SEKOIA_Apt_Kimsuky_Sharptongue_C2_Source

rule SEKOIA_Apt_Kimsuky_Sharptongue_C2_Source
{
	meta:
		description = "Detects the PHP code of the SharpTongue C2"
		author = "Sekoia.io"
		id = "a2ccf773-511c-4088-8bcf-b923291d024b"
		date = "2022-07-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_kimsuky_sharptongue_c2_source.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "c301a99876cfe2863546c990654aa922f9327e0eb010968eaea43f1d8ced76da"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "<?php"
		$ = "foreach($_GET as $variable => $value)"
		$ = "$chk=$value"
		$ = "base64_encode($ip)"

	condition:
		all of them
}