ELCEEF_HTML_Windows_Search_Abuse

rule ELCEEF_HTML_Windows_Search_Abuse
{
	meta:
		description = "Detects HTML files abusing Windows system functionalities to redirect and download malicious payloads"
		author = "marcin@ulikowski.pl"
		id = "537cb46e-4cfc-517c-8d6d-0019f2c3e5ef"
		date = "2024-06-15"
		modified = "2024-06-16"
		reference = "https://github.com/elceef/yara-rulz"
		source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/HTML_Windows_Search.yara#L1-L22"
		license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE"
		hash = "d136dcfc355885c502ff2c3be229791538541b748b6c07df3ced95f9a7eb2f30"
		logic_hash = "6a0d490cf08ab0aad3c535645abe9ebc26d12768cf2a2e932cdb7ec93cf3e2bd"
		score = 75
		quality = 73
		tags = ""

	strings:
		$location1 = "location.href" wide ascii
		$location2 = "location.replace(" wide ascii
		$location3 = "location.assign(" wide ascii
		$metarefresh = "<meta http-equiv=\"refresh\"" nocase wide ascii
		$search1 = "\"search-ms:query=" wide ascii
		$search2 = "\"search:query=" wide ascii
		$search3 = "URL=search:query=" wide ascii
		$crumb1 = "&crumb=location:" wide ascii
		$crumb2 = "&amp;crumb=location:" wide ascii

	condition:
		( any of ( $location* ) or $metarefresh ) and any of ( $search* ) and any of ( $crumb* )
}