CADOSECURITY_Linux_Wiper_AWFULSHRED

rule CADOSECURITY_Linux_Wiper_AWFULSHRED
{
	meta:
		description = "Detects AWFULSHRED wiper used against Ukrainian ICS"
		author = "mmuir@cadosecurity.com"
		id = "0328f0d9-3c73-5d13-bf32-8a25139cf3cf"
		date = "2022-04-12"
		modified = "2022-07-06"
		reference = "https://github.com/cado-security/DFIR_Resources_Industroyer2"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Linux_Wiper_AWFULSHRED.yar#L1-L26"
		license_url = "N/A"
		hash = "bcdf0bd8142a4828c61e775686c9892d89893ed0f5093bdc70bde3e48d04ab99"
		logic_hash = "796dfdc4238e3d729180657b7bc79464003434c73568b49895cb8d37ce1a5499"
		score = 75
		quality = 80
		tags = ""
		license = "Apache License 2.0"

	strings:
		$isBash = "/bin/bash" ascii
		$a1 = "declare -r" ascii
		$a2 = "bash_history" ascii
		$a3 = "bs=1k if=/dev/urandom of=" ascii
		$a4 = "systemd" ascii
		$a5 = "apache http ssh" ascii
		$a6 = "shred" ascii
		$var1 = "iwljzfkg" ascii
		$var2 = "yrkdrrue" ascii
		$var3 = "agzerlyf" ascii
		$var4 = "rggygzny" ascii
		$var5 = "zubzgnvp" ascii

	condition:
		$isBash and 3 of ( $a* ) and 4 of ( $var* )
}