SEKOIA_Apt_Unk_Hrserv_Memory_Commands_Strings

rule SEKOIA_Apt_Unk_Hrserv_Memory_Commands_Strings
{
	meta:
		description = "Detects HrServ web shell memory commands"
		author = "Sekoia.io"
		id = "1b5f442a-e758-4bd5-a612-8b504a542d29"
		date = "2023-11-23"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_unk_hrserv_memory_commands_strings.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "a87c35658ded301c098f9ee8ee5886a54e89537eabd145cf82b0286c703a77d2"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "list all the process" ascii wide
		$ = "equal with cmd /c tasklist" ascii wide
		$ = "start target service by name" ascii wide
		$ = "query local process information by wmi." ascii wide
		$ = "upload local shellcode to" ascii wide

	condition:
		all of them
}