YARA · SEKOIA.IO Community
SEKOIA_Apt_Uac0154_Malicious_Html_Smuggling
UAC-0154 Infection chain
- Author
- Sekoia.io
- Date
- 2023-10-02
- Modified
- 2024-12-19
- Score / Quality
- 75 / 80
What this rule detects
UAC-0154 Infection chain
It defines 3 patterns (3 text, 0 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
apt-uac0154-malicious-html-smuggling.yarDetection Rule License 1.1
rule SEKOIA_Apt_Uac0154_Malicious_Html_Smuggling : FILE
{
meta:
= "UAC-0154 Infection chain"
= "Sekoia.io"
= "923d11e5-6332-456d-8aff-ae7fb76193a8"
= "2023-10-02"
= "2024-12-19"
= "https://github.com/SEKOIA-IO/Community"
= "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_uac0154_malicious_html_smuggling.yar#L1-L17"
= "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
= "ba37b076ac29edcb9af7792420b527b0d64e7838e0237b39afe98a817eafdf7e"
= 75
= 80
= "FILE"
= "1.0"
= "TLP:CLEAR"
strings:
$ = "Microsoft® HTML Help Workshop 4.1"
$ = "var a=['"
$ = ")+b('0x"
condition:
all of them and filesize < 100KB
}
Strings (3 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $ | text | "Microsoft® HTML Help Workshop 4.1" | |
| $ | text | "var a=['" | |
| $ | text | ")+b('0x" |
Condition
all of them and filesize < 100KBIn plain words (Heuristic)
- The file must be smaller than 100KB (a cheap guard that skips large files).
- All patterns in the rule must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
References
Licence & attribution
Author: Sekoia.io
Source repository: SEKOIA.IO Community @ a438a5901a
Licence: Detection Rule License 1.1 (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 923d11e5-6332-456d-8aff-ae7fb76193a8
Metadata
| version | 1.0 |
|---|---|
| classification | TLP:CLEAR |
Tags:FILE
Related rules
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-10
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11
- APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06