Maîtriser YARA

rule Suspicious_PE_File
{
    meta:
        author = "CTI Analyst"
        description = "Détecte PE avec sections suspectes"
        date = "2025-10-29"
        severity = "high"
        
    strings:
        $mz = "MZ"
        $pe = "PE\x00\x00"
        $suspicious1 = "WinExec" nocase
        $suspicious2 = "URLDownloadToFileA" nocase
        $suspicious3 = "ShellExecuteA" nocase
        
    condition:
        $mz at 0 and
        $pe and
        2 of ($suspicious*) and
        filesize < 500KB
}

rule Ransomware_Generic
{
    meta:
        description = "Détection générique de ransomware"
        author = "Threat Intel Team"
        tlp = "white"
        
    strings:
        $ransom1 = "encrypted" nocase
        $ransom2 = "bitcoin" nocase
        $ransom3 = "decrypt" nocase
        $crypto1 = "CryptEncrypt"
        $crypto2 = "CryptGenKey"
        $file_ext1 = ".locked"
        $file_ext2 = ".encrypted"
        
    condition:
        uint16(0) == 0x5A4D and
        filesize < 2MB and
        (
            (2 of ($ransom*) and 1 of ($crypto*)) or
            (3 of ($ransom*) and any of ($file_ext*))
        )
}

rule Obfuscated_Code
{
    meta:
        description = "Détecte du code fortement obfusqué"
        
    strings:
        $base64_pattern = /[A-Za-z0-9+\/]{200,}/
        $high_entropy = { ( [A-F0-9]{2} ){100,} }
        
    condition:
        for any section in pe.sections : (
            section.name matches /^\.[a-z]{4,8}$/ and
            math.entropy(section.raw_data_offset, 
                        section.raw_data_size) > 7.0
        ) or
        #base64_pattern > 5 or
        #high_entropy > 3
}

import "pe"
import "hash"

rule APT_Backdoor_Custom
{
    meta:
        description = "Détecte un backdoor APT spécifique"
        threat_actor = "APT29"
        mitre_attack = "T1071.001"
        
    strings:
        $c2_pattern = /https?:\/\/[a-z0-9]{16}\.com\/[a-z]{4}/
        $mutex = "Global\\{8F6F0AC4-B9A1-45FD-A8CF-72F04E6BDE8F}"
        $pdb = /[A-Z]:\\Projects\\[a-z]+\\Release\\[a-z]+\.pdb/ nocase
        
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections > 3 and
        pe.timestamp > 1609459200 and // Après 2021
        (
            hash.md5(0, filesize) != 
            hash.md5(pe.sections[0].raw_data_offset, 
                    pe.sections[0].raw_data_size) and
            ($c2_pattern or $mutex or $pdb)
        )
}