SIGNATURE_BASE_MAL_Cisco_Rayinitiator_Stage_2

rule SIGNATURE_BASE_MAL_Cisco_Rayinitiator_Stage_2
{
	meta:
		description = "Detects RayInitiator GRUB bootkit stage 2 code that identifies the Linux kernel syscall table."
		author = "NCSC"
		id = "c49bdbe7-eba6-562c-8388-5e638887b405"
		date = "2025-09-25"
		modified = "2026-05-15"
		reference = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L22-L39"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "27f040bc14caec745f04fa32de08955a09857a801e5f2f04936fffca991c9d19"
		score = 85
		quality = 85
		tags = ""

	strings:
		$xc1 = {
         49 89 E0 48 83 F8 30 0F 84 70 00 00 00 49 01 C0 49 8B
         10 48 83 C0 08 66 85 D2 75 E4 BF ?? ?? 60 00 48 8B 3C 17 48 BE 6E
         6D 69 5F 6D 61 78 5F
      }

	condition:
		$xc1
}