VOLEXITY_Apt_Malware_Python_Knuckleball

rule VOLEXITY_Apt_Malware_Python_Knuckleball : UTA0533 KNUCKLEBALL FILE MEMORY
{
	meta:
		description = "Detects KNUCKLEBALL, a python based injector malware, using string patterns."
		author = "threatintel@volexity.com"
		id = "bceaee99-902b-5e0d-a8e6-f9909fcd3334"
		date = "2026-07-06"
		modified = "2026-07-14"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2026/2026-07-17 SonicWall/rules.yar#L77-L109"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "8c470301dcb7278f73e622f1950073567b34011c64b60cdfbb0f89803923a5a3"
		logic_hash = "306b5e0cc66af163c1dea29f8c55f0dbb396ddcefb63f22d62601d7cf1ea839d"
		score = 75
		quality = 80
		tags = "UTA0533, KNUCKLEBALL, FILE, MEMORY"
		os = "linux"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "high"
		report1 = "TIB-20260714B"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 13233
		version = 5

	strings:
		$s1 = "/tmp/.java_pid{pid}" ascii
		$s2 = "/tmp/.attach_pid{pid}" ascii
		$s3 = "timeout waiting for JVMTI attach socket" ascii
		$s4 = "workplace.startup.CommandStartup" ascii
		$s5 = "/var/run/control.unit.sock" ascii
		$func1 = "unit_put(" ascii
		$func2 = "check_gate(" ascii
		$func3 = "inject_jar(" ascii
		$func4 = "find_wp_pid(" ascii

	condition:
		2 of ( $s* ) or 3 of ( $func* )
}