import "pe"

rule Ghost_Implant_PSK_AesHmac_C2
{
    meta:
        description = "Implant Ghost (MinGW x64) : protocole C2 JSON, AES-256-CBC via CryptoAPI + HMAC-SHA256 construit a la main (pads 0x36/0x5c), cle pre-partagee base64 de 32 octets dans .rdata, identifiant de build G+8 hex"
        sha256_examples = "11942f525df4f7681006b3e681656ef32e3afd248e2d51d3660a80b958f4947e,118c38f1051be7f5,8795abe52d8d274a"
        date = "2026-10-23"
    strings:
        $json1 = "\"build_id\":\"%s\"" ascii
        $json2 = "\"hostname\":\"%s\",\"username\":\"%s\",\"os\":\"windows\"" ascii
        $prov  = "Microsoft Enhanced RSA and AES Cryptographic Provider" ascii
        $cmd   = "cmd.exe /c %s" ascii
        $ipad  = { 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 }
        $opad  = { 5C 5C 5C 5C 5C 5C 5C 5C 5C 5C 5C 5C 5C 5C 5C 5C }
        $bid   = /G[0-9A-F]{8}\x00/ fullword
    condition:
        uint16(0) == 0x5A4D and filesize < 600KB
        and pe.imports("WINHTTP.dll", "WinHttpSendRequest")
        and pe.imports("ADVAPI32.dll", "CryptImportKey")
        and ( ($json1 and $prov and $ipad and $opad) or ($json2 and $cmd and $prov) )
        and $bid
}

rule RevSocks_Loader_Hardcoded_Download_Path
{
    meta:
        description = "Chargeurs RevSocks : telechargent agent.exe / agent.enc / agent_sc.enc depuis un chemin /dl/<jeton 32 hex>/ sur HTTPS, XOR de 32 octets, ecriture dans %TEMP%\\msedge_update.exe ou injection dans explorer.exe"
        date = "2026-10-23"
    strings:
        $dl    = /https:\/\/[0-9.]{7,15}:443\/dl\/[0-9a-f]{32}\/agent(_sc)?\.(enc|exe)/ ascii
        $tok   = "6599207047fdf950a83e680bc24750da" ascii
        $tmp   = "%smsedge_update.exe" ascii
        $flags = { 00 30 80 84 }
    condition:
        uint16(0) == 0x5A4D and filesize < 100KB
        and ( $dl or $tok or ($tmp and $flags) )
}

rule INC_Rust_Windows_Encryptor_Patched_Template
{
    meta:
        description = "Encrypteur INC Windows (Rust) : modele compile sur un runner GitHub Actions, personnalise par patch binaire : cle base64 de 32 octets precedee de ae000000 2e000000, suivie de 'is empty', identifiant u<16 hex><8 hex>%id%"
        date = "2026-10-23"
    strings:
        $note  = "INC-README.txt" ascii
        $runner = "C:\\Users\\runneradmin\\.cargo\\registry" ascii
        $c1    = "curve25519-dalek-3.2.1" ascii
        $c2    = "salsa20-0.9.0" ascii
        $c3    = "aes-soft-0.6.4" ascii
        $c4    = "ctr-0.6.0" ascii
        $patched = { AE 00 00 00 2E 00 00 00 [43] 3D 69 73 20 65 6D 70 74 79 }
        $idfmt = /u[0-9a-f]{24}%id%/ ascii
        $mtx   = "Local\\RustBacktraceMutex" ascii
    condition:
        uint16(0) == 0x5A4D and filesize < 4MB
        and $note and 2 of ($c*) and ( $patched or $idfmt or $runner or $mtx )
}

rule Phantom_PS_Cradle_AMSI_HWBP
{
    meta:
        description = "Cradle PowerShell Phantom : bypass AMSI par point d'arret materiel (VEH + DR0), patch ETW, telechargement /api/v2/update, AES-256-CBC dont cle et IV sont les 48 premiers octets du blob, execution par CreateTimerQueueTimer, marqueur dans WER\\ReportQueue"
        date = "2026-10-23"
    strings:
        $a = "AddVectoredExceptionHandler" ascii
        $b = "AmsiScanBuffer" ascii
        $c = "CreateTimerQueueTimer" ascii
        $d = "ServerCertificateValidationCallback" ascii
        $e = "WER\\ReportQueue\\marker.tmp" ascii
        $f = "NtProtectVirtualMemory" ascii
    condition:
        filesize < 100KB and 4 of them
}

rule Phantom_Python_Beacon_Svc
{
    meta:
        description = "Beacon Python Phantom (svc.py) : stdlib uniquement, TLS sans verification, rotation de User-Agent, camouflage de nom de processus"
        date = "2026-10-23"
    strings:
        $h = "PHANTOM Lightweight C2 Beacon" ascii
        $s = "stage1.cmd -> pythonw.exe svc.py --callback URL --token TOKEN" ascii
        $m = "WUDFHost.exe" ascii
        $v = "4.0.0-svc" ascii
    condition:
        filesize < 100KB and ($h or $s or ($m and $v))
}

rule FakeMicrosoft_SelfSigned_Authenticode
{
    meta:
        description = "Binaire PE signe par un certificat auto-signe 'CN=Microsoft Corporation, O=Microsoft Corporation' sans C/ST/L (les vrais certificats Microsoft portent C=US, ST=Washington, L=Redmond)"
        date = "2026-10-23"
    condition:
        uint16(0) == 0x5A4D and pe.number_of_signatures > 0
        and for any i in (0..pe.number_of_signatures - 1) : (
            pe.signatures[i].subject == pe.signatures[i].issuer
            and pe.signatures[i].subject contains "CN=Microsoft Corporation"
            and not pe.signatures[i].subject contains "Redmond" )
}

rule INC_Rust_Linux_Encryptor_Patched_Template
{
    meta:
        description = "Encrypteurs INC ELF (Rust, toutes architectures, Linux et ESXi) : fichier de rancon INC-README.txt, note de rancon en base64 embarquee, crate cipher 0.3.0, cle publique X25519 base64 de 44 caracteres propre a la victime"
        sha256_examples = "e7c546134a20,c26520e6e7f3,29009de86551,86d04474459f2b0d"
        date = "2026-10-23"
    strings:
        $readme = "INC-README.txt" ascii
        $src    = "src/files.rs" ascii
        $cipher = "cipher-0.3.0" ascii
        $note1  = "mFuc29tLCB3ZSB3" ascii
        $note4  = "JTkMgUmFuc29t" ascii
    condition:
        uint32(0) == 0x464C457F and filesize < 3MB
        and ( $note1 or $note4 ) and 2 of ($readme, $src, $cipher, $note1, $note4)
}

rule Phantom_rks3_Exfil_Agent
{
    meta:
        description = "Agent d'exfiltration rks3 (Go) : module rks3/cmd/agent, tache planifiee StorageSync, chemin de compilation /root/chat/DOWNLOADER/rks3"
        date = "2026-10-23"
    strings:
        $mod  = "rks3/cmd/agent" ascii
        $task = "Microsoft\\Windows\\Maintenance\\StorageSync" ascii wide
        $path = "/root/chat/DOWNLOADER/rks3" ascii
        $vcs  = "125a84a1d3c20fe94227982104cc60664ac06adf" ascii
    condition:
        filesize < 20MB and $mod and ( $task or $path or $vcs )
}

rule Linux_ChaCha20_Tunnel_Agent_V3
{
    meta:
        description = "Agent ELF statique a tunnel ChaCha20 : prefixe de cle chacha20_tunnel_v3_, en-tete CC20, adresse de livraison 77.110.109.248"
        sha256_examples = "c11d57472a70"
        date = "2026-10-23"
    strings:
        $k  = "chacha20_tunnel_v3_" ascii
        $ip = "77.110.109.248" ascii
        $psk = "f191074b103901bb58a4ca37494e4cf6" ascii
    condition:
        uint32(0) == 0x464C457F and filesize < 3MB and $k and ( $ip or $psk )
}

rule Phantom_Athena_QuickLine_Bundle
{
    meta:
        description = "Hote monofichier .NET 8 contenant les assemblees QuickLine, Agent.Profiles.Http et Agent.Crypto.Aes de l'agent Mythic Athena"
        sha256_examples = "c4f5e0b453347dee"
        date = "2026-10-23"
    strings:
        $a = "QuickLine.dll" ascii
        $b = "Agent.Profiles.Http.dll" ascii
        $c = "Agent.Crypto.Aes.dll" ascii
        $d = "Agent.Managers.Python.dll" ascii
    condition:
        uint16(0) == 0x5A4D and filesize > 20MB and $a and $b and $c and $d
}

import "pe"

rule RevSocks_Family_Structural
{
    meta:
        description = "Famille RevSocks par structure et non par jeton : agents a tunnel ChaCha20 (v3 en clair, variante HTTP /tunnel/, v4 a chaines XOR 0x5a), chargeurs et injecteurs de agent.enc ou agent_sc.enc (URL en clair ou XOR 0xcb)"
        sha256_examples = "fc0269ad9945,ba3689bf7bc6,e26df3b6bc8c,2d49a9e3e310,29f87d32b658,d91e304a3378,9113fcddc88f,90fe2b57f37d,4bb026581df6,7114be5cb487,27d39120cdc0,bef87021caf3,e2b5fc7e4576,d4ae978d0fa3,8bba473887e6,c11d57472a70"
        date = "2026-10-23"
    strings:
        $v3a  = "chacha20_tunnel_v3_" ascii
        $psk  = "f191074b103901bb58a4ca37494e4cf6" ascii
        $cc20 = "CC20" ascii
        $cf1  = "/tunnel/%s" ascii
        $hex  = "0123456789abcdef" ascii
        $v4a  = "chacha20_tunnel_v4_" xor(0x5a-0x5a)
        $v4b  = "VBoxService.exe" xor(0x5a-0x5a)
        $v4c  = "vmtoolsd.exe" xor(0x5a-0x5a)
        $dl   = "/dl/" ascii
        $dlx  = "/dl/" xor(0xcb-0xcb)
        $enc1 = "agent_sc.enc" ascii
        $enc2 = "agent.enc" ascii
        $enc3 = "agent.exe" ascii
        $encx = "agent_sc.enc" xor(0xcb-0xcb)
        $sbie = "SbieDll.dll" ascii
        $etw  = "EtwEventWrite" ascii
        $ntc  = "NtCreateThreadEx" ascii
    condition:
        filesize < 1MB and
        (
            ( uint32(0) == 0x464C457F and $v3a and $psk and $cc20 )
            or
            ( uint16(0) == 0x5A4D and (
                ( $v3a and $psk and $cc20 )
                or ( $cf1 and ( $cc20 or $psk ) and $hex )
                or ( $v4a and 1 of ($v4b, $v4c) )
                or ( $dl and 1 of ($enc1, $enc2, $enc3) and pe.imports("WININET.dll", "InternetOpenUrlA") )
                or ( $dlx and $encx and $sbie and $etw and $ntc )
            ))
        )
}

rule Ghost_OneDriveSync_DonutShellcode {
    meta:
        description = "Blob Donut (shellcode PIC) : CALL initial dont le deplacement egale le champ len de l'instance, suivi de l'instance puis du code de chargement"
        hash = "71f5be7bd73e43a2356ecbe1d2d8fbb1ecf339c82195ddd3a8d9f16c2e826e9b"
        date = "2026-10-23"
    condition:
        uint8(0) == 0xE8 and
        uint32(1) == uint32(5) and
        uint32(1) > 4096 and
        filesize > uint32(1) + 5 and
        filesize < uint32(1) + 5 + 65536
}

rule Ghost_dump_ppl_DBUtil_BYOVD {
    meta:
        description = "Ghost_dump_ppl (Go/garble) : videur LSASS PPL-aware embarquant le pilote Dell DBUtil_2_3.sys (CVE-2021-21551) et envoyant le dump par HTTP avec User-Agent de navigateur"
        hash = "609aa250c4b5ac9457f41f9dcfe63f983886fa7cd120e188538ebe247244ade1"
        date = "2026-10-23"
    strings:
        $dev = "\\\\.\\DBUtil_2_3" ascii
        $sys = "DBUtil_2_3.Sys" ascii
        $drv = "[ Dell BIOS Utility Driver - " ascii
    condition:
        uint16(0) == 0x5A4D and filesize > 5MB and
        $dev and $sys and $drv
}

rule RevSocks_V4_Agent_XorPrefix {
    meta:
        description = "Agents RevSocks v4 : prefixe de derivation de cle chacha20_tunnel_v4_ encode par XOR 0x5a"
        date = "2026-10-23"
    strings:
        $pref_v4 = { 39 32 3B 39 32 3B 68 6A 05 2E 2F 34 34 3F 36 05 2C 6E 05 }
    condition:
        uint16(0) == 0x5A4D and $pref_v4
}

rule Ghost_Loader_Meterpreter_AesBlob {
    meta:
        description = "Ghost_loader (MinGW x64) : chargeur d'un Meterpreter stageless chiffre en AES-256-CBC par la CryptoAPI, mutex Global\\WinSvcUpdate_7B3F, execution par EnumDesktopWindows"
        hash = "f6fbe16811654ff1fb44d939bd989f3d1eac5e28f986157030cb9bf3da290c60"
        date = "2026-10-24"
    strings:
        $mtx = "Global\\WinSvcUpdate_7B3F" ascii
        $ntdll = "C:\\Windows\\System32\\ntdll.dll" ascii nocase
        $enum = "EnumDesktopWindows" ascii
        $imp = "CryptImportKey" ascii
        $dec = "CryptDecrypt" ascii
    condition:
        uint16(0) == 0x5A4D and filesize < 1MB and
        $mtx and $ntdll and $enum and $imp and $dec
}

rule Ghost_Telegram_Implant_Commands {
    meta:
        description = "Implants Ghost de deuxieme et troisieme generation (API Telegram) : trames JSON build_id et chat_id, noms de commandes en clair"
        hash = "118c38f1 8795abe5"
        date = "2026-10-24"
    strings:
        $b = "\"build_id\":\"%s\"" ascii
        $c = "\"chat_id\"" ascii
        $x1 = "computers" ascii fullword
        $x2 = "shell:" ascii
    condition:
        uint16(0) == 0x5A4D and filesize < 1MB and
        $b and $c and $x1 and $x2
}

rule SysTool_Software_Ltd_Signed_Binary {
    meta:
        description = "Binaire dont la signature Authenticode porte le sujet SysTool Software Ltd. (certificat de signature de code utilise par BackupAgent, BackupConsole et un troisieme fichier du lot)"
        date = "2026-10-24"
    strings:
        $s = "SysTool Software Ltd." ascii
    condition:
        uint16(0) == 0x5A4D and $s and pe.number_of_signatures >= 1
}

rule Phantom_Go_Module_BuildInfo {
    meta:
        description = "Binaires Go dont la metadonnee de build nomme un module des outils Phantom et Ghost du lot (mcp-agent, mcp-bridge, backupconsole-cli, onedrive-sync, lsass-clean, phantom-cli, netscanner, hostprobe)"
        date = "2026-10-24"
    strings:
        $go = "Go buildinf:" ascii
        $m1 = "path\tmcp-agent" ascii
        $m2 = "path\tmcp-bridge" ascii
        $m3 = "path\tbackupconsole-cli" ascii
        $m4 = "path\tonedrive-sync" ascii
        $m5 = "path\tlsass-clean/cmd/dump" ascii
        $m6 = "path\tphantom-cli" ascii
        $m7 = "path\tnetscanner" ascii
        $m8 = "path\thostprobe" ascii
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464c457f) and $go and 1 of ($m*)
}