SIGNATURE_BASE_SUSP_LNX_Sindoor_Desktopfile_Aug25

rule SIGNATURE_BASE_SUSP_LNX_Sindoor_Desktopfile_Aug25 : FILE
{
	meta:
		description = "Detects ELF obfuscation technique used by Sindoor dropper related to APT 36"
		author = "Pezier Pierre-Henri"
		id = "16719116-0cb2-5c70-a86f-f65f9ea32153"
		date = "2025-08-29"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt36_operation_sindoor.yar#L19-L36"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59"
		logic_hash = "1549aac3132c5f3e73d984c3404a5530507e967df4ab6d5ccd408abc874a5306"
		score = 70
		quality = 85
		tags = "FILE"

	strings:
		$hdr = "[Desktop Entry]"
		$s1 = "printf '\\\\x7FELF' | dd of"
		$s2 = "Future_Note_Warfare_OpSindoor.pdf"

	condition:
		filesize < 100KB and $hdr and any of ( $s* )
}