VOLEXITY_Apt_Malware_Any_Brickstorm_Rust

rule VOLEXITY_Apt_Malware_Any_Brickstorm_Rust : VERDANTBAMBOO BRICKSTORM FILE
{
	meta:
		description = "Detects Rust variants of the BRICKSTORM malware."
		author = "threatintel@volexity.com"
		id = "b85ec85f-f590-5c1a-a5f9-107074b0e2a8"
		date = "2026-02-24"
		modified = "2026-02-24"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2026/2026-06-04 VerdantBamboo/rules.yar#L173-L202"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "45313a6745803a7f57ff35f5397fdf117eaec008a76417e6e2ac8a6280f7d830"
		logic_hash = "5f83f26188b7a8cab4bd548609c503371a18967342bd8dd6dede8e7a047e9508"
		score = 75
		quality = 80
		tags = "VERDANTBAMBOO, BRICKSTORM, FILE"
		os = "linux"
		os_arch = "all"
		scan_context = "file"
		severity = "high"
		report1 = "MAR-20260224"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 12816
		version = 2

	strings:
		$package1 = "Yamux"
		$package2 = "/lib.rs"
		$str1 = "/opt/vmware/bin/vmisupport"
		$str2 = "Socks5CmdNotSupported"
		$str3 = "/dev/ptmx"
		$str4 = "8tr9y8e4df1h6515fthderth"

	condition:
		all of ( $package* ) and 3 of ( $str* )
}