YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_M_Hunting_Webshell_LIGHTWIRE_2

Detects LIGHTWIRE based on the RC4 decoding and execution 1-liner.

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Mandiant (modified by Florian Roth)
Date: 2024-01-11
Modified: 2024-01-12
Score / Quality: 75 / 85

What this rule detects

Detects LIGHTWIRE based on the RC4 decoding and execution 1-liner.

It defines 5 patterns (5 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

m-hunting-webshell-lightwire-2.yarDetection Rule License 1.1

rule SIGNATURE_BASE_M_Hunting_Webshell_LIGHTWIRE_2 : FILE
{
	meta:
		description = "Detects LIGHTWIRE based on the RC4 decoding and execution 1-liner."
		author = "Mandiant (modified by Florian Roth)"
		id = "9451da63-c68e-51e8-b4b1-c3082d46fbf6"
		date = "2024-01-11"
		modified = "2024-01-12"
		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_report_ivanti_mandiant_jan24.yar#L60-L81"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "3d97f55a03ceb4f71671aa2ecf5b24e9"
		logic_hash = "37b22a6c45dd53bc7b3f0c75cc5072e990246fea24591d192176c0b496e92084"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "eval{my"
		$s2 = "Crypt::RC4->new(\""
		$s3 = "->RC4(decode_base64(CGI::param('"
		$s4 = ";eval $"
		$s5 = "\"Compatibility check: $@\";}"

	condition:
		filesize < 10KB and all of them
}

Strings (5 patterns)

Identifier	Type	Value
$s1	text	"eval{my"
$s2	text	"Crypt::RC4->new(\""
$s3	text	"->RC4(decode_base64(CGI::param('"
$s4	text	";eval $"
$s5	text	"\"Compatibility check: $@\";}"

Condition

filesize < 10KB and all of them

In plain words (Heuristic)

The file must be smaller than 10KB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

3d97f55a03ceb4f71671aa2ecf5b24e9

Licence & attribution

Author: Mandiant (modified by Florian Roth)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 9451da63-c68e-51e8-b4b1-c3082d46fbf6

Tags:FILE