apt_ProjectSauron_pipe_backdoor

rule apt_ProjectSauron_pipe_backdoor  {
	meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect ProjectSauron pipe backdoors"
		version = "1.0"
		reference = "https://securelist.com/blog/"
		id = "5a1dd4b3-a03c-51bb-a7bc-25729b487f70"
	strings:
		$a1 = "CreateNamedPipeW" fullword ascii
		$a2 = "SetSecurityDescriptorDacl" fullword ascii
		$a3 = "GetOverlappedResult" fullword ascii
		$a4 = "TerminateThread" fullword ascii
		$a5 = "%s%s%X" fullword wide
	condition:
		uint16(0) == 0x5A4D
		and (all of ($a*))
		and filesize < 100000
}