WITHSECURELABS_Legionrelay_Client

rule WITHSECURELABS_Legionrelay_Client
{
	meta:
		description = "Detects LegionRelay client script"
		author = "WithSecure"
		id = "ec6b7aae-414d-5e54-9fc0-6826c7e9e1b8"
		date = "2026-05-28"
		modified = "2026-05-28"
		reference = "https://github.com/WithSecureLabs/iocs"
		source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L105-L119"
		license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE"
		logic_hash = "ba3fff2de891e880884434150f7a6331356a234ad0b2bc572e158a9b7ac03c0c"
		score = 75
		quality = 75
		tags = ""

	strings:
		$a1 = "powershell_ise"
		$a2 = "pwsh"
		$a3 = "/status"
		$a4 = "/commands?client_id="
		$a5 = "[^\\w\\-]"
		$a6 = "client_config.json"

	condition:
		all of them
}