SEKOIA_Crime_Sload_Powershellarchiveexfiltrator_Strings

rule SEKOIA_Crime_Sload_Powershellarchiveexfiltrator_Strings : FILE
{
	meta:
		description = "No description has been set in the source file - SEKOIA"
		author = "Sekoia.io"
		id = "3934696a-2116-49cb-9f75-3740767ad6f3"
		date = "2022-08-02"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/crime_sload_powershellarchiveexfiltrator_strings.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "7d6234ced7e5915a5b27ce2065772c74adb5c2398a8c972421fb5ec6b1b7771f"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "if ($wr1 -or $wr2){"
		$ = "if ($zp1 -or $zp2){"
		$ = "-join ((65..90) + (97..122) | Get-Random -Count 16 | % {[char]$_});"

	condition:
		all of them and filesize < 1KB
}