SEKOIA_Apt_Oilrig_Maliciousdocument_May2022

rule SEKOIA_Apt_Oilrig_Maliciousdocument_May2022 : FILE
{
	meta:
		description = "Detects OilRig Malicious Document"
		author = "Sekoia.io"
		id = "cb4ab310-e24c-4edc-8804-0c49c30124fb"
		date = "2022-05-13"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_oilrig_maliciousdocument_may2022.yar#L1-L22"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "d4aa960d4471ddf66ec6f98a5c883177763771ba9960b749509311a05384d9a7"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s1 = "<LogonType>InteractiveToken</LogonType>"
		$s2 = "Select * From Win32_PingStatus Where Address"
		$s3 = "She@et1"
		$s4 = "_VBA_PROJECT" wide
		$s5 = "This program cannot be run in DOS mode." base64
		$s6 = ".Agent.pdb" base64
		$s7 = "GetAgentID" base64

	condition:
		uint32be( 0 ) == 0xD0CF11E0 and 3 of them
}