DITEKSHEN_INDICATOR_RMM_Dwagent_CERT

import "pe"

rule DITEKSHEN_INDICATOR_RMM_Dwagent_CERT : FILE
{
	meta:
		description = "Detects DWAgent by certificate. Review RMM Inventory"
		author = "ditekSHen"
		id = "96572e83-ffb9-58d9-93d1-84e16ae1a3ba"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L547-L563"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		hash = "4a13f46def2c9427898a46a88a6a2122ed106b37"
		logic_hash = "9ed86f053c8d1423aae8cfc6e0bba6021510dfb6d722430c8c7edb15d3e8233a"
		score = 75
		quality = 75
		tags = "FILE"

	condition:
		uint16( 0 ) == 0x5a4d and for any i in ( 0 .. pe.number_of_signatures ) : ( pe.signatures [ i ] . subject contains "DWSNET srl" and pe.signatures [ i ] . issuer contains "Sectigo Public Code Signing CA R36" and pe.signatures [ i ] . serial == "00:af:bd:d3:be:b2:4e:1d:e7:37:82:e9:f8:34:7c:f1:53" )
}