VOLEXITY_Apt_Webshell_Aspx_Sportsball

rule VOLEXITY_Apt_Webshell_Aspx_Sportsball : FILE MEMORY
{
	meta:
		description = "The SPORTSBALL webshell, observed in targeted Microsoft Exchange attacks in 2021. SPORTSBALL was later discovered to be a variant of HYPERSHELL, a publicly available webshell."
		author = "threatintel@volexity.com"
		id = "25b23a4c-8fc7-5d6f-b4b5-46fe2c1546d8"
		date = "2021-03-01"
		modified = "2025-07-24"
		reference = "https://github.com/misterch0c/APT34/blob/e62f3d14ec78bea5c98d3c895162ca1e47676c18/Webshells_and_Panel/HyperShell/HyperShell/Shell/simple.aspx"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L57-L89"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a"
		logic_hash = "5ec5e52922e97a3080d397b69b2f42f09daa995271e218ea085fa2ec4e3abad2"
		score = 75
		quality = 80
		tags = "FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 4968
		version = 6

	strings:
		$uniq1 = "HttpCookie newcook = new HttpCookie(\"fqrspt\", HttpContext.Current.Request.Form"
		$uniq2 = "ZN2aDAB4rXsszEvCLrzgcvQ4oi5J1TuiRULlQbYwldE="
		$s1 = "Result.InnerText = string.Empty;"
		$s2 = "newcook.Expires = DateTime.Now.AddDays("
		$s3 = "System.Diagnostics.Process process = new System.Diagnostics.Process();"
		$s4 = "process.StandardInput.WriteLine(HttpContext.Current.Request.Form[\""
		$s5 = "else if (!string.IsNullOrEmpty(HttpContext.Current.Request.Form[\""
		$s6 = "<input type=\"submit\" value=\"Upload\" />"

	condition:
		any of ( $uniq* ) or all of ( $s* )
}