SEKOIA_Tool_Edrsandblast_Kernelcallbacks

rule SEKOIA_Tool_Edrsandblast_Kernelcallbacks : FILE
{
	meta:
		description = "Detects EDRSandblast KernelCallbacks strings"
		author = "Sekoia.io"
		id = "74cf4444-5bd6-4167-930a-5dbf2e529f92"
		date = "2024-11-25"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/tool_edrsandblast_kernelcallbacks.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "ffb1185dca42c5b2b273c3a48f3ba86204a3474a9a045f72dbdb0ba7c9e89c7d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "[+] '%s' service ACL configured to for Everyone" wide
		$ = "%s callback of EDR driver \"%s\" [callback addr: 0x%I64x" wide
		$ = "[!] Could not resolve %s kernel module's address" wide

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 3MB and 3 of them
}