87owo/PYAS
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
87owo authored and GitHub committed 2026-09-22 13:33:35 +08:00
1 parent b89e91cdb8
commit 6cb8b801c7
1 file changed
+15 -12
Download Patch File Download Diff File Expand all files Collapse all files
Engine/Heuristic/Rules_General_B1.yar
+15 -12
View File
@@ -737,7 +737,7 @@ rule Trojan_JS_ObfuscatedLoader
$decode_3 = "decodeURIComponent" ascii wide nocase
$decode_4 = "unescape(" ascii wide nocase
$dynamic_1 = "eval(" ascii wide nocase
$dynamic_2 = "Function(" ascii wide nocase
$dynamic_2 = "Function(" ascii wide
$dynamic_3 = "constructor(" ascii wide nocase
$anchor_1 = "ActiveXObject" ascii wide nocase
$anchor_2 = "WScript" ascii wide nocase
@@ -747,7 +747,8 @@ rule Trojan_JS_ObfuscatedLoader
$anchor_6 = "https://" ascii wide nocase
condition:
Script_Text_Reasonable and (#hex_id >= 12 or #indexed >= 40) and
2 of ($decode_*) and 1 of ($dynamic_*) and 2 of ($anchor_*)
2 of ($decode_*) and 1 of ($dynamic_*) and
1 of ($anchor_1, $anchor_2, $anchor_4) and 1 of ($anchor_3, $anchor_5, $anchor_6)
}
rule Trojan_VBS_ObfuscatedLoader
@@ -1143,6 +1144,10 @@ rule TrojanDownloader_PS_StagedExecution
$exec_1 = "Start-Process" ascii wide nocase
$exec_2 = "Invoke-Expression" ascii wide nocase
$exec_3 = "IEX(" ascii wide nocase
$evasion_1 = "-ExecutionPolicy Bypass" ascii wide nocase
$evasion_2 = "-EncodedCommand" ascii wide nocase
$evasion_3 = "-enc " ascii wide nocase
$evasion_4 = "FromBase64String" ascii wide nocase
$context_1 = "Start-Sleep" ascii wide nocase
$context_2 = "WindowStyle" ascii wide nocase
$context_3 = "$env:APPDATA" ascii wide nocase
@@ -1150,7 +1155,8 @@ rule TrojanDownloader_PS_StagedExecution
$context_5 = "ExecutionPolicy" ascii wide nocase
condition:
Script_Text_Reasonable and 1 of ($client_*) and 1 of ($download_*) and
1 of ($remote_*) and 1 of ($exec_*) and 1 of ($context_*)
1 of ($remote_*) and 1 of ($context_*) and
(($exec_2 or $exec_3) or ($exec_1 and 1 of ($evasion_*)))
}
rule TrojanDownloader_JS_MalBehav
@@ -1194,18 +1200,17 @@ rule Trojan_JS_WSHDynamicEval
attribution = "generic obfuscated-loader capability; not a verified malware-family attribution"
strings:
$host_1 = "WScript" ascii wide nocase
$host_2 = "WScrip" ascii wide nocase
$hex_id = /_0x[0-9a-fA-F]{4,}/
$dynamic_1 = "eval(" ascii wide nocase
$dynamic_2 = "Function(" ascii wide nocase
$decode_1 = "fromCharCode" ascii wide nocase
$decode_2 = "charCodeAt" ascii wide nocase
$decode_3 = "decodeURIComponent" ascii wide nocase
$behavior_1 = "WScript.Shell" ascii wide nocase
$com = "ActiveXObject" ascii wide nocase
$behavior_2 = "XMLHTTP" ascii wide nocase
$behavior_3 = "ADODB.Stream" ascii wide nocase
condition:
Script_Text_Reasonable and 1 of ($host_*) and 1 of ($dynamic_*) and
2 of ($decode_*) and 1 of ($behavior_*)
Script_Text_Reasonable and $host_1 and 1 of ($dynamic_*) and
#hex_id >= 12 and 2 of ($decode_*) and $com and $behavior_2
}
rule Trojan_JS_TypedValue
@@ -1270,21 +1275,19 @@ rule Trojan_JS_WSHEvalLoader
attribution = "generic WSH loader capability; not a verified malware-family attribution"
strings:
$host = "WScript" ascii wide nocase
$hex_id = /_0x[0-9a-fA-F]{4,}/
$dynamic_1 = "eval(" ascii wide nocase
$dynamic_2 = "Function(" ascii wide nocase
$com_1 = "CreateObject" ascii wide nocase
$com_2 = "ActiveXObject" ascii wide nocase
$behavior_1 = "WScript.Shell" ascii wide nocase
$behavior_2 = "XMLHTTP" ascii wide nocase
$behavior_3 = "ADODB.Stream" ascii wide nocase
$behavior_4 = ".Run(" ascii wide nocase
$obf_1 = "fromCharCode" ascii wide nocase
$obf_2 = "charCodeAt" ascii wide nocase
$obf_3 = "String.prototype" ascii wide nocase
$obf_4 = "\\u00" ascii nocase
condition:
Script_Text_Reasonable and $host and 1 of ($dynamic_*) and 1 of ($com_*) and
2 of ($behavior_*) and 1 of ($obf_*)
#hex_id >= 12 and $behavior_2 and 1 of ($obf_*)
}
rule Trojan_JS_DOMDecoder