RemoteExec_Tool

rule RemoteExec_Tool {
	meta:
		description = "Remote Access Tool used in APT Terracotta"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
		date = "2015-08-04"
		hash = "a550131e106ff3c703666f15d55d9bc8c816d1cb9ac1b73c2e29f8aa01e53b78"
		id = "c3262147-3455-554c-88fc-b523352efe7f"
	strings:
		$s0 = "cmd.exe /q /c \"%s\"" fullword ascii 
		$s1 = "\\\\.\\pipe\\%s%s%d" fullword ascii 
		$s2 = "This is a service executable! Couldn't start directly." fullword ascii 
		$s3 = "\\\\.\\pipe\\TermHlp_communicaton" fullword ascii 
		$s4 = "TermHlp_stdout" fullword ascii 
		$s5 = "TermHlp_stdin" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 75KB and 4 of ($s*)
}