SEKOIA_Implant_Win_Sliver_Dll

import "pe"

rule SEKOIA_Implant_Win_Sliver_Dll : FILE
{
	meta:
		description = "Detect the Sliver DLL based on export names (standalone and process/memory dumps)"
		author = "Sekoia.io"
		id = "41d83011-a08b-4245-b633-79fe6afaa4d2"
		date = "2021-11-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/implant_win_sliver_dll.yar#L3-L32"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "251a123fe70338d18c9bc9fb9e0b0d542f2b94203bee8537244e62fa102f371b"
		score = 75
		quality = 80
		tags = "FILE"
		modification_date = "2021-12-22"
		version = "1.1"
		classification = "TLP:CLEAR"

	strings:
		$a1 = "main.RunSliver"
		$a2 = "main.DllInstall"

	condition:
		( filesize > 8MB and filesize < 11MB and uint16be( 0 ) == 0x4d5a and pe.characteristics & pe.DLL and pe.exports ( "RunSliver" ) and pe.exports ( "DllInstall" ) and pe.exports ( "VoidFunc" ) ) or ( true and ( uint32be( 0 ) == 0x4d444d50 or uint32be( 0 ) == 0x00000000 ) and $a2 in ( @a1 .. @a1 + 100 ) )
}