Yara Rule - iOS 장치의 작동 삼각 측량에 사용되는 TriangledB 임플란트 감지 (MACOS 시스템에서도 사용됨)
Yara 정의.
Yara Rule - Detects TriangleDB implant found being used in Operation Triangulation on iOS devices (maybe also used on macOS systems)
Yara definition.
Author: Florian Roth
https://securelist.com/triangledb-triangulation-implant/110050/
date = "2023-06-21"
score = 80
$s1 = "unmungeHexString" ascii fullword
$s2 = "CRPwrInfo" ascii fullword
$s3 = "CRConfig" ascii fullword
$s4 = "CRXConfigureDBServer" ascii fullword
( uint16(0) == 0xfacf and filesize < 30MB and $s1 and 2 of them )```
[https://github.com/Neo23x0/signature-base/commit/044469606530db33e2dc76d2d8ba9f363e784062](https://github.com/Neo23x0/signature-base/commit/044469606530db33e2dc76d2d8ba9f363e784062)