SUSP_DRIVER_USAGE_1.yar

import "pe"

rule SUSP_DRIVER_USAGE_1
{
    meta:
        author      = "@qutluch"
        description = "Non-native PE not importing driver use functions but has reference strings."
        DaysofYARA  = "98/100"
        license     = "BSD-2-CLAUSE"
        date        = "2023-04-08"
        version     = "1.0"

    strings:
        $s0 = "IoCreateSymbolicLink" ascii wide nocase
        $s1 = "IoDeleteDevice" ascii wide nocase
        $s2 = "IoCreateDevice" ascii wide nocase
        $exclude1 = "NtHook" ascii wide nocase
        $exclude2 = "MagicRc" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D
        and (uint32(uint32(0x3C)) == 0x00004550)
        and not pe.is_signed
        and not pe.subsystem == pe.SUBSYSTEM_NATIVE
        and pe.imports(/.*/, /(IoCreateDevice|IoCreateSymbolicLink|IoDeleteDevice)/i) == 0
        and pe.imports(/ADVAPI32.dll/i, /(OpenService[AW]|CreateService[AW])/i) >= 1
        and pe.number_of_imports < 8
        and none of ($exclude*)
        and all of ($s*)
        and filesize < 5MB
}

/* Matches
001ad18d783a69581833dcdb858f7e600647b681337e722f4a4aea65cca4ee80
00bc69b6f067ff0c0fe3874a2516202438f03dd2fa03853652069532230e3e78
017e184d17c6ed3a2374a7130e4147d8427408c35f072e621116570afd87571e
052486ffbfc6a5f0f0a84d8a94c281ffafe330d9cd4200c451417a15ca90c447
05433b9470a35e9bf41f573504e71373aefe0fd4dcabff3a0f94c07715cbe500
068c4d5dd8c26f1dfe4fa61ad6d9ee7df2e544c0e2254018cdb9e72e43f71a81
08301f892b254eecb4bf2b4eea296e5c202815eeff5aba8b1ea50a4f8621819b
092445b32ed238fe34eb1979196cf81a77b482e4f76a6c903339a23c4c6cc387
0a7df5d53d154dbfb77d1a6a2a3ca6a367f87d528ed1c48428877c80fc9498ff
0b75262d66d2860abe99d5e8a84f3b14eae951fa3082da76c0105200109e8054
0ca457b3513770268f0fffe4190d9069429cf97df02605ac372e32125329debf
0efe6dcf7862ca41892f8c14a0bb7d7e0462c5f689e5bc8b519d92a4756720fa
0f6e756055b59d392623900e08b5a981902919e25ba7e44a04d7c8698cb3c79e
11b72685d98df5e3099f1eb8b44872b8936024345d3eb51264485573f69ec8d9
14b6dc138c743e858b8501f095516e8db72b61bd2d1e30d6ef81fc63613b85a4
17c08946c0061d8140ddabe0fd71b73ef2ff9f2f1790ac98eb6c547f708c4750
18e8da9a6a83dcea4e86d39970140f29e9c7d4fe3470515a4ef29b93d905d6d2
18f5e77aa9b0744714ddaaf33b75dd919c01f02bfd69d6d8b759c41c3d939163
193d7a506586b1e185ec3bcebf7780d2bdbf875d25eed455bcb3d6bfedad7478
19e11bad699b0747ba7244e5bbeecebb0da8555286a98671e01f514e7420b6e1
1bba6cd9f1523da40d059b63417743f05253465f58b0057468d9f07084e9f5d5
1c06e82b61cc9c61d62160536f5264ce625296b6f60945c3b73f7d6198ed5413
1efba4b632566fb33a914ced77ca17afe6c94d130120f5eb9dc2a108c30a47b2
1f3be16718d8b2c53161805e475370ea91521b8a2f1d2cc10a2d88bf4cb48c41
238260b6d38a4ac2a8abdf3c724caa7aa1f49fd98997ee64dc08c43cb5b24a7b
2423a162306a653962cdd1907e0171fed17e26946200d29b092199b6e4488597
246b8be37c29a107013a2c6ae3bb32b8a1c4b3549417326848247e2c5ba45202
24a0c8de2dd2909cbd9e294199d3b702bb93bbf42db778ebcfc5119797d97170
25745eaf24479bafa29e00a9cda6823367e82428e6d06acbf971665c9a925116
2612a567ff6f59df415c417bcef35cecd3fc94cc82b2e22da5cc20007c03c59b
277952cc7d84534ac07eb9cbb59b2585f1ed2aebadd95e8e5f0a2dc17cdf06c3
27c13dfc382dd972bd7225649ef8b416753f1bd834db9900868127379f10859e
27fc31035d29ff1c5a11e6b218701fb4db214cf58f5464a902a989de5b28235c
28646200bf3fc235042c69ab2f1117c48dd87ddeab8e9e6c94f1ed7a9e4be079
29b72f71eb69fd4bbc762bdd8c3a81850bc80a4426af77724db00573a240bbbb
2a625856c1231548df70332cc51598cb68758cc6ed1e8899979f3f442d4a0321
2ec2cc8f553089bf2d2e337111574d1027ec1a4ed095dcc3a9ea7b3476334139
30906f772a726b187669dd6b1c9645a62baa7f1fbc33c03e6f0dc3cbc4baf422
30c0f4ad1a75fbfd36ad30e29c0082dabcd8ac6b2d2e882c014883626c1377e6
330ce0dbc3f10a105b167f76d341ea609e634841b87b8069c2c28c69d7379c9d
331900b68bc2f5a7937c3df807726ece7dc57256367eb2d25ddf075532ec7528
33865157b2629fd1264b82296bef5d67cec2938c4d298a46fa0e642dbcf2dffe
345f8b60f63ae6c3fe3da22a314e9830808946fecaa7f75f06c8fa64f81940e7
35226d166b823f1ecf6bf1bcfbdd7093f08f22453b0db9a2a7fd59641e7c246f
38e8e88473bb5eeebfbaf40593076a49890e3907635bc9e5e1565763fb9321df
395c90ddc3ff8875d8a2cd2d354a40ad35bd30cabc56c496af0611412958978b
399fd21af1e7ca8270f4d6fef8ab5fbfb52475797cffefaf9c911b72e371bb05
39c18e506e2114d2be7663e9ef146bca357f3d3fc5e4b5a1098ac72b576bfa4b
3a105bba1c4601d0cd58d55fbd87c76b95f91723ae5e4d949f0d00d653fb6bcc
3b33fd1874dcfcf3df03e02dde3372adb745e87ba99cf3c7ce9dd13908be9d98
3b4ba86f337b266be0249975c91e2395663a62059d0cac8776558657e1f58c5f
3bc75bdc6709d84c66b40a20bc03d8ce48e05cb9035850a69f078904d683129f
3c269c63fa2a15a6a3a67ddb623936b539ebd0243ffa587745d6b07117fd8cb8
3d94391345a365d31ab61398f53677061b4b5ae33560400d133a19e18d335e34
3e2161a0c3eee2a8274ee11c447ac14ef081235057373a9b5aee4cc3025b539c
3fe497464a195685f6a772d262f58565d4d04f4ccfe250ee1e8320c25e9cc6d6
3fecc83a5daa6bfe9917ea22a29f682067de931a78904dccaaa45270a4ac2580
40b33eedfdcf46fe6f1dce072dc16d51f3e2d6309b6fe6b99dd0d017ae7caf73
41c28906c8575c1cf9ba5ef831ad43ec53e7f7962d19b971eb8c448c89fd791f
423b3c47805a110807d1f01ab0995b6d676df2c8af64fbc34b63a510b58894a5
4404a80c5b899324da290baf4939a1357712aae8f31c564fd3ce75c0e3dc9f4a
456b4d66817079a0955e08c46eb10f2bdad1d186d30ec3558d5a4ed4071aafc4
456f74d22fdf32de653102c700662f4358fc904fc428b519155bd52428f1c437
45d05faafa5fe76a72d8d5af7604d0bbeaea0328423ec8314b0d0118205653b5
469588688f7ba1de311ee839f7a78f26bfa0a9cd176d5549e36b77c42395afa9
48149234ae90f537781f675edcd695eadbef27b143eba600eaac24d7b80e39c0
48f5e4ab2f236f0064d27a7dde4a474a4d31341b2f1001b753961a33496b3d9c
4a99595e343481929229541e8f7f15e7c8acc7ed1aa4bc87d829e9ac122220e7
4bd8bb5ab1e343f63c3a29babb909d163503ac885e10a71388f4e1d8721ad49d
4da55d987352c38ecd56ab291370f7d5d884b5abad6701ab8ab1c1b8b774f342
50a44be318fff4d88c463574f2e08ccbf4116af4ee866c31cf1cc9e5f9c3fd02
54d786ff3c95c631350e1e2a1bb44b1936459aa26cebba1b57f5681e03e3348a
54ece2e8415203eadde17ac4b52809cc21a5587a50c3ca6e0ca3ef5fbb1deb19
57f921fdf0e131e7a193af0d7bf308099bd9d13d1c3eab70c9c594d8b27a3ca6
58da3945f94d5d42698e5bb67357655fbf442bceb03ed24f110a0cc2c564f7a7
5a436e03dc378d83e8da5a606b06d7b20b1068d4a53b8d65b9b9ddee21fd0e4e
5a5c13a52874e12b8ebff1852e952d7ce41dc4af03dad9d15d20bdcbc1f736ad
5d2c124308910be1236f7c08503a554c94bfdce445b18bd1ab68e7397dfb568a
5dbac69d3c4850cdfba4d0ac81a1a41ff69ed3b3b450020c32c1fa55e317753f
62de86d1c73015e322ba98ecbe7e206d4e9281f2127b55e9237bac24e6865e66
63e16faea44c4642cc130430a2186f25b7936da8af79c43e8dfdd5a9e9171ab3
648bf9a5a08e286c5e4da2debb4aab268c7fedfe46fdc5e14576ccfc0ae8d9f3
64b62fc9f8b362fbe2218928a2e3c4cbd2eec2dcd8fcd31e35f52e73d5619a2f
656576ad25d81c69a6182eacd2a4cff095b2a70feaa0999a9d815aab8f61f43d
6582714af4401ff4f77cd1d202da60f794b89c2f17aeeb38ed7606ffc0e1615f
65a40926195cbb5ad660b3438062e9b0e286a0ab0ccd392d8f61014aadd0020d
67cff5e4c3066adfd8837373fde384bc33d75661332679ad7f6547aa9362d7fe
67d5b5162a3dd70043e2669a23fcce007b76d98eca11d3b2e569a9d64a6891de
6830ea8d291270b5b5c586c152e5f71b1c86bdb16799559d5e2ebfc25f3ed8ad
6bc01f96e1d448b2368fa5bf25eca14147327e0b5faf9e557c95235671994721
6d0b37d1f3c4cc893fbc9bc51b92016aaa802509b6791902c06123a914ea85b4
6d7a682e632b34e8ba793fe6259c70b03db37653701934c6c0b7b5b7a6794b20
6e2ad478c026692c7545c1df479f34d4a0d35173c2bf6d06b03311f34015b893
6eec5c5368186fe2fd4fbe88b61f0a0ee2ec79dd054b5ecc1ed637f966302307
6f5347e24a93394553566d86598c91a548b3a621b0946cbef28a1754520142b7
6f7c58ab652bc66ba3894a3cb0c044e906926671369fc9c3f4f3392f06639a7e
6fdbd9420f4a4ef2ad463e949bdd4c115f4d4869e50658d2beed17f2fedc0277
703d01f22e14a072cf114f7524d617d734a17f50e3bcc09d16226866adf44ddb
71defe6011e32e59f5b66d7191d7e1540af4d2446aafa1191562aa0fa3ac211d
79b713e00912adad04a4433eba2c27f99975cb81ccb62ef5d9ac808f6b07484a
7a8a86941160c885fa2eaf90eec7c526ed11952d1c08e0c34cd09ebb6a6a040b
7b7990c163e7d84198e1c80e96afe565230b9c88c057880ec834f9ad526af828
7be4ea3c03de6e490d3643ba64efb54da9e46f6025099e32e5882fe0b441e139
7ce87958fd9b0e8c1ed710d96f7f8dc9ec9e6afd4a5bf8e3380c353cd42cd1aa
7edf8cea559c0a4035f7f9c2b2a862ba969c8b8ec286c03e908f248f07996c68
80593521b513eae028dc37d35fa0eee6ab55498ab3bafd22c25632e01f2a845d
809c7481c440a3228eccf8a9077646787c2999c3bd402cb1bcedb96236a1409c
81f202c45f434cae35488ec7875805f0381690ee3e55be0706ae8aea8f51ae67
83c93b2ceb2941c88a743320193bd2046f4b04e93d994c779110c5d9c417a2e9
85c6866cd2552493bf0f29766797fd04e8d13b4e46067a2bdc65bce17c22e867
891397e86a43dc86a5b144023dabbb83f6eab8795e533a41719bc7e41a923276
8b29a0a28c086b2654fae583d2360365c6f986904f0a21b3ae1e2bed4c32680c
8b921171367a48da6a902724d4868d209df2f43b5e52f7d665170fb7e2329544
8cc4459403e755463a5fa763472be92a3b934142926c112dae5e7e3a60931782
8db833d0bd7c37532692e3fb8c3d166469697296e5206320cc225236953b542c
8e54e5170385ee7aa10d5834b6b5cea351c72c3569d1e6854b8dbcda460ace49
910e31cd2fa8e744d6941245072699c35ed4ccb6b79b761e1abcef1ac930629a
91e4e452e59d1b15edf6c68fb5f7c3d7f92193b49869b9a67e2407ae82af532a
9574906d329ad698193ee1a7a58b068dc4ac0d60d9152feff3637d3adfb46121
95e09c560425ca6d1200f6e591bead840632a3e5d6ab92a751107bbf6859b593
9769208e8ed9832de3ecc61663f59aa14daf5ece202d77a02d1824b4e46bc7bc
97b16de9074cf5f6eeb8b05e12a9fccafce721bee1c3348b7bf5f4d40b416ca2
98cd08836984c18e8af0d2661cbf8cb2409f97f942d306b8b0f5838720561451
9914dfc58064433bc307ba0026898a7bed245673a19e442b89c163f4170f5678
996b234eff176a68aef7c47caa3e423c53e61e236e0a43c4e90752afe6bafb9c
9981dfa4a29eef038648a9caf28e827e94f8724762ce08ab5d4dfdc0d7c5b264
9b074b15c599c7bbcfe0138400590c986c9a8d9ba367982db6b93cd2d1bb1879
9d06a735826a82d19e701533a6f390a75cd312140dad9b408f1ca4d55a80cdac
9fbd92efd4c61f1b5a679eb3b19f0b43388ff39e70440ecc36fc9f369c6e2ce2
a122b88e3986e32d2d780f2cefde9c42a0799990c853714fbb666d76e6f79a59
a131299a5cb16c3a86f5eef54907276475df99eab9da77c4c1cd4ad907c9a7b1
a2517925c27325fdb22b7e60f2a2622fe1f2174d83da889f6bc60df7a88614ec
a2e3e6194cd823ea58c5ebe54c2bc68bba24a7235402d812ba0c776cae34f185
a78437c5e1f9b6069bac35a4b445e8f57a62a120055dc0d42424601a5ee52ad9
a7f8e35a55ce5a468e9418a542aee48b554ffaf28f36b96bb3a9f7818d613a3e
a838805e8e62176429e33aa85571e39d15f77c399f59745dfefe31d9a5828315
a841aa502ce899c447c417e0048ae987f386728c521d5ae1247bf14bdabca3ff
a9e5235db5be7014c1b819edc8a564369f6c1603df20b684161d02d69a05d4f8
abba5499ffcf26badadac817c09013af0294c00d3073de3b42b8e3f331ac128a
ac8cf3e76d3e0d6d48628a9c0f4b912fbc5c4ad7e0fe1c25ade06087bff8cee0
adf5246ee1f97a5b255d2af2c8835d29e73a1e5f48765a40b9bfca3cb3990512
aee7241699e09e2ce095dfd2fc12759767dd8cb16080a7eb8e06a62bc05f1d30
af485693485710d1f5b77089421e655c5c507278b76c78662b4d28aa354ca1f9
af4e171db04ed6836ba37a37c92b8b7fbcaac45ecfb06b38becbdd2a56cee81b
b002162a64668ae2dbef0574d207304cb55a1df31f3aeb7326e4aee2399f9ea9
b54b2c741bfe8023d7ba69df79f22574e95915472815705f1736c5fc36a6f4f9
b86a949491338f6f44845cb53a2204a3860eb197ea114a337e742084bcf751fc
bce68f1dc6205d69d6b03d534b7432d9fb5ad787cd485ed71307612f0ce9b5b9
beb90d07a490a23e3c182a63f9888b0550bca1c30e3b4fa21f78589c9f27fe64
bf1ce40e8c40bc3215c005ad4b67bf5dba4f9a3393eda4b6ee41329367a9aabc
bf30fe92f48a657a5aea4970bffdf3312eb8eba8a6a05a0c52846c4bf587dedd
c084850592cf13ed62da326d1e54e2d55ca8562ef2cf5324a065acbba3416695
c188cceec7802841537fac40f0545c916664186add615b97cb86bdd88f8092be
c247e63bace087c6fb9bd1976ba3d15e1fd4098422a9956a79944cd32272190c
c2b1f6cd71d22df4491efd15f6e56af01b5372f2e90bb042d7f6ae53d8ae86ef
c77cc8988fcc0b4819049043eba4b983617fcb32abe94214bebaab7d0a2ba75d
ca4e612610feadc8ba97351b15983f4afd50ae77289a1c4ef9b07dda4d886a20
cba7b0ecee3d0c6350fda153d6e936e1685c7ec35291e9c5757d47e8a1f1f639
d497b9566f72e338b6462f336d08d239f9b0164411096ec252c7ec42394c4588
d4ddb5b91ecb0a5a435f1dbe220aaffcfea242a753e5c9ecc127773ebbad6556
d5fc7fffa38cb36e3ab1e16bb758b15f9f0c534eda2723df703da1f8c72f05ee
d6c874437318f948c5cd9c0bf3b459550ad8365ced71451555eee283f73c86b6
d6ce84a02bf9807f9b42bd7e90d4d9e0b1549598c9164f36a0fb374db2b4c559
d79027db7fb0a366f66af9a325263790f24327e1237a7fe3b3a1fff4cea75419
d7dd250a6bdc113dee486db0417b7b7002ab5f82b437f374322d6e2be32221ec
d90420588094ff84fbe2053bd3eae2c47dd045eb6a58cf414706aacad658c5ee
d9d8ad7803eed796d179fbaa5b736096913b5bb633d378d2cdc9d03fa0aef05c
dba22de5fe1e90d62f85b6bf89f7fe480e5d14092fd68427268762e6ab1e354c
dc11dc4260d15bc12bf60f35621f586f83592da77e97c57357171ceac45561fe
dd6adf8a3b6242648f255a7cf8f0466c7b5d691a28fef4df8c9678282b0859ab
ddecf0546362928ffba05308b07d0ab19bed0730e10568e9adb9269bfc4ca454
de857527332aeab4abd581d91ece4fe0e5ccd5594fe195ab126c6e1787503bdc
e1255a324f0ea6c562f0ce806852436560a0d301f5449a290f6430953ee2033f
e128e83c9cfd71750e6a2691ac49f577019e0635a1488535d7f51fc557fc34a3
e17faaa89939dc9316284de4de87daaea6d8bbfeeac1815b560b5da36e0d6b97
e2e2ec77c7326880a53f3c410cb447dec404ac23dbe5e7b91f640b42d6d13b98
e5552163dc52046c9f3d593afe7821fc38715aa09fc6fc7cb9bc38b72045d4af
e5b3c07f432521cc34910b52a8b1535744594a588f00febb6e3c5480f22f5242
eaa3116c37b9d576584a798ae073001756fbff9c5b30a794f33197ac8d8af457
ec26da2af998da65eebdb24072b1edbd6eafc40e11da92361fa63f4be2386e2c
ec4f4e785e74034b63d72ca88be05108047fdb2ac48ab193f8e81473a6af72ab
edbc38a75bc849e773bff1f9a152651f7c0c40d94327a9f83df706808aab712a
edd882d81ca4223ed400d3e5734c6a791dacd5097f29f6a6af3d28b989895d74
eec112c383aacd68015d01ca169e1a685b0001cdcac17ff84401f202e7ef128c
eefe8d2f7bcf8fc21f031071578c7dc7d6eb7edc4e1942c665702657454b81dd
f0ef33782644a137f82c59a8482fb5c5ce135b5330903fcdd938988a9e4f13a4
f1f43418716f96f66ff1ceabe85760931a3bb21cb785bffd29fd74b92f31ffc3
f21055872ffb6aa4db79aa96d07421bee94c81ca8e507dba1affd1e1a93197e4
f39d464148790020badafec672be15c23fb0f691a266feb8f8f5f08781d8b1e0
f559b41ee3b176fa1c680c01ef425cbab7b1044db204161ee43f77ae8bd4392b
f5c5466775257292e003bbf7a05a397c3dd855b0e0cf7bc786158db697aa1866
f6c2fb29c0415bd7dfdfa3b71546aeeafe01f831bd372531b954a7431ffb79b5
f72895924a3a5750c7b6b879b6936a07a013bc5b7d50183761c9106c5df3a174
f8351ca00ea82742e2afe9e416e8305bb68f69013df60bb691996dc6e4d45a0a
f971fbc2b4eca42fcd9d54459b2a3bbd98314962207c02bcbbda451c541278c5
fc31d0ffd976c381d96246b2c4092379b63f7639381f8985d6ff0f85d497bb0d
fc3566136a30dfb4b5c4f8241103f5862ac3b54144034485bd837c0202417d3f
fd5a6ca7873c6403b3c6f0846f1358b46bf0549801bffed016aa560a2940cf81
fdba414cae4d84068441ebe3b2ff9c016a2c95e6b43998130fba72cd32bfed90
fecf278ba0c49c538c0a6e297fce88244bdec37a584f0413c8b17c968fcb49a1
fef4e2a6c8f1e0b26eb78bbc3a9749d99bd23e46d4d06629b1f4a433198e0891
ff3a4e62d5525931a5ad6441184d032ac64bd50acdd00092539aafee6f1143f5
ffd873200082cf021e1e07d95358ceb5156e76749d20328e70ce82e559fbc264
*/