Skip to content
yararules.org
Menu

YARA · Cado Security (via Open-Source-YARA-rules)

CADOSECURITY_Powershell_Downloader_POWERGAP

Detects POWERGAP downloader used against Ukrainian ICS

MalwareCado Security (via Open-Source-YARA-rules)Apache License 2.0Compiles with YARA-X
Author
mmuir@cadosecurity.com
Date
2022-04-12
Modified
2022-07-06
Score / Quality
75 / 80

What this rule detects

Detects POWERGAP downloader used against Ukrainian ICS

It defines 8 patterns (8 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
powershell-downloader-powergap.yarApache License 2.0
rule CADOSECURITY_Powershell_Downloader_POWERGAP
{
	meta:
		description = "Detects POWERGAP downloader used against Ukrainian ICS"
		author = "mmuir@cadosecurity.com"
		id = "d2a2604c-c558-5663-8dd3-44f3fdda1f71"
		date = "2022-04-12"
		modified = "2022-07-06"
		reference = "https://github.com/cado-security/DFIR_Resources_Industroyer2"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Powershell_Downloader_POWERGAP.yar#L1-L19"
		license_url = "N/A"
		logic_hash = "a9ef1d04ca921f285e973f6abcb2b355eae110678da866e3b6499aa0318338fd"
		score = 75
		quality = 80
		tags = ""
		license = "Apache License 2.0"

	strings:
		$a = "Start-work" ascii
		$b = "$GpoGuid" ascii
		$c = "$SourceFile" ascii
		$d = "$DestinationFile" ascii
		$e = "$appName" ascii
		$f = "LDAP://ROOTDSE" ascii
		$g = "GPT.INI" ascii
		$h = "Get-WmiObject" ascii

	condition:
		5 of them
}

Strings (8 patterns)

IdentifierTypeValueModifiers
$atext"Start-work"ascii
$btext"$GpoGuid"ascii
$ctext"$SourceFile"ascii
$dtext"$DestinationFile"ascii
$etext"$appName"ascii
$ftext"LDAP://ROOTDSE"ascii
$gtext"GPT.INI"ascii
$htext"Get-WmiObject"ascii

Condition

5 of them

In plain words (Heuristic)

  • At least 5 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: mmuir@cadosecurity.com

Source repository: Cado Security (via Open-Source-YARA-rules) @ ec0056f767

Licence: Apache License 2.0 (stated in the rule's own meta)

“Apache License 2.0”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: d2a2604c-c558-5663-8dd3-44f3fdda1f71

Related rules