SUSP_XORed_Mozilla

YARA detection rule by Florian Roth

Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.

rule SUSP_XORed_Mozilla : hardened limited
{
	meta:
		description = "Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key."
		author = "Florian Roth"
		reference = "https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()"
		date = "2019-10-28"
		modified = "2023-11-25"
		score = 65
		id = "af7fc551-0d4e-589e-9152-95d9c4ab03bf"

	strings:
		$xo1 = {(( 4c 6e 7b 68 6d 6d 60 2e 34 2f 31) |( 4f 6d 78 6b 6e 6e 63 2d 37 2c 32) |( 4e 6c 79 6a 6f 6f 62 2c 36 2d 33) |( 49 6b 7e 6d 68 68 65 2b 31 2a 34) |( 48 6a 7f 6c 69 69 64 2a 30 2b 35) |( 4b 69 7c 6f 6a 6a 67 29 33 28 36) |( 4a 68 7d 6e 6b 6b 66 28 32 29 37) |( 45 67 72 61 64 64 69 27 3d 26 38) |( 44 66 73 60 65 65 68 26 3c 27 39) |( 47 65 70 63 66 66 6b 25 3f 24 3a) |( 46 64 71 62 67 67 6a 24 3e 25 3b) |( 41 63 76 65 60 60 6d 23 39 22 3c) |( 40 62 77 64 61 61 6c 22 38 23 3d) |( 43 61 74 67 62 62 6f 21 3b 20 3e) |( 42 60 75 66 63 63 6e 20 3a 21 3f) |( 5d 7f 6a 79 7c 7c 71 3f 25 3e 20) |( 5c 7e 6b 78 7d 7d 70 3e 24 3f 21) |( 5f 7d 68 7b 7e 7e 73 3d 27 3c 22) |( 5e 7c 69 7a 7f 7f 72 3c 26 3d 23) |( 59 7b 6e 7d 78 78 75 3b 21 3a 24) |( 58 7a 6f 7c 79 79 74 3a 20 3b 25) |( 5b 79 6c 7f 7a 7a 77 39 23 38 26) |( 5a 78 6d 7e 7b 7b 76 38 22 39 27) |( 55 77 62 71 74 74 79 37 2d 36 28) |( 54 76 63 70 75 75 78 36 2c 37 29) |( 57 75 60 73 76 76 7b 35 2f 34 2a) |( 56 74 61 72 77 77 7a 34 2e 35 2b) |( 51 73 66 75 70 70 7d 33 29 32 2c) |( 50 72 67 74 71 71 7c 32 28 33 2d) |( 53 71 64 77 72 72 7f 31 2b 30 2e) |( 52 70 65 76 73 73 7e 30 2a 31 2f)  | ( 4c 01 6e 01 7b 01 68 01 6d 01 6d 01 60 01 2e 01 34 01 2f 01 31 01) |( 4f 02 6d 02 78 02 6b 02 6e 02 6e 02 63 02 2d 02 37 02 2c 02 32 02) |( 4e 03 6c 03 79 03 6a 03 6f 03 6f 03 62 03 2c 03 36 03 2d 03 33 03) |( 49 04 6b 04 7e 04 6d 04 68 04 68 04 65 04 2b 04 31 04 2a 04 34 04) |( 48 05 6a 05 7f 05 6c 05 69 05 69 05 64 05 2a 05 30 05 2b 05 35 05) |( 4b 06 69 06 7c 06 6f 06 6a 06 6a 06 67 06 29 06 33 06 28 06 36 06) |( 4a 07 68 07 7d 07 6e 07 6b 07 6b 07 66 07 28 07 32 07 29 07 37 07) |( 45 08 67 08 72 08 61 08 64 08 64 08 69 08 27 08 3d 08 26 08 38 08) |( 44 09 66 09 73 09 60 09 65 09 65 09 68 09 26 09 3c 09 27 09 39 09) |( 47 0a 65 0a 70 0a 63 0a 66 0a 66 0a 6b 0a 25 0a 3f 0a 24 0a 3a 0a) |( 46 0b 64 0b 71 0b 62 0b 67 0b 67 0b 6a 0b 24 0b 3e 0b 25 0b 3b 0b) |( 41 0c 63 0c 76 0c 65 0c 60 0c 60 0c 6d 0c 23 0c 39 0c 22 0c 3c 0c) |( 40 0d 62 0d 77 0d 64 0d 61 0d 61 0d 6c 0d 22 0d 38 0d 23 0d 3d 0d) |( 43 0e 61 0e 74 0e 67 0e 62 0e 62 0e 6f 0e 21 0e 3b 0e 20 0e 3e 0e) |( 42 0f 60 0f 75 0f 66 0f 63 0f 63 0f 6e 0f 20 0f 3a 0f 21 0f 3f 0f) |( 5d 10 7f 10 6a 10 79 10 7c 10 7c 10 71 10 3f 10 25 10 3e 10 20 10) |( 5c 11 7e 11 6b 11 78 11 7d 11 7d 11 70 11 3e 11 24 11 3f 11 21 11) |( 5f 12 7d 12 68 12 7b 12 7e 12 7e 12 73 12 3d 12 27 12 3c 12 22 12) |( 5e 13 7c 13 69 13 7a 13 7f 13 7f 13 72 13 3c 13 26 13 3d 13 23 13) |( 59 14 7b 14 6e 14 7d 14 78 14 78 14 75 14 3b 14 21 14 3a 14 24 14) |( 58 15 7a 15 6f 15 7c 15 79 15 79 15 74 15 3a 15 20 15 3b 15 25 15) |( 5b 16 79 16 6c 16 7f 16 7a 16 7a 16 77 16 39 16 23 16 38 16 26 16) |( 5a 17 78 17 6d 17 7e 17 7b 17 7b 17 76 17 38 17 22 17 39 17 27 17) |( 55 18 77 18 62 18 71 18 74 18 74 18 79 18 37 18 2d 18 36 18 28 18) |( 54 19 76 19 63 19 70 19 75 19 75 19 78 19 36 19 2c 19 37 19 29 19) |( 57 1a 75 1a 60 1a 73 1a 76 1a 76 1a 7b 1a 35 1a 2f 1a 34 1a 2a 1a) |( 56 1b 74 1b 61 1b 72 1b 77 1b 77 1b 7a 1b 34 1b 2e 1b 35 1b 2b 1b) |( 51 1c 73 1c 66 1c 75 1c 70 1c 70 1c 7d 1c 33 1c 29 1c 32 1c 2c 1c) |( 50 1d 72 1d 67 1d 74 1d 71 1d 71 1d 7c 1d 32 1d 28 1d 33 1d 2d 1d) |( 53 1e 71 1e 64 1e 77 1e 72 1e 72 1e 7f 1e 31 1e 2b 1e 30 1e 2e 1e) |( 52 1f 70 1f 65 1f 76 1f 73 1f 73 1f 7e 1f 30 1f 2a 1f 31 1f 2f 1f) )}
		$fp1 = {53 00 65 00 6e 00 74 00 69 00 6e 00 65 00 6c 00 20 00 4c 00 61 00 62 00 73 00}
		$fp2 = {3c 66 69 6c 74 65 72 20 6f 62 6a 65 63 74 20 61 74}

	condition:
		$xo1 and not 1 of ( $fp* ) and not uint32( 0 ) == 0x434d5953
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

66a82c77-25dd-407a-80ec-ca66a0eb03d8

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion