SUSP_ESXiArgs_Endpoint_Conf_Aug23

rule SUSP_ESXiArgs_Endpoint_Conf_Aug23 {
   meta:
      description = "Detects indicators found in endpoint.conf files as modified by actors in the ESXiArgs campaign"
      author = "Florian Roth"
      reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-47"
      date = "2023-08-04"
      score = 75
      id = "3e0b5dbf-7c5b-5599-823a-ce35fbdbe64b"
   strings:
      $a1 = "/client/clients.xml" ascii
      $a2 = "/var/run/vmware/proxy-sdk-tunnel" ascii fullword
      $a3 = "redirect" ascii fullword
      $a4 = "allow" ascii fullword

      $s1 = " local 8008 allow allow"
   condition:
      filesize < 2KB and all of them
}