MSCryptoApi

YARA detection rule by @larsborn · GPL-2.0

Provider names often present when using the Microsoft Crypto API

rule MSCryptoApi
{
    meta:
        description = "Provider names often present when using the Microsoft Crypto API"
        author = "@larsborn"
        created_at = "2021-01-03"
        reference = "https://learn.microsoft.com/en-us/windows/win32/seccrypto/cryptographic-provider-names"
        example_hash_01 = "67ecc3b8c6057090c7982883e8d9d0389a8a8f6e8b00f9e9b73c45b008241322"
        DaysofYARA = "7/100"
    strings:
                $MS_DEF_DH_SCHANNEL_PROV = "Microsoft DH Schannel Cryptographic Provider"
                $MS_DEF_DSS_DH_PROV = "Microsoft Base DSS and Diffie-Hellman Cryptographic Provider"
                $MS_DEF_DSS_PROV = "Microsoft Base DSS Cryptographic Provider"
                $MS_DEF_PROV = "Microsoft Base Cryptographic Provider v1.0"
                $MS_DEF_RSA_SCHANNEL_PROV = "Microsoft RSA Schannel Cryptographic Provider"
                $MS_DEF_RSA_SIG_PROV = "Microsoft RSA Signature Cryptographic Provider"
                $MS_ENH_DSS_DH_PROV = "Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider"
                        $MS_ENH_RSA_AES_PROV = "Microsoft Enhanced RSA and AES Cryptographic Provider"
                $MS_ENHANCED_PROV = "Microsoft Enhanced Cryptographic Provider v1.0"
                $MS_SCARD_PROV = "Microsoft Base Smart Card Crypto Provider"
                $MS_STRONG_PROV = "Microsoft Strong Cryptographic Provider"
    condition:
        any of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

94dd3a44-cefa-4939-9a3d-8879ed13dd83

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion