Skip to content
yararules.org
Menu

YARA · ditekSHen detection

DITEKSHEN_INDICATOR_TOOL_PET_P0Wnedshell

Detects compiled executables of p0wnedShell post-exploitation toolkit

Suspicious / huntingditekSHen detectionBSD 2-Clause LicenseCompiles with YARA-X
Author
ditekSHen
Date
2020-11-06
Modified
2024-09-25
Score / Quality
75 / 75

What this rule detects

Detects compiled executables of p0wnedShell post-exploitation toolkit

Targets: Windows PE.

It defines 19 patterns (19 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
indicator-tool-pet-p0wnedshell.yarBSD 2-Clause License
rule DITEKSHEN_INDICATOR_TOOL_PET_P0Wnedshell : FILE
{
	meta:
		description = "Detects compiled executables of p0wnedShell post-exploitation toolkit"
		author = "ditekSHen"
		id = "7df8f9b4-48d3-5271-9d60-5dd4bfaed316"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L486-L512"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9745b69573bf695fdada122143fb1889a7b2025250b5fb1e8f1a86b3be6f27d3"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "Use WinRM, PsExec, SMB/WMI to execute commands on remote systems" wide
		$s2 = "-CreateProcess \"cmd.exe\" -Username \"nt authority\\system\"" wide
		$s3 = "-Command '\"lsadump::dcsync /user:" wide
		$s4 = "-Payload windows/meterpreter/reverse_https -Lhost" wide
		$s5 = "Get-Content ./EncodedPayload.bat" fullword wide
		$e1 = "OnYNAB+LCAAAAAAABAC8vOeS60iSLvh75yly+rZZVxuqC4KQs3uvLQhFEJIACALoHVuD1oKQBMbuuy+Y4pw8dUTf3R+bZlWVZHh87uHh4vPItv63ZGrCMW+bF7GZ2zL+" wide
		$e2 = "kuIeAB+LCAAAAAAABADsvWt327iuMPw9v0Jv27Wa7DqJc2ma5nl71vZFTpzx/ZJL+3TlyLZiq7EtjyTHcffZ//0BSEqiKEqWbKczs8941qS2LgAIAiAIguDjfNp3DHOq" wide
		$e3 = "mZYIAB+LCAAAAAAABADsvflj2zyOMPx7/gptmnftbBIfuZp0t/OOfMZp7PjO0adfX9lSbCWy5Vp2HGfm+d8/ACQl6vCRNp2Z3bVmnioWSRAEQQAESfC/Pmwp8FTtmTFu" wide
		$e4 = "u9YGAB+LCAAAAAAABADsvW1D40ayKPw9v0Lr4V7ZE8vY5mUY9rKJBzMTnmWAgyGTvYTlCluAdmzJK9nDsEn++1NV/S61ZJmXZJIN52wG7O7q6urq6qrqquoXSfDveZgE" wide
		$e5 = "T3gDAB+LCAAAAAAABADtvX1f2zq2KPz3yafQzuZcwi5JEydQ2nM7v4cCnc0zQLmE7j3z6+7NmMQBnwY7YzsFTqff/WpJsi3Jki07DlA2mT008ctaS0tL601L0nThjSPX" wide
		$e6 = "zRgDAB+LCAAAAAAABADtfW1327jR6OdHv4Kr9TmWdiVZkl+SdZs913Gcrm9tx7WcbvekuS4t0TYbiVRJKYmfbf77xeCNeCVBinKcbNStI5HAYDAYDAaDwczNMhovwjjy" wide
		$e7 = "pxICAB+LCAAAAAAABADtvf17GkeyKPyz+Cvmlfw+ggRhfcXr1X1znsUIx5yVhC7IUbI+fnUHGKRZwww7M1jWyeZ/v1XV3z09wABysnviZ1cBpqe6urqquqq6uno8j4ZZ" wide
		$e8 = "H4sIAAAAAAAEANy9e3wTVfo4PG1SmkLbCdpgFdSgUeuCbLTAthYk005gQhNahUIVkCqIqKi1TaAuIGBaJRzG27Kuul5wV3fV1fUuUFxNKbTl3oJAuaiouE4paAGBFpB5" wide
		$k1 = "EasySystemPPID" fullword ascii
		$k2 = "EasySystemShell" fullword ascii
		$k3 = "LatMovement" fullword ascii
		$k4 = "ListenerURL" fullword ascii
		$k5 = "MeterStager" fullword ascii
		$k6 = "PatchEventLog" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 7 of ( $e* ) or all of ( $k* ) or ( 2 of ( $s* ) and 2 of ( $e* ) and 2 of ( $k* ) ) )
}

Strings (19 patterns)

IdentifierTypeValueModifiers
$s1text"Use WinRM, PsExec, SMB/WMI to execute commands on remote systems"wide
$s2text"-CreateProcess \"cmd.exe\" -Username \"nt authority\\system\""wide
$s3text"-Command '\"lsadump::dcsync /user:"wide
$s4text"-Payload windows/meterpreter/reverse_https -Lhost"wide
$s5text"Get-Content ./EncodedPayload.bat"fullword wide
$e1text"OnYNAB+LCAAAAAAABAC8vOeS60iSLvh75yly+rZZVxuqC4KQs3uvLQhFEJIACALoHVuD1oKQBMbuuy+Y4pw8dUTf3R+bZlWVZHh87uHh4vPItv63ZGrCMW+bF7GZ2zL+"wide
$e2text"kuIeAB+LCAAAAAAABADsvWt327iuMPw9v0Jv27Wa7DqJc2ma5nl71vZFTpzx/ZJL+3TlyLZiq7EtjyTHcffZ//0BSEqiKEqWbKczs8941qS2LgAIAiAIguDjfNp3DHOq"wide
$e3text"mZYIAB+LCAAAAAAABADsvflj2zyOMPx7/gptmnftbBIfuZp0t/OOfMZp7PjO0adfX9lSbCWy5Vp2HGfm+d8/ACQl6vCRNp2Z3bVmnioWSRAEQQAESfC/Pmwp8FTtmTFu"wide
$e4text"u9YGAB+LCAAAAAAABADsvW1D40ayKPw9v0Lr4V7ZE8vY5mUY9rKJBzMTnmWAgyGTvYTlCluAdmzJK9nDsEn++1NV/S61ZJmXZJIN52wG7O7q6urq6qrqquoXSfDveZgE"wide
$e5text"T3gDAB+LCAAAAAAABADtvX1f2zq2KPz3yafQzuZcwi5JEydQ2nM7v4cCnc0zQLmE7j3z6+7NmMQBnwY7YzsFTqff/WpJsi3Jki07DlA2mT008ctaS0tL601L0nThjSPX"wide
$e6text"zRgDAB+LCAAAAAAABADtfW1327jR6OdHv4Kr9TmWdiVZkl+SdZs913Gcrm9tx7WcbvekuS4t0TYbiVRJKYmfbf77xeCNeCVBinKcbNStI5HAYDAYDAaDwczNMhovwjjy"wide
$e7text"pxICAB+LCAAAAAAABADtvf17GkeyKPyz+Cvmlfw+ggRhfcXr1X1znsUIx5yVhC7IUbI+fnUHGKRZwww7M1jWyeZ/v1XV3z09wABysnviZ1cBpqe6urqquqq6uno8j4ZZ"wide
$e8text"H4sIAAAAAAAEANy9e3wTVfo4PG1SmkLbCdpgFdSgUeuCbLTAthYk005gQhNahUIVkCqIqKi1TaAuIGBaJRzG27Kuul5wV3fV1fUuUFxNKbTl3oJAuaiouE4paAGBFpB5"wide
$k1text"EasySystemPPID"fullword ascii
$k2text"EasySystemShell"fullword ascii
$k3text"LatMovement"fullword ascii
$k4text"ListenerURL"fullword ascii
$k5text"MeterStager"fullword ascii
$k6text"PatchEventLog"fullword ascii

Condition

uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 7 of ( $e* ) or all of ( $k* ) or ( 2 of ( $s* ) and 2 of ( $e* ) and 2 of ( $k* ) ) )

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • All patterns in ( $k* ) must match.
  • At least 3 patterns in ( $s* ) must match.
  • At least 7 patterns in ( $e* ) must match.
  • At least 2 patterns in ( $s* ) must match.
  • At least 2 patterns in ( $e* ) must match.
  • At least 2 patterns in ( $k* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: ditekSHen

Source repository: ditekSHen detection @ e76c93dcde

Licence: BSD 2-Clause License (repository licence)

Copyright notice: Copyright 2021 by ditekSHen (https://github.com/ditekshen/detection).

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 7df8f9b4-48d3-5271-9d60-5dd4bfaed316

Tags:FILE

Related rules