SUSP_TH_APT_UNC4736_TradingTech_Cert_Apr23_1

rule SUSP_TH_APT_UNC4736_TradingTech_Cert_Apr23_1 {
   meta:
      description = "Threat hunting rule that detects samples signed with the compromised Trading Technologies certificate after May 2022"
      author = "Florian Roth"
      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
      date = "2023-04-20"
      score = 65
      id = "9a05fba9-9466-5b69-9207-27ad01d6eb8b"
   strings:
      $s1 = { 00 85 38 A6 C5 01 8F 50 FC } /* serial number */
      $s2 = "Go Daddy Secure Certificate Authority - G2" /* CA */
      $s3 = "Trading Technologies International, Inc"
   condition:
      pe.timestamp > 1651363200 /* Sunday, May 1, 2022 12:00:00 AM */
      and all of them
}