SEKOIA_Generic_Bat_Script_Mock_Http_Services

rule SEKOIA_Generic_Bat_Script_Mock_Http_Services : FILE
{
	meta:
		description = "Generic rule detecting BAT script using mock HTTP services (used by APT28)"
		author = "Sekoia.io"
		id = "1cfbe5ba-6304-476d-8308-928100a85c16"
		date = "2023-09-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/generic_bat_script_mock_http_services.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "d34be59cfb054895381580e7852bba6b899cfb680882b7fd24a72438131c3bee"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$bat1 = "@echo off"
		$bat2 = "chcp 65001"
		$ps1 = "WebClient"
		$ps2 = "UploadString"
		$dom1 = "mockbin.org"
		$dom2 = "webhook.site"
		$dom3 = "mocky.io"
		$dom4 = "pipedream.com"

	condition:
		(1 of ( $bat* ) or 1 of ( $ps* ) ) and 1 of ( $dom* ) and filesize < 2000
}