Merge pull request #11 from tstromberg/main

Add hostinfo_collector rule
chainguard-dev · Feb 29, 2024 · 25062bd · 25062bd
2 parents 8bd1c72 + 1f866c5
commit 25062bd
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/rules/combo/backdoor/macos/hostinfo_collector.yara b/rules/combo/backdoor/macos/hostinfo_collector.yara
@@ -0,0 +1,13 @@
+rule hostinfo_collector : suspicious {
+  meta:
+	ref = "https://www.bitdefender.com/blog/labs/new-macos-backdoor-written-in-rust-shows-possible-link-with-windows-ransomware-group/"
+	description = "Collects extremely detailed information about a host"
+  strings:
+	$sp = "system_profiler"
+	$ns = "networksetup"
+	$sysctl = "sysctl"
+	$launchctl = "launchctl"
+  condition:
+	all of them
+}
+