Skip to content

Commit e501956

Browse files
deadbitsdeadbits
committed
IQY hunting (release with blog)
1 parent 7f7c617 commit e501956

4 files changed

+119
-0
lines changed

‎IQY_File.rule

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
rule IQY_File
2+
{
3+
meta:
4+
Author = "InQuest Labs"
5+
Website = "https://www.inquest.net"
6+
Description = "Detects all Excel IQY files by identifying the WEB 'magic' on the first line and also includes any URL."
7+
Severity = "0"
8+
9+
strings:
10+
/* match WEB on the first line of a file
11+
takes into account potential whitespace before or after case-insensitive "WEB" string
12+
*/
13+
$web = /^[ \t]*WEB[ \t]*(\x0A|\x0D\x0A)/ nocase
14+
15+
/* match any http or https URL within the file */
16+
$url = /https?:\/\/([\w\.-]+)([\/\w \.-]*)/
17+
18+
condition:
19+
$web at 0 and $url
20+
}

‎IQY_File_With_Pivot_Extension_URL.rule

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
rule IQY_File_With_Pivot_Extension_URL
2+
{
3+
meta:
4+
Author = "InQuest Labs"
5+
Reference = "https://www.inquest.net"
6+
Description = "Detect Excel IQY files with URLs that contain commonly used malicious file extensions that may act as a pivot to a secondary stage."
7+
Severity = "9"
8+
strings:
9+
/*
10+
match WEB on the first line of a file
11+
takes into account potential whitespace before or after case-insensitive "WEB" string
12+
*/
13+
$web = /^[ \t]*WEB[ \t]*(\x0A|\x0D\x0A)/ nocase
14+
15+
/*
16+
generic URL to direct download a file containing a potentially malicious extension.
17+
File extensions were decided based upon common extensions seen in the wild
18+
The extension list can be expanded upon as new information comes available from matches
19+
on the Stage 1 or Stage 2 signatures
20+
*/
21+
22+
$url = /https?:\/\/[\w\.\/]+\.(scr|exe|hta|vbs|ps1|bat|dat|rar|zip|ace)/ nocase
23+
24+
condition:
25+
$web at 0 and $url
26+
}

‎IQY_File_With_Suspicious_URL.rule

+69
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
rule IQY_File_With_Suspicious_URL
2+
{
3+
meta:
4+
Author = "InQuest Labs"
5+
Reference = "https://www.inquest.net/"
6+
Description = "Detects suspicious IQY Files using URLs associated with suspicious activity such as direct IP address URLs, URL shorteners, and file upload/download providers."
7+
Severity = "5"
8+
9+
strings:
10+
/*
11+
match WEB on the first line of a file
12+
takes into account potential whitespace before or after case-insensitive "WEB" string
13+
*/
14+
$web =/^[ \t]*WEB[ \t]*(\x0A|\x0D\x0A)/ nocase
15+
16+
/* match any http or https URL using a direct IP address */
17+
$aa = /https?:\/\/((1?[0-9]{1,2}|25[0-5]|2[0-4][0-9])[.]){3}((1?[0-9]{1,2}|25[0-5]|2[0-4][0-9]))/
18+
19+
/* file upload/download providers */
20+
$a2 = /https?:\/\/[^\.]*dropbox\.com\/sh?\// nocase
21+
$a4 = /https?:\/\/[^\.]*sendspace\.com\/./ nocase
22+
$a5 = /https?:\/\/[^\.]*bvp\.16mb\.com\/./ nocase
23+
$a6 = /https?:\/\/[^\.]*file\.io\/./ nocase
24+
$a7 = /https?:\/\/[^\.]*wetransfer\.com\/./ nocase
25+
$a8 = /https?:\/\/[^\.]*uploadcare\.com\/./ nocase
26+
$a9 = /https?:\/\/[^\.]*uploadfiles\.io\/./ nocase
27+
$a10 = /https?:\/\/[^\.]*filedropper\.com\/./ nocase
28+
$a11 = /https?:\/\/[^\.]*filefactory\.com\/./ nocase
29+
$a12 = /https?:\/\/[^\.]*doko\.moe\/./ nocase
30+
31+
/* URL shorteners */
32+
$a109 = /https?:\/\/(www\.)?a\.gd\/./ nocase
33+
$a110 = /https?:\/\/(www\.)?binged\.it\/./ nocase
34+
$a112 = /https?:\/\/(www\.)?budurl\.com\/./ nocase
35+
$a113 = /https?:\/\/(www\.)?chilp\.it\/./ nocase
36+
$a114 = /https?:\/\/(www\.)?cli\.gs\/./ nocase
37+
$a115 = /https?:\/\/(www\.)?fon\.gs\/./ nocase
38+
$a117 = /https?:\/\/(www\.)?fwd4\.me\/./ nocase
39+
$a118 = /https?:\/\/(www\.)?hex\.io\/./ nocase
40+
$a119 = /https?:\/\/(www\.)?hurl\.ws\/./ nocase
41+
$a120 = /https?:\/\/(www\.)?is\.gd\/./ nocase
42+
$a121 = /https?:\/\/(www\.)?kl\.am\/./ nocase
43+
$a122 = /https?:\/\/(www\.)?short\.ie\/./ nocase
44+
$a123 = /https?:\/\/(www\.)?short\.to\/./ nocase
45+
$a124 = /https?:\/\/(www\.)?sn\.im\/./ nocase
46+
$a125 = /https?:\/\/(www\.)?snipr\.com\/./ nocase
47+
$a126 = /https?:\/\/(www\.)?snipurl\.com\/./ nocase
48+
$a127 = /https?:\/\/(www\.)?snurl\.com\/./ nocase
49+
$a130 = /https?:\/\/(www\.)?to\.ly\/./ nocase
50+
$a131 = /https?:\/\/(www\.)?tr\.im\/./ nocase
51+
$a132 = /https?:\/\/(www\.)?tweetburner\.com\/./ nocase
52+
$a133 = /https?:\/\/(www\.)?twurl\.nl\/./ nocase
53+
$a134 = /https?:\/\/(www\.)?ub0\.cc\/./ nocase
54+
$a135 = /https?:\/\/(www\.)?ur1\.ca\/./ nocase
55+
$a136 = /https?:\/\/(www\.)?urlborg\.com\/./ nocase
56+
$a137 = /https?:\/\/(www\.)?tiny\.cc\/./ nocase
57+
$a138 = /https?:\/\/(www\.)?lc\.chat\/./ nocase
58+
$a139 = /https?:\/\/(www\.)?soo\.gd\/./ nocase
59+
$a140 = /https?:\/\/(www\.)?s2r\.co\/./ nocase
60+
$a141 = /https?:\/\/(www\.)?clicky\.me\/./ nocase
61+
$a142 = /https?:\/\/(www\.)?bv\.vc\/./ nocase
62+
$a143 = /https?:\/\/(www\.)?s\.id\/./ nocase
63+
$a144 = /https?:\/\/(www\.)?smarturl\.it\/./ nocase
64+
$a145 = /https?:\/\/(www\.)?tiny\.pl\/./ nocase
65+
$a146 = /https?:\/\/(www\.)?x\.co\/./ nocase
66+
67+
condition:
68+
$web at 0 and 1 of ($a*)
69+
}

‎README.md

+4
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,7 @@ malicious crafted PDF. Original write-up from [CheckPoint](https://research.chec
1717
* [RTF_Byte_Nibble_Obfuscation](https://github.com/InQuest/yara-rules/blob/master/RTF_Byte_Nibble_Obfuscation.rule)
1818
* This signature is designed to detect the obfuscation method described by Boris Larin here [Disappearing bytes: Reverse engineering the MS Office RTF parser](https://securelist.com/disappearing-bytes/84017/). This obfuscation method is rarely seen but was used in the distribution of CVE-2018-8174 0day discovered in-the-wild.
1919
* We'll continue to earmark interesting tidbits around the subject matter in this [Twitter Moment](https://twitter.com/i/moments/994122868949770240).
20+
* Hunting Suspicious IQY Files
21+
* [IQY_File](https://github.com/InQuest/yara-rules/blob/master/IQY_File.rule)
22+
* [IQY_File_With_Suspicious_URL](https://github.com/InQuest/yara-rules/blob/master/IQY_File_With_Suspicious_URL.rule)
23+
* [IQY_File_With_Pivot_Extension_URL.rule](https://github.com/InQuest/yara-rules/blob/master/IQY_File_With_Pivot_Extension_URL.rule)

0 commit comments

Comments
 (0)