ESET_Cw_Windows_Redline_Panel_Status_Message_Strings

rule ESET_Cw_Windows_Redline_Panel_Status_Message_Strings : FILE
{
	meta:
		description = "Matches error/success messages in Redline panel"
		author = "ESET Research"
		id = "70bdff10-9c86-57e3-b839-e86173a44855"
		date = "2022-10-11"
		modified = "2024-11-12"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/redline/redline.yar#L115-L142"
		license_url = "https://github.com/eset/malware-ioc/blob/17baf44964a77368e9149f4f593eb098beddf1c5/LICENSE"
		hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d"
		logic_hash = "c60fabc81967b083be72ff564af744ab60441de5d563ea6d88d873c0a99bfbdd"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = 1

	strings:
		$ = "All Browsers are empty"
		$ = "Client [{0}:{1}:{2}] completed task with {3} ID."
		$ = "A List of logs cleared"
		$ = "Browsers not found"
		$ = "Browsers is empty"
		$ = "Done. Check your build file"
		$ = "You must to enable assembly info or certificate in settings"
		$ = "Duplicate log from "
		$ = "Password list is empty"
		$ = "Cookie list is empty"
		$ = "FTPs not found"
		$ = "Files not found"

	condition:
		uint16( 0 ) == 0x5A4D and 8 of them
}