Yara Rule - PE 메타 데이터 정보를 기반으로 HP 하드웨어 진단 드라이버 (ETDSUPP.SYS)의 취약한 버전 감지
Yara 정의.
Yara Rule - Detects vulnerable versions of the HP Hardware Diagnostics driver (etdsupp.sys) based on PE metadata info
Yara definition.
Author: X__Junior (Nextron Systems)
https://github.com/alfarom256/HPHardwareDiagnostics-PoC/tree/main/
date = "2023-05-12"
hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
$s3 = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}([\x00-\xff]{2}[\x00-\x11]\x00[\x00-\xff]{4}|\x00\x00\x12\x00\x00\x00\x00\x00)/ /* Vuln Version*/
uint16(0) == 0x5a4d and int16(uint32(0x3C) + 0x5c) == 0x0001 and filesize < 100KB and all of them```
[https://github.com/Neo23x0/signature-base/commit/1a0b6ff86273aeeee896dd9d3c63b0236b3b478f](https://github.com/Neo23x0/signature-base/commit/1a0b6ff86273aeeee896dd9d3c63b0236b3b478f)