SIGNATURE_BASE_MAL_EXPL_Perfctl_Oct24

rule SIGNATURE_BASE_MAL_EXPL_Perfctl_Oct24 : FILE
{
	meta:
		description = "Detects exploits used in relation with Perfctl malware campaigns"
		author = "Florian Roth"
		id = "1f525eaf-445c-592e-bfa4-e9846390dd1d"
		date = "2024-10-09"
		modified = "2024-12-12"
		reference = "https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_perfctl_oct24.yar#L2-L21"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "22e4a57ac560ebe1eff8957906589f4dd5934ee555ebcc0f7ba613b07fad2c13"
		logic_hash = "44d4683efc66b3c6c2d32be6b83a2bbc1db39c9a020365dddd27c20667bc6a66"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "Exploit failed. Target is most likely patched." ascii fullword
		$s2 = "SHELL=pkexec" ascii fullword
		$s3 = "/dump_" ascii fullword
		$s4 = ".EYE$" ascii

	condition:
		uint16( 0 ) == 0x457f and filesize < 30000KB and 2 of them or all of them
}