Alternative Detection Surfaces

Write a rule to detect renamed powershell.exe

Provided the following sample, write a rule to detect an instance of a powershell.exe with a file system path that is *not* C:\Windows\system32\powershell.exe. Submit your rule and the command-line syntax to successfully test the rule. (hint: use external variable)



Sha256 of legitimate powershell.exe: 6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7

Zip of sample: https://drive.google.com/file/d/1PRcAv3A_aIOS3U86872ilkOfX3puzEiS/view?usp=share_link (password is infected)



Use YARA to calculate the crc32 of the the .text section of the provided file.

What is the CRC32 value of the text section of this "dropbk" malware sample? 



Sha256 of "dropbk" malware sample: a8e18a84898f46cd88813838f5e69f05240c4853af2aee5917dcee3a3e2a5d5a

Zip of sample: https://drive.google.com/file/d/1nuYd3vNamIu_suVM7GoqNmEpqXmQ62dY/view?usp=share_link (password is infected)



Post the rule you wrote to aid with the calculation along with the calculated CRC value.