SEKOIA_Apt_Oilrig_Webshell

rule SEKOIA_Apt_Oilrig_Webshell : FILE
{
	meta:
		description = "Detects a webshell used by OilRig"
		author = "Sekoia.io"
		id = "53955117-5176-4682-89ad-1503faba42aa"
		date = "2024-10-23"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_oilrig_webshell.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "0e0879bafa1becf7e4aef008229a79ab8e0c50eda03232abd5cbb8fc59f482d3"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "string d = com;"
		$ = "string p = fu;"
		$ = "#@rt12!@$$$nnMF##"
		$ = "messi(d)))"

	condition:
		2 of them and filesize < 80KB
}