SIGNATURE_BASE_MAL_Cisco_Rayinitiator_Stage_1

rule SIGNATURE_BASE_MAL_Cisco_Rayinitiator_Stage_1
{
	meta:
		description = "Detects RayInitiator GRUB bootkit stage 1 code that searches for the 'Booting the kernel' string."
		author = "NCSC"
		id = "5631f2c5-5141-5039-9cd0-a35314aa0bd5"
		date = "2025-09-25"
		modified = "2026-05-15"
		reference = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L1-L20"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "e657de97954545f06fc6997a3221eb77037fb89c6c56f08eeb78be615512a3e4"
		score = 85
		quality = 85
		tags = ""

	strings:
		$xc1 = {
         BB 00 00 40 00 43 81 FB 00 00 60 00 0F 87 AB 00 00 00
         8B 3B 81 FF 64 6F 6E 65 75 E9 83 C3 04 8B 3B 81 FF 2E 0A 42 6F 75
         DC 83 C3 04 8B 3B 81 FF 6F 74 69 6E 75 CF 83 C3 04 8B 3B 81 FF 67
         20 74 68 75 C2 83 C3 04 8B 3B 81 FF 65 20 6B 65 75 B5 83 C3 04 8B
         3B 81 FF 72 6E 65 6C 75 A8 83 EB 14
      }

	condition:
		$xc1
}