SIGNATURE_BASE_SUSP_RDP_File_Indicators_Oct24_1

rule SIGNATURE_BASE_SUSP_RDP_File_Indicators_Oct24_1 : FILE
{
	meta:
		description = "Detects characteristics found in malicious RDP files used as email attachments in spear phishing campaigns"
		author = "Florian Roth"
		id = "16128c1e-64ed-5a3e-ad1e-e0330d91f5a9"
		date = "2024-10-25"
		modified = "2024-12-12"
		reference = "https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_nobellium_rdp_phish.yar#L2-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0"
		hash = "8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5"
		hash = "9b8cb8b01ce4eafb9204250a3c28bfaf70cc76a99ce411ad52bbf1aa2b6cce34"
		hash = "ba4d58f2c5903776fe47c92a0ec3297cc7b9c8fa16b3bf5f40b46242e7092b46"
		hash = "f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8"
		logic_hash = "55bd63738c38719ce7aeb874956488b0d3f7167a31d880ee61994b5921bd1458"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "redirectclipboard:i:1" wide fullword
		$s2 = "redirectprinters:i:1" wide fullword
		$s3 = "remoteapplicationmode:i:1" wide fullword
		$s4 = "username:s:" wide
		$s5 = "emoteapplicationicon:s:C:\\Windows\\SystemApps" wide

	condition:
		filesize < 50KB and all of them
}