Add detection rule for hp-socket linking (#848)

* Add initial detection rule Signed-off-by: Still Hsu <[email protected]> --------- Signed-off-by: Still Hsu <[email protected]> Co-authored-by: Yacine <[email protected]>
mandiant · Jan 23, 2024 · 8bbae03 · 8bbae03
1 parent bbd8690
commit 8bbae03
Showing 1 changed file with 32 additions and 0 deletions.
diff --git a/nursery/linked-against-hp-socket.yml b/nursery/linked-against-hp-socket.yml
@@ -0,0 +1,32 @@
+rule:
+  meta:
+    name: linked against hp-socket
+    namespace: linking/static/hp-socket
+    authors:
+      - [email protected]
+    scopes:
+      static: file
+      dynamic: file
+    att&ck:
+      - Command and Control::Non-Application Layer Protocol [T1095]
+    references:
+      - https://github.com/ldcsaa/HP-Socket/
+    examples:
+      - 4c46fdafceba8e450deb93cdb82a177e
+  features:
+    - or:
+      - substring: "HP-Socket for Linux v%d.%d.%d [BN:%02d]"
+      - 3 or more:
+        - substring: "global/helper.cpp"
+        - substring: "src/HttpServer.cpp"
+        - substring: "src/TcpServer.cpp"
+        - substring: "src/common/IODispatcher.cpp"
+        - substring: "src/common/Thread.cpp"
+        - substring: "/HP-Socket/Linux/"
+      # in theory the following should be present for Windows version; untested
+      - 3 or more:
+        - substring: "Client Send Fail [SOCK: %d, SEQ: %d]"
+        - substring: "(%Iu) Send OK -->"
+        - substring: "<%s#%d> OP: %d, CODE: %d (DATA: 0x%X, LEN: %d>"
+        - substring: "---------------> Client Worker Thread 0x%08X stoped <---------------"
+        - substring: "<C-CNNID: %Iu> OnSend() event should not return 'HR_ERROR' !!"