YARA · SecuInfra Falcon Team
SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Recbin_Jun23
Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Recycle Bin; could potentially yield FPs
- Author
- SECUINFRA Falcon Team (@SI_FalconTeam)
- Date
- 2023-06-21
- Score / Quality
- 75 / 70
What this rule detects
Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Recycle Bin; could potentially yield FPs
Associated malware family: Plugx.
It defines 3 patterns (3 text, 0 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from SecuInfra Falcon Team, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: SECUINFRA Falcon Team (@SI_FalconTeam)
Source repository: SecuInfra Falcon Team @ 2d7c66d7d1
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 026eba63-12c1-55aa-b736-aea0494c1ab9
Metadata
| tlp | CLEAR |
|---|
Related rules
- SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Icon_Jun23Metadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
- SECUINFRA_MALWARE_Plugx_USB_Delivery_LNK_Jun23Metadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- MalwareSEKOIA.IO Community· Sekoia.io· 2023-07-04
- ARKBIRD_SOLG_Mal_Plugx_Thor_July_2021_1Metadata onlyMalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-07-27
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-12-18
- SECUINFRA_MALWARE_Emotet_Onenote_Delivery_Wsf_Mar23Metadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-03-16
- SECUINFRA_RANSOM_Esxiargs_Ransomware_Bash_Feb23Metadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07