turla_dropper

YARA detection rule by Yara-Rules · GPL-2.0

This sample was pulled from the bae systems snake campaign report. The Turla dropper creates a file in teh temp dir and registers an auto start service call \

rule turla_dropper
{ 
   
    meta:
        maltype = "turla dropper"
        ref = "https://github.com/reed1713"
        reference = "http://info.baesystemsdetica.com/rs/baesystems/images/snake_whitepaper.pdf"
        date = "3/13/2014"
        description = "This sample was pulled from the bae systems snake campaign report. The Turla dropper creates a file in teh temp dir and registers an auto start service call \"RPC Endpoint Locator\"."
    strings:

        $type="Microsoft-Windows-Security-Auditing"
        $eventid="4688"
        $data="AppData\\Local\\Temp\\rsys.exe"

        $type1="Service Control Manager"
        $eventid1="7036"
        $data1="RPC Endpoint Locator"
        $data2="running"

        $type2="Service Control Manager"
        $eventid2="7045"
        $data3="RPC Endpoint Locator"
        $data4="user mode service" 
        $data5="auto start"

    condition:
    ($type and $eventid and $data) or ($type1 and $eventid1 and $data1 and $data2 and $type2 and $eventid2 and $data3 and $data4 and $data5)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

705c8348-8d69-4823-ba1b-a68cc9f20dbf

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion