PoC Yara rule for PE shellcode artefacts in UUIDs

binToUUIDs.yara

rule PEs_converted_to_UUID {
	meta:
		description = "Loading PE shellcode through UUIDs"
		author = "ajpc500"
		date = "2021-01-24"
		reference_url1 = "https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/"
		reference_url2 = "https://gist.github.com/rxwx/c5e0e5bba8c272eb6daa587115ae0014#file-uuid-c"
	strings:
		// UUIDs for "This program cannot be run in DOS mode"
		$s1 = "70207369-6f72-7267-616d-2063616e6e6f"
		$s2 = "65622074-7220-6e75-2069-6e20444f5320"
		$s3 = "HeapAlloc"
		$s4 = "EnumSystemLocales"
		$s5 = "UuidFromString"
	condition:
		all of them
}