rule APT_Sandworm_CyclopsBlink_handle_mod_0xf_command {
   meta:
      author = "NCSC"
      description = "Detects the code bytes used to check module ID 0xf control flags and a format string used for file content upload"
      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
      date = "2022-02-23"
      id = "36646b7a-389d-5fd9-88a1-e43e7224763a"
   strings:
      // Tests execute flag (bit 0)
      $ = {54 00 06 3E 54 00 07 FE 54 00 06 3E 2F 80 00 00}
      // Tests add module flag (bit 1)
      $ = {54 00 06 3E 54 00 07 BC 2F 80 00 00}
      // Tests run as shellcode flag (bit 2)
      $ = {54 00 06 3E 54 00 07 7A 2F 80 00 00}
      // Tests upload flag (bit 4)
      $ = {54 00 06 3E 54 00 06 F6 2F 80 00 00}
      // Upload format string
      $ = "file:%s\n" fullword
   condition:
      (uint32(0) == 0x464c457f) and (all of them)
}

rule APT_Sandworm_CyclopsBlink_default_config_values {
   meta:
      author = "NCSC"
      description = "Detects the code bytes used to set default Cyclops Blink configuration values"
      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
      date = "2022-02-23"
      id = "04067609-1173-51f2-907f-2a236aae6c7c"
   strings:
      // Unknown config value set to 0x19
      $ = {38 00 00 19 90 09 01 A4}
      // Unknown config value set to 0x18000
      $ = {3C 00 00 01 60 00 80 00 90 09 01 A8}
      // Unknown config value set to 0x4000
      $ = {38 00 40 00 90 09 01 AC}
      // Unknown config value set to 0x10b
      $ = {38 00 01 0B 90 09 01 B0}
      // Unknown config value set to 0x2711
      $ = {38 00 27 11 90 09 01 C0}
   condition:
      (uint32(0) == 0x464c457f) and (3 of them)
}

rule APT_Sandworm_CyclopsBlink_handle_mod_0x51_command {
   meta:
      author = "NCSC"
      description = "Detects the code bytes used to check commands sent to module ID 0x51 and notable strings relating to the Cyclops Blink update process"
      hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
      hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
      reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
      date = "2022-02-23"
      id = "a6800aed-27dc-5d01-b005-1eb4a62344a3"
   strings:
      // Check for module command ID equals 0x1, 0x2 or 0x3
      $cmd_check = {88 1F [2] 54 00 06 3E 2F 80 00 (01|02|03) }
      // Legitimate WatchGuard filepaths relating to device configuration
      $path1 = "/etc/wg/configd-hash.xml"
      $path2 = "/etc/wg/config.xml"
      // Mount arguments used to remount root filesystem as RW or RO
      $mnt_arg1 = "ext2"
      $mnt_arg2 = "errors=continue"
      $mnt_arg3 = {38 C0 0C 20}
      $mnt_arg4 = {38 C0 0C 21}
   condition:
      (uint32(0) == 0x464c457f) and (#cmd_check == 3) and
      ((@cmd_check[3] - @cmd_check[1]) < 0x200) and
      (all of ($path*)) and (all of ($mnt_arg*))
}