CADOSECURITY_Linux_Worm_ORCSHRED

rule CADOSECURITY_Linux_Worm_ORCSHRED
{
	meta:
		description = "Detects ORCSHRED worm used in attacks on Ukrainian ICS"
		author = "mmuir@cadosecurity.com"
		id = "4fdad42e-81eb-58a4-b869-a0aae9c72357"
		date = "2022-04-12"
		modified = "2022-07-06"
		reference = "https://github.com/cado-security/DFIR_Resources_Industroyer2"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Linux_Worm_ORCSHRED.yar#L1-L19"
		license_url = "N/A"
		hash = "43d07f28b7b699f43abd4f695596c15a90d772bfbd6029c8ee7bc5859c2b0861"
		logic_hash = "bf826e2cb0bc0fef74db1248539b00dfa57a9a9c84c0ab374e6b3f92b02de84e"
		score = 75
		quality = 80
		tags = ""
		license = "Apache License 2.0"

	strings:
		$a = "is_owner" ascii
		$b = "Start most security mode!" ascii
		$c = "check_solaris" ascii
		$d = "wsol.sh" ascii
		$e = "wobf.sh" ascii
		$f = "disown" ascii
		$g = "/var/log/tasks" ascii

	condition:
		4 of them
}