| 1 |
// MakeNotWork - embedded script downloaders / stagers. |
| 2 |
// Conservative: a binary/asset that bundles a remote-fetch-and-execute stager |
| 3 |
// is highly suspicious for a creative-content marketplace. Multi-token |
| 4 |
// conditions keep false positives off legitimate code samples. |
| 5 |
|
| 6 |
rule suspicious_script_in_binary { |
| 7 |
meta: |
| 8 |
description = "Executable/asset containing embedded script downloaders" |
| 9 |
strings: |
| 10 |
$ps1 = "powershell" ascii nocase |
| 11 |
$ps2 = "Invoke-Expression" ascii nocase |
| 12 |
$ps3 = "DownloadString" ascii nocase |
| 13 |
$bash1 = "curl " ascii |
| 14 |
$bash2 = "| bash" ascii |
| 15 |
$bash3 = "| sh" ascii |
| 16 |
$wget1 = "wget " ascii |
| 17 |
condition: |
| 18 |
(2 of ($ps*)) or (($bash1 or $wget1) and ($bash2 or $bash3)) |
| 19 |
} |
| 20 |
|