CADOSECURITY_Powershell_Downloader_POWERGAP

rule CADOSECURITY_Powershell_Downloader_POWERGAP
{
	meta:
		description = "Detects POWERGAP downloader used against Ukrainian ICS"
		author = "mmuir@cadosecurity.com"
		id = "d2a2604c-c558-5663-8dd3-44f3fdda1f71"
		date = "2022-04-12"
		modified = "2022-07-06"
		reference = "https://github.com/cado-security/DFIR_Resources_Industroyer2"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Powershell_Downloader_POWERGAP.yar#L1-L19"
		license_url = "N/A"
		logic_hash = "a9ef1d04ca921f285e973f6abcb2b355eae110678da866e3b6499aa0318338fd"
		score = 75
		quality = 80
		tags = ""
		license = "Apache License 2.0"

	strings:
		$a = "Start-work" ascii
		$b = "$GpoGuid" ascii
		$c = "$SourceFile" ascii
		$d = "$DestinationFile" ascii
		$e = "$appName" ascii
		$f = "LDAP://ROOTDSE" ascii
		$g = "GPT.INI" ascii
		$h = "Get-WmiObject" ascii

	condition:
		5 of them
}