YARA rules for RemoteCMD
1 rules · scoped to tool · back to RemoteCMD
YARA rules whose family, name, or description matches this tool or its tooling. Use these for binary-pattern hunts.
rule HKTL_RemoteCmd {
meta:
description = "Detects a remote access tool used by APT groups - file RemoteCmd.exe"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Florian Roth (Nextron Systems)"
reference = "http://goo.gl/igxLyF"
date = "2016-09-08"
modified = "2022-12-21"
score = 70
hash1 = "5264d1de687432f8346617ac88ffcb31e025e43fc3da1dad55882b17b44f1f8b"
id = "384f37f3-4562-5d79-9793-0384c43d4602"
strings:
$s1 = "RemoteCmd.exe" fullword wide
$s2 = "\\Release\\RemoteCmd.pdb" ascii
$s3 = "RemoteCmd [ComputerName] [Executable] [Param1] [Param2] ..." fullword wide
$s4 = "http://{0}:65101/CommandEngine" fullword wide
$s5 = "Brenner.RemoteCmd.Client" fullword ascii
$s6 = "$b1888995-1ee5-4f6d-82df-d2ab8ae73d63" fullword ascii
condition:
( uint16(0) == 0x5a4d and filesize < 50KB and 2 of them ) or ( 4 of them )
}