SIGNATURE_BASE_MAL_Kernel_Regphantom_Mar26

rule SIGNATURE_BASE_MAL_Kernel_Regphantom_Mar26 : FILE
{
	meta:
		description = "Detects RegPhantom, a kernel-mode rootkit that allow attacker to inject arbitrary code from unprivileged user-mode into kernel-mode and execute it."
		author = "Pezier Pierre-Henri (Nextron Systems)"
		id = "aa8963b5-3053-52a4-a84f-2fc02d03275e"
		date = "2026-03-19"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_kernel_regphantom_mar26.yar#L1-L31"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "006e08f1b8cad821f7849c282dc11d317e76ce66a5bcd84053dd5e7752e0606f"
		logic_hash = "53dead8b4cd4f0139249940fbf2767a5411aef73e1919279ef66243fe009bb27"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "CmRegisterCallback" fullword
		$s2 = "PsSetCreateThreadNotifyRoutine" fullword
		$o1 = {
         // xor decrypt
         48 8b 09     // mov     rcx, [rcx]
         0f b6 14 08  // movzx   edx, byte ptr [rax+rcx]
         4c 31 c2     // xor     rdx, r8
         88 14 08     // mov     [rax+rcx], dl
      }
		$o2 = {
         // Command selector
         c6 01 01     // mov     byte ptr [rcx], 1
         48 83 38 77  // cmp     qword ptr [rax], 77h
         0f 94 c0     // setz    al
         24 01        // and     al, 1
      }

	condition:
		uint16( 0 ) == 0x5a4d and all of them
}