VOLEXITY_Apt_Malware_Win_Deepdata_Module

rule VOLEXITY_Apt_Malware_Win_Deepdata_Module : BRAZENBAMBOO FILE MEMORY
{
	meta:
		description = "Detects modules used by DEEPDATA based on the required export names used by those modules."
		author = "threatintel@volexity.com"
		id = "1287f5dd-9229-57ce-a91a-73d61041df80"
		date = "2024-07-30"
		modified = "2024-11-14"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2024/2024-11-15 BrazenBamboo/rules.yar#L1-L25"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "c782346bf9e5c08a0c43a85d4991f26b0b3c99c054fa83beb4a9e406906f011e"
		logic_hash = "d36f34343826daf7f7368118c7127c7181a54c99a01803016c9a6965abb309cb"
		score = 75
		quality = 80
		tags = "BRAZENBAMBOO, FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10868
		version = 2

	strings:
		$str1 = "ExecuteCommand"
		$str2 = "GetPluginCommandID"
		$str3 = "GetPluginName"
		$str4 = "GetPluginVersion"

	condition:
		all of them
}