godlua_malware_detector_sysmon_behavior

rule godlua_malware_detector_sysmon_behavior {
 meta:
    author = "Lee Archinal"
    description = "This content detects charactaristics that are attributed to the Godlua Malware Strain  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/GrXZjG031CKs"
    version = "0.01"
    created = "2019/07/05"
    product = "windows"
    service = "sysmon"
    mitre = "command_and_control, collection, t1043, t1005"

  events:
(($selection1.metadata.product_event_type = "1" and ($selection1.target.file.md5 = "870319967dba4bd02c7a7f8be8ece84f" or $selection1.target.file.md5 = "c9b712f6c347edde22836fb43b927633" or $selection1.target.file.md5 = "75902cf93397d2e2d1797cd115f8347a") and (($selection1.metadata.product_event_type = "11" and (re.regex($selection1.target.file.full_path, `.*start\.png`) or re.regex($selection1.target.file.full_path, `.*run\.png`) or re.regex($selection1.target.file.full_path, `.*quit\.png`) or re.regex($selection1.target.file.full_path, `.*watch\.png`) or re.regex($selection1.target.file.full_path, `.*upgrade\.png`) or re.regex($selection1.target.file.full_path, `.*proxy\.png`) or re.regex($selection1.target.file.full_path, `.*packet\.png`) or re.regex($selection1.target.file.full_path, `.*curl\.png`) or re.regex($selection1.target.file.full_path, `.*util\.png`) or re.regex($selection1.target.file.full_path, `.*utils\.png`) or re.regex($selection1.target.file.full_path, `.*VM\.png`) or re.regex($selection1.target.file.full_path, `.*CC\.png`))) or ($selection1.metadata.product_event_type = "3" and ($selection1.target.ip = "198.204.231.250" or $selection1.target.ip = "104.238.151.101" or $selection1.target.ip = "43.224.225.220")))) or ($selection1.metadata.product_event_type = "11" and (re.regex($selection1.target.file.full_path, `.*start\.png`) or re.regex($selection1.target.file.full_path, `.*run\.png`) or re.regex($selection1.target.file.full_path, `.*quit\.png`) or re.regex($selection1.target.file.full_path, `.*watch\.png`) or re.regex($selection1.target.file.full_path, `.*upgrade\.png`) or re.regex($selection1.target.file.full_path, `.*proxy\.png`) or re.regex($selection1.target.file.full_path, `.*packet\.png`) or re.regex($selection1.target.file.full_path, `.*curl\.png`) or re.regex($selection1.target.file.full_path, `.*util\.png`) or re.regex($selection1.target.file.full_path, `.*utils\.png`) or re.regex($selection1.target.file.full_path, `.*VM\.png`) or re.regex($selection1.target.file.full_path, `.*CC\.png`))))

  condition:
    $selection1
}