SEKOIA_Apt_Apt29_Malicious_Rdp_File

rule SEKOIA_Apt_Apt29_Malicious_Rdp_File : FILE
{
	meta:
		description = "Detects malicious RDP files"
		author = "Sekoia.io"
		id = "a7b092b5-53a1-4638-a6c1-733d3f063139"
		date = "2024-10-25"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_apt29_malicious_rdp_file.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "db326d934e386059cc56c4e61695128e"
		hash = "b38e7e8bba44bc5619b2689024ad9fca"
		hash = "f58cf55b944f5942f1d120d95140b800"
		hash = "40f957b756096fa6b80f95334ba92034"
		logic_hash = "da9d8dfbbf82f48c8b880cbde21f75ecd1e9f779e462da5ced32b6587c71eaf2"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "RedirectPrinters" wide
		$ = "RedirectCOMPorts" wide
		$ = "RedirectSmartCards" wide
		$ = "RedirectPOSDevices" wide
		$ = "RedirectClipboard" wide
		$ = "DrivesToRedirect" wide
		$ = "full address:s:" wide

	condition:
		uint16be( 0 ) == 0xFFFE and all of them and filesize < 20KB
}