SEKOIA_Apt_Apt37_Chinotto_Powershell_Variant

rule SEKOIA_Apt_Apt37_Chinotto_Powershell_Variant
{
	meta:
		description = "Detects APT37 Chinotto Powershell Variant"
		author = "Sekoia.io"
		id = "fa42b225-58fe-4e00-b84b-df37491d8fdd"
		date = "2023-03-06"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_apt37_chinotto_powershell_variant.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "b4d17467f15d52bd615e335fa8bc31381ec273b67dabb74655f47179f04f631f"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "$env:COMPUTERNAME + '-' + $env:USERNAME;" ascii wide
		$ = "while($true -eq $true)" ascii wide
		$ = "Start-Sleep -Seconds" ascii wide
		$ = " -ne 'null' -and $" ascii wide
		$ = "= 'R=' + [System.Convert]::" ascii wide
		$ = "[string]$([char]0x0D) + [string]$([char]0x0A);" ascii wide

	condition:
		4 of them
}