SUSP_NK_MAL_M_Hunting_POOLRAT

rule SUSP_NK_MAL_M_Hunting_POOLRAT {
   meta:
      description = "Detects VEILEDSIGNAL malware"
      author = "Mandiant"
      old_rule_name = "APT_NK_MAL_M_Hunting_POOLRAT"
      score = 70
      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
      description = "Detects strings found in POOLRAT malware"
      hash1 = "451c23709ecd5a8461ad060f6346930c"
      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
      date = "2023-04-20"
      id = "70f5f3a0-0fd0-54dc-97cc-4f3c35f02fcd"
   strings:
      /*
      $hex1 = { 6e 61 6d 65 3d 22 75 69 64 22 25 73 25 73 25 75 25 73 }
      $hex_uni1 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 75 00 69 00 64 00 22 00 25 00 73 00 25 00 73 00 25 00 75 00 25 00 73 }
      */
      $s1 = "name=\"uid\"%s%s%u%s" ascii wide
      /*
      $hex2 = { 6e 61 6d 65 3d 22 73 65 73 73 69 6f 6e 22 25 73 25 73 25 75 25 73 }
      $hex_uni2 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 73 00 65 00 73 00 73 00 69 00 6f 00 6e 00 22 00 25 00 73 00 25 00 73 00 25 00 75 00 25 00 73 }
      */
      $s2 = "name=\"session\"%s%s%u%s" ascii wide
      /*
      $hex3 = { 6e 61 6d 65 3d 22 61 63 74 69 6f 6e 22 25 73 25 73 25 73 25 73 }
      $hex_uni3 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 61 00 63 00 74 00 69 00 6f 00 6e 00 22 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 }
      */
      $s3 = "name=\"action\"%s%s%s%s" ascii wide
      /*
      $hex4 = { 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 25 73 25 73 25 75 25 73 }
      $hex_uni4 = { 6e 00 61 00 6d 00 65 00 3d 00 22 00 74 00 6f 00 6b 00 65 00 6e 00 22 00 25 00 73 00 25 00 73 00 25 00 75 00 25 00 73 }
      */
      $s4 = "name=\"token\"%s%s%u%s" ascii wide
      $str1 = "--N9dLfqxHNUUw8qaUPqggVTpX-" wide ascii nocase
   condition:
      any of ($s*) or $str1
}