edeca

/* Posted in answer to the question:
 *
 * "As a Yara rule, what's the right way to specify that every byte 
 * at an odd address must have a zero as its upper nybble?
 * 
 * Should I use an iterator for this, or is there a better way?"
 *
 * Asked by @travisgoodspeed on Twitter / X: 
 *  https://x.com/travisgoodspeed/status/1795911866411008003
 *

edeca

/*

Original rule from: https://gist.github.com/g-les/0745a9d6cd7f4abb3083a8dee1eaf984

Two variations on the original rule by @greglesnewich.

Conversation on Twitter at: https://twitter.com/edeca/status/1477650229709225990

*/

edeca

import "math"

rule example {
  meta:
    author = "David Cannings"
    description = "Rule example - finding a chunk of code near other known code"

  strings:
    $chunk = { AA BB CC DD }
    $chunk_prologue = { 11 22 33 44 }

edeca

rule terminal_services_scripting {
  meta:
    author = "David Cannings"
    description = "Microsoft Terminal Services Client Control (not safe for scripting)"
    ref = "https://twitter.com/joe4security/status/1221765460502421504?s=20%E2%80%9D"
    generated_by = "yaml2yara, see https://github.com/nccgroup/yaml2yara/"

  strings:
    // Parsers will open files without the full 'rtf'
    $header_rtf = "{\\rt" nocase

edeca

import idaapi
from idautils import *


########
#   Date: October 2019
# Author: David Cannings (@edeca)
#
# Rename all functions that are called by library code as "__unknown_library_function_N".
#

edeca

import fileinput
import re
import string

########
# Author: David Cannings
#
# Convert IDA string output to a Yara rule, escaping as necessary
# and using unicode modifiers.
########

edeca

import argparse
from base64 import b64decode
from binascii import unhexlify
from Crypto.Cipher import AES

########
# Author: David Cannings
#   Date: 7th November 2018
#
# Quick and dirty cpassword decryption tool, ported to Python from the

edeca

import argparse
import logging
import pefile
import sys
from prettytable import PrettyTable

########
# Author: David Cannings @edeca
#   Date: September 2018
#

edeca

Paranoid PlugX

This gist contains brief details of additional "Paranoid PlugX" files, likely associated with a sophisticated attacker. NCC Group is monitoring a number of OOXML and RTF techniques our red team has been using since September 2016, which uncovered multiple malicious documents from around August 2017.

For the original Paranoid PlugX article, please see: https://researchcenter.paloaltonetworks.com/2017/06/unit42-paranoid-plugx/ (h/t Palo and @tlansec).

Documents

A few documents can be found which use 203.248.116.182 to obtain further malicious content.

edeca

from pysmt.shortcuts import Symbol, Plus, Equals, GE, LE, And, Int, AllDifferent, get_model
from pysmt.typing import INT

########
# Author: David Cannings
#   Date: June 2017
#
# Basic example using pysmt to solve "Suko", a puzzle printed in some
# UK newspapers and available online.
#