tool_swor

YARA detection rule by Sekoia.io · GPL-2.0

Detects swor

rule tool_swor {
  meta:
    id             = "75ce2ed7-2972-4e04-98dc-451acf80c842"
    version        = "1.0"
    description    = "Detects swor"
    author         = "Sekoia.io"
    creation_date  = "2024-09-09"
    classification = "TLP:CLEAR"
    hash           = "d3f92b3349109fc6de26f5e40800fec15308c27fa4fe81fe42af5030637a3a63"

  strings:
    $old_sword_s1  = "Failed to open payload file: "
    $old_sword_s2  = "Failed to open config file: "
    $sword_s1      = "open encrypted file error: "
    $sword_s2      = "open config file error: "
    $enum_calendar = "EnumCalendarInfo"

  condition:
    uint16be(0) == 0x4d5a and
    $enum_calendar and
    (2 of ($old_sword_s*) or 2 of ($sword_s*)) and
    filesize < 1MB and
    true
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

adb6ae61-755d-4e3a-a465-1f6e1b1158d7

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion