VOLEXITY_Webshell_Aspx_Regeorgtunnel

rule VOLEXITY_Webshell_Aspx_Regeorgtunnel : FILE MEMORY
{
	meta:
		description = "A variation of the reGeorgtunnel open-source webshell."
		author = "threatintel@volexity.com"
		id = "b8aa27c9-a28a-5051-8f81-1184f28842ed"
		date = "2021-03-02"
		modified = "2024-10-18"
		reference = "https://github.com/sensepost/reGeorg/blob/master/tunnel.aspx"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L26-L56"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928"
		logic_hash = "ea3d0532cb609682922469e8272dc8061efca3b3ae27df738ef2646e30404c6f"
		score = 75
		quality = 80
		tags = "FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 4979
		version = 4

	strings:
		$s1 = "System.Net.Sockets"
		$s2 = "System.Text.Encoding.Default.GetString(Convert.FromBase64String(StrTr(Request.Headers.Get"
		$t1 = ".Split('|')"
		$t2 = "Request.Headers.Get"
		$t3 = ".Substring("
		$t4 = "new Socket("
		$t5 = "IPAddress ip;"

	condition:
		all of ( $s* ) or all of ( $t* )
}