YARA · SecuInfra Falcon Team
SECUINFRA_APT_Bitter_Maldoc_Verify
Detects Bitter (T-APT-17) shellcode in oleObject (CVE-2018-0798)
- Author
- SECUINFRA Falcon Team (@SI_FalconTeam)
- Date
- 2022-06-01
- Modified
- 2022-07-05
- Score / Quality
- 75 / 70
What this rule detects
Detects Bitter (T-APT-17) shellcode in oleObject (CVE-2018-0798)
It defines 8 patterns (7 text, 1 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from SecuInfra Falcon Team, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 0c7158f9fc2093caf5ea1e34d8b8fffce0780ffd25191fac9c9b52c3208bc450
- bd0d25194634b2c74188cfa3be6668590e564e6fe26a6fe3335f95cbc943ce1d
- 3992d5a725126952f61b27d43bd4e03afa5fa4a694dca7cf8bbf555448795cd6
Licence & attribution
Author: SECUINFRA Falcon Team (@SI_FalconTeam)
Source repository: SecuInfra Falcon Team @ 2d7c66d7d1
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 8e0e32d3-f00e-5145-9386-f42ddca703ae
Metadata
| tlp | WHITE |
|---|
Tags:CVE_2018_0798
Related rules
- SECUINFRA_APT_Bitter_Almond_RATMetadata onlyAPT / threat actorSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-01
- SECUINFRA_APT_Bitter_PDB_PathsMetadata onlyAPT / threat actorSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-22
- SECUINFRA_MALWARE_Emotet_Onenote_Delivery_Wsf_Mar23Metadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-03-16
- SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Icon_Jun23Metadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
- MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
- SECUINFRA_MALWARE_Plugx_USB_Delivery_LNK_Jun23Metadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
- SECUINFRA_RANSOM_Esxiargs_Ransomware_Bash_Feb23Metadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07
- SECUINFRA_RANSOM_Esxiargs_Ransomware_Encryptor_Feb23Metadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07