VOLEXITY_Apt_Webshell_Java_Orangetail

rule VOLEXITY_Apt_Webshell_Java_Orangetail : UTA0533 ORANGETAIL FILE MEMORY
{
	meta:
		description = "Detection for ORANGETAIL, a custom Java webshell used by UTA0533."
		author = "threatintel@volexity.com"
		id = "5bbffb5f-0917-57e4-a7d4-f5c770b5d253"
		date = "2026-07-06"
		modified = "2026-07-14"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2026/2026-07-17 SonicWall/rules.yar#L26-L53"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "ea9154e374e4f77bc2cf54282e23543573980342a85bc888cb23f20b8bbba081"
		logic_hash = "1a495df2bc13b1c2c61315d76d66b150452b923afa5847121429fa8ae9788a7b"
		score = 75
		quality = 80
		tags = "UTA0533, ORANGETAIL, FILE, MEMORY"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		report1 = "TIB-20260714B"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 13239
		version = 5

	strings:
		$s1 = "agentmain called args="
		$s2 = "tryInject="
		$s3 = "agentmain ex:"
		$s4 = "javassist="
		$s5 = "tryInject exception"
		$s6 = "found loaded class:"

	condition:
		4 of ( $s* )
}