[RULESET.0001] IMPORTRULE.0001 = 1 IMPORTRULE.0002 = 2 DESCRIPTION = "Process32First/Process32Next combination" ------------------------------------------------------------------------ [RULESET.0002] IMPORTRULE.0001 = 10 IMPORTRULE.0002 = 11 IMPORTRULE.0003 = 12 IMPORTRULE.0004 = 13 DESCRIPTION = "tries gaining higher process privileges" ------------------------------------------------------------------------ [RULESET.0003] IMPORTRULE.0001 = 5 IMPORTRULE.0002 = 6 DESCRIPTION = "FindFirstFile/FindNextFile combination" ------------------------------------------------------------------------ [RULESET.0004] IMPORTRULE.0001 = 14 IMPORTRULE.0002 = 15 IMPORTRULE.0003 = 16 IMPORTRULE.0004 = 17 DESCRIPTION = "Possible file dropping functionality" ------------------------------------------------------------------------ [RULESET.0005] IMPORTRULE.0001 = 3 DESCRIPTION = "Probable dns client/server" ------------------------------------------------------------------------ [RULESET.0006] IMPORTRULE.0001 = E DESCRIPTION = "retrieves data from FTP/Gopher/HTTP connection" ------------------------------------------------------------------------ [RULESET.0007] IMPORTRULE.0001 = 8 DESCRIPTION = "launches an external file using CreateProcess()" ------------------------------------------------------------------------ [RULESET.0008] IMPORTRULE.0001 = 9 DESCRIPTION = "Creates a mutex" ------------------------------------------------------------------------ [RULESET.0009] IMPORTRULE.0001 = 4 DESCRIPTION = "Probable smtp client/server" ------------------------------------------------------------------------ [RULESET.000A] IMPORTRULE.0001 = 7 DESCRIPTION = "sends data over a network connection using send()" ------------------------------------------------------------------------ [RULESET.000B] IMPORTRULE.0001 = B DESCRIPTION = "restarts/shuts down computer or logs user off" ------------------------------------------------------------------------ [RULESET.000C] IMPORTRULE.0001 = C DESCRIPTION = "terminates a process" ------------------------------------------------------------------------ [RULESET.000D] IMPORTRULE.0001 = D DESCRIPTION = "launches an external process using ShellExecute()" ------------------------------------------------------------------------ [RULESET.000E] IMPORTRULE.0001 = F DESCRIPTION = "Winsock initialisation" ------------------------------------------------------------------------ [RULESET.000F] IMPORTRULE.0001 = 18 DESCRIPTION = "deletes a file" ------------------------------------------------------------------------ [RULESET.0010] IMPORTRULE.0001 = 19 IMPORTRULE.0002 = 1A DESCRIPTION = "copies a file to windows directory" ------------------------------------------------------------------------ [RULESET.0011] IMPORTRULE.0001 = 1B DESCRIPTION = "launches an external process using WinExec()" ------------------------------------------------------------------------ [RULESET.0012] IMPORTRULE.0001 = A DESCRIPTION = "retrieves data over a network connection using recv()" ------------------------------------------------------------------------ [RULESET.0013] IMPORTRULE.0001 = 1C IMPORTRULE.0002 = 1D DESCRIPTION = "process injection" ------------------------------------------------------------------------ [RULESET.0014] IMPORTRULE.0001 = 1E DESCRIPTION = "writes MZ header to file (dropper)" ------------------------------------------------------------------------ [RULESET.0015] IMPORTRULE.0001 = 1F DESCRIPTION = "opens/creates/modifies Run(Once) registry key" ------------------------------------------------------------------------ [RULESET.0016] IMPORTRULE.0001 = 20 DESCRIPTION = "opens/creates/modifies Run(Once) registry key" ------------------------------------------------------------------------ [RULESET.0017] IMPORTRULE.0001 = 1C DESCRIPTION = "process memory modification (injection?)" ------------------------------------------------------------------------ [RULESET.0018] IMPORTRULE.0001 = 21 DESCRIPTION = "listens for incoming connections" ------------------------------------------------------------------------ [RULESET.0019] IMPORTRULE.0001 = 1A IMPORTRULE.0002 = 22 DESCRIPTION = "creates copy of itself" ------------------------------------------------------------------------ [RULESET.001A] IMPORTRULE.0001 = 23 DESCRIPTION = "possible http client/server" ------------------------------------------------------------------------ [RULESET.001B] IMPORTRULE.0001 = 24 DESCRIPTION = "uploads data using file transfer protocol (ftp)" ------------------------------------------------------------------------ [RULESET.001C] IMPORTRULE.0001 = 25 DESCRIPTION = "downloads data using file transfer protocol (ftp)" ------------------------------------------------------------------------ [RULESET.001D] IMPORTRULE.0001 = 26 DESCRIPTION = "dacl" ------------------------------------------------------------------------ [RULESET.001E] IMPORTRULE.0001 = 27 DESCRIPTION = "sacl" ------------------------------------------------------------------------ [RULESET.001F] IMPORTRULE.0001 = 28 DESCRIPTION = "owner" ------------------------------------------------------------------------ [RULESET.0020] IMPORTRULE.0001 = 29 DESCRIPTION = "group" ------------------------------------------------------------------------ [RULESET.0021] IMPORTRULE.0001 = 2A DESCRIPTION = "IsDebuggerPresent() debugger detection" ------------------------------------------------------------------------ ------------------------------------------------------------------------ ------------------------------------------------------------------------ [IMPORTRULE.0001] IMPORT.0001 = Process32First DESCRIPTION = "Process32First" ------------------------------------------------------------------------ [IMPORTRULE.0002] IMPORT.0001 = Process32Next DESCRIPTION = "Process32Next" ------------------------------------------------------------------------ [IMPORTRULE.0003] IMPORT.0001 = htons IMPORT.0001.PARAMSEQ.0001 = 1 IMPORT.0001.PARAM.0001 = 53 IMPORT.0001.PARAM.0001.TYPE = Immediate DESCRIPTION = "Probable dns client/server" ------------------------------------------------------------------------ [IMPORTRULE.0004] IMPORT.0001 = htons IMPORT.0001.PARAMSEQ.0001 = 1 IMPORT.0001.PARAM.0001 = 25 IMPORT.0001.PARAM.0001.TYPE = Immediate DESCRIPTION = "Probable smtp client/server" ------------------------------------------------------------------------ [IMPORTRULE.0005] IMPORT.0001 = FindFirstFile DESCRIPTION = "FindFirstFile" ------------------------------------------------------------------------ [IMPORTRULE.0006] IMPORT.0001 = FindNextFile DESCRIPTION = "FindNextFile" ------------------------------------------------------------------------ [IMPORTRULE.0007] IMPORT.0001 = send DESCRIPTION = "sends information over a network connection" ------------------------------------------------------------------------ [IMPORTRULE.0008] IMPORT.0001 = CreateProcess DESCRIPTION = "launches an external process" ------------------------------------------------------------------------ [IMPORTRULE.0009] IMPORT.0001 = CreateMutexA DESCRIPTION = "creates a mutex" ------------------------------------------------------------------------ [IMPORTRULE.000A] IMPORT.0001 = recv DESCRIPTION = "retrieves information over a network connection" ------------------------------------------------------------------------ [IMPORTRULE.000B] IMPORT.0001 = ExitWindows DESCRIPTION = "restarts/shuts down computer or logs user off" ------------------------------------------------------------------------ [IMPORTRULE.000C] IMPORT.0001 = TerminateProcess DESCRIPTION = "terminates a process" ------------------------------------------------------------------------ [IMPORTRULE.000D] IMPORT.0001 = ShellExecute DESCRIPTION = "launches an external process" ------------------------------------------------------------------------ [IMPORTRULE.000E] IMPORT.0001 = InternetReadFile DESCRIPTION = "retrieves data from FTP/Gopher/HTTP connection" ------------------------------------------------------------------------ [IMPORTRULE.000F] IMPORT.0001 = WSAStartup DESCRIPTION = "Winsock initialisation" ------------------------------------------------------------------------ [IMPORTRULE.0010] IMPORT.0001 = GetCurrentProcess DESCRIPTION = "Get current process" ------------------------------------------------------------------------ [IMPORTRULE.0011] IMPORT.0001 = OpenProcessToken DESCRIPTION = "opens process token" ------------------------------------------------------------------------ [IMPORTRULE.0012] IMPORT.0001 = LookupPrivilegeValue DESCRIPTION = "looks up privilege value" ------------------------------------------------------------------------ [IMPORTRULE.0013] IMPORT.0001 = AdjustTokenPrivileges DESCRIPTION = "adjusts privileges" ------------------------------------------------------------------------ [IMPORTRULE.0014] IMPORT.0001 = FindResource DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0015] IMPORT.0001 = LoadResource DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0016] IMPORT.0001 = LockResource DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0017] IMPORT.0001 = CreateFile DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0018] IMPORT.0001 = DeleteFile DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0019] IMPORT.0001 = GetWindowsDirectory DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.001A] IMPORT.0001 = CopyFile DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.001B] IMPORT.0001 = WinExec DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.001C] IMPORT.0001 = WriteProcessMemory DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.001D] IMPORT.0001 = CreateRemoteThread DESCRIPTION = "probable process injection" ------------------------------------------------------------------------ [IMPORTRULE.001E] IMPORT.0001 = WriteFile IMPORT.0001.PARAMSEQ.0001 = 2 IMPORT.0001.PARAM.0002 = "MZ" IMPORT.0001.PARAM.0002.TYPE = substring DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.001F] IMPORT.0001 = RegOpenKey IMPORT.0001.PARAMSEQ.0001 = 2 IMPORT.0001.PARAM.0002 = "CurrentVersion\Run" IMPORT.0001.PARAM.0002.TYPE = substring DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0020] IMPORT.0001 = RegCreateKey IMPORT.0001.PARAMSEQ.0001 = 2 IMPORT.0001.PARAM.0002 = "CurrentVersion\Run" IMPORT.0001.PARAM.0002.TYPE = substring DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0021] IMPORT.0001 = listen DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0022] IMPORT.0001 = GetModuleFileName DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0023] IMPORT.0001 = htons IMPORT.0001.PARAMSEQ.0001 = 1 IMPORT.0001.PARAM.0001 = 80 IMPORT.0001.PARAM.0001.TYPE = immediate DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0024] IMPORT.0001 = FtpPutFile DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0025] IMPORT.0001 = FtpGetFile DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0026] IMPORT.0001 = SetSecurityDescriptorDacl DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0027] IMPORT.0001 = SetSecurityDescriptorSacl DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0028] IMPORT.0001 = SetSecurityDescriptorOwner DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.0029] IMPORT.0001 = SetSecurityDescriptorGroup DESCRIPTION = "" ------------------------------------------------------------------------ [IMPORTRULE.002A] IMPORT.0001 = IsDebuggerPresent DESCRIPTION = ""