dubseven_file_set

rule dubseven_file_set
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for service files loading UP007"

		id = "5b0a9cb9-aeef-5508-8854-51ad846b22c5"
	strings:
		$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
		$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
		$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
		$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
		$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
		$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
		$file7 = "\\Microsoft\\Internet Explorer\\mon"
		$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"

	condition:
		//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		//Just a few of these as they differ
		3 of ($file*)
}