rule: darkside command line detection

bboosz · May 11, 2021 · e9e4471 · e9e4471
1 parent 241e291
commit e9e4471
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/yara/mal_darkside.yar b/yara/mal_darkside.yar
@@ -0,0 +1,14 @@
+rule MAL_DarkSide_May21 {
+   meta:
+      description = "Detects PowerShell invocation as used by DarkSide loader"
+      author = "Florian Roth"
+      date = "2021-05-11"
+      reference = "https://www.varonis.com/blog/darkside-ransomware/"
+      score = 60
+   strings:
+        $ = " -ep bypass " ascii
+        $ = "(0..61)|%{$s+=[char]" ascii 
+        $ = ";iex $" ascii
+   condition:
+      2 of them
+}