Hacktools_CN_Burst_sql

rule Hacktools_CN_Burst_sql {
   meta:
      description = "Disclosed hacktool set - file sql.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "d5139b865e99b7a276af7ae11b14096adb928245"
      id = "77ea95fc-7a6a-522b-8a72-1832598c4d2d"
   strings:
      $s0 = "s.exe %s %s %s %s %d /save" fullword ascii
      $s2 = "s.exe start error...%d" fullword ascii
      $s4 = "EXEC sp_addextendedproc xp_cmdshell,'xplog70.dll'" fullword ascii
      $s7 = "EXEC master..xp_cmdshell 'wscript.exe cc.js'" fullword ascii
      $s10 = "Result.txt" fullword ascii
      $s11 = "Usage:sql.exe [options]" fullword ascii
      $s17 = "%s root %s %d error" fullword ascii
      $s18 = "Pass.txt" fullword ascii
      $s20 = "SELECT sillyr_at_gmail_dot_com INTO DUMPFILE '%s\\\\sillyr_x.so' FROM sillyr_x" fullword ascii
   condition:
      6 of them
}