WITHSECURELABS_GREYVIBE_Phantomrelay_Watchdog

rule WITHSECURELABS_GREYVIBE_Phantomrelay_Watchdog : FILE
{
	meta:
		description = "Detects GREYVIBE's watchdog script for PhantomRelay"
		author = "WithSecure"
		id = "c59eef2e-22c8-5df2-aa81-111cce4d20c8"
		date = "2026-05-28"
		modified = "2026-05-28"
		reference = "https://github.com/WithSecureLabs/iocs"
		source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L91-L103"
		license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE"
		logic_hash = "19d5fdaf2e2c98637971427761e316fd405a0f6d8e7f539dc9f72d20313ba43c"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$a1 = "--headless"
		$a2 = "/watchdog"
		$a3 = "Register-ScheduledTask"
		$a4 = "DownloadFile"

	condition:
		filesize < 50KB and all of them
}