SEKOIA_Apt_Coathanger_Files

rule SEKOIA_Apt_Coathanger_Files : FILE
{
	meta:
		description = "Detects COATHANGER files"
		author = "Sekoia.io"
		id = "615f5ac1-14bc-4f5b-a02e-7b13cd179917"
		date = "2024-02-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_coathanger_files.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "5406d8a99e16f08f1ffca548ea1dd1e27e7707506e796e0fc263bcdbb681632d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "/data2/"
		$ = "/httpsd"
		$ = "/preload.so"
		$ = "/authd"
		$ = "/tmp/packfile"
		$ = "/smartctl"
		$ = "/etc/ld.so.preload"
		$ = "/newcli"
		$ = "/bin/busybox"

	condition:
		( uint32( 0 ) == 0x464c457f or uint32( 4 ) == 0x464c457f ) and filesize < 5MB and 4 of them
}