SEKOIA_Koi_Powershell_Loading_Obfuscatednet

rule SEKOIA_Koi_Powershell_Loading_Obfuscatednet
{
	meta:
		description = "Powershell script loading obfuscated .NET Koi module"
		author = "Sekoia.io"
		id = "75a7460d-cc28-470e-9841-da8e46ee0101"
		date = "2024-03-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/koi_powershell_loading_obfuscatednet.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "82f30c04474ea77af5169771a2c0e75ba792fd32dc559b8c29172b73ace4ef10"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s1 = "# [Net.ServicePointManager]::SecurityProtocol +='tls12'"
		$s2 = "$binary[$i] = $binary[$i] -bxor $k[$i % $k.Length]"
		$s3 = "\").Split('|')"
		$s4 = "$ep.Invoke($null, "

	condition:
		$s3 and 3 of them
}