shellcromancer

rule alg_crypto_rc4 {
    meta:
        descrption = "Identify code for the (A)RC4 cryptographic algorithm."
        author = "@shellcromancer <root@shellcromancer.io>"
        version = "0.1"
        date = "2022-01-03"
        reference = "https://www.goggleheadedhacker.com/blog/post/reversing-crypto-functions#identifying-rc4-in-assembly"
        reference = "https://0xc0decafe.com/detect-rc4-encryption-in-malicious-binaries/"
        reference = "https://blog.talosintelligence.com/2014/06/an-introduction-to-recognizing-and.html"
    strings:

D00MFist

              
{
  "options": {
    "logger_snapshot_event_type": "true",
    "schedule_splay_percent": 10
  },
  "platform": "darwin",
  "schedule": {
    "authorized_keys": {
      "query": "SELECT * FROM users CROSS JOIN authorized_keys USING (uid);",

hazcod

{
  "options": {
    "disable_audit": false,
    "disable_events": false,
    "enable_mouse_events": false,
    "enable_keyboard_events": false,
    "events_max": 10000,
    "events_expiry": 3600,
    "read_max": 52428800,
    "logger_event_type": false,

richiercyrus

{
  "options": {
     "config_plugin": "filesystem",
     "logger_plugin": "filesystem",
     "logger_path": "/var/log/osquery",
     "disable_logging": "false",
     "log_result_events": "true",
     "schedule_splay_percent": "10",
     "pidfile": "/var/osquery/osquery.pidfile",
     "events_expiry": "3600",

magisterquis

// demoshell is a nifty beaconing shell useful for demos
package main

/*
 * demoshell.go
 * Simple reverse shell used in demos
 * By J. Stuart McMurray
 * Created 20180331
 * Last Modified 20180331
 */