/*
  VizurProtect starter rules. Add more by dropping .yar files into this folder,
  e.g. the YARA Forge "core" bundle: https://github.com/YARAHQ/yara-forge/releases
  meta: severity = "low" or "info" makes a match count as suspicious instead of malicious.
*/

rule EICAR_Test_File
{
    meta:
        description = "EICAR anti-malware test file"
        severity = "high"
    strings:
        $e = "EICAR-STANDARD-ANTIVIRUS-TEST-FILE"
    condition:
        $e in (0..128)
}

rule Webshell_PHP_Eval_Request
{
    meta:
        description = "PHP code evaluating attacker-supplied input"
        severity = "high"
    strings:
        $php = "<?php" nocase
        $e1 = /eval\s*\(\s*(base64_decode|gzinflate|str_rot13|gzuncompress)?\s*\(?\s*\$_(POST|GET|REQUEST|COOKIE)/ nocase
        $e2 = /(assert|system|passthru|shell_exec|exec|popen)\s*\(\s*\$_(POST|GET|REQUEST|COOKIE)\s*\[/ nocase
        $e3 = /preg_replace\s*\(\s*["']\/.*\/e["']/ nocase
    condition:
        $php and any of ($e*)
}

rule PowerShell_Encoded_Hidden_Launcher
{
    meta:
        description = "Hidden PowerShell launched with an encoded command"
        severity = "high"
    strings:
        $p = "powershell" nocase
        $h = /-w(indowstyle)?\s+h(idden)?/ nocase
        $e = /-e(nc|ncodedcommand)?\s+[A-Za-z0-9+\/=]{40,}/ nocase
    condition:
        all of them
}

rule Office_Macro_AutoExec_Download
{
    meta:
        description = "Office macro that auto-runs and downloads or executes"
        severity = "high"
    strings:
        $a1 = "AutoOpen" nocase
        $a2 = "Document_Open" nocase
        $a3 = "Workbook_Open" nocase
        $a4 = "Auto_Open" nocase
        $d1 = "URLDownloadToFile" nocase
        $d2 = "MSXML2.XMLHTTP" nocase
        $d3 = "WScript.Shell" nocase
        $d4 = "powershell" nocase
    condition:
        any of ($a*) and 2 of ($d*)
}

rule Ransomware_Shadow_Copy_Deletion
{
    meta:
        description = "Deletes Windows shadow copies / disables recovery"
        severity = "high"
    strings:
        $v1 = "vssadmin" nocase wide ascii
        $v2 = "delete shadows" nocase wide ascii
        $w1 = "shadowcopy delete" nocase wide ascii
        $b1 = "recoveryenabled no" nocase wide ascii
    condition:
        ($v1 and $v2) or $w1 or $b1
}

rule HackTool_Mimikatz_Strings
{
    meta:
        description = "Mimikatz credential dumping tool"
        severity = "high"
    strings:
        $s1 = "sekurlsa::logonpasswords" nocase wide ascii
        $s2 = "gentilkiwi" wide ascii
        $s3 = "kiwi_msv1_0" wide ascii
    condition:
        any of them
}

rule PE_Process_Injection_Imports
{
    meta:
        description = "Executable importing the remote process-injection API set"
        severity = "low"
    strings:
        $a = "VirtualAllocEx"
        $b = "WriteProcessMemory"
        $c = "CreateRemoteThread"
    condition:
        uint16(0) == 0x5A4D and all of them
}

rule Suspicious_LNK_Launcher
{
    meta:
        description = "Windows shortcut that launches a script interpreter"
        severity = "high"
    strings:
        $ps = "powershell" nocase wide ascii
        $m = "mshta" nocase wide ascii
        $c = "cmd.exe" nocase wide ascii
    condition:
        uint32(0) == 0x0000004C and any of them
}

rule Telegram_Bot_Exfiltration
{
    meta:
        description = "Sends data to a Telegram bot (stealers, phishing kits)"
        severity = "low"
    strings:
        $t = /api\.telegram\.org\/bot[0-9]{6,12}:[A-Za-z0-9_-]{30,}/
    condition:
        $t
}