SIGNATURE_BASE_MAL_Cisco_Rayinitiator_Stage_3

rule SIGNATURE_BASE_MAL_Cisco_Rayinitiator_Stage_3
{
	meta:
		description = "Detects RayInitiator GRUB bootkit stage 3 install phase code that searches for the 'client-cert-fail' string."
		author = "NCSC"
		id = "ea42c20b-7362-5d2d-9ce2-ad010f3f880d"
		date = "2025-09-25"
		modified = "2026-05-15"
		reference = "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_cisco_asa_lineviper_rayinitiator_sep25.yar#L41-L58"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "332756bc77cc17c3330ce1ffb0af9d1a7c0f5f9a457f7e9ad7f4081d7aba50c6"
		score = 85
		quality = 85
		tags = ""

	strings:
		$xc1 = {
         48 81 EE 00 00 00 08 48 B8 63 6C 69 65 6E 74 2D 63 49
         B8 65 72 74 2D 66 61 69 6C 48 FF C6 48 39 D6 0F 87 D2
         00 00 00 48 8B 3E 48 39 C7
      }

	condition:
		$xc1
}