SEKOIA_Apt_Turla_Comlook

rule SEKOIA_Apt_Turla_Comlook : FILE
{
	meta:
		description = "Detects Class and Method names used inside ComLook"
		author = "Sekoia.io"
		id = "c3bf886b-f952-47f9-aff6-3cd74c27077d"
		date = "2023-10-30"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_turla_comlook.yar#L1-L31"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "882a2efda4c3888c34a2802797c9eac4ab8b96774f2eea19e586ff9c8adb9292"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ClassName1 = "AgentConfig"
		$ClassName2 = "CommandPerforming"
		$MethodName1 = "CmdCommand"
		$MethodName2 = "GetConfigCommand"
		$MethodName3 = "GetFileCommand"
		$MethodName4 = "PutFileCommand"
		$MethodName5 = "SetConfigCommand"
		$MethodName6 = "AgentProtocol"
		$Log1 = "CONFIG_SERVERS_LIST_PARSING_ERROR" ascii wide
		$Log2 = "GET_UIDS_TO_CHECK_PARSING_ERROR" ascii wide
		$Log3 = "PAYLOAD_PARSING_FILEPATH_AND_FILE_ERROR" ascii wide
		$Log4 = "COMMAND_EMPTY_ERROR" ascii wide
		$Log5 = "IMAP_USERNAME_FORMAT_INCORRECT" ascii wide
		$Log6 = "NO_MESSAGES_TO_RETRIEVE" ascii wide

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 10MB and any of ( $ClassName* ) and any of ( $MethodName* ) and any of ( $Log* )
}