SEKOIA_Apt_Cloudatlas_Powershower_Clean

rule SEKOIA_Apt_Cloudatlas_Powershower_Clean : FILE
{
	meta:
		description = "Detects clean version of PowerShower"
		author = "Sekoia.io"
		id = "4a7c37df-3f53-4190-a86f-94bba3df628e"
		date = "2022-12-05"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_cloudatlas_powershower_clean.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "24ea6ec0cd8dbcebdf7e42dbd48319562d8682fefd5d0d464a3a5c4b90be40f3"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "[io.file]::WriteAllBytes($zipfile" ascii wide
		$ = "System.IO.File]::Exists($p_t" ascii wide
		$ = "HttpRequestP" ascii wide
		$ = "$http_request.getOption(2)" ascii wide
		$ = "HttpRequestP($url)" ascii wide

	condition:
		uint8( 0 ) == 0x24 and filesize < 4000 and 4 of them
}