SEKOIA_Infostealer_Win_Solarmarker_Powershell

rule SEKOIA_Infostealer_Win_Solarmarker_Powershell : FILE
{
	meta:
		description = "Finds SolarMarker PowerShell script based on characteristic strings"
		author = "Sekoia.io"
		id = "a2fe7f09-7134-4054-ba40-5ea66785a26d"
		date = "2022-12-09"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_solarmarker_powershell.yar#L1-L25"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "32267cf7e03ed65da969aeeff5ef5d7291e47446ea11a4b391f085967e8aa67d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$fun = "function " ascii
		$ps0 = "return -join (0..(10..30|Get-Random)|%{[char]((65..90)+(97..122)|Get-Random)})" ascii
		$ps1 = /new-item -path \$[a-zA-Z0-9_]* -itemtype registrykey -force;/
		$ps2 = /set-item -path \$[a-zA-Z0-9_]* -value \$[a-zA-Z0-9_]*;/
		$str0 = "[IO.File]::WriteAllText($" ascii
		$str1 = "CreateShortcut($env:appdata+" ascii
		$str2 = "Registry::HKEY_CURRENT_USER\\Software\\Classes\\" ascii
		$str3 = "New-Object System.Security.Cryptography.AesCryptoServiceProvider" ascii
		$str4 = "[Convert]::FromBase64String([IO.File]::ReadAllText(" ascii

	condition:
		$fun at 0 and 1 of ( $ps* ) and 2 of ( $str* )
}