Heuristic_Stack_String_SeLoadDriverPrivilege_C

YARA detection rule by BitsOfBinary · GPL-2.0

Detects the stack string SeLoadDriverPrivilege being loaded in a combination of 1, 2, and 4 byte chunks, not necessarily in order

rule Heuristic_Stack_String_SeLoadDriverPrivilege_C {
    meta:
        description = "Detects the stack string SeLoadDriverPrivilege being loaded in a combination of 1, 2, and 4 byte chunks, not necessarily in order"
        author = "BitsOfBinary"
        reference = "https://bitsofbinary.github.io/yara/2023/04/08/100daysofyara-day-98.html"
        version = "1.0"
        date = "2023-04-08"
        DaysofYARA = "98/100"
    strings:
        $one_byte_mov_S_stack = {C6 44 24 ?? 53}
        $one_byte_mov_e_stack = {C6 44 24 ?? 65}
        $one_byte_mov_L_stack = {C6 44 24 ?? 4c}
        $one_byte_mov_o_stack = {C6 44 24 ?? 6f}
        $one_byte_mov_a_stack = {C6 44 24 ?? 61}
        $one_byte_mov_d_stack = {C6 44 24 ?? 64}
        $one_byte_mov_D_stack = {C6 44 24 ?? 44}
        $one_byte_mov_r_stack = {C6 44 24 ?? 72}
        $one_byte_mov_i_stack = {C6 44 24 ?? 69}
        $one_byte_mov_v_stack = {C6 44 24 ?? 76}
        $one_byte_mov_P_stack = {C6 44 24 ?? 50}
        $one_byte_mov_l_stack = {C6 44 24 ?? 6c}
        $one_byte_mov_g_stack = {C6 44 24 ?? 67}
        $two_byte_mov_Se_stack = {66 C7 44 24 ?? 53 65}
        $two_byte_mov_eL_stack = {66 C7 44 24 ?? 65 4c}
        $two_byte_mov_Lo_stack = {66 C7 44 24 ?? 4c 6f}
        $two_byte_mov_oa_stack = {66 C7 44 24 ?? 6f 61}
        $two_byte_mov_ad_stack = {66 C7 44 24 ?? 61 64}
        $two_byte_mov_dD_stack = {66 C7 44 24 ?? 64 44}
        $two_byte_mov_Dr_stack = {66 C7 44 24 ?? 44 72}
        $two_byte_mov_ri_stack = {66 C7 44 24 ?? 72 69}
        $two_byte_mov_iv_stack = {66 C7 44 24 ?? 69 76}
        $two_byte_mov_ve_stack = {66 C7 44 24 ?? 76 65}
        $two_byte_mov_er_stack = {66 C7 44 24 ?? 65 72}
        $two_byte_mov_rP_stack = {66 C7 44 24 ?? 72 50}
        $two_byte_mov_Pr_stack = {66 C7 44 24 ?? 50 72}
        $two_byte_mov_vi_stack = {66 C7 44 24 ?? 76 69}
        $two_byte_mov_il_stack = {66 C7 44 24 ?? 69 6c}
        $two_byte_mov_le_stack = {66 C7 44 24 ?? 6c 65}
        $two_byte_mov_eg_stack = {66 C7 44 24 ?? 65 67}
        $two_byte_mov_ge_stack = {66 C7 44 24 ?? 67 65}
        $four_byte_mov_SeLo_stack = {C7 44 24 ?? 53 65 4c 6f}
        $four_byte_mov_eLoa_stack = {C7 44 24 ?? 65 4c 6f 61}
        $four_byte_mov_Load_stack = {C7 44 24 ?? 4c 6f 61 64}
        $four_byte_mov_oadD_stack = {C7 44 24 ?? 6f 61 64 44}
        $four_byte_mov_adDr_stack = {C7 44 24 ?? 61 64 44 72}
        $four_byte_mov_dDri_stack = {C7 44 24 ?? 64 44 72 69}
        $four_byte_mov_Driv_stack = {C7 44 24 ?? 44 72 69 76}
        $four_byte_mov_rive_stack = {C7 44 24 ?? 72 69 76 65}
        $four_byte_mov_iver_stack = {C7 44 24 ?? 69 76 65 72}
        $four_byte_mov_verP_stack = {C7 44 24 ?? 76 65 72 50}
        $four_byte_mov_erPr_stack = {C7 44 24 ?? 65 72 50 72}
        $four_byte_mov_rPri_stack = {C7 44 24 ?? 72 50 72 69}
        $four_byte_mov_Priv_stack = {C7 44 24 ?? 50 72 69 76}
        $four_byte_mov_rivi_stack = {C7 44 24 ?? 72 69 76 69}
        $four_byte_mov_ivil_stack = {C7 44 24 ?? 69 76 69 6c}
        $four_byte_mov_vile_stack = {C7 44 24 ?? 76 69 6c 65}
        $four_byte_mov_ileg_stack = {C7 44 24 ?? 69 6c 65 67}
        $four_byte_mov_lege_stack = {C7 44 24 ?? 6c 65 67 65}
    condition:
        for any of ($four_byte_*) : (
            any of ($one_byte_*, $two_byte_*) at @+8
        )
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

58f084ba-2093-466d-8430-a2fc5bc1d4d4

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion