YARA rules for EnvyScout
2 rules · scoped to tool · back to EnvyScout
YARA rules whose family, name, or description matches this tool or its tooling. Use these for binary-pattern hunts.
rule APT_APT29_NOBELIUM_JS_EnvyScout_May21_1 {
meta:
description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
author = "Florian Roth (Nextron Systems)"
reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
date = "2021-05-29"
id = "42739aad-a88a-545b-8256-1f727c79c4f8"
strings:
$x1 = "[i].charCodeAt(0) ^ 2);}"
condition:
filesize < 5000KB and 1 of them
}
rule APT_APT29_NOBELIUM_JS_EnvyScout_May21_2 {
meta:
description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
author = "Florian Roth (Nextron Systems)"
reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
date = "2021-05-29"
id = "d5cf3365-fe24-533a-a678-b5b6d4d99997"
strings:
$s1 = "saveAs(blob, " ascii
$s2 = ".iso\");" ascii
$s3 = "application/x-cd-image" ascii
$s4 = ".indexOf(\"Win\")!=-1" ascii
condition:
filesize < 5000KB and all of them
}