SEKOIA_Tool_Tokenplayer_Strings

rule SEKOIA_Tool_Tokenplayer_Strings : FILE
{
	meta:
		description = "Detects TokenPlayer based on strings"
		author = "Sekoia.io"
		id = "74ed8812-f113-47a9-9ff2-6cbe2746ee11"
		date = "2024-11-04"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/tool_tokenplayer_strings.yar#L1-L25"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "f01eae4ee3cc03d621be7b0af7d60411"
		logic_hash = "e419fa8c690816cd0e449f0a1d66d170e8806b38a99758631719b239363e330e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "[*]Spawning Process as user: %s\\%s" wide
		$ = "[-]Target isn't vulnerable!"
		$ = "[+]Process spawned!"
		$ = "[+]Process Spawned"
		$ = "[+]OpenProcessToken() success!"
		$ = "CreateProcessWithLogonW() error : % u"
		$ = "[+]CreateProcessWithLogonW() succeed!"
		$ = "TokenPlayer.pdb"

	condition:
		uint16be( 0 ) == 0x4d5a and 5 of them and filesize < 500KB
}