SEKOIA_Apt_Unc4990_Explorer_Ps1_Reverse_B64

rule SEKOIA_Apt_Unc4990_Explorer_Ps1_Reverse_B64 : FILE
{
	meta:
		description = "Detects reverse base64 files (explorer.ps1)"
		author = "Sekoia.io"
		id = "35c3ffb2-2ced-426c-ac3f-a8cd0c357672"
		date = "2024-02-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_unc4990_explorer_ps1_reverse_b64.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "bf13fbf2dbe6a718510f3e435a9fe06517ed962f8e129d79a15e6a301e5713ca"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s0 = "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(\""
		$s1 = "Wa1VHJ\"[-1..-"
		$s2 = "-join '')))"

	condition:
		all of them and $s0 at 0 and @s2 - @s2 < 20
}