With the details below, take the provided rule and improve it.


BURNTCIGAR malware
Hash: 4306c5d152cdd86f3506f91633ef3ae7d8cf0dd25f3e37bec43423c4742f4c42
download zip (password: infected)
Type: PE EXE
Filesize: 238.5 KB
Note from the Mandiant blog: “BURNTCIGAR is a utility that terminates processes at the kernel level by exploiting an Avast driver’s undocumented IOCTL code. The malware terminates targeted processes using the function DeviceIoControl to exploit the undocumented 0x9988C094 IOCTL code of the Avast driver, which calls ZwTerminateProcess with the given process identifier. We have observed a batch script launcher that creates and starts a kernel service called aswSP_ArPot2 loading binary file C:\windows\temp\aswArPot.sys (legitimate Avast driver).”
Hint: you don’t need to know much else about the malware to examine and improve this rule with better formatting, adjusted strings, and more meaningful conditions.

rule MAL_BURNTCIGAR_Strings {
strings:
$s0 = "!This program cannot be run in DOS mode."
$s1 = "CorExitProcess"
$s2 = "Kill PID ="
$s3 = "CreateFile Error = "
$s4 = "F:\\Source\\WorkNew19\\KillAV\\Release\\KillAV.pdb"
$s5 = "SentinelHelperService.exe" wide
$s6 = "SentinelServiceHost.exe" wide
$s7 = "SentinelStaticEngineScanner.exe" wide
$s8 = "Sentinel0Agent.exe" wide
$s9 = "SentinelAgentWorker.exe" wide
$s10 = "SentinelUI.exe" wide
$s11 = "SAVAdminService.exe" wide
$s12 = "SavService.exe" wide
$s13 = "SEDService.exe" wide
$s14 = "ALsvc.exe" wide
$s15 = "SophosCleanM64.exe" wide
$s16 = "SophosFS.exe" wide
$s17 = "SophosFileScanner.exe" wide
$s18 = "SophosHealth.exe" wide
$s19 = "Endpoint Agent Tray.exe" wide
$s20 = "EAServiceMonitor.exe" wide
$s21 = "MsMpEng.exe" wide
$s22 = "\\\\.\\aswSP_ArPot2" wide
$s23 = "\\\\.\\aswSP_Avar" wide
condition: all of them }
