YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_Fscan_Port_Scanner_Output_Jun23

Detects output generated by the command line port scanner FScan

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth
Date: 2023-06-15
Modified: 2023-12-05
Score / Quality: 70 / 85

What this rule detects

Detects output generated by the command line port scanner FScan

It defines 3 patterns (3 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

susp-fscan-port-scanner-output-jun23.yarDetection Rule License 1.1

rule SIGNATURE_BASE_SUSP_Fscan_Port_Scanner_Output_Jun23 : SCRIPT FILE
{
	meta:
		description = "Detects output generated by the command line port scanner FScan"
		author = "Florian Roth"
		id = "7eb4b27f-0c5b-5d7e-b759-95d7894d5822"
		date = "2023-06-15"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_barracuda_esg_unc4841_jun23.yar#L103-L117"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "49b5055c96d7b7446ee5ae8667a5aa3645f0f98d8b5f2bffcd6ef3b20bc64e05"
		score = 70
		quality = 85
		tags = "SCRIPT, FILE"

	strings:
		$s1 = "[*] NetInfo:" ascii
		$s2 = ":443 open" ascii
		$s3 = "   [->]"

	condition:
		filesize < 800KB and all of them
}

Strings (3 patterns)

Identifier	Type	Value	Modifiers
$s1	text	"[*] NetInfo:"	ascii
$s2	text	":443 open"	ascii
$s3	text	" [->]"

Condition

filesize < 800KB and all of them

In plain words (Heuristic)

The file must be smaller than 800KB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally

Licence & attribution

Author: Florian Roth

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 7eb4b27f-0c5b-5d7e-b759-95d7894d5822

Tags:SCRIPT FILE

SIGNATURE_BASE_SUSP_Command_Line_Combos_Feb24_2
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-02-23
SIGNATURE_BASE_SUSP_Screenconnect_Exploitation_Artefacts_Feb24
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-02-23
SIGNATURE_BASE_SUSP_PS1_Combo_Transfersh_Feb24
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-02-23
SIGNATURE_BASE_SUSP_PY_Shell_Spawn_Jun23_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-06-15
SIGNATURE_BASE_APT_PS1_Sysaid_EXPL_Forensicartifacts_Nov23_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth· 2023-11-09
SIGNATURE_BASE_EXPL_Cleo_Exploitation_Log_Indicators_Dec24
ExploitSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-12-10
SIGNATURE_BASE_EXPL_Cleo_Exploitation_PS1_Indicators_Dec24
ExploitSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-12-10
SIGNATURE_BASE_SUSP_MAL_Signingcert_Feb24_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth· 2024-02-23