Lab Instructions

For this exercise, examine the provided samples, inspect the code signing certificates, and compose and test rules that will detect the malware based on the certificate features.


Compose one rule that is specific to the code signing certificate
Compose another, looser rule that is less specific to exact certificate features and will catch other samples signed with similar certificates.
Try to identify anything unusual or atypical about the malware sample certificates, and try to invent a third rule that detects a certificate “anomaly”

Sha256 of samples:


78a07502443145d762536afaabd4d6139b81ca3cc9f8c28427ec724a3107e17b
f1cbacea1c6d05cd5aa6fc9532f5ead67220d15008db9fa29afaaf134645e9de

Zip of both samples:


lab-codesignedmalware.zip

https://drive.google.com/file/d/15uR6_fB8IJLlgrD62K2TdhLgSs0NN997/view?usp=share_link

Zip password: infected

-----------------

Solution

import "pe"

import "console"

/*

Sample files

- 78a07502443145d762536afaabd4d6139b81ca3cc9f8c28427ec724a3107e17b

f1cbacea1c6d05cd5aa6fc9532f5ead67220d15008db9fa29afaaf134645e9de

*/



private rule Code_Sig_42_6e_86_or_2e_3c_dd {

    meta:

        desc = "Code signing cert used to sign at least one piece of malware."

        ref = "78a07502443145d762536afaabd4d6139b81ca3cc9f8c28427ec724a3107e17b"

    condition:

        pe.number_of_signatures > 0

        and 

        for any thing in pe.signatures:

        (

            thing.serial == "42:6e:86:60:53:09:73:ac:4e:fd:3b:0d:41:f1:c6:1f"

            or thing.serial == "2e:3c:dd:64:c2:66:e1:9e:47:99:56:52:fe:0c:79:a2"

        )

}

private rule Mal_Cert_GoogleInc {

    condition:

        for any thing in pe.signatures:

        (

            thing.issuer == "/CN=Google Inc"

            and

            thing.subject == "/CN=Google Inc"

        )

}

private rule TTP_CodeSigned_Same_Issuer_Subject {

    meta:

        description = "Looking for oddity where certificate issuer is the exact same as the subject"

    condition:

        for any thing in pe.signatures:

        (

            thing.issuer == thing.subject 

            //and console.log("Issuer: ",thing.issuer)

            //and console.log("Subject: ",thing.subject)

        )

}

rule TTP_CodeSign_Short_Issuer {

    condition:

    for any thing in pe.signatures:

    (

        thing.issuer matches /^[a-zA-Z0-9\.\_=\/\s]{1,8}$/

        and console.log("Issuer: ",thing.issuer)

    )

}
