SEKOIA_Apt_Polonium_Powershell_Creepydrive_Strings

rule SEKOIA_Apt_Polonium_Powershell_Creepydrive_Strings
{
	meta:
		description = "Detects POLONIUM CreepyDrive Powershell implant"
		author = "Sekoia.io"
		id = "0ba196bd-9cd6-4553-b7bf-69989cdb8be4"
		date = "2022-06-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_polonium_powershell_creepydrive_strings.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "28b8f10a36d13e97e606b082f20c50c3d48241409e7f1aca621e2af9d756dbe5"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "function Exec($comm)" base64 ascii wide
		$ = "$comm = $comm + \"| outstring" base64 ascii wide
		$ = "Invoke-Expression -Command:$comm" base64 ascii wide
		$ = "microsoft.com" base64 ascii wide
		$ = "$req = Invoke-WebRequest" base64 ascii wide
		$ = "$j += $data" base64 ascii wide
		$ = "$res = Exec($arr[$i])" base64 ascii wide
		$ = "$arr = @(iex \"$req\")" base64 ascii wide
		$ = "elseif ($req -cmatch" base64 ascii wide
		$ = "graph.microsoft.com" base64 ascii wide

	condition:
		3 of them
}