VOLEXITY_Apt_Malware_Win_CLEANGULP_Memoryonly

rule VOLEXITY_Apt_Malware_Win_CLEANGULP_Memoryonly : CLEANGULP MEMORY
{
	meta:
		description = "CLEANGULP: Detects decoded runtime strings associated with command-and-control, tasking, and persistence."
		author = "threatintel@volexity.com"
		id = "e1c0e877-2d11-567c-8e9f-c40ef9d8f784"
		date = "2026-09-16"
		modified = "2026-09-16"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2026/2026-09-21 Chrome-part-2/rules.yar#L1-L29"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		logic_hash = "dd65a0a286689427b296b4468147231e9ff17aa2ba1e6ce582f53db50b5b543f"
		score = 75
		quality = 80
		tags = "CLEANGULP, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "memory"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 13450
		version = 1

	strings:
		$protocol_pre_register = "%s/beacon/pre-register" ascii
		$protocol_register = "%s/beacon/register" ascii
		$protocol_registration = "{\"uuid\":\"%s\",\"username\":\"%s\",\"computer\":\"%s\",\"internal_ip\":\"%s\",\"process\":\"%s\",\"pid\":%d,\"arch\":\"%s\",\"is_admin\":%s}" ascii
		$protocol_file_transfer = "{\"task_id\":\"%s\",\"filename\":\"%s\",\"data\":\"%s\",\"size\":%ld,\"chunk\":%d,\"total_chunks\":%d,\"file_transfer\":true}" ascii
		$capability_help = "Available: shell, ps, ls, upload, download, sleep, exit, help, bof" ascii
		$capability_upload = "[-] Usage: upload <server_filename>:<target_path>" ascii
		$capability_bof = "[-] Usage: bof <encoded_bof>:<encoded_args>" ascii

	condition:
		2 of ( $protocol* ) or 2 of ( $capability* )
}