APT_OilRig_PSH_Helminth_2016_1

YARA detection rule by Arkbird_SOLG

Detect Powershell script Helminth in base 64 used by OilRig (2016)

rule APT_OilRig_PSH_Helminth_2016_1 {
   meta:
      description = "Detect Powershell script Helminth in base 64 used by OilRig (2016)"
      author = "Arkbird_SOLG"
      reference = "https://twitter.com/Arkbird_SOLG/status/1298758788028264450"
      date = "2020-08-26"
      hash1 = "1edbb818ea75919bb70bd2496e789e89d26c94cdf65ab61ebb5f1403d45d323c"
      hash2 = "1191d5c1dd7f6ac38b8d72bee37415b3ff1c28a8f907971443ac3a36906e8bf5"
   strings:
      $block1 = { 70 74 65 57 6c 6b 49 44 30 67 4a 79 4d 6a 49 79 63 67 44 51 6f 67 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 68 76 62 57 55 67 50 53 41 69 4a 47 56 75 64 6a 70 51 64 }       $block2 = { 41 67 ?? ?? 42 6c 62 48 4e 6c 61 57 59 6f 4a 47 31 35 5a 6d 78 68 5a 7a 4d 67 4c 57 56 78 49 44 49 70 49 41 30 4b 49 43 41 67 49 48 73 67 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 67 6e 64 33 63 6e 4b 79 52 6e 62 47 39 69 59 57 77 36 62 58 6c 70 5a 43 73 6b 59 32 31 6b 61 57 51 72 4a 48 42 68 63 6e 52 70 5a 43 73 6f }       $block3 = { 6a 61 47 46 79 58 53 42 62 61 57 35 30 58 53 41 6b 64 47 31 77 57 7a 42 64 4b 53 41 72 49 43 }       $block4 = { 43 52 6a 62 6e 51 67 4c 57 56 78 49 44 49 31 4b 53 6b 67 44 51 6f 67 49 43 41 67 65 79 41 }       $block5 = { 5a 6c 52 45 35 54 49 43 67 6b 5a 43 6b 67 44 51 70 37 49 41 30 4b 43 53 52 6a 62 6e 51 67 50 53 41 77 49 41 30 4b 43 58 64 6f 61 57 78 6c 49 43 67 6b 59 32 35 30 49 43 31 73 64 43 41 79 4d 43 6b 67 44 51 6f 4a 65 79 41 4e 43 67 6b 4a 64 48 4a 35 49 41 30 4b 43 51 6c 37 }       $block6 = { 4b 49 43 41 67 49 43 41 67 49 43 41 6b 61 53 73 72 49 41 30 4b 49 43 41 67 49 48 30 67 44 51 6f 67 49 43 41 67 61 57 59 6f 4a 48 4a 6c 64 43 41 74 5a 58 45 67 4d 53 6b 67 44 51 6f 67 49 43 41 }       $block7 = { 77 36 62 58 6c 6d 62 47 46 6e 49 44 30 67 4d 43 41 4e 43 69 41 67 49 43 42 39 49 41 30 4b 49 43 41 67 49 47 56 73 63 32 56 70 5a 69 41 6f 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 5a 73 59 57 63 67 4c 57 56 78 49 44 45 70 49 41 30 4b 49 43 41 67 49 48 73 67 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 52 30 62 58 41 67 50 53 41 6b 62 58 6c 6b 59 58 52 68 4c 6c 4e 77 62 47 6c 30 4b 43 63 75 4a 79 6b 67 44 51 6f 67 49 43 41 67 49 43 41 67 49 46 74 54 65 58 4e 30 5a 57 30 75 53 55 38 75 52 6d 6c 73 5a 56 30 36 4f 6b 46 77 63 47 56 75 5a 45 46 73 62 46 52 6c 65 48 51 6f 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 68 76 62 57 55 72 4a 33 52 77 58 43 63 72 4a 47 64 73 62 32 4a 68 62 44 70 6d 61 57 78 6c 62 6d 46 74 }       $block8 = { 4a 47 6b 72 4b 79 41 4e 43 69 41 67 49 43 42 39 49 41 30 4b 49 48 30 67 44 51 6f 67 44 51 6f 67 5a 6e 56 75 59 33 52 70 62 32 34 67 52 32 56 30 53 55 [1-10] 4e 43 69 41 67 49 43 41 6b 5a 32 78 76 59 6d 46 73 4f 6d 31 35 61 57 51 67 50 53 42 54 5a 57 35 6b 55 6d 56 6a 5a 57 6c 32 5a 55 52 4f 55 79 41 6f 4b 45 64 6c 64 46 4e 31 59 69 41 77 4b 53 73 6e 4d 7a 41 6e 4b 53 41 4e 43 69 42 39 49 41 30 4b 49 41 30 4b 49 47 5a 31 62 6d 4e 30 61 57 39 [1-10] 56 52 6f 61 58 4e 47}       $block9 = { 73 67 44 51 6f 4a 43 57 31 6b 49 43 31 47 62 33 4a 6a 5a 53 41 6f 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 68 76 62 57 55 72 4a 33 52 77 58 43 63 70 49 41 30 4b 43 51 6c 48 5a 58 52 4a 52 43 41 4e 43 67 6b 4a 51 32 68 68 62 6d 64 6c 56 47 68 70 63 30 5a 70 62 47 55 67 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 6c 6b 49 41 30 4b 49 43 41 67 49 48 30 67 44 51 6f 67 66 53 41 4e 43 69 42 6d 64 57 35 6a 64 47 6c 76 62 69 42 74 59 57 6c 75 49 41 30 4b }    condition:
      filesize < 3KB and 7 of them 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d215c462-bd4e-47a2-b433-72fd7655a727

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion