SEKOIA_Tool_Enum4Linux_Strings

rule SEKOIA_Tool_Enum4Linux_Strings
{
	meta:
		description = "Detects enum4linux based on strings"
		author = "Sekoia.io"
		id = "6b3094fe-1292-4da3-a1ed-9e255be531da"
		date = "2024-02-02"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/tool_enum4linux_strings.yar#L1-L22"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "d3f7ddbdfb679b34777298aec84464d55fac7600b855526a7f13d8c8f17ab888"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "my $os_info = `$command`;"
		$ = "($global_workgroup) = $os_info =~"
		$ = "sub enum_groups {"
		$ = "if ($shares =~ /NT_STATUS_ACCESS_DENIED/) {"
		$ = "Can't open share list file $shares_file"
		$ = "my $users = `$command`;"
		$ = "my @shares = <SHARES>;"
		$ = "foreach my $grouptype (\"builtin\", \"domain\") {"

	condition:
		6 of them
}