added Hex Encoded Powershell rule

InQuest · Nov 28, 2019 · 9195db3 · 9195db3
1 parent fbb14a6
commit 9195db3
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/Hex_Encoded_Powershell.rule b/Hex_Encoded_Powershell.rule
@@ -0,0 +1,15 @@
+rule Hex_Encoded_Powershell
+{
+    meta:
+        Author    = "InQuest Labs"
+        Reference = "https://labs.inquest.net/dfi/sha256/c430b2b2885804a638fc8d850b1aaca9eb0a981c7f5f9e467e44478e6bc961ee"
+        Similar   = "https://labs.inquest.net/dfi/search/ext/ext_context/67697468756275736572636F6E74656E742E636F6D2F6A6F686E646F657465"
+    strings:
+        // http or https, powershell, invoke-webrequest
+        // generated via: https://labs.inquest.net/tools/yara/iq-mixed-case
+        $http = /[46]8[57]4[57]4[57]0([57]3)?3a2f2f/ nocase
+        $powershell = /[57]0[46]f[57]7[46]5[57]2[57]3[46]8[46]5[46]c[46]c/ nocase
+        $invoke = /[46]9[46]e[57]6[46]f[46]b[46]52d[57]7[46]5[46]2[57]2[46]5[57]1[57]5[46]5[57]3[57]4/ nocase
+    condition:
+        all of them
+}
diff --git a/README.md b/README.md
@@ -16,6 +16,10 @@ A collection of YARA rules we wish to share with the world. These rules should n
 * [Executables Converted to MSI](https://github.com/InQuest/yara-rules/blob/master/Executable_Converted_to_MSI.rule)
   * [Blog: "Carving Sneaky XLM Files"](http://blog.inquest.net/blog/2019/01/29/Carving-Sneaky-XLM-Files/)
   * [www.exetomsi.com](http://www.exetomsi.com)
+* [Hex Encoded Powershell Pivot](https://github.com/InQuest/yara-rules/blob/master/Hex_Encoded_Powershell.rule)
+  * [Sample](https://labs.inquest.net/dfi/sha256/c430b2b2885804a638fc8d850b1aaca9eb0a981c7f5f9e467e44478e6bc961ee)
+  * [Related Samples](https://labs.inquest.net/dfi/search/ext/ext_context/67697468756275736572636F6E74656E742E636F6D2F6A6F686E646F657465)
+  * [Mixed Hex Case Regex Generator](https://labs.inquest.net/tools/yara/iq-mixed-case)
 * [Hidden Bee Custom Windows Executable Format](https://github.com/InQuest/yara-rules/blob/master/Hidden_Bee_Elements.rule)
   * [Malwarebytes Blog](https://blog.malwarebytes.com/threat-analysis/2018/08/reversing-malware-in-a-custom-format-hidden-bee-elements/)
   * [Malware Samples](https://github.com/InQuest/malware-samples/tree/master/2018-08-Hidden-Bee-Elements)