SEKOIA_Tool_Edrsandblast_Strings

rule SEKOIA_Tool_Edrsandblast_Strings : FILE
{
	meta:
		description = "Detects EDRSandblast strings"
		author = "Sekoia.io"
		id = "7059b89c-80b5-4768-b3eb-02f173f628b0"
		date = "2024-01-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/tool_edrsandblast_strings.yar#L1-L29"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "8528c4c440734ba97b98b6e0857d95f38a91eaf9120ba2eacff292c864fb86a5"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "[!] Cred Guard bypass failed: obtained invalid" wide
		$ = "[!] Cred Guard bypass non fatal error:" wide
		$ = "[+] Successfully overwrote wdigest's g_fParameter_UseLogonCredential" wide
		$ = "[!] ERROR: could not allocate memory for the handl" wide
		$ = "[+] [ProcessProtection] Found the handle of the current" wide
		$ = "[+] [ProcessProtection] Found self process EPROCCES struct at" wide
		$ = "ETW Threat Intel ProviderEnableInfo address could not be found." wide
		$ = "The ETW Threat Intel provider was successfully" wide
		$ = "[+] [NotifyRountines]" wide
		$ = "[callback addr: 0x" wide
		$ = "EDR / security products driver(s)" wide
		$ = "Object callback offsets not loaded ! Aborting..." wide
		$ = "No more space to store object callbacks !!" wide

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 1MB and 3 of them
}