SEKOIA_Loader_Fakebat_Initial_Powershell_May24

rule SEKOIA_Loader_Fakebat_Initial_Powershell_May24 : FILE
{
	meta:
		description = "Finds FakeBat initial PowerShell script downloading and executing the next-stage payload."
		author = "Sekoia.io"
		id = "adf0e4fc-fa98-470b-9535-bd30d0bdb3aa"
		date = "2024-05-28"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/loader_fakebat_initial_powershell_may24.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "6a699df361b0cb2baf1d0b128f795aa9918ebe11daaeb1fa49aebf9320add762"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		modification_date = "2024-06-21"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "='http" wide
		$str02 = "=(iwr -Uri $" wide
		$str03 = " -UserAgent $" wide
		$str04 = " -UseBasicParsing).Content; iex $" wide

	condition:
		3 of ( $str* ) and filesize < 1KB and true
}