SEKOIA_Tool_Rubeus_Strings

rule SEKOIA_Tool_Rubeus_Strings : FILE
{
	meta:
		description = "Detects Rubeus"
		author = "Sekoia.io"
		id = "df1860d0-ec34-4c2d-bd83-5f16b26d075c"
		date = "2024-03-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/tool_rubeus_strings.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "adc6a5207bb15c8020ca170564ea9066b2c0b0e09839d6838744c623f59153cf"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = ".Ndr.RPC_DISPATCH_TABLE32"
		$ = ".Ndr.RPC_PROTSEQ_ENDPOINT32"
		$ = ".Ndr.RPC_SERVER_INTERFACE32"
		$ = ".Ndr.NDR_EXPR_DESC32"
		$ = "$krb5tgs${0}$*{1}${2}${3}*${4}${5}" wide
		$ = "$krb5asrep$23${0}@{1}:{2}" wide
		$ = "Unable to decrypt the EncTicketPart using key:" wide
		$ = "[*] Target service  : {0:x}" wide

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 1MB and 5 of them
}