Skip to content

Commit f9716b0

Browse files
octo-sts[bot]github-actions[bot]
octo-sts[bot]
and
github-actions[bot]
authored
Update third-party rules as of 2026-02-04 (#1351)
Co-authored-by: Update third-party rules <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 8223117 commit f9716b0

File tree

7 files changed

+241
-1
lines changed

7 files changed

+241
-1
lines changed

‎third_party/yara/elastic/RELEASE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
103842377447ea43059390d35b7dc393f5144c55
1+
dc64ed57860f4a150c7d1fe33d645d69f384506e

‎third_party/yara/elastic/Windows_Ransomware_DragonForce.yar‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
rule Windows_Ransomware_DragonForce_44bb8f0d {
2+
meta:
3+
author = "Elastic Security"
4+
id = "44bb8f0d-9648-426d-bd1c-0e16ccc8ad04"
5+
fingerprint = "990654f2598e9f9878ba61e0eeef67522cc6e851c49fc9ca4874131a26c120bb"
6+
creation_date = "2025-05-28"
7+
last_modified = "2026-02-02"
8+
threat_name = "Windows.Ransomware.DragonForce"
9+
reference_sample = "d06b5a200292fedcfb4d4aecac32387a2e5b5bb09aaab5199c56bab3031257d6"
10+
severity = 100
11+
arch_context = "x86, arm64"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$str_1 = "%04d-%02d-%02dT%02d:%02d:00Z" wide fullword
17+
$str_2 = ".dragonforce_encrypted" wide fullword
18+
$seq_1 = { C6 44 24 19 45 C6 44 24 1A 55 C6 44 24 1B 3C C6 44 24 1C 55 C6 44 24 1D 3A C6 44 24 1E 55 C6 44 24 1F 3F }
19+
$seq_2 = { C6 45 D4 00 C6 45 D5 4F C6 45 D6 69 C6 45 D7 28 C6 45 D8 69 C6 45 D9 1A C6 45 DA 69 C6 45 DB 3B C6 45 DC }
20+
$seq_3 = { C6 45 8C 00 C6 45 8D 55 C6 45 8E 02 C6 45 8F 4C C6 45 90 02 C6 45 91 73 C6 45 92 02 }
21+
condition:
22+
3 of them
23+
}
24+

‎third_party/yara/elastic/Windows_Trojan_BadIIS.yar‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
rule Windows_Trojan_BadIIS_2a604c44 {
2+
meta:
3+
author = "Elastic Security"
4+
id = "2a604c44-80ad-4b25-abdc-6f57074a3b37"
5+
fingerprint = "3568b0878dd8404aa5a99101c132b158cea015a5397a114a28fc2057258a6f24"
6+
creation_date = "2026-01-26"
7+
last_modified = "2026-02-02"
8+
threat_name = "Windows.Trojan.BadIIS"
9+
reference_sample = "1b723a5f9725b607926e925d1797f7ec9664bb308c9602002345485e18085b72"
10+
severity = 100
11+
arch_context = "x86"
12+
scan_context = "file, memory"
13+
license = "Elastic License v2"
14+
os = "windows"
15+
strings:
16+
$a1 = { 48 FF C0 80 3C 01 00 75 F7 48 8B 72 08 }
17+
$a2 = { 0F 11 45 D8 4C 89 75 E8 4C 89 75 F0 4D 8B EE 4C 89 75 E8 41 BC }
18+
$a3 = { 49 8B C7 48 C1 E8 04 4C 8D 25 [2] 02 00 46 0F B6 }
19+
$a5 = { 48 8B 45 C7 48 83 F8 01 72 29 48 FF }
20+
$a6 = { 0F B6 44 37 FF 48 2B F8 }
21+
condition:
22+
3 of them
23+
}
24+
25+
rule Windows_Trojan_BadIIS_56117744 {
26+
meta:
27+
author = "Elastic Security"
28+
id = "56117744-f09a-4efa-bfc6-0f2273e6025c"
29+
fingerprint = "d83da4a12e47bf898a4150b2c2c4c2815f9bcf59e48ea7cd416ff2a8382580ba"
30+
creation_date = "2026-01-26"
31+
last_modified = "2026-02-02"
32+
threat_name = "Windows.Trojan.BadIIS"
33+
reference_sample = "a69a5fe19eae825c463e83265f7bbe31d1e514176e11ba5f63c25351542c46b6"
34+
severity = 100
35+
arch_context = "x86"
36+
scan_context = "file, memory"
37+
license = "Elastic License v2"
38+
os = "windows"
39+
strings:
40+
$a1 = "bing|google|naver" fullword
41+
$a2 = "bingbot|Googlebot|Yeti" fullword
42+
$a3 = "bingbot|Googlebot|coccocbot" fullword
43+
$a4 = "|split'.split('|'),0,{}))</script>\n" fullword
44+
$a5 = "iPhone|iPad|iPod|iOS|Android|uc|BlackBerry|HUAWEI" fullword
45+
$a6 = ".js|.css|.jpg|.jpeg|.png|.gif|.bmp|.ico|.svg|.tif|.pict|.tiff|.swf" fullword
46+
$a7 = "tee|pat|and|app|poker|gam|sto|vid|bea|slo|fis|bac|pac|tig|bmw|fru|bull|card|gods|fish|mahj" fullword
47+
$a8 = "return||if|replace|while||13|eval|toString|String||new||RegExp|script|window|document||write|type|text|javascript|src" fullword
48+
condition:
49+
4 of them
50+
}
51+
52+
rule Windows_Trojan_BadIIS_71069efd {
53+
meta:
54+
author = "Elastic Security"
55+
id = "71069efd-75a4-4752-8b31-a8ac0a17cfc0"
56+
fingerprint = "e775c597c743e41dd11e4aedce991609d81764fd3b31ed29efcea1cc57fce81f"
57+
creation_date = "2026-01-26"
58+
last_modified = "2026-02-02"
59+
threat_name = "Windows.Trojan.BadIIS"
60+
reference_sample = "c5abe6936fe111bbded1757a90c934a9e18d849edd70e56a451c1547688ff96f"
61+
severity = 100
62+
arch_context = "x86"
63+
scan_context = "file, memory"
64+
license = "Elastic License v2"
65+
os = "windows"
66+
strings:
67+
$a1 = "hm.baidu.com/hm.js" fullword
68+
$a2 = "googletagmanager.com/gtag/js?id" fullword
69+
$a3 = "</div>\n<a id=\"js-alert-btn\" class=\"alert-btn\" href=\"" fullword
70+
$a4 = "index.php?domain=" fullword
71+
$seq1 = { C7 45 C4 [4] C7 45 C8 04 00 00 00 C7 45 CC [4] C7 45 D0 04 00 00 00 }
72+
$seq2 = { C7 45 E8 07 00 00 00 C7 45 EC [4] C7 45 F0 04 00 00 00 C7 45 F4 [4] C7 45 F8 09 00 00 00 }
73+
condition:
74+
2 of ($a*) and 1 of ($seq*)
75+
}
76+

‎third_party/yara/elastic/Windows_Trojan_Generic.yar‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -361,3 +361,52 @@ rule Windows_Trojan_Generic_9e4bb0ce {
361361
5 of them
362362
}
363363

364+
rule Windows_Trojan_Generic_41da339f {
365+
meta:
366+
author = "Elastic Security"
367+
id = "41da339f-0266-4e8e-bae6-9b4c58210856"
368+
fingerprint = "6c6d63d9595bc37714bf33ccda155825c507f566b1654182a85e86e0e3bffb49"
369+
creation_date = "2026-01-26"
370+
last_modified = "2026-02-02"
371+
threat_name = "Windows.Trojan.Generic"
372+
reference_sample = "2340f152e8cb4cc7d5d15f384517d756a098283aef239f8cbfe3d91f8722800a"
373+
severity = 100
374+
arch_context = "x86"
375+
scan_context = "file, memory"
376+
license = "Elastic License v2"
377+
os = "windows"
378+
strings:
379+
$pdb = { 43 3A 5C 55 73 65 72 73 5C 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 5C 44 65 73 6B 74 6F 70 5C E6 9B BF E6 8D A2 E9 85 8D E7 BD AE E6 96 87 E4 BB B6 5C 77 33 77 70 2D 73 76 63 68 6F 73 74 5C 78 36 34 5C 52 65 6C 65 61 73 65 5C 43 62 73 4D 73 67 41 70 69 2E 70 64 62 }
380+
$str1 = "C:\\Windows\\System32\\drivers\\WUDFPfprot.sys" fullword
381+
$str2 = "C:\\Windows\\System32\\drivers\\WppRecorderpo.sys" fullword
382+
$str3 = "C:\\Windows\\System32\\drivers\\WppRecorderrt.sys" fullword
383+
$str4 = "WsmRes64.dll" fullword
384+
$str5 = "CbsMsgApi.dll" fullword
385+
condition:
386+
$pdb or 4 of ($str*)
387+
}
388+
389+
rule Windows_Trojan_Generic_4a773368 {
390+
meta:
391+
author = "Elastic Security"
392+
id = "4a773368-deaf-4248-b0ec-c4e924cc7428"
393+
fingerprint = "96329cbe576ba9772259c068916b928e7c33afcd18616ddd04d82227459d6a7f"
394+
creation_date = "2026-01-26"
395+
last_modified = "2026-02-02"
396+
threat_name = "Windows.Trojan.Generic"
397+
reference_sample = "055bdcaa0b69a1e205c931547ef863531e9fdfdaac93aaea29fb701c7b468294"
398+
severity = 100
399+
arch_context = "x86"
400+
scan_context = "file, memory"
401+
license = "Elastic License v2"
402+
os = "windows"
403+
strings:
404+
$pdb = { 43 3A 5C 55 73 65 72 73 5C 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 5C 44 65 73 6B 74 6F 70 5C E6 9B BF E6 8D A2 E9 85 8D E7 BD AE E6 96 87 E4 BB B6 5C 77 33 77 70 73 65 72 76 69 63 65 2D 73 76 63 68 6F 73 74 5C 78 36 34 5C 52 65 6C 65 61 73 65 5C 43 62 73 4D 73 67 41 70 69 2E 70 64 62 }
405+
$str1 = "AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD" wide fullword
406+
$str2 = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" wide fullword
407+
$str3 = "ExcuteEnLargeDll failed with error code " fullword
408+
$str4 = "ChangeServiceConfig2 (SERVICE_CONFIG_DESCRIPTION) failed with error code" fullword
409+
condition:
410+
$pdb or 3 of ($str*)
411+
}
412+

‎third_party/yara/elastic/Windows_Trojan_Vidar.yar‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,3 +113,47 @@ rule Windows_Trojan_Vidar_65d3d7e5 {
113113
6 of them
114114
}
115115

116+
rule Windows_Trojan_Vidar_5e3e5c75 {
117+
meta:
118+
author = "Elastic Security"
119+
id = "5e3e5c75-00a6-4dca-ac29-1a4d3554b9bd"
120+
fingerprint = "6a21d58bd025d08b40c64fd38df8af637bc97938b268143427aaa96c79a8caa7"
121+
creation_date = "2025-12-16"
122+
last_modified = "2026-02-02"
123+
threat_name = "Windows.Trojan.Vidar"
124+
reference_sample = "0f8976f8b0f6f717ffdfb22cfc1620eee53ce462975bb270929bff3497d22beb"
125+
severity = 100
126+
arch_context = "x86"
127+
scan_context = "file, memory"
128+
license = "Elastic License v2"
129+
os = "windows"
130+
strings:
131+
$a = "%DRIVE_FIXED%" fullword
132+
$e = "%DRIVE_REMOVABLE%" fullword
133+
$d = "_0.indexeddb.leveldb" fullword
134+
$c = "key4.db" fullword
135+
condition:
136+
all of them
137+
}
138+
139+
rule Windows_Trojan_Vidar_4ed00a37 {
140+
meta:
141+
author = "Elastic Security"
142+
id = "4ed00a37-9101-4c54-ad42-06e81051be69"
143+
fingerprint = "92f3a503d66bc9873691a36f8259aee86948e0b9594e6b8c492b970d9d587500"
144+
creation_date = "2025-12-16"
145+
last_modified = "2026-02-02"
146+
threat_name = "Windows.Trojan.Vidar"
147+
reference_sample = "0f8976f8b0f6f717ffdfb22cfc1620eee53ce462975bb270929bff3497d22beb"
148+
severity = 100
149+
arch_context = "x86"
150+
scan_context = "file, memory"
151+
license = "Elastic License v2"
152+
os = "windows"
153+
strings:
154+
$a = { 8A 1C 32 44 30 C3 88 1C 31 }
155+
$b = { 42 8A 1C 1A 44 30 C3 42 88 1C 19 }
156+
condition:
157+
all of them
158+
}
159+

‎third_party/yara/elastic/Windows_VulnDriver_ThrottleStop.yar‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
rule Windows_VulnDriver_ThrottleStop_166b7608 {
2+
meta:
3+
author = "Elastic Security"
4+
id = "166b7608-f65c-4bb1-9986-4fb99542ebf4"
5+
fingerprint = "944d96cd7dadc43e327ef96e54498ed9956a7896ce080e9e849f2057827e5fc0"
6+
creation_date = "2025-12-10"
7+
last_modified = "2026-02-02"
8+
description = "Subject: TechPowerUp LLC, Version: <= 3.0.0.0"
9+
threat_name = "Windows.VulnDriver.ThrottleStop"
10+
reference_sample = "16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0"
11+
severity = 50
12+
arch_context = "x86"
13+
scan_context = "file"
14+
license = "Elastic License v2"
15+
os = "windows"
16+
strings:
17+
$subject_name = { 06 03 55 04 03 [2] 54 65 63 68 50 6F 77 65 72 55 70 20 4C 4C 43 }
18+
$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
19+
$str1 = "Driver.pdb"
20+
condition:
21+
int16(uint32(0x3C) + 0x5c) == 0x0001 and int16(uint32(0x3C) + 0x18) == 0x020b and $subject_name and $version and $str1
22+
}
23+

‎third_party/yara/elastic/Windows_VulnDriver_TopazOFD.yar‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
rule Windows_VulnDriver_TopazOFD_86b87a80 {
2+
meta:
3+
author = "Elastic Security"
4+
id = "86b87a80-1080-4a24-8cdf-352ded07e95d"
5+
fingerprint = "232be04d29f158eef348266f55c94544de4f37541a55aa200aef1025b0b1a5ea"
6+
creation_date = "2026-01-22"
7+
last_modified = "2026-02-02"
8+
description = "Subject: TPZ SOLUCOES DIGITAIS LTDA, Name: wsftprm.sys, Version: 2.0.0.0, Product Name: wsddprm"
9+
threat_name = "Windows.VulnDriver.TopazOFD"
10+
reference_sample = "ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8"
11+
severity = 50
12+
arch_context = "x86"
13+
scan_context = "file"
14+
license = "Elastic License v2"
15+
os = "windows"
16+
strings:
17+
$subject_name = { 06 03 55 04 03 [2] 54 50 5A 20 53 4F 4C 55 43 4F 45 53 20 44 49 47 49 54 41 49 53 20 4C 54 44 41 }
18+
$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 [1-8] 77 00 73 00 66 00 74 00 70 00 72 00 6D 00 2E 00 73 00 79 00 73 00 00 }
19+
$product_version = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E [1-8] 32 00 2E 00 30 00 2E 00 30 00 2E 00 30 }
20+
$product_name = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 [1-8] 77 00 73 00 64 00 64 00 70 00 72 00 6D 00 }
21+
condition:
22+
int16(uint32(0x3C) + 0x5c) == 0x0001 and int16(uint32(0x3C) + 0x18) == 0x020b and $subject_name and $original_file_name and $product_version and $product_name
23+
}
24+

0 commit comments

Comments
 (0)