YARA rules for PowerSploit
1 rules · scoped to tool · back to PowerSploit
YARA rules whose family, name, or description matches this tool or its tooling. Use these for binary-pattern hunts.
rule HKTL_PowerSploit {
meta:
description = "Detects default strings used by PowerSploit to establish persistence"
author = "Markus Neis"
reference = "https://www.hybrid-analysis.com/sample/16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75?environmentId=100" /*MuddyWater*/
date = "2018-06-23"
hash1 = "16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75"
id = "8cb0753c-c5bb-56fc-b492-4e785f4bdaf4"
strings:
$ps = "function" nocase ascii wide
$s1 = "/Create /RU system /SC ONLOGON" ascii wide
$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
condition:
all of them
}