TEMP_Periscope_July2018_Spearphish

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule TEMP_Periscope_July2018_Spearphish (No description metadata provided).

rule TEMP_Periscope_July2018_Spearphish: email {
  meta:
    Author      = "Insikt Group, Recorded Future"
    TLP         = "White"
    Date        = "2018-09-22"
    Description = "Rule to identify spearphish sent by Chinese threat actor TEMP.Periscope during July 2018 campaign"

  strings:
    $eml_1      = "From:"
    $eml_2      = "To:"
    $eml_3      = "Subject:"
    $greeting_1 = "Dear,"
    $content_1  = "Melissa Coade" nocase
    $content_2  = "Below is the Report Website and conatc"
    $content_3  = "Would yo mind giving me"
    $url_1      = "file://"
    $url_2      = "https://drive.google.com/open?"

  condition:
    all of ($eml*) and all of ($greeting*) and 2 of ($content*) and 2 of ($url*)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

2dba3a88-3172-4505-b5c6-fd623b7ab0e8

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion