Yara Rule - 취약한 프로세스 탐색기 드라이버 감지 (원본 파일 이름 : procexp152.sys)로 이름이 바뀌 었습니다 (종종 공격자가 권한을 높이기 위해 사용).
Yara 정의.
Yara Rule - Detects vulnerable process explorer driver (original file name: PROCEXP152.SYS) that has been renamed (often used by attackers to elevate privileges)
Yara definition.
Author: Florian Roth
https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/
date = "2023-05-05"
score = 60
hash1 = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
$a1 = "\\ProcExpDriver.pdb" ascii
$a2 = "\\Device\\PROCEXP152" wide fullword
$a3 = "procexp.Sys" wide fullword
uint16(0) == 0x5a4d
date = "2023-05-05"
score = 70
hash1 = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
$a1 = "\\ProcExpDriver.pdb" ascii
$a2 = "\\Device\\PROCEXP152" wide fullword
$a3 = "procexp.Sys" wide fullword
uint16(0) == 0x5a4d```
[https://github.com/Neo23x0/signature-base/commit/5c6e3e9f37c979b222f1ab874306933db5084d85](https://github.com/Neo23x0/signature-base/commit/5c6e3e9f37c979b222f1ab874306933db5084d85)