SEKOIA_Implant_Lin_Lightning

rule SEKOIA_Implant_Lin_Lightning : FILE
{
	meta:
		description = "Detect the Lightning framework (Core & Downloader plugin)"
		author = "Sekoia.io"
		id = "56f53e89-3b63-4ce7-a3c8-da0ba37246f1"
		date = "2022-07-21"
		modified = "2024-12-19"
		reference = "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/implant_lin_lightning.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "215eea8275fa69a901f6413b334d2824086098e9a9bb2cffd7cb9df5c869be4c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "{\"ComputerName\":\"%s\",\"Guid\":\"%s\",\"RequestName\":\"%s\",\"Licence\":\"%s\"}"
		$ = "kill -9 %s"
		$ = "{%08X-%04X-%04X-%04X-%04X%04X%04X}"
		$ = "sleep 60 && ./%s &"
		$ = "cat /sys/class/net/%s/address"
		$ = "/usr/bin/netstat"
		$ = "/usr/bin/whoami"
		$ = "/usr/bin/su"
		$ = "dup2: %s"
		$ = "Linux.Plugin.Kernel_%s"
		$ = "Lightning"

	condition:
		uint32( 0 ) == 0x464c457f and 9 of them
}