SEKOIA_Tool_Win_Gosecretsdump

rule SEKOIA_Tool_Win_Gosecretsdump : FILE
{
	meta:
		description = "Finds gosecretsdump EXE based on strings"
		author = "Sekoia.io"
		id = "9225fe95-e37c-48ff-b5b5-680f255349bd"
		date = "2024-06-10"
		modified = "2024-12-19"
		reference = "https://github.com/C-Sto/gosecretsdump/releases"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/tool_win_gosecretsdump.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "957b0deae745e4fda5a790acc391cebf9d193efb2a19ad5eb18c54da8c17bcfa"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "github.com/C-Sto/gosecretsdump" ascii
		$str02 = "/pkg/esent" ascii
		$str03 = "/pkg/ditreader" ascii
		$str04 = "/pkg/samreader" ascii
		$str05 = "ntdsFileLocation" ascii
		$str06 = "NTDSLoc" ascii
		$str07 = "SAMEntries" ascii
		$str08 = "SAMHashAES" ascii
		$str09 = "NTLMHash" ascii
		$str10 = "HasNoLMHashPolicy" ascii
		$str11 = "PreviousIncBackup" ascii
		$str12 = "Esent_record" ascii

	condition:
		uint16( 0 ) == 0x5A4D and 7 of them
}