginFormsPDF {
|
|
264
|
+
meta:
|
|
265
|
+
description = "Detects phishing attempts via fake login forms in PDF files"
|
|
266
|
+
severity = "Medium"
|
|
267
|
+
author = "kartikey"
|
|
268
|
+
date = "2025-03-29"
|
|
269
|
+
strings:
|
|
270
|
+
$phish1 = "/JavaScript /submitForm"
|
|
271
|
+
$phish2 = "login"
|
|
272
|
+
$phish3 = "password"
|
|
273
|
+
$phish4 = "/Form /Login"
|
|
274
|
+
$phish5 = "/SubmitForm /URL"
|
|
275
|
+
$phish6 = "http://"
|
|
276
|
+
$phish7 = "https://"
|
|
277
|
+
condition:
|
|
278
|
+
(uint16(0) == 0x2550) and any of them
|
|
279
|
+
}
|
|
280
|
+
|
|
281
|
+
|
|
282
|
+
rule MaliciousFormFieldsPDF {
|
|
283
|
+
meta:
|
|
284
|
+
description = "Detects malicious form fields in PDF files"
|
|
285
|
+
severity = "Medium"
|
|
286
|
+
author = "kartikey"
|
|
287
|
+
date = "2025-03-29"
|
|
288
|
+
strings:
|
|
289
|
+
$form1 = "/Form /Field"
|
|
290
|
+
$form2 = "/Field /Hidden"
|
|
291
|
+
$form3 = "/SubmitForm"
|
|
292
|
+
$form4 = "/JavaScript /FormField"
|
|
293
|
+
$form5 = "/Action /FormSubmit"
|
|
294
|
+
condition:
|
|
295
|
+
(uint16(0) == 0x2550) and any of them
|
|
296
|
+
}
|
|
297
|
+
|
|
298
|
+
|
|
299
|
+
rule FakeDocumentOrSoftwareUpdatesPDF {
|
|
300
|
+
meta:
|
|
301
|
+
description = "Detects fake document or software update prompts in PDF files"
|
|
302
|
+
severity = "Medium"
|
|
303
|
+
author = "kartikey"
|
|
304
|
+
date = "2025-03-29"
|
|
305
|
+
strings:
|
|
306
|
+
$fake1 = "Update Required"
|
|
307
|
+
$fake2 = "Your software is out of date"
|
|
308
|
+
$fake3 = "Download the latest version"
|
|
309
|
+
$fake4 = "/JavaScript /updatePrompt"
|
|
310
|
+
$fake5 = "/OpenAction /update"
|
|
311
|
+
condition:
|
|
312
|
+
(uint16(0) == 0x2550) and any of them
|
|
313
|
+
}
|
|
314
|
+
|
|
315
|
+
|
|
316
|
+
rule EmbeddingExecutablesPDF {
|
|
317
|
+
meta:
|
|
318
|
+
description = "Detects embedded executables in PDF files"
|
|
319
|
+
severity = "Medium"
|
|
320
|
+
author = "kartikey"
|
|
321
|
+
date = "2025-03-29"
|
|
322
|
+
strings:
|
|
323
|
+
$exe1 = "/EmbeddedFile"
|
|
324
|
+
$exe2 = ".exe"
|
|
325
|
+
$exe3 = "application/x-msdownload"
|
|
326
|
+
$exe4 = "/JavaScript /launchExecutable"
|
|
327
|
+
$exe5 = "/FileAttachment"
|
|
328
|
+
condition:
|
|
329
|
+
(uint16(0) == 0x2550) and any of them
|
|
330
|
+
}
|
|
331
|
+
|
|
332
|
+
|
|
333
|
+
rule SocialEngineeringViaFakeAlertsPDF {
|
|
334
|
+
meta:
|
|
335
|
+
description = "Detects social engineering attempts using fake alerts in PDF files"
|
|
336
|
+
severity = "Medium"
|
|
337
|
+
author = "kartikey"
|
|
338
|
+
date = "2025-03-29"
|
|
339
|
+
strings:
|
|
340
|
+
$alert1 = "Your system is infected"
|
|
341
|
+
$alert2 = "Critical warning"
|
|
342
|
+
$alert3 = "Click here to resolve"
|
|
343
|
+
$alert4 = "Immediate action required"
|
|
344
|
+
$alert5 = "/JavaScript /showAlert"
|
|
345
|
+
condition:
|
|
346
|
+
(uint16(0) == 0x2550) and any of them
|
|
347
|
+
}
|
|
348
|
+
|
|
349
|
+
|
|
350
|
+
rule FakeSoftwareInstallersPDF {
|
|
351
|
+
meta:
|
|
352
|
+
description = "Detects fake software installer prompts in PDF files"
|
|
353
|
+
severity = "Medium"
|
|
354
|
+
author = "kartikey"
|
|
355
|
+
date = "2025-03-29"
|
|
356
|
+
strings:
|
|
357
|
+
$installer1 = "Install the latest version"
|
|
358
|
+
$installer2 = "Setup.exe"
|
|
359
|
+
$installer3 = "application/x-msdownload"
|
|
360
|
+
$installer4 = "Run the installer"
|
|
361
|
+
$installer5 = "/JavaScript /launchInstaller"
|
|
362
|
+
condition:
|
|
363
|
+
(uint16(0) == 0x2550) and any of them
|
|
364
|
+
}
|
|
365
|
+
|
|
366
|
+
|
|
367
|
+
rule HiddenLayersPDF {
|
|
368
|
+
meta:
|
|
369
|
+
description = "Detects hidden layers embedded in PDF files"
|
|
370
|
+
severity = "Medium"
|
|
371
|
+
author = "kartikey"
|
|
372
|
+
date = "2025-03-29"
|
|
373
|
+
strings:
|
|
374
|
+
$hidden1 = "/OC /Properties"
|
|
375
|
+
$hidden2 = "/OptionalContent"
|
|
376
|
+
$hidden3 = "/Layer /Hidden"
|
|
377
|
+
$hidden4 = "/Content /DisplayFalse"
|
|
378
|
+
condition:
|
|
379
|
+
(uint16(0) == 0x2550) and any of them
|
|
380
|
+
}
|
|
381
|
+
|
|
382
|
+
|
|
383
|
+
rule InsertingHiddenLayersPDF {
|
|
384
|
+
meta:
|
|
385
|
+
description = "Detects hidden layers embedded in PDF files to obscure content"
|
|
386
|
+
severity = "Medium"
|
|
387
|
+
author = "kartikey"
|
|
388
|
+
date = "2025-03-29"
|
|
389
|
+
strings:
|
|
390
|
+
$hidden1 = "/OCProperties"
|
|
391
|
+
$hidden2 = "/OptionalContent"
|
|
392
|
+
$hidden3 = "/Group /Usage"
|
|
393
|
+
$hidden4 = "/Hidden /True"
|
|
394
|
+
$hidden5 = "/DisplayNone"
|
|
395
|
+
condition:
|
|
396
|
+
uint16(0) == 0x2550 and any of them
|
|
397
|
+
}
|
|
398
|
+
|
|
399
|
+
|
|
400
|
+
rule NetworkCommunicationViaWebSocketsPDF {
|
|
401
|
+
meta:
|
|
402
|
+
description = "Detects network communication via WebSockets in PDF files"
|
|
403
|
+
severity = "Medium"
|
|
404
|
+
author = "kartikey"
|
|
405
|
+
date = "2025-03-29"
|
|
406
|
+
strings:
|
|
407
|
+
$websocket1 = "WebSocket"
|
|
408
|
+
$websocket2 = "/JavaScript /new WebSocket"
|
|
409
|
+
$websocket3 = "wss://"
|
|
410
|
+
$websocket4 = "ws://"
|
|
411
|
+
$websocket5 = "/JavaScript /WebSocket.send"
|
|
412
|
+
condition:
|
|
413
|
+
uint16(0) == 0x2550 and any of them
|
|
414
|
+
}
|
|
415
|
+
|
|
416
|
+
|
|
417
|
+
rule EmbeddingFlashOrJavaObjectsPDF {
|
|
418
|
+
meta:
|
|
419
|
+
description = "Detects embedded Flash or Java objects in PDF files"
|
|
420
|
+
severity = "Medium"
|
|
421
|
+
author = "kartikey"
|
|
422
|
+
date = "2025-03-29"
|
|
423
|
+
strings:
|
|
424
|
+
$flash1 = "/Flash"
|
|
425
|
+
$flash2 = ".swf"
|
|
426
|
+
$flash3 = "/RichMedia"
|
|
427
|
+
$java1 = "/Java"
|
|
428
|
+
$java2 = ".jar"
|
|
429
|
+
$java3 = "/JavaScript /launchJavaApp"
|
|
430
|
+
condition:
|
|
431
|
+
uint16(0) == 0x2550 and any of them
|
|
432
|
+
}
|
|
433
|
+
|
|
434
|
+
|
|
435
|
+
rule RemoteAccessViaPDF {
|
|
436
|
+
meta:
|
|
437
|
+
description = "Detects remote access capabilities embedded in PDF files"
|
|
438
|
+
severity = "Medium"
|
|
439
|
+
author = "kartikey"
|
|
440
|
+
date = "2025-03-29"
|
|
441
|
+
strings:
|
|
442
|
+
$remote1 = "/JavaScript /connectToHost"
|
|
443
|
+
$remote2 = "/RemoteAccess"
|
|
444
|
+
$remote3 = "tcp://"
|
|
445
|
+
$remote4 = "http://"
|
|
446
|
+
$remote5 = "https://"
|
|
447
|
+
$remote6 = "/SocketConnection"
|
|
448
|
+
$remote7 = "/WebSocket"
|
|
449
|
+
condition:
|
|
450
|
+
uint16(0) == 0x2550 and any of them
|
|
451
|
+
}
|
|
452
|
+
|
|
453
|
+
|
|
454
|
+
rule QRCodeRedirectionPDF {
|
|
455
|
+
meta:
|
|
456
|
+
description = "Detects QR code redirection patterns in PDF files"
|
|
457
|
+
severity = "Medium"
|
|
458
|
+
author = "kartikey"
|
|
459
|
+
date = "2025-03-29"
|
|
460
|
+
strings:
|
|
461
|
+
$qr1 = "/QRCode"
|
|
462
|
+
$qr2 = "https://"
|
|
463
|
+
$qr3 = "http://"
|
|
464
|
+
$qr4 = "/JavaScript /generateQRCode"
|
|
465
|
+
$qr5 = "/JavaScript /redirectToURL"
|
|
466
|
+
$qr6 = "/Action /Redirect"
|
|
467
|
+
condition:
|
|
468
|
+
uint16(0) == 0x2550 and any of them
|
|
469
|
+
}
|
|
470
|
+
|
|
471
|
+
|
|
472
|
+
rule ZombiePDF {
|
|
473
|
+
meta:
|
|
474
|
+
description = "Detects Zombie PDF files that maintain persistent or malicious behavior"
|
|
475
|
+
severity = "Medium"
|
|
476
|
+
author = "kartikey"
|
|
477
|
+
date = "2025-03-29"
|
|
478
|
+
strings:
|
|
479
|
+
$zombie1 = "/JavaScript /setInterval"
|
|
480
|
+
$zombie2 = "/JavaScript /setTimeout"
|
|
481
|
+
$zombie3 = "/OpenAction /loop"
|
|
482
|
+
$zombie4 = "/AutoTrigger"
|
|
483
|
+
$zombie5 = "/PersistentAction"
|
|
484
|
+
condition:
|
|
485
|
+
uint16(0) == 0x2550 and any of them
|
|
486
|
+
}
|
|
487
|
+
|
|
488
|
+
|
|
489
|
+
rule Malicious_PDF_Registry_Access {
|
|
490
|
+
meta:
|
|
491
|
+
author = "kartikey"
|
|
492
|
+
description = "Detects malicious PDF files querying Windows registry"
|
|
493
|
+
date = "2025-04-03"
|
|
494
|
+
version = "1.0"
|
|
495
|
+
reference = "https://www.adobe.com/content/dam/acom/en/devnet/acrobat/pdfs/AcrobatDC_js_api_reference.pdf"
|
|
496
|
+
strings:
|
|
497
|
+
// JavaScript function for registry access
|
|
498
|
+
$js_registry_query = /app\.getPath\(("HKCU|HKLM|HKEY_LOCAL_MACHINE|HKEY_CURRENT_USER)[^)]+"\)/ nocase
|
|
499
|
+
|
|
500
|
+
// Shell execution methods used in malicious PDFs
|
|
501
|
+
$js_exec = /app\.launchURL\(|util\.spawn\(|eval\(|new Function\(/ nocase
|
|
502
|
+
$js_cmd = /cmd\.exe|reg query|powershell\.exe|wscript\.shell/i
|
|
503
|
+
condition:
|
|
504
|
+
uint32(0) == 0x25504446 and // PDF file magic bytes ("%PDF")
|
|
505
|
+
any of ($js_registry_query) or (any of ($js_exec) and any of ($js_cmd))
|
|
506
|
+
}
|
|
507
|
+
|
|
508
|
+
|
|
509
|
+
/* https://github.com/tylabs/quicksand PDF Exploit detection signatures */
|
|
510
|
+
rule shellcode_hash__CloseHandle {
|
|
511
|
+
meta:
|
|
512
|
+
is_exploit = false
|
|
513
|
+
is_warning = true
|
|
514
|
+
is_feature = false
|
|
515
|
+
rank = 2
|
|
516
|
+
revision = "1"
|
|
517
|
+
date = "June 07 2020"
|
|
518
|
+
author = "@tylabs"
|
|
519
|
+
sigtype = "pdfexaminer_shellcode"
|
|
520
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
521
|
+
desc = "shellcode.hash CloseHandle"
|
|
522
|
+
mitre = "T1106"
|
|
523
|
+
strings:
|
|
524
|
+
$h_raw = "fb97fd0f" nocase
|
|
525
|
+
$h_hex = { fb97fd0f }
|
|
526
|
+
condition:
|
|
527
|
+
filesize < 1MB and any of them
|
|
528
|
+
}
|
|
529
|
+
|
|
530
|
+
|
|
531
|
+
rule shellcode_hash__CreateFileA {
|
|
532
|
+
meta:
|
|
533
|
+
is_exploit = false
|
|
534
|
+
is_warning = true
|
|
535
|
+
is_feature = false
|
|
536
|
+
rank = 2
|
|
537
|
+
revision = "1"
|
|
538
|
+
date = "June 07 2020"
|
|
539
|
+
author = "@tylabs"
|
|
540
|
+
sigtype = "pdfexaminer_shellcode"
|
|
541
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
542
|
+
desc = "shellcode.hash CreateFileA"
|
|
543
|
+
mitre = "T1106"
|
|
544
|
+
strings:
|
|
545
|
+
$h_raw = "a517007c" nocase
|
|
546
|
+
$h_hex = { a517007c }
|
|
547
|
+
condition:
|
|
548
|
+
filesize < 1MB and any of them
|
|
549
|
+
}
|
|
550
|
+
|
|
551
|
+
|
|
552
|
+
rule shellcode_hash__CreateProcessA {
|
|
553
|
+
meta:
|
|
554
|
+
is_exploit = false
|
|
555
|
+
is_warning = true
|
|
556
|
+
is_feature = false
|
|
557
|
+
rank = 2
|
|
558
|
+
revision = "1"
|
|
559
|
+
date = "June 07 2020"
|
|
560
|
+
author = "@tylabs"
|
|
561
|
+
sigtype = "pdfexaminer_shellcode"
|
|
562
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
563
|
+
desc = "shellcode.hash CreateProcessA"
|
|
564
|
+
mitre = "T1106"
|
|
565
|
+
strings:
|
|
566
|
+
$h_raw = "72feb316" nocase
|
|
567
|
+
$h_hex = { 72feb316 }
|
|
568
|
+
condition:
|
|
569
|
+
filesize < 1MB and any of them
|
|
570
|
+
}
|
|
571
|
+
|
|
572
|
+
|
|
573
|
+
rule shellcode_hash__DeleteFileA {
|
|
574
|
+
meta:
|
|
575
|
+
is_exploit = false
|
|
576
|
+
is_warning = true
|
|
577
|
+
is_feature = false
|
|
578
|
+
rank = 2
|
|
579
|
+
revision = "1"
|
|
580
|
+
date = "June 07 2020"
|
|
581
|
+
author = "@tylabs"
|
|
582
|
+
sigtype = "pdfexaminer_shellcode"
|
|
583
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
584
|
+
desc = "shellcode.hash DeleteFileA"
|
|
585
|
+
mitre = "T1106"
|
|
586
|
+
strings:
|
|
587
|
+
$h_raw = "25b0ffc2" nocase
|
|
588
|
+
$h_hex = { 25b0ffc2 }
|
|
589
|
+
condition:
|
|
590
|
+
filesize < 1MB and any of them
|
|
591
|
+
}
|
|
592
|
+
|
|
593
|
+
|
|
594
|
+
rule shellcode_hash__ExitProcess {
|
|
595
|
+
meta:
|
|
596
|
+
is_exploit = false
|
|
597
|
+
is_warning = true
|
|
598
|
+
is_feature = false
|
|
599
|
+
rank = 2
|
|
600
|
+
revision = "1"
|
|
601
|
+
date = "June 07 2020"
|
|
602
|
+
author = "@tylabs"
|
|
603
|
+
sigtype = "pdfexaminer_shellcode"
|
|
604
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
605
|
+
desc = "shellcode.hash ExitProcess"
|
|
606
|
+
mitre = "T1106"
|
|
607
|
+
strings:
|
|
608
|
+
$h_raw = "7ed8e273" nocase
|
|
609
|
+
$h_hex = { 7ed8e273 }
|
|
610
|
+
condition:
|
|
611
|
+
filesize < 1MB and any of them
|
|
612
|
+
}
|
|
613
|
+
|
|
614
|
+
|
|
615
|
+
rule shellcode_hash__ExitThread {
|
|
616
|
+
meta:
|
|
617
|
+
is_exploit = false
|
|
618
|
+
is_warning = true
|
|
619
|
+
is_feature = false
|
|
620
|
+
rank = 2
|
|
621
|
+
revision = "1"
|
|
622
|
+
date = "June 07 2020"
|
|
623
|
+
author = "@tylabs"
|
|
624
|
+
sigtype = "pdfexaminer_shellcode"
|
|
625
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
626
|
+
desc = "shellcode.hash ExitThread"
|
|
627
|
+
mitre = "T1106"
|
|
628
|
+
strings:
|
|
629
|
+
$h_raw = "efcee060" nocase
|
|
630
|
+
$h_hex = { efcee060 }
|
|
631
|
+
condition:
|
|
632
|
+
filesize < 1MB and any of them
|
|
633
|
+
}
|
|
634
|
+
|
|
635
|
+
|
|
636
|
+
rule shellcode_hash__GetProcAddress {
|
|
637
|
+
meta:
|
|
638
|
+
is_exploit = false
|
|
639
|
+
is_warning = true
|
|
640
|
+
is_feature = false
|
|
641
|
+
rank = 2
|
|
642
|
+
revision = "1"
|
|
643
|
+
date = "June 07 2020"
|
|
644
|
+
author = "@tylabs"
|
|
645
|
+
sigtype = "pdfexaminer_shellcode"
|
|
646
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
647
|
+
desc = "shellcode.hash GetProcAddress"
|
|
648
|
+
mitre = "T1129"
|
|
649
|
+
strings:
|
|
650
|
+
$h_raw = "aafc0d7c" nocase
|
|
651
|
+
$h_hex = { aafc0d7c }
|
|
652
|
+
condition:
|
|
653
|
+
filesize < 1MB and any of them
|
|
654
|
+
}
|
|
655
|
+
|
|
656
|
+
|
|
657
|
+
rule shellcode_hash__GetSystemDirectoryA {
|
|
658
|
+
meta:
|
|
659
|
+
is_exploit = false
|
|
660
|
+
is_warning = true
|
|
661
|
+
is_feature = false
|
|
662
|
+
rank = 2
|
|
663
|
+
revision = "1"
|
|
664
|
+
date = "June 07 2020"
|
|
665
|
+
author = "@tylabs"
|
|
666
|
+
sigtype = "pdfexaminer_shellcode"
|
|
667
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
668
|
+
desc = "shellcode.hash GetSystemDirectoryA"
|
|
669
|
+
mitre = "T1106"
|
|
670
|
+
strings:
|
|
671
|
+
$h_raw = "c179e5b8" nocase
|
|
672
|
+
$h_hex = { c179e5b8 }
|
|
673
|
+
condition:
|
|
674
|
+
filesize < 1MB and any of them
|
|
675
|
+
}
|
|
676
|
+
|
|
677
|
+
|
|
678
|
+
rule shellcode_hash___hwrite {
|
|
679
|
+
meta:
|
|
680
|
+
is_exploit = false
|
|
681
|
+
is_warning = true
|
|
682
|
+
is_feature = false
|
|
683
|
+
rank = 2
|
|
684
|
+
revision = "1"
|
|
685
|
+
date = "June 07 2020"
|
|
686
|
+
author = "@tylabs"
|
|
687
|
+
sigtype = "pdfexaminer_shellcode"
|
|
688
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
689
|
+
desc = "shellcode.hash _hwrite"
|
|
690
|
+
mitre = "T1106"
|
|
691
|
+
strings:
|
|
692
|
+
$h_raw = "d98a23e9" nocase
|
|
693
|
+
$h_hex = { d98a23e9 }
|
|
694
|
+
condition:
|
|
695
|
+
filesize < 1MB and any of them
|
|
696
|
+
}
|
|
697
|
+
|
|
698
|
+
|
|
699
|
+
rule shellcode_hash___lclose {
|
|
700
|
+
meta:
|
|
701
|
+
is_exploit = false
|
|
702
|
+
is_warning = true
|
|
703
|
+
is_feature = false
|
|
704
|
+
rank = 2
|
|
705
|
+
revision = "1"
|
|
706
|
+
date = "June 07 2020"
|
|
707
|
+
author = "@tylabs"
|
|
708
|
+
sigtype = "pdfexaminer_shellcode"
|
|
709
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
710
|
+
desc = "shellcode.hash _lclose"
|
|
711
|
+
mitre = "T1106"
|
|
712
|
+
strings:
|
|
713
|
+
$h_raw = "5b4c1add" nocase
|
|
714
|
+
$h_hex = { 5b4c1add }
|
|
715
|
+
condition:
|
|
716
|
+
filesize < 1MB and any of them
|
|
717
|
+
}
|
|
718
|
+
|
|
719
|
+
|
|
720
|
+
rule shellcode_hash___lcreat {
|
|
721
|
+
meta:
|
|
722
|
+
is_exploit = false
|
|
723
|
+
is_warning = true
|
|
724
|
+
is_feature = false
|
|
725
|
+
rank = 2
|
|
726
|
+
revision = "1"
|
|
727
|
+
date = "June 07 2020"
|
|
728
|
+
author = "@tylabs"
|
|
729
|
+
sigtype = "pdfexaminer_shellcode"
|
|
730
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
731
|
+
desc = "shellcode.hash _lcreat"
|
|
732
|
+
mitre = "T1106"
|
|
733
|
+
strings:
|
|
734
|
+
$h_raw = "ea498ae8" nocase
|
|
735
|
+
$h_hex = { ea498ae8 }
|
|
736
|
+
condition:
|
|
737
|
+
filesize < 1MB and any of them
|
|
738
|
+
}
|
|
739
|
+
|
|
740
|
+
|
|
741
|
+
rule shellcode_hash__LoadLibraryA {
|
|
742
|
+
meta:
|
|
743
|
+
is_exploit = false
|
|
744
|
+
is_warning = true
|
|
745
|
+
is_feature = false
|
|
746
|
+
rank = 2
|
|
747
|
+
revision = "1"
|
|
748
|
+
date = "June 07 2020"
|
|
749
|
+
author = "@tylabs"
|
|
750
|
+
sigtype = "pdfexaminer_shellcode"
|
|
751
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
752
|
+
desc = "shellcode.hash LoadLibraryA"
|
|
753
|
+
mitre = "T1129"
|
|
754
|
+
strings:
|
|
755
|
+
$h_raw = "8e4e0eec" nocase
|
|
756
|
+
$h_hex = { 8e4e0eec }
|
|
757
|
+
condition:
|
|
758
|
+
filesize < 1MB and any of them
|
|
759
|
+
}
|
|
760
|
+
|
|
761
|
+
|
|
762
|
+
rule shellcode_hash___lwrite {
|
|
763
|
+
meta:
|
|
764
|
+
is_exploit = false
|
|
765
|
+
is_warning = true
|
|
766
|
+
is_feature = false
|
|
767
|
+
rank = 2
|
|
768
|
+
revision = "1"
|
|
769
|
+
date = "June 07 2020"
|
|
770
|
+
author = "@tylabs"
|
|
771
|
+
sigtype = "pdfexaminer_shellcode"
|
|
772
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
773
|
+
desc = "shellcode.hash _lwrite"
|
|
774
|
+
mitre = "T1106"
|
|
775
|
+
strings:
|
|
776
|
+
$h_raw = "db8a23e9" nocase
|
|
777
|
+
$h_hex = { db8a23e9 }
|
|
778
|
+
condition:
|
|
779
|
+
filesize < 1MB and any of them
|
|
780
|
+
}
|
|
781
|
+
|
|
782
|
+
|
|
783
|
+
rule shellcode_hash__SetUnhandledExceptionFilter {
|
|
784
|
+
meta:
|
|
785
|
+
is_exploit = false
|
|
786
|
+
is_warning = true
|
|
787
|
+
is_feature = false
|
|
788
|
+
rank = 2
|
|
789
|
+
revision = "1"
|
|
790
|
+
date = "June 07 2020"
|
|
791
|
+
author = "@tylabs"
|
|
792
|
+
sigtype = "pdfexaminer_shellcode"
|
|
793
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
794
|
+
desc = "shellcode.hash SetUnhandledExceptionFilter"
|
|
795
|
+
mitre = "T1106"
|
|
796
|
+
strings:
|
|
797
|
+
$h_raw = "f08a045f" nocase
|
|
798
|
+
$h_hex = { f08a045f }
|
|
799
|
+
condition:
|
|
800
|
+
filesize < 1MB and any of them
|
|
801
|
+
}
|
|
802
|
+
|
|
803
|
+
|
|
804
|
+
rule shellcode_hash__WaitForSingleObject {
|
|
805
|
+
meta:
|
|
806
|
+
is_exploit = false
|
|
807
|
+
is_warning = true
|
|
808
|
+
is_feature = false
|
|
809
|
+
rank = 2
|
|
810
|
+
revision = "1"
|
|
811
|
+
date = "June 07 2020"
|
|
812
|
+
author = "@tylabs"
|
|
813
|
+
sigtype = "pdfexaminer_shellcode"
|
|
814
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
815
|
+
desc = "shellcode.hash WaitForSingleObject"
|
|
816
|
+
mitre = "T1106"
|
|
817
|
+
strings:
|
|
818
|
+
$h_raw = "add905ce" nocase
|
|
819
|
+
$h_hex = { add905ce }
|
|
820
|
+
condition:
|
|
821
|
+
filesize < 1MB and any of them
|
|
822
|
+
}
|
|
823
|
+
|
|
824
|
+
|
|
825
|
+
rule shellcode_hash__WinExec {
|
|
826
|
+
meta:
|
|
827
|
+
is_exploit = false
|
|
828
|
+
is_warning = true
|
|
829
|
+
is_feature = false
|
|
830
|
+
rank = 2
|
|
831
|
+
revision = "1"
|
|
832
|
+
date = "June 07 2020"
|
|
833
|
+
author = "@tylabs"
|
|
834
|
+
sigtype = "pdfexaminer_shellcode"
|
|
835
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
836
|
+
desc = "shellcode.hash WinExec"
|
|
837
|
+
mitre = "T1059.003"
|
|
838
|
+
strings:
|
|
839
|
+
$h_raw = "98fe8a0e" nocase
|
|
840
|
+
$h_hex = { 98fe8a0e }
|
|
841
|
+
condition:
|
|
842
|
+
filesize < 1MB and any of them
|
|
843
|
+
}
|
|
844
|
+
|
|
845
|
+
|
|
846
|
+
rule shellcode_hash__WriteFile {
|
|
847
|
+
meta:
|
|
848
|
+
is_exploit = false
|
|
849
|
+
is_warning = true
|
|
850
|
+
is_feature = false
|
|
851
|
+
rank = 2
|
|
852
|
+
revision = "1"
|
|
853
|
+
date = "June 07 2020"
|
|
854
|
+
author = "@tylabs"
|
|
855
|
+
sigtype = "pdfexaminer_shellcode"
|
|
856
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
857
|
+
desc = "shellcode.hash WriteFile"
|
|
858
|
+
mitre = "T1059"
|
|
859
|
+
strings:
|
|
860
|
+
$h_raw = "1f790ae8" nocase
|
|
861
|
+
$h_hex = { 1f790ae8 }
|
|
862
|
+
condition:
|
|
863
|
+
filesize < 1MB and any of them
|
|
864
|
+
}
|
|
865
|
+
|
|
866
|
+
|
|
867
|
+
rule shellcode_hash__accept {
|
|
868
|
+
meta:
|
|
869
|
+
is_exploit = false
|
|
870
|
+
is_warning = true
|
|
871
|
+
is_feature = false
|
|
872
|
+
rank = 2
|
|
873
|
+
revision = "1"
|
|
874
|
+
date = "June 07 2020"
|
|
875
|
+
author = "@tylabs"
|
|
876
|
+
sigtype = "pdfexaminer_shellcode"
|
|
877
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
878
|
+
desc = "shellcode.hash accept"
|
|
879
|
+
mitre = "T1106"
|
|
880
|
+
strings:
|
|
881
|
+
$h_raw = "e5498649" nocase
|
|
882
|
+
$h_hex = { e5498649 }
|
|
883
|
+
condition:
|
|
884
|
+
filesize < 1MB and any of them
|
|
885
|
+
}
|
|
886
|
+
|
|
887
|
+
|
|
888
|
+
rule shellcode_hash__bind {
|
|
889
|
+
meta:
|
|
890
|
+
is_exploit = false
|
|
891
|
+
is_warning = true
|
|
892
|
+
is_feature = false
|
|
893
|
+
rank = 2
|
|
894
|
+
revision = "1"
|
|
895
|
+
date = "June 07 2020"
|
|
896
|
+
author = "@tylabs"
|
|
897
|
+
sigtype = "pdfexaminer_shellcode"
|
|
898
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
899
|
+
desc = "shellcode.hash bind"
|
|
900
|
+
mitre = "T1106"
|
|
901
|
+
strings:
|
|
902
|
+
$h_raw = "a41a70c7" nocase
|
|
903
|
+
$h_hex = { a41a70c7 }
|
|
904
|
+
condition:
|
|
905
|
+
filesize < 1MB and any of them
|
|
906
|
+
}
|
|
907
|
+
|
|
908
|
+
|
|
909
|
+
rule shellcode_hash__closesocket {
|
|
910
|
+
meta:
|
|
911
|
+
is_exploit = false
|
|
912
|
+
is_warning = true
|
|
913
|
+
is_feature = false
|
|
914
|
+
rank = 2
|
|
915
|
+
revision = "1"
|
|
916
|
+
date = "June 07 2020"
|
|
917
|
+
author = "@tylabs"
|
|
918
|
+
sigtype = "pdfexaminer_shellcode"
|
|
919
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
920
|
+
desc = "shellcode.hash closesocket"
|
|
921
|
+
mitre = "T1106"
|
|
922
|
+
strings:
|
|
923
|
+
$h_raw = "e779c679" nocase
|
|
924
|
+
$h_hex = { e779c679 }
|
|
925
|
+
condition:
|
|
926
|
+
filesize < 1MB and any of them
|
|
927
|
+
}
|
|
928
|
+
|
|
929
|
+
|
|
930
|
+
rule shellcode_hash__connect {
|
|
931
|
+
meta:
|
|
932
|
+
is_exploit = false
|
|
933
|
+
is_warning = true
|
|
934
|
+
is_feature = false
|
|
935
|
+
rank = 2
|
|
936
|
+
revision = "1"
|
|
937
|
+
date = "June 07 2020"
|
|
938
|
+
author = "@tylabs"
|
|
939
|
+
sigtype = "pdfexaminer_shellcode"
|
|
940
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
941
|
+
desc = "shellcode.hash connect"
|
|
942
|
+
mitre = "T1106"
|
|
943
|
+
strings:
|
|
944
|
+
$h_raw = "ecf9aa60" nocase
|
|
945
|
+
$h_hex = { ecf9aa60 }
|
|
946
|
+
condition:
|
|
947
|
+
filesize < 1MB and any of them
|
|
948
|
+
}
|
|
949
|
+
|
|
950
|
+
|
|
951
|
+
rule shellcode_hash__listen {
|
|
952
|
+
meta:
|
|
953
|
+
is_exploit = false
|
|
954
|
+
is_warning = true
|
|
955
|
+
is_feature = false
|
|
956
|
+
rank = 2
|
|
957
|
+
revision = "1"
|
|
958
|
+
date = "June 07 2020"
|
|
959
|
+
author = "@tylabs"
|
|
960
|
+
sigtype = "pdfexaminer_shellcode"
|
|
961
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
962
|
+
desc = "shellcode.hash listen"
|
|
963
|
+
mitre = "T1106"
|
|
964
|
+
strings:
|
|
965
|
+
$h_raw = "a4ad2ee9" nocase
|
|
966
|
+
$h_hex = { a4ad2ee9 }
|
|
967
|
+
condition:
|
|
968
|
+
filesize < 1MB and any of them
|
|
969
|
+
}
|
|
970
|
+
|
|
971
|
+
|
|
972
|
+
rule shellcode_hash__recv {
|
|
973
|
+
meta:
|
|
974
|
+
is_exploit = false
|
|
975
|
+
is_warning = true
|
|
976
|
+
is_feature = false
|
|
977
|
+
rank = 2
|
|
978
|
+
revision = "1"
|
|
979
|
+
date = "June 07 2020"
|
|
980
|
+
author = "@tylabs"
|
|
981
|
+
sigtype = "pdfexaminer_shellcode"
|
|
982
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
983
|
+
desc = "shellcode.hash recv"
|
|
984
|
+
mitre = "T1106"
|
|
985
|
+
strings:
|
|
986
|
+
$h_raw = "b61918e7" nocase
|
|
987
|
+
$h_hex = { b61918e7 }
|
|
988
|
+
condition:
|
|
989
|
+
filesize < 1MB and any of them
|
|
990
|
+
}
|
|
991
|
+
|
|
992
|
+
|
|
993
|
+
rule shellcode_hash__send {
|
|
994
|
+
meta:
|
|
995
|
+
is_exploit = false
|
|
996
|
+
is_warning = true
|
|
997
|
+
is_feature = false
|
|
998
|
+
rank = 2
|
|
999
|
+
revision = "1"
|
|
1000
|
+
date = "June 07 2020"
|
|
1001
|
+
author = "@tylabs"
|
|
1002
|
+
sigtype = "pdfexaminer_shellcode"
|
|
1003
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1004
|
+
desc = "shellcode.hash send"
|
|
1005
|
+
mitre = "T1106"
|
|
1006
|
+
strings:
|
|
1007
|
+
$h_raw = "a41970e9" nocase
|
|
1008
|
+
$h_hex = { a41970e9 }
|
|
1009
|
+
condition:
|
|
1010
|
+
filesize < 1MB and any of them
|
|
1011
|
+
}
|
|
1012
|
+
|
|
1013
|
+
|
|
1014
|
+
rule shellcode_hash__socket {
|
|
1015
|
+
meta:
|
|
1016
|
+
is_exploit = false
|
|
1017
|
+
is_warning = true
|
|
1018
|
+
is_feature = false
|
|
1019
|
+
rank = 2
|
|
1020
|
+
revision = "1"
|
|
1021
|
+
date = "June 07 2020"
|
|
1022
|
+
author = "@tylabs"
|
|
1023
|
+
sigtype = "pdfexaminer_shellcode"
|
|
1024
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1025
|
+
desc = "shellcode.hash socket"
|
|
1026
|
+
mitre = "T1106"
|
|
1027
|
+
strings:
|
|
1028
|
+
$h_raw = "6e0b2f49" nocase
|
|
1029
|
+
$h_hex = { 6e0b2f49 }
|
|
1030
|
+
condition:
|
|
1031
|
+
filesize < 1MB and any of them
|
|
1032
|
+
}
|
|
1033
|
+
|
|
1034
|
+
|
|
1035
|
+
rule shellcode_hash__WSASocketA {
|
|
1036
|
+
meta:
|
|
1037
|
+
is_exploit = false
|
|
1038
|
+
is_warning = true
|
|
1039
|
+
is_feature = false
|
|
1040
|
+
rank = 2
|
|
1041
|
+
revision = "1"
|
|
1042
|
+
date = "June 07 2020"
|
|
1043
|
+
author = "@tylabs"
|
|
1044
|
+
sigtype = "pdfexaminer_shellcode"
|
|
1045
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1046
|
+
desc = "shellcode.hash WSASocketA"
|
|
1047
|
+
mitre = "T1106"
|
|
1048
|
+
strings:
|
|
1049
|
+
$h_raw = "d909f5ad" nocase
|
|
1050
|
+
$h_hex = { d909f5ad }
|
|
1051
|
+
condition:
|
|
1052
|
+
filesize < 1MB and any of them
|
|
1053
|
+
}
|
|
1054
|
+
|
|
1055
|
+
|
|
1056
|
+
rule shellcode_hash__WSAStartup {
|
|
1057
|
+
meta:
|
|
1058
|
+
is_exploit = false
|
|
1059
|
+
is_warning = true
|
|
1060
|
+
is_feature = false
|
|
1061
|
+
rank = 2
|
|
1062
|
+
revision = "1"
|
|
1063
|
+
date = "June 07 2020"
|
|
1064
|
+
author = "@tylabs"
|
|
1065
|
+
sigtype = "pdfexaminer_shellcode"
|
|
1066
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1067
|
+
desc = "shellcode.hash WSAStartup"
|
|
1068
|
+
mitre = "T1106"
|
|
1069
|
+
strings:
|
|
1070
|
+
$h_raw = "cbedfc3b" nocase
|
|
1071
|
+
$h_hex = { cbedfc3b }
|
|
1072
|
+
condition:
|
|
1073
|
+
filesize < 1MB and any of them
|
|
1074
|
+
}
|
|
1075
|
+
|
|
1076
|
+
|
|
1077
|
+
rule shellcode_hash__URLDownloadToFileA {
|
|
1078
|
+
meta:
|
|
1079
|
+
is_exploit = false
|
|
1080
|
+
is_warning = true
|
|
1081
|
+
is_feature = false
|
|
1082
|
+
rank = 2
|
|
1083
|
+
revision = "1"
|
|
1084
|
+
date = "June 07 2020"
|
|
1085
|
+
author = "@tylabs"
|
|
1086
|
+
sigtype = "pdfexaminer_shellcode"
|
|
1087
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1088
|
+
desc = "shellcode.hash URLDownloadToFileA"
|
|
1089
|
+
mitre = "T1106"
|
|
1090
|
+
strings:
|
|
1091
|
+
$h_raw = "361a2f70" nocase
|
|
1092
|
+
$h_hex = { 361a2f70 }
|
|
1093
|
+
condition:
|
|
1094
|
+
filesize < 1MB and any of them
|
|
1095
|
+
}
|
|
1096
|
+
|
|
1097
|
+
|
|
1098
|
+
rule suspicious_shellcode_NOP_Sled {
|
|
1099
|
+
meta:
|
|
1100
|
+
is_exploit = false
|
|
1101
|
+
is_warning = true
|
|
1102
|
+
is_feature = false
|
|
1103
|
+
rank = 2
|
|
1104
|
+
revision = "1"
|
|
1105
|
+
date = "June 07 2020"
|
|
1106
|
+
author = "@tylabs"
|
|
1107
|
+
sigtype = "pdfexaminer_shellcode"
|
|
1108
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1109
|
+
desc = "suspicious.shellcode NOP Sled"
|
|
1110
|
+
mitre = "T1106"
|
|
1111
|
+
strings:
|
|
1112
|
+
$h_raw = "9090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090" nocase
|
|
1113
|
+
$h_hex = { 9090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090 }
|
|
1114
|
+
condition:
|
|
1115
|
+
filesize < 1MB and any of them
|
|
1116
|
+
}
|
|
1117
|
+
|
|
1118
|
+
|
|
1119
|
+
rule suspicious_obfuscation_using_unescape {
|
|
1120
|
+
meta:
|
|
1121
|
+
is_exploit = false
|
|
1122
|
+
is_warning = true
|
|
1123
|
+
is_feature = false
|
|
1124
|
+
rank = 1
|
|
1125
|
+
revision = "1"
|
|
1126
|
+
date = "June 07 2020"
|
|
1127
|
+
author = "@tylabs"
|
|
1128
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1129
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1130
|
+
desc = "suspicious.obfuscation using unescape"
|
|
1131
|
+
mitre = "T1027"
|
|
1132
|
+
strings:
|
|
1133
|
+
$h_reg1 = /une(.{0,6}?)sca(.{0,6}?)pe([^\)]{0,6}?)\(/
|
|
1134
|
+
$h_reg2 = /un(.{0,6}?)esc(.{0,6}?)ape([^\)]{0,6}?)\(/
|
|
1135
|
+
$h_reg3 = /unesc([\W]{0,6}?)ape/
|
|
1136
|
+
//$h_reg4 = /u([\W]{0,6}?)n([\W]{0,6}?)e([\W]{0,6}?)s([\W]{0,6}?)c([\W]{0,6}?)a([\W]{0,6}?)p([\W]{0,6}?)e/
|
|
1137
|
+
$h_reg5 = /unescape([^\)]{0,6}?)\(/
|
|
1138
|
+
$h_raw6 = "\"u\",\"s\",\"p\",\"c\",\"n\",\"e\",\"a\"," nocase
|
|
1139
|
+
$h_raw7 = "\"s\",\"n\",\"a\",\"e\",\"c\",\"u\",\"e\",\"p\"" nocase
|
|
1140
|
+
condition:
|
|
1141
|
+
any of them
|
|
1142
|
+
}
|
|
1143
|
+
|
|
1144
|
+
/*
|
|
1145
|
+
rule suspicious_obfuscation_using_charCodeAt {
|
|
1146
|
+
meta:
|
|
1147
|
+
is_exploit = false
|
|
1148
|
+
is_warning = true
|
|
1149
|
+
is_feature = false
|
|
1150
|
+
rank = 1
|
|
1151
|
+
revision = "1"
|
|
1152
|
+
date = "June 07 2020"
|
|
1153
|
+
author = "@tylabs"
|
|
1154
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1155
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1156
|
+
desc = "suspicious.obfuscation using charCodeAt"
|
|
1157
|
+
mitre = "T1027"
|
|
1158
|
+
strings:
|
|
1159
|
+
$h_reg1 = /c([\W]{0,4}?)h([\W]{0,4}?)a([\W]{0,4}?)r([\W]{0,4}?)C([\W]{0,3}?)o([\W]{0,3}?)d([\W]{0,3}?)e([\W]{0,3}?)A(.{0,3}?)t/
|
|
1160
|
+
condition:
|
|
1161
|
+
any of them
|
|
1162
|
+
}*/
|
|
1163
|
+
|
|
1164
|
+
|
|
1165
|
+
rule suspicious_string_nopblock {
|
|
1166
|
+
meta:
|
|
1167
|
+
is_exploit = false
|
|
1168
|
+
is_warning = true
|
|
1169
|
+
is_feature = false
|
|
1170
|
+
rank = 1
|
|
1171
|
+
revision = "1"
|
|
1172
|
+
date = "June 07 2020"
|
|
1173
|
+
author = "@tylabs"
|
|
1174
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1175
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1176
|
+
desc = "suspicious.string nopblock"
|
|
1177
|
+
mitre = "T1027"
|
|
1178
|
+
strings:
|
|
1179
|
+
$h_raw1 = "nopblock" nocase
|
|
1180
|
+
condition:
|
|
1181
|
+
filesize < 1MB and any of them
|
|
1182
|
+
}
|
|
1183
|
+
|
|
1184
|
+
|
|
1185
|
+
rule suspicious_obfuscation_using_eval {
|
|
1186
|
+
meta:
|
|
1187
|
+
is_exploit = false
|
|
1188
|
+
is_warning = true
|
|
1189
|
+
is_feature = false
|
|
1190
|
+
rank = 1
|
|
1191
|
+
revision = "1"
|
|
1192
|
+
date = "June 07 2020"
|
|
1193
|
+
author = "@tylabs"
|
|
1194
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1195
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1196
|
+
desc = "suspicious.obfuscation using eval"
|
|
1197
|
+
mitre = "T1027"
|
|
1198
|
+
strings:
|
|
1199
|
+
$h_reg1 = /eval(\s{0,3}?)\(/
|
|
1200
|
+
$h_raw2 = "eval\\" nocase
|
|
1201
|
+
$h_raw3 = "eval," nocase
|
|
1202
|
+
$h_reg4 = /'e'(.{1,30}?)'va'(.{1,3}?)'l/
|
|
1203
|
+
$h_raw5 = "\"l\",\"v\",\"e\",\"a\"" nocase
|
|
1204
|
+
$h_raw6 = "\"e\",\"l\",\"a\",\"v\"" nocase
|
|
1205
|
+
$h_reg7 = /=(\s{0,6}?)eval/
|
|
1206
|
+
condition:
|
|
1207
|
+
any of them
|
|
1208
|
+
}
|
|
1209
|
+
|
|
1210
|
+
|
|
1211
|
+
rule suspicious_javascript_object {
|
|
1212
|
+
meta:
|
|
1213
|
+
is_exploit = false
|
|
1214
|
+
is_warning = true
|
|
1215
|
+
is_feature = false
|
|
1216
|
+
rank = 1
|
|
1217
|
+
revision = "1"
|
|
1218
|
+
date = "June 07 2020"
|
|
1219
|
+
author = "@tylabs"
|
|
1220
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1221
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1222
|
+
desc = "suspicious.javascript object"
|
|
1223
|
+
mitre = "T1027 T1059.007"
|
|
1224
|
+
strings:
|
|
1225
|
+
$h_raw1 = "/JavaScript" nocase
|
|
1226
|
+
$h_raw2 = "/JS "
|
|
1227
|
+
condition:
|
|
1228
|
+
any of them
|
|
1229
|
+
}
|
|
1230
|
+
|
|
1231
|
+
|
|
1232
|
+
rule suspicious_javascript_in_XFA_block {
|
|
1233
|
+
meta:
|
|
1234
|
+
is_exploit = false
|
|
1235
|
+
is_warning = true
|
|
1236
|
+
is_feature = false
|
|
1237
|
+
rank = 1
|
|
1238
|
+
revision = "1"
|
|
1239
|
+
date = "June 07 2020"
|
|
1240
|
+
author = "@tylabs"
|
|
1241
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1242
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1243
|
+
desc = "suspicious.javascript in XFA block"
|
|
1244
|
+
mitre = "T1027 T1059.007"
|
|
1245
|
+
strings:
|
|
1246
|
+
$h_raw1 = "application/x-javascript" nocase
|
|
1247
|
+
$h_raw2 = "application#2Fx-javascript" nocase
|
|
1248
|
+
//$h_reg3 = /(\&\#0*97;|a)(\&\#0*112;|p)(\&\#0*112;|p)(\&\#0*108;|l)(\&\#0*105;|i)(\&\#0*99;|c)(\&\#0*97;|a)(\&\#0*116;|t)(\&\#0*105;|i)(\&\#0*111;|o)(\&\#0*110;|n)(\&\#0*47;|\/)(\&\#0*120;|x)(\&\#0*45;|\-)(\&\#0*106;|j)(\&\#0*97;|a)(\&\#0*76;|v)(\&\#0*97;|a)(\&\#0*115;|s)(\&\#0*99;|c)(\&\#0*114;|r)(\&\#0*105;|i)(\&\#0*112;|p)(\&\#0*116;|t)/
|
|
1249
|
+
condition:
|
|
1250
|
+
any of them
|
|
1251
|
+
}
|
|
1252
|
+
|
|
1253
|
+
|
|
1254
|
+
rule suspicious_pdf_embedded_PDF_file {
|
|
1255
|
+
meta:
|
|
1256
|
+
is_exploit = false
|
|
1257
|
+
is_warning = true
|
|
1258
|
+
is_feature = false
|
|
1259
|
+
rank = 1
|
|
1260
|
+
revision = "1"
|
|
1261
|
+
date = "June 07 2020"
|
|
1262
|
+
author = "@tylabs"
|
|
1263
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1264
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1265
|
+
desc = "suspicious.pdf embedded PDF file"
|
|
1266
|
+
mitre = "T1204.002"
|
|
1267
|
+
strings:
|
|
1268
|
+
$h_raw1 = "application#2Fpdf" nocase
|
|
1269
|
+
condition:
|
|
1270
|
+
any of them
|
|
1271
|
+
}
|
|
1272
|
+
|
|
1273
|
+
|
|
1274
|
+
rule suspicious_obfuscation_toString {
|
|
1275
|
+
meta:
|
|
1276
|
+
is_exploit = false
|
|
1277
|
+
is_warning = true
|
|
1278
|
+
is_feature = false
|
|
1279
|
+
rank = 1
|
|
1280
|
+
revision = "1"
|
|
1281
|
+
date = "June 07 2020"
|
|
1282
|
+
author = "@tylabs"
|
|
1283
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1284
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1285
|
+
desc = "suspicious.obfuscation toString"
|
|
1286
|
+
mitre = "T1027"
|
|
1287
|
+
strings:
|
|
1288
|
+
$h_raw1 = "toString(" nocase
|
|
1289
|
+
condition: filesize < 1MB and any of them
|
|
1290
|
+
}
|
|
1291
|
+
|
|
1292
|
+
|
|
1293
|
+
rule suspicious_obfuscation_using_substr {
|
|
1294
|
+
meta:
|
|
1295
|
+
is_exploit = false
|
|
1296
|
+
is_warning = true
|
|
1297
|
+
is_feature = false
|
|
1298
|
+
rank = 1
|
|
1299
|
+
revision = "1"
|
|
1300
|
+
date = "June 07 2020"
|
|
1301
|
+
author = "@tylabs"
|
|
1302
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1303
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1304
|
+
desc = "suspicious.obfuscation using substr"
|
|
1305
|
+
mitre = "T1027"
|
|
1306
|
+
strings:
|
|
1307
|
+
$h_raw1 = "substr(" nocase
|
|
1308
|
+
condition: filesize < 1MB and any of them
|
|
1309
|
+
}
|
|
1310
|
+
|
|
1311
|
+
|
|
1312
|
+
rule suspicious_obfuscation_using_String_replace {
|
|
1313
|
+
meta:
|
|
1314
|
+
is_exploit = false
|
|
1315
|
+
is_warning = true
|
|
1316
|
+
is_feature = false
|
|
1317
|
+
rank = 1
|
|
1318
|
+
revision = "1"
|
|
1319
|
+
date = "June 07 2020"
|
|
1320
|
+
author = "@tylabs"
|
|
1321
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1322
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1323
|
+
desc = "suspicious.obfuscation using String.replace"
|
|
1324
|
+
mitre = "T1027"
|
|
1325
|
+
strings:
|
|
1326
|
+
$h_reg1 = /'re'(.{1,24}?)'place'/
|
|
1327
|
+
$h_raw2 = ".replace" nocase
|
|
1328
|
+
condition: filesize < 1MB and any of them
|
|
1329
|
+
}
|
|
1330
|
+
|
|
1331
|
+
|
|
1332
|
+
rule suspicious_obfuscation_using_String_fromCharCode {
|
|
1333
|
+
meta:
|
|
1334
|
+
is_exploit = false
|
|
1335
|
+
is_warning = true
|
|
1336
|
+
is_feature = false
|
|
1337
|
+
rank = 1
|
|
1338
|
+
revision = "1"
|
|
1339
|
+
date = "June 07 2020"
|
|
1340
|
+
author = "@tylabs"
|
|
1341
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1342
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1343
|
+
desc = "suspicious.obfuscation using String.fromCharCode"
|
|
1344
|
+
mitre = "T1027"
|
|
1345
|
+
strings:
|
|
1346
|
+
$h_raw1 = "\"rCo\",\"t\",\"cha\",\"\",\"deA\"" nocase
|
|
1347
|
+
$h_raw2 = "\"deA\",\"cha\",\"rCo\",\"t\"" nocase
|
|
1348
|
+
$h_reg3 = /from([\W]{0,6}?)C([\W]{0,6}?)h([\W]{0,6}?)a(.{0,6}?)r(.{0,6}?)C(.{0,6}?)o([\W]{0,6}?)d([\W]{0,6}?)e/
|
|
1349
|
+
$h_raw4 = ".fromCharC" nocase
|
|
1350
|
+
condition:
|
|
1351
|
+
any of them
|
|
1352
|
+
}
|
|
1353
|
+
|
|
1354
|
+
|
|
1355
|
+
rule suspicious_obfuscation_using_substring {
|
|
1356
|
+
meta:
|
|
1357
|
+
is_exploit = false
|
|
1358
|
+
is_warning = true
|
|
1359
|
+
is_feature = false
|
|
1360
|
+
rank = 1
|
|
1361
|
+
revision = "1"
|
|
1362
|
+
date = "June 07 2020"
|
|
1363
|
+
author = "@tylabs"
|
|
1364
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1365
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1366
|
+
desc = "suspicious.obfuscation using substring"
|
|
1367
|
+
mitre = "T1027"
|
|
1368
|
+
strings:
|
|
1369
|
+
$h_reg1 = /\.substring(\s{0,3}?)\(/
|
|
1370
|
+
condition: filesize < 1MB and any of them
|
|
1371
|
+
}
|
|
1372
|
+
|
|
1373
|
+
|
|
1374
|
+
rule suspicious_obfuscation_using_util_byteToChar {
|
|
1375
|
+
meta:
|
|
1376
|
+
is_exploit = false
|
|
1377
|
+
is_warning = true
|
|
1378
|
+
is_feature = false
|
|
1379
|
+
rank = 1
|
|
1380
|
+
revision = "1"
|
|
1381
|
+
date = "June 07 2020"
|
|
1382
|
+
author = "@tylabs"
|
|
1383
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1384
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1385
|
+
desc = "suspicious.obfuscation using util.byteToChar"
|
|
1386
|
+
mitre = "T1027"
|
|
1387
|
+
strings:
|
|
1388
|
+
$h_raw1 = "byteToChar" nocase
|
|
1389
|
+
condition: filesize < 1MB and any of them
|
|
1390
|
+
}
|
|
1391
|
+
|
|
1392
|
+
|
|
1393
|
+
rule suspicious_string_Shellcode_NOP_sled {
|
|
1394
|
+
meta:
|
|
1395
|
+
is_exploit = false
|
|
1396
|
+
is_warning = true
|
|
1397
|
+
is_feature = false
|
|
1398
|
+
rank = 1
|
|
1399
|
+
revision = "1"
|
|
1400
|
+
date = "June 07 2020"
|
|
1401
|
+
author = "@tylabs"
|
|
1402
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1403
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1404
|
+
desc = "suspicious.string Shellcode NOP sled"
|
|
1405
|
+
mitre = "T1027"
|
|
1406
|
+
strings:
|
|
1407
|
+
$h_raw1 = "%u9090" nocase
|
|
1408
|
+
condition: filesize < 1MB and any of them
|
|
1409
|
+
}
|
|
1410
|
+
|
|
1411
|
+
|
|
1412
|
+
rule suspicious_string_heap_spray_shellcode {
|
|
1413
|
+
meta:
|
|
1414
|
+
is_exploit = false
|
|
1415
|
+
is_warning = true
|
|
1416
|
+
is_feature = false
|
|
1417
|
+
rank = 1
|
|
1418
|
+
revision = "1"
|
|
1419
|
+
date = "June 07 2020"
|
|
1420
|
+
author = "@tylabs"
|
|
1421
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1422
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1423
|
+
desc = "suspicious.string heap spray shellcode"
|
|
1424
|
+
mitre = "T1027"
|
|
1425
|
+
strings:
|
|
1426
|
+
$h_raw1 = "\"%\" + \"u\" + \"0\" + \"c\" + \"0\" + \"c\" + \"%u\" + \"0\" + \"c\" + \"0\" + \"c\"" nocase
|
|
1427
|
+
condition:
|
|
1428
|
+
any of them
|
|
1429
|
+
}
|
|
1430
|
+
|
|
1431
|
+
|
|
1432
|
+
rule suspicious_string_shellcode {
|
|
1433
|
+
meta:
|
|
1434
|
+
is_exploit = false
|
|
1435
|
+
is_warning = true
|
|
1436
|
+
is_feature = false
|
|
1437
|
+
rank = 1
|
|
1438
|
+
revision = "1"
|
|
1439
|
+
date = "June 07 2020"
|
|
1440
|
+
author = "@tylabs"
|
|
1441
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1442
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1443
|
+
desc = "suspicious.string shellcode"
|
|
1444
|
+
mitre = "T1027"
|
|
1445
|
+
strings:
|
|
1446
|
+
$h_raw1 = "%u4141%u4141" nocase
|
|
1447
|
+
condition: filesize < 1MB and any of them
|
|
1448
|
+
}
|
|
1449
|
+
|
|
1450
|
+
|
|
1451
|
+
rule suspicious_string__Run_Sploit_ {
|
|
1452
|
+
meta:
|
|
1453
|
+
is_exploit = false
|
|
1454
|
+
is_warning = true
|
|
1455
|
+
is_feature = false
|
|
1456
|
+
rank = 1
|
|
1457
|
+
revision = "1"
|
|
1458
|
+
date = "June 07 2020"
|
|
1459
|
+
author = "@tylabs"
|
|
1460
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1461
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1462
|
+
desc = "suspicious.string -Run_Sploit-"
|
|
1463
|
+
mitre = "T1027"
|
|
1464
|
+
strings:
|
|
1465
|
+
$h_raw1 = "Run_Sploit" nocase
|
|
1466
|
+
condition: filesize < 1MB and any of them
|
|
1467
|
+
}
|
|
1468
|
+
|
|
1469
|
+
|
|
1470
|
+
rule suspicious_string__HeapSpray_ {
|
|
1471
|
+
meta:
|
|
1472
|
+
is_exploit = false
|
|
1473
|
+
is_warning = true
|
|
1474
|
+
is_feature = false
|
|
1475
|
+
rank = 1
|
|
1476
|
+
revision = "1"
|
|
1477
|
+
date = "June 07 2020"
|
|
1478
|
+
author = "@tylabs"
|
|
1479
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1480
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1481
|
+
desc = "suspicious.string -HeapSpray-"
|
|
1482
|
+
mitre = "T1027"
|
|
1483
|
+
strings:
|
|
1484
|
+
$h_raw1 = "HeapSpray" nocase
|
|
1485
|
+
condition: filesize < 1MB and any of them
|
|
1486
|
+
}
|
|
1487
|
+
|
|
1488
|
+
|
|
1489
|
+
rule suspicious_flash_writeMultiByte {
|
|
1490
|
+
meta:
|
|
1491
|
+
is_exploit = false
|
|
1492
|
+
is_warning = true
|
|
1493
|
+
is_feature = false
|
|
1494
|
+
rank = 1
|
|
1495
|
+
revision = "1"
|
|
1496
|
+
date = "June 07 2020"
|
|
1497
|
+
author = "@tylabs"
|
|
1498
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1499
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1500
|
+
desc = "suspicious.flash writeMultiByte"
|
|
1501
|
+
mitre = "T1027"
|
|
1502
|
+
strings:
|
|
1503
|
+
$h_raw1 = "writeMultiByte" nocase
|
|
1504
|
+
condition: filesize < 1MB and any of them
|
|
1505
|
+
}
|
|
1506
|
+
|
|
1507
|
+
|
|
1508
|
+
rule suspicious_flash_addFrameScript {
|
|
1509
|
+
meta:
|
|
1510
|
+
is_exploit = false
|
|
1511
|
+
is_warning = true
|
|
1512
|
+
is_feature = false
|
|
1513
|
+
rank = 1
|
|
1514
|
+
revision = "1"
|
|
1515
|
+
date = "June 07 2020"
|
|
1516
|
+
author = "@tylabs"
|
|
1517
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1518
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1519
|
+
desc = "suspicious.flash addFrameScript"
|
|
1520
|
+
mitre = "T1027"
|
|
1521
|
+
strings:
|
|
1522
|
+
$h_raw1 = "addFrameScript" nocase
|
|
1523
|
+
condition: filesize < 1MB and any of them
|
|
1524
|
+
}
|
|
1525
|
+
|
|
1526
|
+
|
|
1527
|
+
rule suspicious_flash_Adobe_Shockwave_Flash_in_a_PDF_define_obj_type {
|
|
1528
|
+
meta:
|
|
1529
|
+
is_exploit = false
|
|
1530
|
+
is_warning = true
|
|
1531
|
+
is_feature = false
|
|
1532
|
+
rank = 1
|
|
1533
|
+
revision = "1"
|
|
1534
|
+
date = "June 07 2020"
|
|
1535
|
+
author = "@tylabs"
|
|
1536
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1537
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1538
|
+
desc = "suspicious.flash Adobe Shockwave Flash in a PDF define obj type"
|
|
1539
|
+
strings:
|
|
1540
|
+
$h_hex1 = { (52|233532) (69|233639) (63|233633) (68|233638) (4D|233444|233464) (65|233635) (64|233634) (69|233639)(61|233631) }
|
|
1541
|
+
condition:
|
|
1542
|
+
any of them
|
|
1543
|
+
}
|
|
1544
|
+
|
|
1545
|
+
|
|
1546
|
+
rule suspicious_flash_obfuscated_name {
|
|
1547
|
+
meta:
|
|
1548
|
+
is_exploit = false
|
|
1549
|
+
is_warning = true
|
|
1550
|
+
is_feature = false
|
|
1551
|
+
rank = 1
|
|
1552
|
+
revision = "1"
|
|
1553
|
+
date = "June 07 2020"
|
|
1554
|
+
author = "@tylabs"
|
|
1555
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1556
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1557
|
+
desc = "suspicious.flash obfuscated name"
|
|
1558
|
+
mitre = "T1027"
|
|
1559
|
+
strings:
|
|
1560
|
+
$h_raw1 = "/R#69chM#65#64ia#53e#74ti#6e#67#73/" nocase
|
|
1561
|
+
condition:
|
|
1562
|
+
any of them
|
|
1563
|
+
}
|
|
1564
|
+
|
|
1565
|
+
|
|
1566
|
+
rule pdf_exploit_FlateDecode_Stream_Predictor_02_Integer_Overflow_CVE_2009_3459 {
|
|
1567
|
+
meta:
|
|
1568
|
+
is_exploit = true
|
|
1569
|
+
is_warning = false
|
|
1570
|
+
is_feature = false
|
|
1571
|
+
rank = 5
|
|
1572
|
+
revision = "1"
|
|
1573
|
+
date = "June 07 2020"
|
|
1574
|
+
author = "@tylabs"
|
|
1575
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1576
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1577
|
+
desc = "pdf.exploit FlateDecode Stream Predictor 02 Integer Overflow CVE-2009-3459"
|
|
1578
|
+
mitre = "T1203 T1204.002"
|
|
1579
|
+
strings:
|
|
1580
|
+
$h_reg1 = /Predictor 02(\s{0,2}?)\/(\s{0,2}?)Colors 1073741838/
|
|
1581
|
+
condition:
|
|
1582
|
+
any of them
|
|
1583
|
+
}
|
|
1584
|
+
|
|
1585
|
+
|
|
1586
|
+
rule pdf_exploit_colors_number_is_high_CVE_2009_3459 {
|
|
1587
|
+
meta:
|
|
1588
|
+
is_exploit = true
|
|
1589
|
+
is_warning = false
|
|
1590
|
+
is_feature = false
|
|
1591
|
+
rank = 5
|
|
1592
|
+
revision = "1"
|
|
1593
|
+
date = "June 07 2020"
|
|
1594
|
+
author = "@tylabs"
|
|
1595
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1596
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1597
|
+
desc = "pdf.exploit colors number is high CVE-2009-3459"
|
|
1598
|
+
mitre = "T1203 T1204.002"
|
|
1599
|
+
strings:
|
|
1600
|
+
$h_reg1 = /\/Colors \d{5,15}?/
|
|
1601
|
+
condition:
|
|
1602
|
+
any of them
|
|
1603
|
+
}
|
|
1604
|
+
|
|
1605
|
+
|
|
1606
|
+
rule pdf_exploit_URI_directory_traversal {
|
|
1607
|
+
meta:
|
|
1608
|
+
is_exploit = false
|
|
1609
|
+
is_warning = true
|
|
1610
|
+
is_feature = false
|
|
1611
|
+
rank = 1
|
|
1612
|
+
revision = "1"
|
|
1613
|
+
date = "June 07 2020"
|
|
1614
|
+
author = "@tylabs"
|
|
1615
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1616
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1617
|
+
desc = "pdf.exploit URI directory traversal"
|
|
1618
|
+
mitre = "T1203 T1204.002"
|
|
1619
|
+
strings:
|
|
1620
|
+
$h_reg1 = /URI.{1,30}?\/\.\.\/\.\./
|
|
1621
|
+
condition:
|
|
1622
|
+
any of them
|
|
1623
|
+
}
|
|
1624
|
+
|
|
1625
|
+
|
|
1626
|
+
rule pdf_exploit_URI_directory_traversal_system32 {
|
|
1627
|
+
meta:
|
|
1628
|
+
is_exploit = false
|
|
1629
|
+
is_warning = true
|
|
1630
|
+
is_feature = false
|
|
1631
|
+
rank = 1
|
|
1632
|
+
revision = "1"
|
|
1633
|
+
date = "June 07 2020"
|
|
1634
|
+
author = "@tylabs"
|
|
1635
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1636
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1637
|
+
desc = "pdf.exploit URI directory traversal system32"
|
|
1638
|
+
mitre = "T1203 T1204.002"
|
|
1639
|
+
strings:
|
|
1640
|
+
$h_reg1 = /URI.{1,65}?system32/
|
|
1641
|
+
condition:
|
|
1642
|
+
any of them
|
|
1643
|
+
}
|
|
1644
|
+
|
|
1645
|
+
|
|
1646
|
+
rule pdf_exploit_execute_EXE_file {
|
|
1647
|
+
meta:
|
|
1648
|
+
is_exploit = false
|
|
1649
|
+
is_warning = true
|
|
1650
|
+
is_feature = true
|
|
1651
|
+
rank = 10
|
|
1652
|
+
revision = "1"
|
|
1653
|
+
date = "June 07 2020"
|
|
1654
|
+
author = "@tylabs"
|
|
1655
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1656
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1657
|
+
desc = "pdf.exploit execute EXE file"
|
|
1658
|
+
mitre = "T1203 T1204.002"
|
|
1659
|
+
strings:
|
|
1660
|
+
$h_reg1 = /\/(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|6e)(.{0,64}?)\.exe/
|
|
1661
|
+
condition:
|
|
1662
|
+
any of them
|
|
1663
|
+
}
|
|
1664
|
+
|
|
1665
|
+
|
|
1666
|
+
rule pdf_warning_openaction {
|
|
1667
|
+
meta:
|
|
1668
|
+
is_exploit = false
|
|
1669
|
+
is_warning = true
|
|
1670
|
+
is_feature = true
|
|
1671
|
+
rank = 1
|
|
1672
|
+
revision = "1"
|
|
1673
|
+
date = "July 14 2020"
|
|
1674
|
+
author = "@tylabs"
|
|
1675
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1676
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1677
|
+
desc = "pdf.warning OpenAction"
|
|
1678
|
+
mitre = "T1203 T1204.002"
|
|
1679
|
+
strings:
|
|
1680
|
+
$h_reg1 = /\/(O|#4F)(p|#70)(e|#65)(n|#6e)(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|6e)/
|
|
1681
|
+
condition:
|
|
1682
|
+
any of them
|
|
1683
|
+
}
|
|
1684
|
+
|
|
1685
|
+
|
|
1686
|
+
rule pdf_exploit_access_system32_directory {
|
|
1687
|
+
meta:
|
|
1688
|
+
is_exploit = false
|
|
1689
|
+
is_warning = true
|
|
1690
|
+
is_feature = false
|
|
1691
|
+
rank = 1
|
|
1692
|
+
revision = "1"
|
|
1693
|
+
date = "June 07 2020"
|
|
1694
|
+
author = "@tylabs"
|
|
1695
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1696
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1697
|
+
desc = "pdf.exploit access system32 directory"
|
|
1698
|
+
mitre = "T1203 T1204.002"
|
|
1699
|
+
strings:
|
|
1700
|
+
$h_reg1 = /\/(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|6e)(.{0,64}?)system32/
|
|
1701
|
+
condition:
|
|
1702
|
+
any of them
|
|
1703
|
+
}
|
|
1704
|
+
|
|
1705
|
+
|
|
1706
|
+
rule pdf_warning_remote_action {
|
|
1707
|
+
meta:
|
|
1708
|
+
is_exploit = false
|
|
1709
|
+
is_warning = true
|
|
1710
|
+
is_feature = false
|
|
1711
|
+
rank = 5
|
|
1712
|
+
revision = "1"
|
|
1713
|
+
date = "June 07 2020"
|
|
1714
|
+
author = "@tylabs"
|
|
1715
|
+
sigtype = "pdfexaminer_active"
|
|
1716
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1717
|
+
desc = "pdf.exploit action uri"
|
|
1718
|
+
mitre = "T1566.002"
|
|
1719
|
+
strings:
|
|
1720
|
+
$h_reg1 = /\/(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|6e)\s*\/(U|#55)(R|#52)(I|49)/
|
|
1721
|
+
$h_reg2 = /\/(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|6e)\s*\/(S|#53)\s*\/(U|#55)(R|#52)(I|49)/
|
|
1722
|
+
|
|
1723
|
+
condition:
|
|
1724
|
+
any of them
|
|
1725
|
+
}
|
|
1726
|
+
|
|
1727
|
+
|
|
1728
|
+
|
|
1729
|
+
|
|
1730
|
+
rule pdf_exploit_execute_action_command {
|
|
1731
|
+
meta:
|
|
1732
|
+
is_exploit = false
|
|
1733
|
+
is_warning = true
|
|
1734
|
+
is_feature = false
|
|
1735
|
+
rank = 1
|
|
1736
|
+
revision = "1"
|
|
1737
|
+
date = "June 07 2020"
|
|
1738
|
+
author = "@tylabs"
|
|
1739
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1740
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1741
|
+
desc = "pdf.exploit execute action command"
|
|
1742
|
+
mitre = "T1203 T1204.002"
|
|
1743
|
+
strings:
|
|
1744
|
+
$h_raw1 = "Launch/Type/Action/Win" nocase
|
|
1745
|
+
condition:
|
|
1746
|
+
any of them
|
|
1747
|
+
}
|
|
1748
|
+
|
|
1749
|
+
|
|
1750
|
+
rule pdf_exploit_printSeps_memory_heap_corruption_CVE_2010_4091 {
|
|
1751
|
+
meta:
|
|
1752
|
+
is_exploit = true
|
|
1753
|
+
is_warning = false
|
|
1754
|
+
is_feature = false
|
|
1755
|
+
rank = 5
|
|
1756
|
+
revision = "1"
|
|
1757
|
+
date = "June 07 2020"
|
|
1758
|
+
author = "@tylabs"
|
|
1759
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1760
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1761
|
+
desc = "pdf.exploit printSeps memory heap corruption CVE-2010-4091"
|
|
1762
|
+
mitre = "T1203 T1204.002"
|
|
1763
|
+
strings:
|
|
1764
|
+
$h_raw1 = "printSeps" nocase
|
|
1765
|
+
condition: filesize < 1MB and any of them
|
|
1766
|
+
}
|
|
1767
|
+
|
|
1768
|
+
|
|
1769
|
+
rule suspicious_obfuscation_jjencoded_javascript {
|
|
1770
|
+
meta:
|
|
1771
|
+
is_exploit = false
|
|
1772
|
+
is_warning = true
|
|
1773
|
+
is_feature = false
|
|
1774
|
+
rank = 1
|
|
1775
|
+
revision = "1"
|
|
1776
|
+
date = "June 07 2020"
|
|
1777
|
+
author = "@tylabs"
|
|
1778
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1779
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1780
|
+
desc = "suspicious.obfuscation jjencoded javascript"
|
|
1781
|
+
mitre = "T1059.007"
|
|
1782
|
+
strings:
|
|
1783
|
+
$h_raw1 = ":++$,$$$$:" nocase
|
|
1784
|
+
$h_raw2 = "$$:++$,$$$" nocase
|
|
1785
|
+
condition:
|
|
1786
|
+
any of them
|
|
1787
|
+
}
|
|
1788
|
+
|
|
1789
|
+
|
|
1790
|
+
rule suspicious_obfuscation_getAnnots_access_blocks {
|
|
1791
|
+
meta:
|
|
1792
|
+
is_exploit = false
|
|
1793
|
+
is_warning = true
|
|
1794
|
+
is_feature = false
|
|
1795
|
+
rank = 1
|
|
1796
|
+
revision = "1"
|
|
1797
|
+
date = "June 07 2020"
|
|
1798
|
+
author = "@tylabs"
|
|
1799
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1800
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1801
|
+
desc = "suspicious.obfuscation getAnnots access blocks"
|
|
1802
|
+
mitre = "T1059.007"
|
|
1803
|
+
strings:
|
|
1804
|
+
$h_hex1 = {67 [0-2] 65 [0-2] 74 [0-2] 41 [0-2] 6E [0-2] 6E [0-2] 6F [0-2] 74}
|
|
1805
|
+
|
|
1806
|
+
$h_str2 = "getAnnots" nocase ascii wide
|
|
1807
|
+
//$h_reg1 = /g(\W{0,2}?)e(\W{0,2}?)t(\W{0,2}?)A([\W]{0,2}?)n([\W]{0,1}?)n([\W]{0,2}?)o([\W]{0,2}?)t/ //slow
|
|
1808
|
+
condition:
|
|
1809
|
+
any of them
|
|
1810
|
+
}
|
|
1811
|
+
|
|
1812
|
+
|
|
1813
|
+
rule suspicious_obfuscation_info_Trailer_to_access_blocks {
|
|
1814
|
+
meta:
|
|
1815
|
+
is_exploit = false
|
|
1816
|
+
is_warning = true
|
|
1817
|
+
is_feature = false
|
|
1818
|
+
rank = 1
|
|
1819
|
+
revision = "1"
|
|
1820
|
+
date = "June 07 2020"
|
|
1821
|
+
author = "@tylabs"
|
|
1822
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1823
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1824
|
+
desc = "suspicious.obfuscation info.Trailer to access blocks"
|
|
1825
|
+
mitre = "T1059.007"
|
|
1826
|
+
strings:
|
|
1827
|
+
$h_reg1 = /info([\W]{0,4}?)\.([\W]{0,4}?)Trailer/
|
|
1828
|
+
condition:
|
|
1829
|
+
any of them
|
|
1830
|
+
}
|
|
1831
|
+
|
|
1832
|
+
|
|
1833
|
+
rule suspicious_obfuscation_using_app_setTimeOut_to_eval_code {
|
|
1834
|
+
meta:
|
|
1835
|
+
is_exploit = false
|
|
1836
|
+
is_warning = true
|
|
1837
|
+
is_feature = false
|
|
1838
|
+
rank = 1
|
|
1839
|
+
revision = "1"
|
|
1840
|
+
date = "June 07 2020"
|
|
1841
|
+
author = "@tylabs"
|
|
1842
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1843
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1844
|
+
desc = "suspicious.obfuscation using app.setTimeOut to eval code"
|
|
1845
|
+
mitre = "T1059.007"
|
|
1846
|
+
strings:
|
|
1847
|
+
$h_raw1 = "app.setTimeOut" nocase
|
|
1848
|
+
condition:
|
|
1849
|
+
any of them
|
|
1850
|
+
}
|
|
1851
|
+
|
|
1852
|
+
|
|
1853
|
+
rule suspicious_string__shellcode_ {
|
|
1854
|
+
meta:
|
|
1855
|
+
is_exploit = false
|
|
1856
|
+
is_warning = true
|
|
1857
|
+
is_feature = false
|
|
1858
|
+
rank = 1
|
|
1859
|
+
revision = "1"
|
|
1860
|
+
date = "June 07 2020"
|
|
1861
|
+
author = "@tylabs"
|
|
1862
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1863
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1864
|
+
desc = "suspicious.string -shellcode-"
|
|
1865
|
+
mitre = "T1027 T1059.007"
|
|
1866
|
+
strings:
|
|
1867
|
+
$h_raw1 = "var shellcode" nocase
|
|
1868
|
+
condition:
|
|
1869
|
+
any of them
|
|
1870
|
+
}
|
|
1871
|
+
|
|
1872
|
+
|
|
1873
|
+
rule pdf_exploit_Collab_collectEmailInfo_CVE_2008_0655 {
|
|
1874
|
+
meta:
|
|
1875
|
+
is_exploit = true
|
|
1876
|
+
is_warning = false
|
|
1877
|
+
is_feature = false
|
|
1878
|
+
rank = 5
|
|
1879
|
+
revision = "1"
|
|
1880
|
+
date = "June 07 2020"
|
|
1881
|
+
author = "@tylabs"
|
|
1882
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1883
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1884
|
+
desc = "pdf.exploit Collab.collectEmailInfo CVE-2008-0655"
|
|
1885
|
+
mitre = "T1203 T1204.002"
|
|
1886
|
+
strings:
|
|
1887
|
+
$h_reg1 = /Collabb([\W]{0,6}?).([\W]{0,6}?)collectEmailInfo/
|
|
1888
|
+
$h_raw2 = "CollabcollectEmailInfo" nocase
|
|
1889
|
+
$h_raw3 = "Collab.collectEmailInfo" nocase
|
|
1890
|
+
condition:
|
|
1891
|
+
any of them
|
|
1892
|
+
}
|
|
1893
|
+
|
|
1894
|
+
|
|
1895
|
+
rule pdf_exploit_Collab_getIcon_CVE_2009_0927 {
|
|
1896
|
+
meta:
|
|
1897
|
+
is_exploit = true
|
|
1898
|
+
is_warning = false
|
|
1899
|
+
is_feature = false
|
|
1900
|
+
rank = 5
|
|
1901
|
+
revision = "1"
|
|
1902
|
+
date = "June 07 2020"
|
|
1903
|
+
author = "@tylabs"
|
|
1904
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1905
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1906
|
+
desc = "pdf.exploit Collab.getIcon CVE-2009-0927"
|
|
1907
|
+
mitre = "T1203 T1204.002"
|
|
1908
|
+
strings:
|
|
1909
|
+
$h_reg1 = /Collab([\W]{0,6}?).([\W]{0,6}?)getIcon/
|
|
1910
|
+
$h_reg2 = /Collab.get(.{1,24}?)Icon/
|
|
1911
|
+
$h_raw3 = "Collab.getIcon" nocase
|
|
1912
|
+
condition:
|
|
1913
|
+
any of them
|
|
1914
|
+
}
|
|
1915
|
+
|
|
1916
|
+
|
|
1917
|
+
rule pdf_suspicious_util_printd_used_to_fill_buffers {
|
|
1918
|
+
meta:
|
|
1919
|
+
is_exploit = false
|
|
1920
|
+
is_warning = true
|
|
1921
|
+
is_feature = false
|
|
1922
|
+
rank = 1
|
|
1923
|
+
revision = "1"
|
|
1924
|
+
date = "June 07 2020"
|
|
1925
|
+
author = "@tylabs"
|
|
1926
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1927
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1928
|
+
desc = "pdf.suspicious util.printd used to fill buffers"
|
|
1929
|
+
mitre = "T1027 T1059.007"
|
|
1930
|
+
strings:
|
|
1931
|
+
$h_raw1 = "util.printd" nocase
|
|
1932
|
+
condition:
|
|
1933
|
+
any of them
|
|
1934
|
+
}
|
|
1935
|
+
|
|
1936
|
+
|
|
1937
|
+
rule pdf_exploit_media_newPlayer_CVE_2009_4324 {
|
|
1938
|
+
meta:
|
|
1939
|
+
is_exploit = true
|
|
1940
|
+
is_warning = false
|
|
1941
|
+
is_feature = false
|
|
1942
|
+
rank = 5
|
|
1943
|
+
revision = "1"
|
|
1944
|
+
date = "June 07 2020"
|
|
1945
|
+
author = "@tylabs"
|
|
1946
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1947
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1948
|
+
desc = "pdf.exploit media.newPlayer CVE-2009-4324"
|
|
1949
|
+
mitre = "T1203 T1204.002"
|
|
1950
|
+
strings:
|
|
1951
|
+
$h_reg1 = /med(.{1,24}?)ia(.{1,24}?)new(.{1,24}?)Play(.{1,24}?)er/
|
|
1952
|
+
$h_reg2 = /med(.{1,24}?)ia(.{1,24}?)newPlay(.{1,24}?)er/
|
|
1953
|
+
$h_reg3 = /me(.{1,24}?)dia\.(.{1,24}?)new(.{1,24}?)Play(.{1,24}?)er/
|
|
1954
|
+
$h_reg4 = /mediaa([\W]{0,6}?)newPlayer/
|
|
1955
|
+
$h_reg5 = /media(.{1,24}?)newPlayer/
|
|
1956
|
+
$h_raw6 = "media.newPlayer" nocase
|
|
1957
|
+
condition:
|
|
1958
|
+
any of them
|
|
1959
|
+
}
|
|
1960
|
+
|
|
1961
|
+
|
|
1962
|
+
rule pdf_exploit_spell_customDictionaryOpen_CVE_2009_1493 {
|
|
1963
|
+
meta:
|
|
1964
|
+
is_exploit = true
|
|
1965
|
+
is_warning = false
|
|
1966
|
+
is_feature = false
|
|
1967
|
+
rank = 5
|
|
1968
|
+
revision = "1"
|
|
1969
|
+
date = "June 07 2020"
|
|
1970
|
+
author = "@tylabs"
|
|
1971
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1972
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1973
|
+
desc = "pdf.exploit spell.customDictionaryOpen CVE-2009-1493"
|
|
1974
|
+
mitre = "T1203 T1204.002"
|
|
1975
|
+
strings:
|
|
1976
|
+
$h_reg1 = /spell(.{1,24}?)customDictionaryOpen/
|
|
1977
|
+
$h_raw2 = "spell.customDictionaryOpen" nocase
|
|
1978
|
+
condition:
|
|
1979
|
+
any of them
|
|
1980
|
+
}
|
|
1981
|
+
|
|
1982
|
+
|
|
1983
|
+
rule pdf_exploit_util_printf_CVE_2008_2992 {
|
|
1984
|
+
meta:
|
|
1985
|
+
is_exploit = true
|
|
1986
|
+
is_warning = false
|
|
1987
|
+
is_feature = false
|
|
1988
|
+
rank = 5
|
|
1989
|
+
revision = "1"
|
|
1990
|
+
date = "June 07 2020"
|
|
1991
|
+
author = "@tylabs"
|
|
1992
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
1993
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
1994
|
+
desc = "pdf.exploit util.printf CVE-2008-2992"
|
|
1995
|
+
mitre = "T1203 T1204.002"
|
|
1996
|
+
strings:
|
|
1997
|
+
$h_reg1 = /util(.{1,24}?)printf(.{1,24}?)45000f/
|
|
1998
|
+
condition:
|
|
1999
|
+
any of them
|
|
2000
|
+
}
|
|
2001
|
+
|
|
2002
|
+
|
|
2003
|
+
rule pdf_exploit_using_TIFF_overflow_CVE_2010_0188 {
|
|
2004
|
+
meta:
|
|
2005
|
+
is_exploit = true
|
|
2006
|
+
is_warning = false
|
|
2007
|
+
is_feature = false
|
|
2008
|
+
rank = 5
|
|
2009
|
+
revision = "1"
|
|
2010
|
+
date = "June 07 2020"
|
|
2011
|
+
author = "@tylabs"
|
|
2012
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2013
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2014
|
+
desc = "pdf.exploit using TIFF overflow CVE-2010-0188"
|
|
2015
|
+
mitre = "T1203 T1204.002"
|
|
2016
|
+
strings:
|
|
2017
|
+
$h_reg1 = /contentType=(.{0,6}?)image\/(.{0,30}?)CQkJCQkJCQkJCQkJCQkJCQkJ/
|
|
2018
|
+
$h_raw2 = "kJCQ,kJCQ,kJCQ,kJCQ,kJCQ,kJCQ" nocase
|
|
2019
|
+
condition:
|
|
2020
|
+
any of them
|
|
2021
|
+
}
|
|
2022
|
+
|
|
2023
|
+
|
|
2024
|
+
rule suspicious_string_TIFF_overflow_exploit_tif_name_CVE_2010_0188 {
|
|
2025
|
+
meta:
|
|
2026
|
+
is_exploit = true
|
|
2027
|
+
is_warning = false
|
|
2028
|
+
is_feature = false
|
|
2029
|
+
rank = 5
|
|
2030
|
+
revision = "1"
|
|
2031
|
+
date = "June 07 2020"
|
|
2032
|
+
author = "@tylabs"
|
|
2033
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2034
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2035
|
+
desc = "suspicious.string TIFF overflow exploit.tif name CVE-2010-0188"
|
|
2036
|
+
mitre = "T1203 T1204.002"
|
|
2037
|
+
strings:
|
|
2038
|
+
$h_raw1 = "exploit.tif" nocase
|
|
2039
|
+
condition:
|
|
2040
|
+
any of them
|
|
2041
|
+
}
|
|
2042
|
+
|
|
2043
|
+
|
|
2044
|
+
rule suspicious_string_base_64_nop_sled_used_in_TIFF_overflow_CVE_2010_0188 {
|
|
2045
|
+
meta:
|
|
2046
|
+
is_exploit = true
|
|
2047
|
+
is_warning = false
|
|
2048
|
+
is_feature = false
|
|
2049
|
+
rank = 5
|
|
2050
|
+
revision = "1"
|
|
2051
|
+
date = "June 07 2020"
|
|
2052
|
+
author = "@tylabs"
|
|
2053
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2054
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2055
|
+
desc = "suspicious.string base 64 nop sled used in TIFF overflow CVE-2010-0188"
|
|
2056
|
+
mitre = "T1203 T1204.002"
|
|
2057
|
+
strings:
|
|
2058
|
+
$h_raw1 = "JCQkJCQkJCQkJCQkJCQkJCQkJCQk" nocase
|
|
2059
|
+
$h_raw2 = "TU0AKgAAIDgMkAyQDJAMkAyQDJAMk" nocase
|
|
2060
|
+
$h_hex3 = { 4A [1-2] 43 [1-2] 51 [1-2] 6B [1-2] 4A [1-2] 43 [1-2] 51 [1-2] 6B}
|
|
2061
|
+
//$h_reg3 = /J.{1,2}?C.{1,2}?Q.{1,2}?k.{1,2}?J.{1,2}?C.{1,2}?Q.{1,2}?k.{1,2}?J.{1,2}?C.{1,2}?Q.{1,2}?k/ //slow
|
|
2062
|
+
$h_raw4 = "+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4" nocase
|
|
2063
|
+
condition:
|
|
2064
|
+
any of them
|
|
2065
|
+
}
|
|
2066
|
+
|
|
2067
|
+
|
|
2068
|
+
rule pdf_exploit_TIFF_overflow_CVE_2010_0188 {
|
|
2069
|
+
meta:
|
|
2070
|
+
is_exploit = true
|
|
2071
|
+
is_warning = false
|
|
2072
|
+
is_feature = false
|
|
2073
|
+
rank = 5
|
|
2074
|
+
revision = "1"
|
|
2075
|
+
date = "June 07 2020"
|
|
2076
|
+
author = "@tylabs"
|
|
2077
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2078
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2079
|
+
desc = "pdf.exploit TIFF overflow CVE-2010-0188"
|
|
2080
|
+
mitre = "T1203 T1204.002"
|
|
2081
|
+
strings:
|
|
2082
|
+
$h_reg1 = /ImageField1(.{0,6}?)xfa:contentType=(.{0,6}?)image\/tif/
|
|
2083
|
+
$h_hex2 = {BB1500070003FE7FB27F0007BB15000711000100ACA80007BB15000700010100ACA80007F772000711000100E2520007545C0007FFFFFFFF000101000000000004010100001000004000000031D70007BB1500075A526A024D15000722A70007BB15000758CD2E3C4D15000722A70007BB150007055A74F44D15000722A70007BB150007B849492A4D15000722A70007BB150007008BFAAF4D15000722A70007BB15000775EA87FE4D15000722A70007BB150007EB0A5FB94D15000722A70007BB150007}
|
|
2084
|
+
condition:
|
|
2085
|
+
any of them
|
|
2086
|
+
}
|
|
2087
|
+
|
|
2088
|
+
|
|
2089
|
+
rule pdf_execute_access_system32_directory {
|
|
2090
|
+
meta:
|
|
2091
|
+
is_exploit = false
|
|
2092
|
+
is_warning = true
|
|
2093
|
+
is_feature = false
|
|
2094
|
+
rank = 1
|
|
2095
|
+
revision = "1"
|
|
2096
|
+
date = "June 07 2020"
|
|
2097
|
+
author = "@tylabs"
|
|
2098
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2099
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2100
|
+
desc = "pdf.execute access system32 directory"
|
|
2101
|
+
mitre = "T1203 T1204.002"
|
|
2102
|
+
strings:
|
|
2103
|
+
$h_reg1 = /\/(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|6e)(.{0,36}?)system32/
|
|
2104
|
+
condition:
|
|
2105
|
+
any of them
|
|
2106
|
+
}
|
|
2107
|
+
|
|
2108
|
+
|
|
2109
|
+
rule suspicious_string_obfuscated_unicode_NOP_sled {
|
|
2110
|
+
meta:
|
|
2111
|
+
is_exploit = false
|
|
2112
|
+
is_warning = true
|
|
2113
|
+
is_feature = false
|
|
2114
|
+
rank = 1
|
|
2115
|
+
revision = "1"
|
|
2116
|
+
date = "June 07 2020"
|
|
2117
|
+
author = "@tylabs"
|
|
2118
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2119
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2120
|
+
desc = "suspicious.string obfuscated unicode NOP sled"
|
|
2121
|
+
mitre = "T1027"
|
|
2122
|
+
strings:
|
|
2123
|
+
$h_raw1 = "M9090M9090M9090M9090" nocase
|
|
2124
|
+
condition:
|
|
2125
|
+
any of them
|
|
2126
|
+
}
|
|
2127
|
+
|
|
2128
|
+
|
|
2129
|
+
rule suspicious_flash_Embedded_Flash {
|
|
2130
|
+
meta:
|
|
2131
|
+
is_exploit = false
|
|
2132
|
+
is_warning = true
|
|
2133
|
+
is_feature = false
|
|
2134
|
+
rank = 1
|
|
2135
|
+
revision = "1"
|
|
2136
|
+
date = "June 07 2020"
|
|
2137
|
+
author = "@tylabs"
|
|
2138
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2139
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2140
|
+
desc = "suspicious.flash Embedded Flash"
|
|
2141
|
+
strings:
|
|
2142
|
+
$h_reg1 = /^FWS/
|
|
2143
|
+
$h_reg2 = /^CWS/
|
|
2144
|
+
$h_reg3 = /^SWF/
|
|
2145
|
+
$h_hex4 = {0D0A43575309A2D20000789CECBD797C54}
|
|
2146
|
+
$h_reg5 = /\x0aFWS/
|
|
2147
|
+
$h_reg6 = /\x0aCWS/
|
|
2148
|
+
$h_reg7 = /\x0aSWF/
|
|
2149
|
+
|
|
2150
|
+
condition:
|
|
2151
|
+
any of them
|
|
2152
|
+
}
|
|
2153
|
+
|
|
2154
|
+
|
|
2155
|
+
rule suspicious_flash_Embedded_Flash_define_obj {
|
|
2156
|
+
meta:
|
|
2157
|
+
is_exploit = false
|
|
2158
|
+
is_warning = true
|
|
2159
|
+
is_feature = false
|
|
2160
|
+
rank = 1
|
|
2161
|
+
revision = "1"
|
|
2162
|
+
date = "June 07 2020"
|
|
2163
|
+
author = "@tylabs"
|
|
2164
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2165
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2166
|
+
desc = "suspicious.flash Embedded Flash define obj"
|
|
2167
|
+
mitre = "T1204.002"
|
|
2168
|
+
strings:
|
|
2169
|
+
$h_raw1 = "application#2Fx-shockwave-flash" nocase
|
|
2170
|
+
$h_raw2 = "application/x-shockwave-flash" nocase
|
|
2171
|
+
condition:
|
|
2172
|
+
any of them
|
|
2173
|
+
}
|
|
2174
|
+
|
|
2175
|
+
|
|
2176
|
+
rule pdf_exploit_fontfile_SING_table_overflow_CVE_2010_2883_generic {
|
|
2177
|
+
meta:
|
|
2178
|
+
is_exploit = true
|
|
2179
|
+
is_warning = false
|
|
2180
|
+
is_feature = false
|
|
2181
|
+
rank = 5
|
|
2182
|
+
revision = "1"
|
|
2183
|
+
date = "June 07 2020"
|
|
2184
|
+
author = "@tylabs"
|
|
2185
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2186
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2187
|
+
desc = "pdf.exploit fontfile SING table overflow CVE-2010-2883 generic"
|
|
2188
|
+
mitre = "T1203 T1204.002"
|
|
2189
|
+
strings:
|
|
2190
|
+
$h_reg1 = "SING" nocase
|
|
2191
|
+
$h_hex2 = { 41414141414141414141 }
|
|
2192
|
+
condition: $h_reg1 in (0..400) and $h_hex2 in (0..500)
|
|
2193
|
+
}
|
|
2194
|
+
|
|
2195
|
+
|
|
2196
|
+
rule pdf_exploit_fontfile_SING_table_overflow_CVE_2010_2883_A {
|
|
2197
|
+
meta:
|
|
2198
|
+
is_exploit = true
|
|
2199
|
+
is_warning = false
|
|
2200
|
+
is_feature = false
|
|
2201
|
+
rank = 5
|
|
2202
|
+
revision = "1"
|
|
2203
|
+
date = "June 07 2020"
|
|
2204
|
+
author = "@tylabs"
|
|
2205
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2206
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2207
|
+
desc = "pdf.exploit fontfile SING table overflow CVE-2010-2883 A"
|
|
2208
|
+
mitre = "T1203 T1204.002"
|
|
2209
|
+
strings:
|
|
2210
|
+
$h_hex1 = {1045086F0000EB4C00000024686D747809C68EB20000B4C4000004306B65726EDC52D5990000BDA000002D8A6C6F6361F3CBD23D0000BB840000021A6D6178700547063A0000EB2C0000002053494E47D9BCC8B50000011C00001DDF706F7374B45A2FBB0000B8F40000028E70726570}
|
|
2211
|
+
condition:
|
|
2212
|
+
any of them
|
|
2213
|
+
}
|
|
2214
|
+
|
|
2215
|
+
|
|
2216
|
+
rule flash_exploit_CVE_2011_0609 {
|
|
2217
|
+
meta:
|
|
2218
|
+
is_exploit = true
|
|
2219
|
+
is_warning = false
|
|
2220
|
+
is_feature = false
|
|
2221
|
+
rank = 5
|
|
2222
|
+
revision = "1"
|
|
2223
|
+
date = "June 07 2020"
|
|
2224
|
+
author = "@tylabs"
|
|
2225
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2226
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2227
|
+
desc = "flash.exploit CVE-2011-0609"
|
|
2228
|
+
mitre = "T1203 T1204.002"
|
|
2229
|
+
strings:
|
|
2230
|
+
$h_hex1 = {4657530947CB0000480140005A0000190100441108000000BF141CCB0000000000000010002E00060080804094A8D0A001808004100002000000121212E24130F00931343134313431343134313431343134313431343134313431343134313431343134313431343134313431343134313431343134}
|
|
2231
|
+
$h_hex2 = {34363537353330394541433730303030373830303036343030303030304338303030303032443031303034343131313830303030303034333032463446344634383630363036303230303031303030304646303931303030303030303033303030313030383630363036303130303032303030303430303030303030424631313235}
|
|
2232
|
+
$h_hex3 = {3941303139413031394130313941303139064C6F61646572}
|
|
2233
|
+
condition:
|
|
2234
|
+
any of them
|
|
2235
|
+
}
|
|
2236
|
+
|
|
2237
|
+
|
|
2238
|
+
rule flash_exploit_CVE_2011_0611 {
|
|
2239
|
+
meta:
|
|
2240
|
+
is_exploit = true
|
|
2241
|
+
is_warning = false
|
|
2242
|
+
is_feature = false
|
|
2243
|
+
rank = 5
|
|
2244
|
+
revision = "1"
|
|
2245
|
+
date = "June 07 2020"
|
|
2246
|
+
author = "@tylabs"
|
|
2247
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2248
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2249
|
+
desc = "flash.exploit CVE-2011-0611"
|
|
2250
|
+
mitre = "T1203 T1204.002"
|
|
2251
|
+
strings:
|
|
2252
|
+
$h_hex1 = {7772697465427974650541727261799817343635373533304143433035303030303738}
|
|
2253
|
+
$h_hex2 = {5131645443737746414142346E453155625778545A52512B743733742B3362744B4E30596E617767552F414452654D5848334777597276757737597A643743674A734A6C76643174374E716D393959576D4B676B5A7674686C68446942556E344D694645453030514659306D456F664A2B4F45504D55594E6F69614C526D4E696A4D45494444665065652B3139663534652B35356E764F63383578376532766732514551504148514C6B45384248683175303937414B7741654943394F6A336579756277574E52793141564A475939326D4777444832794278794147636569424250524348}
|
|
2254
|
+
$h_hex3 = {343635373533304143433035303030303738303030353546303030303046413030303030313830313030343431313030303030303030334630334137303530303030393630433030303530303037393543333743313330374642433337433133304531323944303230303443303439443032303031383030383831353030303930303431}
|
|
2255
|
+
$h_hex4 = {3063306330633063306330633063306306537472696E6706}
|
|
2256
|
+
$h_hex5 = {410042004300440045004600470048004900A18E110064656661756C74}
|
|
2257
|
+
$h_hex6 = {00414243444500566B6475686752656D686677317375727772777C73680064656661756C740067657453697A650047647768317375727772777C73680077777273757277}
|
|
2258
|
+
$h_raw7 = "AAB4AAVfAAAPoAAAGAEARBEAAAAAPwOnBQAAlgwABQAHlcN8Ewf7w3wTDhKdAgBMBJ0CABgAiBUACQBBAEIAQwBEAEUARgBHAEgASQChjhEAZGVmYXVsdAABAAQqAAIAmAGWCgAHWMBJSAenP7a3YJ0CAAAAmQIASQBAlgUABxZ0cAtMYp0CAAwAhwEAAxeHAQABlgoAB" nocase
|
|
2259
|
+
condition:
|
|
2260
|
+
any of them
|
|
2261
|
+
}
|
|
2262
|
+
|
|
2263
|
+
|
|
2264
|
+
rule flash_suspicious_jit_spray {
|
|
2265
|
+
meta:
|
|
2266
|
+
is_exploit = false
|
|
2267
|
+
is_warning = true
|
|
2268
|
+
is_feature = false
|
|
2269
|
+
rank = 1
|
|
2270
|
+
revision = "1"
|
|
2271
|
+
date = "June 07 2020"
|
|
2272
|
+
author = "@tylabs"
|
|
2273
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2274
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2275
|
+
desc = "flash.suspicious jit_spray"
|
|
2276
|
+
mitre = "T1027 T1059.007"
|
|
2277
|
+
strings:
|
|
2278
|
+
$h_hex1 = {076A69745F65676708}
|
|
2279
|
+
condition:
|
|
2280
|
+
any of them
|
|
2281
|
+
}
|
|
2282
|
+
|
|
2283
|
+
|
|
2284
|
+
rule pdf_exploit_U3D_CVE_2011_2462_A {
|
|
2285
|
+
meta:
|
|
2286
|
+
is_exploit = true
|
|
2287
|
+
is_warning = false
|
|
2288
|
+
is_feature = false
|
|
2289
|
+
rank = 5
|
|
2290
|
+
revision = "1"
|
|
2291
|
+
date = "June 07 2020"
|
|
2292
|
+
author = "@tylabs"
|
|
2293
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2294
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2295
|
+
desc = "pdf.exploit U3D CVE-2011-2462 A"
|
|
2296
|
+
mitre = "T1203 T1204.002"
|
|
2297
|
+
strings:
|
|
2298
|
+
$h_hex1 = {066F3A40AE366A4360DFCBEF8C38CA0492794B79E942BD2BB95B866065A4750119DACF6AF72A773CDEF1117533D394744A14734B18A166C20FDE3DED19D4322E}
|
|
2299
|
+
condition:
|
|
2300
|
+
any of them
|
|
2301
|
+
}
|
|
2302
|
+
|
|
2303
|
+
|
|
2304
|
+
rule pdf_exploit_PRC_CVE_2011_4369_A {
|
|
2305
|
+
meta:
|
|
2306
|
+
is_exploit = true
|
|
2307
|
+
is_warning = false
|
|
2308
|
+
is_feature = false
|
|
2309
|
+
rank = 5
|
|
2310
|
+
revision = "1"
|
|
2311
|
+
date = "June 07 2020"
|
|
2312
|
+
author = "@tylabs"
|
|
2313
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2314
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2315
|
+
desc = "pdf.exploit PRC CVE-2011-4369 A"
|
|
2316
|
+
mitre = "T1203 T1204.002"
|
|
2317
|
+
strings:
|
|
2318
|
+
$h_hex1 = {ED7C7938945DF8FF9985868677108DA58C922C612A516FA9D182374A8B868AA25284242D8A3296B497B74849D2A210D14EA94654A2452ACA2B29D18268A5B7C5EF7E}
|
|
2319
|
+
condition:
|
|
2320
|
+
any of them
|
|
2321
|
+
}
|
|
2322
|
+
|
|
2323
|
+
|
|
2324
|
+
rule flash_exploit_flash_calling_malformed_MP4_CVE_2012_0754 {
|
|
2325
|
+
meta:
|
|
2326
|
+
is_exploit = true
|
|
2327
|
+
is_warning = false
|
|
2328
|
+
is_feature = false
|
|
2329
|
+
rank = 5
|
|
2330
|
+
revision = "1"
|
|
2331
|
+
date = "June 07 2020"
|
|
2332
|
+
author = "@tylabs"
|
|
2333
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2334
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2335
|
+
desc = "flash.exploit flash calling malformed MP4 CVE-2012-0754"
|
|
2336
|
+
mitre = "T1203 T1204.002"
|
|
2337
|
+
strings:
|
|
2338
|
+
$h_hex1 = {537472696E6706586D6C537766094D6F766965436C6970076A69745F656767086368696C645265660D446973706C61794F626A656374074D79566964656F05566964656F044D794E430D4E6574436F6E6E656374696F6E}
|
|
2339
|
+
condition:
|
|
2340
|
+
any of them
|
|
2341
|
+
}
|
|
2342
|
+
|
|
2343
|
+
|
|
2344
|
+
rule flash_exploit_MP4_Loader_CVE_2012_0754_B {
|
|
2345
|
+
meta:
|
|
2346
|
+
is_exploit = true
|
|
2347
|
+
is_warning = false
|
|
2348
|
+
is_feature = false
|
|
2349
|
+
rank = 5
|
|
2350
|
+
revision = "1"
|
|
2351
|
+
date = "June 07 2020"
|
|
2352
|
+
author = "@tylabs"
|
|
2353
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2354
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2355
|
+
desc = "flash.exploit MP4 Loader CVE-2012-0754 B"
|
|
2356
|
+
mitre = "T1203 T1204.002"
|
|
2357
|
+
strings:
|
|
2358
|
+
$h_hex1 = {6D703405566964656F0A6E6574436F6E6E6563740D4E6574436F6E6E656374696F6E096E657453747265616D094E657453747265616D}
|
|
2359
|
+
condition:
|
|
2360
|
+
any of them
|
|
2361
|
+
}
|
|
2362
|
+
|
|
2363
|
+
|
|
2364
|
+
rule flash_exploit_MP4_CVE_2012_0754 {
|
|
2365
|
+
meta:
|
|
2366
|
+
is_exploit = true
|
|
2367
|
+
is_warning = false
|
|
2368
|
+
is_feature = false
|
|
2369
|
+
rank = 5
|
|
2370
|
+
revision = "1"
|
|
2371
|
+
date = "June 07 2020"
|
|
2372
|
+
author = "@tylabs"
|
|
2373
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2374
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2375
|
+
desc = "flash.exploit MP4 CVE-2012-0754"
|
|
2376
|
+
mitre = "T1203 T1204.002"
|
|
2377
|
+
strings:
|
|
2378
|
+
$h_hex1 = {6D70343269736F6D000000246D646174018080800E1180808009029F0F808080020001C0101281302A056DC00000000D63707274}
|
|
2379
|
+
condition:
|
|
2380
|
+
any of them
|
|
2381
|
+
}
|
|
2382
|
+
|
|
2383
|
+
|
|
2384
|
+
rule pdf_exploit_Sandbox_Bypass_CVE_2013_0641 {
|
|
2385
|
+
meta:
|
|
2386
|
+
is_exploit = true
|
|
2387
|
+
is_warning = false
|
|
2388
|
+
is_feature = false
|
|
2389
|
+
rank = 5
|
|
2390
|
+
revision = "1"
|
|
2391
|
+
date = "June 07 2020"
|
|
2392
|
+
author = "@tylabs"
|
|
2393
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2394
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2395
|
+
desc = "pdf.exploit Sandbox Bypass CVE-2013-0641"
|
|
2396
|
+
mitre = "T1203 T1204.002"
|
|
2397
|
+
strings:
|
|
2398
|
+
$h_reg1 = /push(.{1,5}?)xfa.datasets.createNode(.{1,5}?)dataValue/
|
|
2399
|
+
condition:
|
|
2400
|
+
any of them
|
|
2401
|
+
}
|
|
2402
|
+
|
|
2403
|
+
|
|
2404
|
+
rule pdf_exploit_BMP_RLE_integer_heap_overflow_CVE_2013_2729 {
|
|
2405
|
+
meta:
|
|
2406
|
+
is_exploit = true
|
|
2407
|
+
is_warning = false
|
|
2408
|
+
is_feature = false
|
|
2409
|
+
rank = 5
|
|
2410
|
+
revision = "1"
|
|
2411
|
+
date = "June 07 2020"
|
|
2412
|
+
author = "@tylabs"
|
|
2413
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2414
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2415
|
+
desc = "pdf.exploit BMP RLE integer heap overflow CVE-2013-2729"
|
|
2416
|
+
mitre = "T1203 T1204.002"
|
|
2417
|
+
strings:
|
|
2418
|
+
$h_reg1 = /image.jpeg(.{1,5}?)Qk0AAAAAAAAAAAAAAABAAAAALAEAAAEAAAABAAgAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAUkdC/
|
|
2419
|
+
$h_raw2 = "<image>Qk0AAAAAAAAAAAAAAABAAAAALAEAAAEAAAABAAgAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAUkdC" nocase
|
|
2420
|
+
condition:
|
|
2421
|
+
any of them
|
|
2422
|
+
}
|
|
2423
|
+
|
|
2424
|
+
|
|
2425
|
+
rule pdf_exploit_ToolButton_use_after_free_CVE_2014_0496 {
|
|
2426
|
+
meta:
|
|
2427
|
+
is_exploit = true
|
|
2428
|
+
is_warning = false
|
|
2429
|
+
is_feature = false
|
|
2430
|
+
rank = 5
|
|
2431
|
+
revision = "1"
|
|
2432
|
+
date = "June 07 2020"
|
|
2433
|
+
author = "@tylabs"
|
|
2434
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2435
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2436
|
+
desc = "pdf.exploit ToolButton use-after-free CVE-2014-0496"
|
|
2437
|
+
mitre = "T1203 T1204.002"
|
|
2438
|
+
strings:
|
|
2439
|
+
$h_reg1 = /function(.{1,24}?)app.addToolButton/
|
|
2440
|
+
$h_reg2 = /function(.{1,24}?)app.removeToolButton/
|
|
2441
|
+
condition:
|
|
2442
|
+
any of them
|
|
2443
|
+
}
|
|
2444
|
+
|
|
2445
|
+
|
|
2446
|
+
rule suspicious_javascript_addToolButton {
|
|
2447
|
+
meta:
|
|
2448
|
+
is_exploit = false
|
|
2449
|
+
is_warning = true
|
|
2450
|
+
is_feature = false
|
|
2451
|
+
rank = 1
|
|
2452
|
+
revision = "1"
|
|
2453
|
+
date = "June 07 2020"
|
|
2454
|
+
author = "@tylabs"
|
|
2455
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2456
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2457
|
+
desc = "suspicious.javascript addToolButton"
|
|
2458
|
+
mitre = "T1059.007"
|
|
2459
|
+
strings:
|
|
2460
|
+
$h_raw1 = "app.addToolButton" nocase
|
|
2461
|
+
condition:
|
|
2462
|
+
any of them
|
|
2463
|
+
}
|
|
2464
|
+
|
|
2465
|
+
|
|
2466
|
+
rule suspicious_embedded_doc_file {
|
|
2467
|
+
meta:
|
|
2468
|
+
is_exploit = false
|
|
2469
|
+
is_warning = true
|
|
2470
|
+
is_feature = false
|
|
2471
|
+
rank = 1
|
|
2472
|
+
revision = "1"
|
|
2473
|
+
date = "June 07 2020"
|
|
2474
|
+
author = "@tylabs"
|
|
2475
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2476
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2477
|
+
desc = "suspicious.embedded doc file"
|
|
2478
|
+
mitre = "T1204.002"
|
|
2479
|
+
strings:
|
|
2480
|
+
$h_reg1 = /\/Type\/Filespec\/F(.{1,30}?)\.doc/
|
|
2481
|
+
condition:
|
|
2482
|
+
any of them
|
|
2483
|
+
}
|
|
2484
|
+
|
|
2485
|
+
|
|
2486
|
+
rule suspicious_embedded_xls_file {
|
|
2487
|
+
meta:
|
|
2488
|
+
is_exploit = false
|
|
2489
|
+
is_warning = true
|
|
2490
|
+
is_feature = false
|
|
2491
|
+
rank = 1
|
|
2492
|
+
revision = "1"
|
|
2493
|
+
date = "June 07 2020"
|
|
2494
|
+
author = "@tylabs"
|
|
2495
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2496
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2497
|
+
desc = "suspicious.embedded xls file"
|
|
2498
|
+
mitre = "T1204.002"
|
|
2499
|
+
strings:
|
|
2500
|
+
$h_reg1 = /\/Type\/Filespec\/F(.{1,30}?)\.xls/
|
|
2501
|
+
condition:
|
|
2502
|
+
any of them
|
|
2503
|
+
}
|
|
2504
|
+
|
|
2505
|
+
|
|
2506
|
+
rule suspicious_embedded_ppt_file {
|
|
2507
|
+
meta:
|
|
2508
|
+
is_exploit = false
|
|
2509
|
+
is_warning = true
|
|
2510
|
+
is_feature = false
|
|
2511
|
+
rank = 1
|
|
2512
|
+
revision = "1"
|
|
2513
|
+
date = "June 07 2020"
|
|
2514
|
+
author = "@tylabs"
|
|
2515
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2516
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2517
|
+
desc = "suspicious.embedded ppt file"
|
|
2518
|
+
mitre = "T1204.002"
|
|
2519
|
+
strings:
|
|
2520
|
+
$h_reg1 = /\/Type\/Filespec\/F(.{1,30}?)\.ppt/
|
|
2521
|
+
$h_reg2 = /\/Type\/Filespec\/F(.{1,30}?)\.pps/
|
|
2522
|
+
condition:
|
|
2523
|
+
any of them
|
|
2524
|
+
}
|
|
2525
|
+
|
|
2526
|
+
|
|
2527
|
+
rule suspicious_embedded_scr_file {
|
|
2528
|
+
meta:
|
|
2529
|
+
is_exploit = false
|
|
2530
|
+
is_warning = true
|
|
2531
|
+
is_feature = false
|
|
2532
|
+
rank = 1
|
|
2533
|
+
revision = "1"
|
|
2534
|
+
date = "June 07 2020"
|
|
2535
|
+
author = "@tylabs"
|
|
2536
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2537
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2538
|
+
desc = "suspicious.embedded scr file"
|
|
2539
|
+
mitre = "T1204.002"
|
|
2540
|
+
strings:
|
|
2541
|
+
$h_reg1 = /\/Type\/Filespec\/F(.{1,30}?)\.scr/
|
|
2542
|
+
condition:
|
|
2543
|
+
any of them
|
|
2544
|
+
}
|
|
2545
|
+
|
|
2546
|
+
|
|
2547
|
+
rule suspicious_embedded_exe_file {
|
|
2548
|
+
meta:
|
|
2549
|
+
is_exploit = false
|
|
2550
|
+
is_warning = true
|
|
2551
|
+
is_feature = false
|
|
2552
|
+
rank = 1
|
|
2553
|
+
revision = "1"
|
|
2554
|
+
date = "June 07 2020"
|
|
2555
|
+
author = "@tylabs"
|
|
2556
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2557
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2558
|
+
desc = "suspicious.embedded exe file"
|
|
2559
|
+
mitre = "T1204.002"
|
|
2560
|
+
strings:
|
|
2561
|
+
$h_reg1 = /\/Type\/Filespec\/F(.{1,30}?)\.exe/
|
|
2562
|
+
condition:
|
|
2563
|
+
any of them
|
|
2564
|
+
}
|
|
2565
|
+
|
|
2566
|
+
|
|
2567
|
+
rule suspicious_embedded_bat_file {
|
|
2568
|
+
meta:
|
|
2569
|
+
is_exploit = false
|
|
2570
|
+
is_warning = true
|
|
2571
|
+
is_feature = false
|
|
2572
|
+
rank = 1
|
|
2573
|
+
revision = "1"
|
|
2574
|
+
date = "June 07 2020"
|
|
2575
|
+
author = "@tylabs"
|
|
2576
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2577
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2578
|
+
desc = "suspicious.embedded bat file"
|
|
2579
|
+
mitre = "T1204.002"
|
|
2580
|
+
strings:
|
|
2581
|
+
$h_reg1 = /\/Type\/Filespec\/F(.{1,30}?)\.bat/
|
|
2582
|
+
condition:
|
|
2583
|
+
any of them
|
|
2584
|
+
}
|
|
2585
|
+
|
|
2586
|
+
|
|
2587
|
+
rule suspicious_embedded_rtf_file {
|
|
2588
|
+
meta:
|
|
2589
|
+
is_exploit = false
|
|
2590
|
+
is_warning = true
|
|
2591
|
+
is_feature = false
|
|
2592
|
+
rank = 1
|
|
2593
|
+
revision = "1"
|
|
2594
|
+
date = "June 07 2020"
|
|
2595
|
+
author = "@tylabs"
|
|
2596
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2597
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2598
|
+
desc = "suspicious.embedded rtf file"
|
|
2599
|
+
mitre = "T1204.002"
|
|
2600
|
+
strings:
|
|
2601
|
+
$h_reg1 = /\/Type\/Filespec\/F(.{1,30}?)\.rtf/
|
|
2602
|
+
condition:
|
|
2603
|
+
any of them
|
|
2604
|
+
}
|
|
2605
|
+
|
|
2606
|
+
|
|
2607
|
+
rule suspicious_embedded_mso_file {
|
|
2608
|
+
meta:
|
|
2609
|
+
is_exploit = false
|
|
2610
|
+
is_warning = true
|
|
2611
|
+
is_feature = false
|
|
2612
|
+
rank = 1
|
|
2613
|
+
revision = "1"
|
|
2614
|
+
date = "June 07 2020"
|
|
2615
|
+
author = "@tylabs"
|
|
2616
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2617
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2618
|
+
desc = "suspicious.embedded mso file"
|
|
2619
|
+
mitre = "T1204.002"
|
|
2620
|
+
strings:
|
|
2621
|
+
$h_reg1 = /\/Type\/Filespec\/F(.{1,30}?)\.mso/
|
|
2622
|
+
condition:
|
|
2623
|
+
any of them
|
|
2624
|
+
}
|
|
2625
|
+
|
|
2626
|
+
|
|
2627
|
+
rule suspicious_embedded_html_file {
|
|
2628
|
+
meta:
|
|
2629
|
+
is_exploit = false
|
|
2630
|
+
is_warning = true
|
|
2631
|
+
is_feature = false
|
|
2632
|
+
rank = 1
|
|
2633
|
+
revision = "1"
|
|
2634
|
+
date = "June 07 2020"
|
|
2635
|
+
author = "@tylabs"
|
|
2636
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2637
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2638
|
+
desc = "suspicious.embedded html file"
|
|
2639
|
+
mitre = "T1204.002"
|
|
2640
|
+
strings:
|
|
2641
|
+
$h_reg1 = /\/Type\/Filespec\/F(.{1,30}?)\.htm/
|
|
2642
|
+
condition:
|
|
2643
|
+
any of them
|
|
2644
|
+
}
|
|
2645
|
+
|
|
2646
|
+
|
|
2647
|
+
rule suspicious_embedded_OLE_document_header {
|
|
2648
|
+
meta:
|
|
2649
|
+
is_exploit = false
|
|
2650
|
+
is_warning = true
|
|
2651
|
+
is_feature = false
|
|
2652
|
+
rank = 1
|
|
2653
|
+
revision = "1"
|
|
2654
|
+
date = "June 07 2020"
|
|
2655
|
+
author = "@tylabs"
|
|
2656
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2657
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2658
|
+
desc = "suspicious.embedded OLE document header"
|
|
2659
|
+
mitre = "T1204.002"
|
|
2660
|
+
strings:
|
|
2661
|
+
$h_reg1 = { d0 cf 11 e0}
|
|
2662
|
+
condition: $h_reg1 at 0
|
|
2663
|
+
}
|
|
2664
|
+
|
|
2665
|
+
|
|
2666
|
+
rule suspicious_embedded_external_content {
|
|
2667
|
+
meta:
|
|
2668
|
+
is_exploit = false
|
|
2669
|
+
is_warning = true
|
|
2670
|
+
is_feature = false
|
|
2671
|
+
rank = 1
|
|
2672
|
+
revision = "1"
|
|
2673
|
+
date = "June 07 2020"
|
|
2674
|
+
author = "@tylabs"
|
|
2675
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2676
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2677
|
+
desc = "suspicious.embedded external content"
|
|
2678
|
+
mitre = "T1566.002"
|
|
2679
|
+
strings:
|
|
2680
|
+
$h_raw1 = "/S /URI" nocase
|
|
2681
|
+
condition:
|
|
2682
|
+
any of them
|
|
2683
|
+
}
|
|
2684
|
+
|
|
2685
|
+
|
|
2686
|
+
rule pdf_exploit_Corrupted_JPEG2000_CVE_2018_4990 {
|
|
2687
|
+
meta:
|
|
2688
|
+
is_exploit = true
|
|
2689
|
+
is_warning = false
|
|
2690
|
+
is_feature = false
|
|
2691
|
+
rank = 5
|
|
2692
|
+
revision = "1"
|
|
2693
|
+
date = "June 07 2020"
|
|
2694
|
+
author = "@tylabs"
|
|
2695
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2696
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2697
|
+
desc = "pdf.exploit Corrupted JPEG2000 CVE-2018-4990"
|
|
2698
|
+
mitre = "T1203 T1204.002"
|
|
2699
|
+
strings:
|
|
2700
|
+
$h_hex1 = { 0C6A5020 200D0A87 0A000004 1D6A7032 68000000 16696864 72000000 20000000 200001FF 07000000 0003FC63 6D617000 }
|
|
2701
|
+
condition: $h_hex1
|
|
2702
|
+
}
|
|
2703
|
+
|
|
2704
|
+
|
|
2705
|
+
rule pdf_exploit_using_jbig2decode_CVE_2009_0658 {
|
|
2706
|
+
meta:
|
|
2707
|
+
is_exploit = true
|
|
2708
|
+
is_warning = false
|
|
2709
|
+
is_feature = false
|
|
2710
|
+
rank = 5
|
|
2711
|
+
revision = "1"
|
|
2712
|
+
date = "July 20 2020"
|
|
2713
|
+
author = "@tylabs"
|
|
2714
|
+
sigtype = "pdfexaminer_obfuscation"
|
|
2715
|
+
copyright = "Copyright 2020 tylabs.com. All rights reserved."
|
|
2716
|
+
desc = "pdf.exploit using JBIG2Decode CVE-2009-0658"
|
|
2717
|
+
mitre = "T1203 T1204.002"
|
|
2718
|
+
url = "https://www.exploit-db.com/exploits/8099"
|
|
2719
|
+
strings:
|
|
2720
|
+
$h_raw1 = "JBIG2Decode" nocase
|
|
2721
|
+
$h_raw2 = "Decode [ 1 0 ]"
|
|
2722
|
+
$h_raw3 = "ABCD\x13"
|
|
2723
|
+
condition: all of them
|
|
2724
|
+
}
|
|
2725
|
+
|
|
2726
|
+
|
|
2727
|
+
rule PDF_Containing_JavaScript {
|
|
2728
|
+
meta:
|
|
2729
|
+
author = "InQuest Labs"
|
|
2730
|
+
description = "This signature detects a PDF file that contains JavaScript. JavaScript can be used to customize PDFs by implementing objects, methods, and properties. While not inherently malicious, embedding JavaScript inside of a PDF is often used for malicious purposes such as malware delivery or exploitation."
|
|
2731
|
+
created_date = "2022-03-15"
|
|
2732
|
+
updated_date = "2022-03-15"
|
|
2733
|
+
blog_reference = "www.sans.org/security-resources/malwarefaq/pdf-overview.php"
|
|
2734
|
+
labs_reference = "N/A"
|
|
2735
|
+
labs_pivot = "N/A"
|
|
2736
|
+
samples = "c82e29dcaed3c71e05449cb9463f3efb7114ea22b6f45b16e09eae32db9f5bef"
|
|
2737
|
+
strings:
|
|
2738
|
+
|
|
2739
|
+
$pdf_tag1 = /\x25\x50\x44\x46\x2d/
|
|
2740
|
+
$js_tag1 = "/JavaScript" fullword
|
|
2741
|
+
$js_tag2 = "/JS" fullword
|
|
2742
|
+
condition:
|
|
2743
|
+
|
|
2744
|
+
$pdf_tag1 in (0..1024) and ($js_tag1 or $js_tag2)
|
|
2745
|
+
|
|
2746
|
+
}
|
|
2747
|
+
|
|
2748
|
+
|
|
2749
|
+
rule PDF_Launch_Action_EXE {
|
|
2750
|
+
meta:
|
|
2751
|
+
author = "InQuest Labs"
|
|
2752
|
+
description = "This signature detects PDF files that launch an executable upon being opened on a host machine. This action is performed by the Launch Action feature available in the PDF file format and is commonly abused by threat actors to execute delivered malware."
|
|
2753
|
+
created_date = "2022-03-15"
|
|
2754
|
+
updated_date = "2022-03-15"
|
|
2755
|
+
blog_reference = "InQuest Labs Empirical Observations"
|
|
2756
|
+
labs_reference = "N/A"
|
|
2757
|
+
labs_pivot = "N/A"
|
|
2758
|
+
samples = "cb5e659c4ac93b335c77c9b389d8ef65d8c20ab8b0ad08e5f850cc5055e564c3"
|
|
2759
|
+
strings:
|
|
2760
|
+
|
|
2761
|
+
/* 8 0 obj
|
|
2762
|
+
<<
|
|
2763
|
+
/Type /Action
|
|
2764
|
+
/S /Launch
|
|
2765
|
+
/Win
|
|
2766
|
+
<<
|
|
2767
|
+
/F (cmd.exe)
|
|
2768
|
+
>>
|
|
2769
|
+
>>
|
|
2770
|
+
endobj
|
|
2771
|
+
|
|
2772
|
+
*/
|
|
2773
|
+
|
|
2774
|
+
$magic01 = "INQUEST-PP=pdfparser"
|
|
2775
|
+
$magic02 = "%PDF"
|
|
2776
|
+
|
|
2777
|
+
$re1 = /\x2fType[ \t\r\n]*\x2fAction/ nocase wide ascii
|
|
2778
|
+
$re2 = /obj[^\x3c\x3e]+<<[^\x3e]*\x2fS[ \t\r\n]*\x2fLaunch[^\x3c\x3e]*<<[^\x3e]*\x2fF[ \t\r\n]*\x28[^\x29]+\.exe[^\x29]*\x29/ nocase wide ascii
|
|
2779
|
+
condition:
|
|
2780
|
+
|
|
2781
|
+
($magic01 in (filesize-30 .. filesize) or $magic02 in (0 .. 10)) and all of ($re*)
|
|
2782
|
+
|
|
2783
|
+
}
|
|
2784
|
+
|
|
2785
|
+
|
|
2786
|
+
rule PDF_Launch_Function {
|
|
2787
|
+
meta:
|
|
2788
|
+
author = "InQuest Labs"
|
|
2789
|
+
description = "This signature detects the launch function within a PDF file. This function allows a document author to attach an executable file."
|
|
2790
|
+
created_date = "2022-03-15"
|
|
2791
|
+
updated_date = "2022-03-15"
|
|
2792
|
+
blog_reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/PDF-launch-feature-abused-to-carry-zeuszbot/"
|
|
2793
|
+
labs_reference = "N/A"
|
|
2794
|
+
labs_pivot = "N/A"
|
|
2795
|
+
samples = "c2f2d1de6bf973b849725f1069c649ce594a907c1481566c0411faba40943ee5"
|
|
2796
|
+
strings:
|
|
2797
|
+
|
|
2798
|
+
$pdf_header = "%PDF-"
|
|
2799
|
+
$launch = "/Launch" nocase
|
|
2800
|
+
condition:
|
|
2801
|
+
|
|
2802
|
+
$pdf_header in (0..1024) and $launch
|
|
2803
|
+
|
|
2804
|
+
}
|
|
2805
|
+
|
|
2806
|
+
|
|
2807
|
+
rule PDF_with_Embedded_RTF_OLE_Newlines {
|
|
2808
|
+
meta:
|
|
2809
|
+
author = "InQuest Labs"
|
|
2810
|
+
description = "This signature detects suspicious PDF files embedded with RTF files that contain embedded OLE content that injects newlines into embedded OLE contents as a means of payload obfuscation and detection evasion."
|
|
2811
|
+
created_date = "2022-03-15"
|
|
2812
|
+
updated_date = "2022-03-15"
|
|
2813
|
+
blog_reference = "InQuest Internal Research"
|
|
2814
|
+
labs_reference = "N/A"
|
|
2815
|
+
labs_pivot = "N/A"
|
|
2816
|
+
samples = "d784c53b8387f1e2f1bcb56a3604a37b431638642e692540ebeaeee48c1f1a07"
|
|
2817
|
+
|
|
2818
|
+
strings:
|
|
2819
|
+
$rtf_magic = "{\\rt" // note that {\rtf1 is not required
|
|
2820
|
+
|
|
2821
|
+
$rtf_objdata = /\x7b[^\x7d]*\\objdata/ nocase
|
|
2822
|
+
|
|
2823
|
+
$nor = "D0CF11E0A1B11AE1" nocase
|
|
2824
|
+
|
|
2825
|
+
$obs = /D[ \r\t\n]*0[ \r\t\n]*C[ \r\t\n]*F[ \r\t\n]*1[ \r\t\n]*1[ \r\t\n]*E[ \r\t\n]*0[ \r\t\n]*A[ \r\t\n]*1[ \r\t\n]*B[ \r\t\n]*1[ \r\t\n]*1[ \r\t\n]*A[ \r\t\n]*E[ \r\t\n]*1/ nocase
|
|
2826
|
+
condition:
|
|
2827
|
+
$rtf_magic and $rtf_objdata and ($obs and not $nor)
|
|
2828
|
+
}
|
|
2829
|
+
|
|
2830
|
+
|
|
2831
|
+
rule PDF_with_Launch_Action_Function {
|
|
2832
|
+
meta:
|
|
2833
|
+
author = "InQuest Labs"
|
|
2834
|
+
description = "This signature detects the launch function within a PDF file. This function allows the document author to attach an executable file."
|
|
2835
|
+
created_date = "2022-03-15"
|
|
2836
|
+
updated_date = "2022-03-15"
|
|
2837
|
+
blog_reference = "http://blog.didierstevens.com/2010/03/29/escape-from-pdf/"
|
|
2838
|
+
labs_reference = "N/A"
|
|
2839
|
+
labs_pivot = "N/A"
|
|
2840
|
+
samples = "a9fbb50dedfd84e1f4a3507d45b1b16baa43123f5ae98dae6aa9a5bebeb956a8"
|
|
2841
|
+
strings:
|
|
2842
|
+
$pdf_header = "%PDF-"
|
|
2843
|
+
$a = "<</S/Launch/Type/Action/Win<</F"
|
|
2844
|
+
condition:
|
|
2845
|
+
$pdf_header in (0..1024) and $a
|
|
2846
|
+
}
|
|
2847
|
+
|
|
2848
|
+
|
|
2849
|
+
rule PDF_Phishing {
|
|
2850
|
+
meta:
|
|
2851
|
+
description = "Detects PDF phishing attempts"
|
|
2852
|
+
severity = "medium"
|
|
2853
|
+
strings:
|
|
2854
|
+
$uri = "/URI" nocase
|
|
2855
|
+
$acroform = "/AcroForm" nocase
|
|
2856
|
+
$submit = "/SubmitForm" nocase
|
|
2857
|
+
$login = /https*?:\/\/[^\s"]*?(login|password|banking|verify|update|secure)/ nocase
|
|
2858
|
+
condition:
|
|
2859
|
+
($uri and any of ($acroform, $submit, $login))
|
|
2860
|
+
}
|
|
2861
|
+
|
|
2862
|
+
|
|
2863
|
+
rule brooxml_phishing {
|
|
2864
|
+
meta:
|
|
2865
|
+
description = "Detects PDF and OOXML files leading to AiTM phishing"
|
|
2866
|
+
author = "Proofpoint"
|
|
2867
|
+
category = "phishing"
|
|
2868
|
+
strings:
|
|
2869
|
+
$hex1 = { 21 20 03 20 c3 be c3 bf 09 20 [0-1] 06 20 20 20 20 20 20 20 20 20 20 20 01 20 20 20 06 20 20 20 20 20 20 20 20 10 20 20 05 20 20 20 01 20 20 20 c3 be c3 bf c3 bf c3 bf }
|
|
2870
|
+
$docx = { 50 4b }
|
|
2871
|
+
$pdf = { 25 50 44 46 2d }
|
|
2872
|
+
condition:
|
|
2873
|
+
all of ($hex*) and (($docx at 0) or ($pdf at 0))
|
|
2874
|
+
}
|
|
2875
|
+
|
|
2876
|
+
|
|
2877
|
+
rule malware_MalDocinPDF {
|
|
2878
|
+
meta:
|
|
2879
|
+
description = "Hunt Maldoc in PDF"
|
|
2880
|
+
author = "JPCERT/CC Incident Response Group"
|
|
2881
|
+
hash1 = "ef59d7038cfd565fd65bae12588810d5361df938244ebad33b71882dcf683058"
|
|
2882
|
+
hash2 = "098796e1b82c199ad226bff056b6310262b132f6d06930d3c254c57bdf548187"
|
|
2883
|
+
hash3 = "5b677d297fb862c2d223973697479ee53a91d03073b14556f421b3d74f136b9d"
|
|
2884
|
+
strings:
|
|
2885
|
+
$docfile2 = "<w:WordDocument>" ascii nocase
|
|
2886
|
+
$xlsfile2 = "<x:ExcelWorkbook>" ascii nocase
|
|
2887
|
+
$mhtfile0 = "mime" ascii nocase
|
|
2888
|
+
$mhtfile1 = "content-location:" ascii nocase
|
|
2889
|
+
$mhtfile2 = "content-type:" ascii nocase
|
|
2890
|
+
condition:
|
|
2891
|
+
(uint32(0) == 0x46445025) and
|
|
2892
|
+
(1 of ($mhtfile*)) and
|
|
2893
|
+
((1 of ($docfile*)) or (1 of ($xlsfile*)))
|
|
2894
|
+
}
|
|
2895
|
+
|
|
2896
|
+
|
|
2897
|
+
rule phoenix_pdf : EK PDF {
|
|
2898
|
+
meta:
|
|
2899
|
+
author = "Josh Berry"
|
|
2900
|
+
date = "2016-06-26"
|
|
2901
|
+
description = "Phoenix Exploit Kit Detection"
|
|
2902
|
+
hash0 = "16de68e66cab08d642a669bf377368da"
|
|
2903
|
+
hash1 = "bab281fe0cf3a16a396550b15d9167d5"
|
|
2904
|
+
sample_filetype = "pdf"
|
|
2905
|
+
yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
|
|
2906
|
+
strings:
|
|
2907
|
+
$string0 = "0000000254 00000 n"
|
|
2908
|
+
$string1 = "0000000295 00000 n"
|
|
2909
|
+
$string2 = "trailer<</Root 1 0 R /Size 7>>"
|
|
2910
|
+
$string3 = "0000000000 65535 f"
|
|
2911
|
+
$string4 = "3 0 obj<</JavaScript 5 0 R >>endobj"
|
|
2912
|
+
$string5 = "0000000120 00000 n"
|
|
2913
|
+
$string6 = "%PDF-1.0"
|
|
2914
|
+
$string7 = "startxref"
|
|
2915
|
+
$string8 = "0000000068 00000 n"
|
|
2916
|
+
$string9 = "endobjxref"
|
|
2917
|
+
$string10 = ")6 0 R ]>>endobj"
|
|
2918
|
+
$string11 = "0000000010 00000 n"
|
|
2919
|
+
condition:
|
|
2920
|
+
11 of them
|
|
2921
|
+
}
|
|
2922
|
+
|
|
2923
|
+
|
|
2924
|
+
rule phoenix_pdf2 : EK PDF {
|
|
2925
|
+
meta:
|
|
2926
|
+
author = "Josh Berry"
|
|
2927
|
+
date = "2016-06-26"
|
|
2928
|
+
description = "Phoenix Exploit Kit Detection"
|
|
2929
|
+
hash0 = "33cb6c67f58609aa853e80f718ab106a"
|
|
2930
|
+
sample_filetype = "pdf"
|
|
2931
|
+
yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
|
|
2932
|
+
strings:
|
|
2933
|
+
$string0 = "\\nQb<%"
|
|
2934
|
+
$string1 = "0000000254 00000 n"
|
|
2935
|
+
$string2 = ":S3>v0$EF"
|
|
2936
|
+
$string3 = "trailer<</Root 1 0 R /Size 7>>"
|
|
2937
|
+
$string4 = "%PDF-1.0"
|
|
2938
|
+
$string5 = "0000000000 65535 f"
|
|
2939
|
+
$string6 = "endstream"
|
|
2940
|
+
$string7 = "0000000010 00000 n"
|
|
2941
|
+
$string8 = "6 0 obj<</JS 7 0 R/S/JavaScript>>endobj"
|
|
2942
|
+
$string9 = "3 0 obj<</JavaScript 5 0 R >>endobj"
|
|
2943
|
+
$string10 = "}pr2IE"
|
|
2944
|
+
$string11 = "0000000157 00000 n"
|
|
2945
|
+
$string12 = "1 0 obj<</Type/Catalog/Pages 2 0 R /Names 3 0 R >>endobj"
|
|
2946
|
+
$string13 = "5 0 obj<</Names[("
|
|
2947
|
+
condition:
|
|
2948
|
+
13 of them
|
|
2949
|
+
}
|
|
2950
|
+
|
|
2951
|
+
|
|
2952
|
+
rule phoenix_pdf3 : EK PDF {
|
|
2953
|
+
meta:
|
|
2954
|
+
author = "Josh Berry"
|
|
2955
|
+
date = "2016-06-26"
|
|
2956
|
+
description = "Phoenix Exploit Kit Detection"
|
|
2957
|
+
hash0 = "bab281fe0cf3a16a396550b15d9167d5"
|
|
2958
|
+
sample_filetype = "pdf"
|
|
2959
|
+
yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
|
|
2960
|
+
strings:
|
|
2961
|
+
$string0 = "trailer<</Root 1 0 R /Size 7>>"
|
|
2962
|
+
$string1 = "stream"
|
|
2963
|
+
$string2 = ";_oI5z"
|
|
2964
|
+
$string3 = "0000000010 00000 n"
|
|
2965
|
+
$string4 = "3 0 obj<</JavaScript 5 0 R >>endobj"
|
|
2966
|
+
$string5 = "7 0 obj<</Filter[ /FlateDecode /ASCIIHexDecode /ASCII85Decode ]/Length 3324>>"
|
|
2967
|
+
$string6 = "endobjxref"
|
|
2968
|
+
$string7 = "L%}gE("
|
|
2969
|
+
$string8 = "0000000157 00000 n"
|
|
2970
|
+
$string9 = "1 0 obj<</Type/Catalog/Pages 2 0 R /Names 3 0 R >>endobj"
|
|
2971
|
+
$string10 = "0000000120 00000 n"
|
|
2972
|
+
$string11 = "4 0 obj<</Type/Page/Parent 2 0 R /Contents 12 0 R>>endobj"
|
|
2973
|
+
condition:
|
|
2974
|
+
11 of them
|
|
2975
|
+
}
|
|
2976
|
+
|
|
2977
|
+
|
|
2978
|
+
rule apt_apt29_wineloader_malicious_pdf {
|
|
2979
|
+
meta:
|
|
2980
|
+
id = "b1db731e-471e-493a-b76c-38d2808ccac9"
|
|
2981
|
+
version = "1.0"
|
|
2982
|
+
description = "Detects malicious PDF used by APT29 to drop Wineloader"
|
|
2983
|
+
author = "Sekoia.io"
|
|
2984
|
+
creation_date = "2024-03-25"
|
|
2985
|
+
classification = "TLP:CLEAR"
|
|
2986
|
+
hash = "9712217ff3597468b48cdf45da588005de3a725ba554789bb7e5ae1b0f7c02a7"
|
|
2987
|
+
hash = "3739b2eae11c8367b576869b68d502b97676fb68d18cc0045f661fbe354afcb9"
|
|
2988
|
+
strings:
|
|
2989
|
+
$s1 = "<</Type/Annot/Subtype/Link/Border[0 0 0]/Rect["
|
|
2990
|
+
$s2 = "/A<</Type/Action/S/URI/URI("
|
|
2991
|
+
$s3 = { 2f [2-10] 2e 70 68 70 29 3e 3e }
|
|
2992
|
+
$s4 = "JamrulNormal"
|
|
2993
|
+
condition:
|
|
2994
|
+
uint32be(0) == 0x25504446 and
|
|
2995
|
+
$s2 in (@s1..@s3) and $s4
|
|
2996
|
+
}
|