File: //var/lib/clamav/securiteinfo.yara
rule SecuriteInfo_PUA_PHP_Exec_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "<?" nocase
$code1 = "@shell_exec" nocase
$code2 = "@exec" nocase
$code3 = "@system" nocase
$code4 = "@passthru" nocase
condition:
$a1 and all of ($code*)
}
rule SecuriteInfo_ObfusURL1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$re1 = /href=\"[0-9a-zA-Z]{1,70}@(`){1,20}0x/ nocase
$re4 = /href=\"http:\/\/[0-9a-zA-Z]{1,70}@(`){1,20}0x/ nocase
$re2 = /href=\"http:\/\/[0-9a-zA-Z]{1,70}\.@0x/ nocase
$re3 = /href=\"http:\/\/[0-9a-zA-Z]{1,70}\.@(`){1,20}0x/ nocase
$re5 = /href=\"http:\/\/[0-9a-zA-Z]{1,70}@0x/ nocase
condition:
$re1 or $re2 or $re3 or $re4 or $re5
}
rule SecuriteInfo_SuspiciousMacro
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /regsvr32\.exe/ nocase
$a2 = /cmd\.exe/ nocase
$a3 = /cmd \// nocase
$a4 = /powershell\.exe/ nocase
condition:
uint32(0) == 0x00100809 and 1 of ($a*)
}
rule SecuriteInfo_VBA_Downloader_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Sub Auto_Open()" nocase
$a2 = "Attribute VB_Name" nocase
$a3 = "workbook_open()" nocase
$b1 = "mshta " nocase
$b2 = "mshta.exe" nocase
$url_regex = /https?:\/\/([\w\.-]+)([\/\w \.-]*)/
condition:
1 of ($a*) and 1 of ($b*) and $url_regex
}
rule SecuriteInfo_VBA_Downloader_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$url_regex = /type=\"http:\/\/schemas.openxmlformats.org\/officedocument\/2006\/relationships\/frame\" target=\"https?:\/\/([0-9]{1,3}\.){3}[0-9]{1,3}\//
condition:
$url_regex
}
rule SecuriteInfo_VBA_Downloader_3
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "activexobject" nocase
$a2 = "(\"get" nocase
$a3 = /send.\(\)/ nocase
$b1 = /https?:\/\/...textbin\.net/ nocase
$b2 = /https?:\/\/textbin\.net/ nocase
condition:
all of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_VBA_Shell_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "workbook_activate()" nocase fullword
$a2 = "shell(" nocase
$a3 = "start" nocase fullword
condition:
all of ($a*)
}
rule SecuriteInfo_VBA_Shell_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Attribute VB_Name =" nocase
$b1 = "cmd /c" nocase
condition:
$a1 and $b1
}
rule SecuriteInfo_VBA_Obfus_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Attribute VB_Name" nocase
$a2 = "<script language = 'vbs'>" nocase
$b1 = "\"Scripting.FileSyste\" & \"mObject\"" nocase
$b2 = "strreverse(" nocase
$b3 = "create\" + \"object" nocase
$b4 = "sheehe & \"l.application" nocase
$b5 = "St^a^rt-BitsTr^ans^fer" nocase
$b6 = "Sta^rt-BitsTr^ans^fer" nocase
$b7 = "Start-BitsTr^a^nsfer" nocase
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_XML_Exec_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "start-process(" nocase
condition:
uint32(0) == 0x6D783F3C and uint32(4) == 0x6576206C and $a1
}
rule SecuriteInfo_PUA_JS_Obfus
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /\+=String.fromCharCode\(.{1,8}\[.{1,8}\]\^.{1,8}\);/
condition:
1 of ($a*)
}
rule SecuriteInfo_VBA_Exec_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "cmd /c" nocase
$a2 = "CreateObject(\"WScript.Shell\")" nocase
$a3 = ".Run"
condition:
all of ($a*)
}
rule SecuriteInfo_VBS_Exec_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "<script" nocase
$b1 = "microsoft.xmlhttp" nocase
$b2 = "adodb.stream" nocase
$b3 = "wscript.shell" nocase
$b4 = "cmd.exe /c" nocase
condition:
$a1 and all of ($b*)
}
rule SecuriteInfo_Miner_Config
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "\"pools\":"
$a2 = "\"url\":"
$a3 = "\"user\":"
$a4 = "\"cpu\":"
condition:
all of ($a*)
}
rule SecuriteInfo_Suspicious_Document
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /<?xml version="1\.0" encoding="utf-8"/
$b2 = /target=".{0,100}(plesk\.page|pckd\.me|bit\.ly|is\.gd|ow\.ly|3\.ly|clicky\.me|bl\.ink|buff\.ly|rebrand\.ly|bit\.do|cutt\.ly|shorturl\.at|short\.io|kutt\.it|switchy\.io|urlr\.me|name\.com|han\.gl|bitly\.kr|hoy\.kr|vo\.la|oe\.cd|btfy\.io|url-x\.it|wee\.so|duckdns\.org|\.ydns\.eu|\.page\.link|tsurl\.co|vk\.sv|cutt\.us|\.app\.link|\/\/rb\.gy)\//i
$b3 = /target="&#/i
$c1 = "bit.ly/omnicell-fr"
condition:
$a1 and 1 of ($b*) and not 1 of ($c*)
}
rule SecuriteInfo_Suspicious_Order_Invoice
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "View ORDER" nocase
$b2 = /https?:\/\/smartforms\.dev/ nocase
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Suspicious_Phishing_Mail_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "<html" nocase
$a2 = "<tbody" nocase
$a3 = "<body" nocase
$b1 = "secure.alpha.gr" nocase
$b2 = "account.live.com/SecurityNotifications" nocase
$b3 = "crédit agricole" nocase
$b4 = "crédit agricole" nocase
$b5 = "l'accès à votre espace client sera bloqué" nocase
$b6 = "LCL Banque" nocase
$b7 = "société générale" nocase
$b8 = "no-reply@societegenerale.fr" nocase
$b10 = "pass s curit " nocase
$b12 = "secure banking service" nocase
$b13 = "Ihre Postbank" nocase
$b14 = "SOCIÉTÉ GÉNÉRALE" nocase
$b15 = "CRÉDIT AGRICOLE" nocase
$b16 = "Sogecash" nocase
$b17 = "Online Banking Login" nocase
$b18 = "truist bank" nocase
$b19 = "credit union" nocase
$b20 = "certicode plus" nocase
$b21 = "//cdaas.americanexpress.com/akamai/" nocase
$b22 = "//login.coinbase.com" nocase
$b23 = "https://p.sfx.ms/images/favicon.ico" nocase
$b24 = "compte est temporairement bloqu" nocase
$b25 = "keep current password" nocase
$b26 = "You have been selected" nocase
$b27 = "You've been selected" nocase
$b29 = "documents.adobe.com" nocase
$b30 = "tradekorea.com"
$c1 = "href=\"https://cutt.ly" nocase
$c2 = ".blogspot.com" nocase
$c3 = "//storageapi.fleek.co" nocase
$c4 = "//sites.google.com" nocase
$c5 = "//t.co/" nocase
$c6 = ".page.link" nocase
$c7 = "sécurisez votre compte" nocase
$c8 = ".web.app" nocase
$c9 = "fleek.co/" nocase
$c11 = "wp-includes" nocase
$c12 = "wp-admin" nocase
$c13 = "href=\"https://vk.sv/" nocase
$c14 = ".plesk.page" nocase
$c15 = ".pages.dev" nocase
$c16 = "//bit.ly/" nocase
$c17 = "//t.me/" nocase
$c18 = "//api.telegram.org/bot" nocase
$c19 = ".edgeone.dev"
$u1 = { 64 65 78 }
$v1 = { 00 00 }
$w1 = { D0 CF }
$x1 = { 52 61 72 21 }
$y1 = { 50 4B }
$z1 = { 4D 5A }
condition:
1 of ($a*) and 1 of ($b*) and 1 of ($c*) and not $z1 at 0 and not $y1 at 0 and not $x1 at 0 and not $w1 at 0 and not $v1 at 0 and not $u1 at 0
}
rule SecuriteInfo_VBS_Exec_3
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "CreateObject(\"Scripting.FileSystemObject\")" nocase
$a2 = "OpenTextFile(Wscript.ScriptFullName" nocase
$a3 = "execute" nocase
$x1 = { 52 61 72 21 }
$y1 = { 50 4B }
$z1 = { 4D 5A }
condition:
all of ($a*) and not $z1 at 0 and not $y1 at 0 and not $x1 at 0
}
rule SecuriteInfo_Suspicious_Phishing_Mail_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "@labanquepostale.fr" nocase
$a2 = "@creditmutuel.fr" nocase
$a3 = "@credit-agricole.fr" nocase
$a4 = ".bnpparibas" nocase
$a5 = "@credit-du-nord.fr" nocase
$a6 = "@banquepopulaire.fr" nocase
$a7 = "@caisse-epargne.fr" nocase
$a8 = "@lcl.fr" nocase
$a9 = "@cic.fr" nocase
$a10 = "@boursorama-banque.com" nocase
$a11 = "@hellobank.fr" nocase
$a12 = "@fortuneo.fr" nocase
$a13 = "@monabanq.com" nocase
$a14 = "@axa.fr" nocase
$a15 = "@bforbank.com" nocase
$a16 = "@n26.com" nocase
$a17 = "@nickel.eu" nocase
$a18 = "@orangebank.fr" nocase
$a19 = "@revolut.com" nocase
$a20 = "@c-zam.com" nocase
$a21 = "@mafrenchbank.fr" nocase
$a22 = "@bunq.com" nocase
$a23 = "@hsbc.fr" nocase
$a24 = "@lydia-app.com" nocase
$a25 = "@societegenerale.fr" nocase
$a26 = "@infos.lcl.fr" nocase
$a27 = "@socgen.com" nocase
$a28 = "@axisbank.com" nocase
$a29 = "@socgen.org" nocase
$a30 = "@carrefour-banque.fr" nocase
$a31 = "@mabanqueprivee.bnpparibas.com" nocase
$a32 = "From: DHL Express Service" nocase
$a33 = "@creditagricole.fr"
$a34 = "@ccf.fr"
$a35 = "@notificationsclients.socgen.com"
$b1 = /X-PHP-Originating-Script:.{1,120}\.php/
$b2 = "Return-Path: <www-data@"
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Suspicious_Phishing_Mail_5
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "la direction gnrale des finances publiques" nocase
$a2 = "remboursement non effectu" nocase
$a3 = "extra1.ameli.fr"
$a4 = "monespacesante.fr"
$a5 = /Subject:.{1,120}AR24/
$c1 = "//tinyurl.com/" nocase
condition:
1 of ($a*) and $c1
}
rule SecuriteInfo_Suspicious_Phishing_Mail_6
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "click on the link" nocase
$a2 = "new incoming inbox messages" nocase
$a3 = "deactivate your email account" nocase
$a4 = "documents for download" nocase
$a5 = "sent you a document" nocase
$a6 = "mailbox account" nocase
$a7 = "your mailbox" nocase
$a8 = "your e-mail storage" nocase
$a9 = "email account" nocase
$a10 = "mail server" nocase
$a11 = "email termination" nocase
$a12 = "pending messages" nocase
$a13 = "to re-activate" nocase
$a14 = "login to" nocase
$a15 = "account password" nocase
$a16 = "failure notice" nocase
$a17 = "zoom video communications" nocase
$a18 = "Docusign" nocase
$a19 = "upgrade your webmail" nocase
$a20 = "chorus pro" nocase
$a21 = "your inbox" nocase
$b1 = "//ipfs.io/ipfs/"
$b2 = "//cf-ipfs.com/ipfs/"
$b3 = "//ipfs.thirdwebcdn.com/ipfs/"
$b4 = "ipfs-com.translate.goog/"
$b5 = "//fleek.ipfs.io/ipfs/"
$b6 = "ipfs-dweb-link.translate.goog"
$b7 = "//dweb.link/ipfs/"
$b8 = "//firebasestorage.googleapis.com/"
$b9 = "//storageapi.fleek.co/"
$b10 = ".myqcloud.com"
$b11 = ".twil.io"
$b12 = ".netlify.app"
$c1 = "Return-Path:"
$c2 = "<html" nocase
$c3 = "<tbody" nocase
$c4 = "Received:"
$x1 = { 52 61 72 21 }
$y1 = { 50 4B }
$z1 = { 4D 5A }
condition:
1 of ($a*) and 1 of ($b*) and 1 of ($c*) and not $z1 at 0 and not $y1 at 0 and not $x1 at 0
}
rule SecuriteInfo_Suspicious_Phishing_Mail_7
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "<html" nocase
$a2 = "<tbody" nocase
$a3 = "<body" nocase
$b1 = "swisspass" nocase
$b2 = "DHL Home" nocase
$b4 = "<title>icservices" nocase
$b5 = "sign in to your microsoft account" nocase
$b6 = "Accès CR - Crédit Agricole" nocase
$b7 = "<title>SFR Mail" nocase
$b8 = "Microsoft Exchange - Outlook Web Access" nocase
$b9 = "<title>Swisscom" nocase
$b10 = "<title>Sign in - chase.com" nocase
$b11 = /<title>.. - UPS/ nocase
$b12 = /<title>send.?money/ nocase
$b13 = "<title>sign in to continue" nocase
$b14 = "verify your id" nocase
$b15 = "<title>dhl " nocase
$b16 = "online banking" nocase
$b17 = "<title>Microsoft| Login" nocase
$b18 = "<title>Banque " nocase
$b19 = "<title>Trust Wallet" nocase
$b20 = " | dhl</title>" nocase
$b21 = "this document is protected"
$b22 = "<title>excel"
$b23 = /<title>.{0,20}paypal/ nocase
$b24 = "<title>QuickBooks Online Login" nocase
$b25 = "<title>SF Speed Post" nocase
$b26 = "sign in to view document" nocase
$b27 = "<title>adobe online" nocase
$b28 = "<title>Idaho Central Credit Union" nocase
$b29 = "<title>3D SECURE" nocase
$b30 = "vous recevrez votre confirmation de paiement par e-mail" nocase
$b31 = "<title>cmvisa"
$c1 = /method=.?post/ nocase
$c2 = /method\%3d\%22post/ nocase
$c3 = /type.?:.?post/ nocase
$c4 = /\$\.post.?\(/
$d1 = /action=.{0,80}\.php/ nocase
$d2 = /url.?:.{0,80}\.php/ nocase
$d3 = /\$\.post.?\(.{0,80}\.php/ nocase
$d4 = /action\%3d.{0,80}\.php/ nocase
$x1 = { 52 61 72 21 }
$y1 = { 50 4B }
$z1 = { 4D 5A }
condition:
1 of ($a*) and 1 of ($b*) and 1 of ($c*) and 1 of ($d*) and not $z1 at 0 and not $y1 at 0 and not $x1 at 0
}
rule SecuriteInfo_Suspicious_Phishing_Mail_8
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "<html" nocase
$a2 = "<tbody" nocase
$a3 = "<body" nocase
$b1 = "<!-- saved from url="
$c1 = /method=post/ nocase
$c2 = /method="post/ nocase
$c3 = /type:.?post/ nocase
$d1 = /action=.{0,60}\.php/ nocase
$d2 = /url:.?https?:\/\/.{0,60}\.php/ nocase
condition:
1 of ($a*) and $b1 and 1 of ($c*) and 1 of ($d*)
}
rule SecuriteInfo_Suspicious_Phishing_Mail_9
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "sign in to upgrade your mailbox"
$a2 = "sign in to view secure document"
$a3 = "CONTINUE WITH CURRENT PASSWORD" nocase
$a4 = "account password is set to expire"
condition:
1 of ($a*)
}
rule SecuriteInfo_Suspicious_Phishing_Mail_10
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-Path:.{0,80}.amazonses.com>/ nocase
$a2 = "noreply@myprojectdevelopment.com"
$a4 = /Return-Path:.{0,80}\.firebaseapp\.com>/ nocase
$b1 = /https:\/\/cloudflare-ipfs\.com\/ipfs\// nocase
$b2 = /https:\/\/storage\.reurl\.cc\// nocase
$b3 = /https:\/\/t\.ly\// nocase
$b4 = /https:\/\/pckd\.me\// nocase
$b5 = /https:\/\/bit\.ly\// nocase
$b6 = /https:\/\/is\.gd\// nocase
$b7 = /https:\/\/ow\.ly\// nocase
$b8 = /https:\/\/3\.ly\// nocase
$b9 = /https:\/\/clicky\.me\// nocase
$b10 = /https:\/\/bl\.ink\// nocase
$b11 = /https:\/\/buff\.ly\// nocase
$b12 = /https:\/\/rebrand\.ly\// nocase
$b13 = /https:\/\/bit\.do\// nocase
$b14 = /https:\/\/cutt\.ly\// nocase
$b15 = /https:\/\/shorturl\.at\// nocase
$b16 = /https:\/\/short\.io\// nocase
$b17 = /https:\/\/kutt\.it\// nocase
$b18 = /https:\/\/switchy\.io\// nocase
$b19 = /https:\/\/urlr\.me\// nocase
$b20 = /https:\/\/name\.com\// nocase
$b21 = /https:\/\/han\.gl\// nocase
$b22 = /https:\/\/bitly\.kr\// nocase
$b23 = /https:\/\/hoy\.kr\// nocase
$b24 = /https:\/\/vo\.la\// nocase
$b25 = /https:\/\/oe\.cd\// nocase
$b26 = /https:\/\/btfy\.io\// nocase
$b27 = /https:\/\/url-x\.it\// nocase
$b28 = /https:\/\/wee\.so\// nocase
$b29 = /https:\/\/tsurl\.co\// nocase
$b30 = /https:\/\/cutt\.us\// nocase
$b31 = /https:\/\/ipfs\.io\// nocase
$b32 = /https:\/\/l\.ead\.me\// nocase
$b33 = /https:\/\/hm\.ru\// nocase
$b34 = /https:\/\/espanolinves\.me\// nocase
$b35 = /https:\/\/1drv\.ms\// nocase
$b36 = /https:\/\/shorturl\.ac\// nocase
$b37 = /https:\/\/shrtco\.de\// nocase
$b38 = /https:\/\/url\.dev\// nocase
$b39 = /https:\/\/rb\.gy\// nocase
$b40 = /https:\/\/conta\.cc\// nocase
$b41 = /https:\/\/nev\.lt\// nocase
$x1 = { 52 61 72 21 }
$y1 = { 50 4B }
$z1 = { 4D 5A }
condition:
1 of ($a*) and 1 of ($b*) and not $z1 at 0 and not $y1 at 0 and not $x1 at 0
}
rule SecuriteInfo_Suspicious_Phishing_Mail_11
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Return-Path: "
$b1 = /From: .{1,90}\@lcl\.fr/
$b2 = /From: .{1,90}\@societegenerale\.fr/
$b3 = /From: .{1,90}\@labanquepostale\.fr/
$b4 = /From: .{1,90}\@creditmutuel\.fr/
$b5 = /From: .{1,90}\@credit-agricole\.fr/
$b6 = /From: .{1,90}\.bnpparibas/
$b7 = /From: .{1,90}\@credit-du-nord\.fr/
$b8 = /From: .{1,90}\@banquepopulaire\.fr/
$b9 = /From: .{1,90}\@caisse-epargne\.fr/
$b10 = /From: .{1,90}\@cic\.fr/
$b11 = /From: .{1,90}\@boursorama-banque\.com/
$b12 = /From: .{1,90}\@hellobank\.fr/
$b13 = /From: .{1,90}\@fortuneo\.fr/
$b14 = /From: .{1,90}\@monabanq\.com/
$b15 = /From: .{1,90}\@axa\.fr/
$b16 = /From: .{1,90}\@bforbank\.com/
$b17 = /From: .{1,90}\@n26\.com/
$b18 = /From: .{1,90}\@nickel\.eu/
$b19 = /From: .{1,90}\@orangebank\.fr/
$b20 = /From: .{1,90}\@revolut\.com/
$b21 = /From: .{1,90}\@c-zam\.com/
$b22 = /From: .{1,90}\@mafrenchbank\.fr/
$b23 = /From: .{1,90}\@bunq\.com/
$b24 = /From: .{1,90}\@hsbc\.fr/
$b25 = /From: .{1,90}\@lydia-app\.com/
$b26 = /From: .{1,90}\@infos\.lcl\.fr/
$b27 = /From: .{1,90}\@compte-nickel\.fr/
$b28 = /From: .{1,90}\@socgen\.com/
$b29 = /From: .{1,90}\@labanquepostale\.fr/
$b30 = /From: .{1,90}\@credit-agricole-sa\.fr/
$b31 = /From: .{1,90}labanquepostale\.fr/
$c1 = "Received-SPF: Permerror"
condition:
$a1 and 1 of ($b*) and $c1
}
rule SecuriteInfo_Suspicious_Phishing_Mail_12
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /From:.{1,90}@gendarmerie-nationale\.interieur\.gouv\.fr/
$b1 = /Message-ID:.{1,90}@mailsender/
condition:
$a1 and $b1
}
rule SecuriteInfo_Suspicious_Phishing_Mail_13
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "sign in to view the document"
$b1 = "email"
$b2 = "password"
condition:
$a1 and 2 of ($b*)
}
rule SecuriteInfo_Suspicious_Phishing_Mail_14
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Reply-To: .{1,90}googleusercontent\.com>/
$b1 = "Crédit Mutuel"
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Suspicious_Phishing_Mail_15
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Return-Path: <>" nocase
$a2 = "X-Envelope-From: <>" nocase
$b1 = /Received: .{1,90}googleusercontent\.com/
$b2 = /Subject: .{1,30}Action Required/ nocase
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Suspicious_JS_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /<script (language="javascript" |)src="https:\/\/cloudflare-ipfs\.com\/ipfs\// nocase
$a2 = /<script (language="javascript" |)src="https:\/\/storage\.reurl\.cc\// nocase
$a3 = /<script (language="javascript" |)src="https:\/\/t\.ly\// nocase
$a4 = /<script (language="javascript" |)src="https:\/\/pckd\.me\// nocase
$a5 = /<script (language="javascript" |)src="https:\/\/bit\.ly\// nocase
$a6 = /<script (language="javascript" |)src="https:\/\/is\.gd\// nocase
$a7 = /<script (language="javascript" |)src="https:\/\/ow\.ly\// nocase
$a8 = /<script (language="javascript" |)src="https:\/\/3\.ly\// nocase
$a9 = /<script (language="javascript" |)src="https:\/\/clicky\.me\// nocase
$a10 = /<script (language="javascript" |)src="https:\/\/bl\.ink\// nocase
$a11 = /<script (language="javascript" |)src="https:\/\/buff\.ly\// nocase
$a12 = /<script (language="javascript" |)src="https:\/\/rebrand\.ly\// nocase
$a13 = /<script (language="javascript" |)src="https:\/\/bit\.do\// nocase
$a14 = /<script (language="javascript" |)src="https:\/\/cutt\.ly\// nocase
$a15 = /<script (language="javascript" |)src="https:\/\/shorturl\.at\// nocase
$a16 = /<script (language="javascript" |)src="https:\/\/short\.io\// nocase
$a17 = /<script (language="javascript" |)src="https:\/\/kutt\.it\// nocase
$a18 = /<script (language="javascript" |)src="https:\/\/switchy\.io\// nocase
$a19 = /<script (language="javascript" |)src="https:\/\/urlr\.me\// nocase
$a20 = /<script (language="javascript" |)src="https:\/\/name\.com\// nocase
$a21 = /<script (language="javascript" |)src="https:\/\/han\.gl\// nocase
$a22 = /<script (language="javascript" |)src="https:\/\/bitly\.kr\// nocase
$a23 = /<script (language="javascript" |)src="https:\/\/hoy\.kr\// nocase
$a24 = /<script (language="javascript" |)src="https:\/\/vo\.la\// nocase
$a25 = /<script (language="javascript" |)src="https:\/\/oe\.cd\// nocase
$a26 = /<script (language="javascript" |)src="https:\/\/btfy\.io\// nocase
$a27 = /<script (language="javascript" |)src="https:\/\/url-x\.it\// nocase
$a28 = /<script (language="javascript" |)src="https:\/\/wee\.so\// nocase
$a29 = /<script (language="javascript" |)src="https:\/\/tsurl\.co\// nocase
$a30 = /<script (language="javascript" |)src="https:\/\/cutt\.us\// nocase
$a31 = /<script (language="javascript" |)src="https:\/\/ipfs\.io\// nocase
$a32 = /<script (language="javascript" |)src="https:\/\/l\.ead\.me\// nocase
$a33 = /<script (language="javascript" |)src="https:\/\/hm\.ru\// nocase
$a34 = /<script (language="javascript" |)src="https:\/\/espanolinves\.me\// nocase
$a35 = /<script (language="javascript" |)src="https:\/\/1drv\.ms\// nocase
$a36 = /<script (language="javascript" |)src="https:\/\/shorturl\.ac\// nocase
$a37 = /<script (language="javascript" |)src="https:\/\/shrtco\.de\// nocase
$a38 = /<script (language="javascript" |)src="https:\/\/url\.dev\// nocase
$a39 = /<script (language="javascript" |)src="https:\/\/rb\.gy\// nocase
condition:
1 of ($a*)
}
rule SecuriteInfo_Suspicious_Phishing_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$b1 = "pαssword" nocase
$b2 = "will stop sending and receiving emails"
$b3 = "voicemail message"
$b7 = "important encrypted message" nocase
$b9 = "Revalidate Your Email" nocase
$b10 = "company statement of account" nocase
$b11 = "mail storage notification" nocase
$b12 = "blocked from receiving and sending messages" nocase
$b13 = "sign-in to your e-mail" nocase
$b14 = "Dropbox Service" nocase
$b15 = "login to your webmail" nocase
$b16 = "undelivered mails" nocase
$b17 = "Release Messages" nocase
$b18 = "mail storage capacity" nocase
$b19 = "storage to deliver mail" nocase
$b20 = "<title>Sign in" nocase
$c1 = "//formsubmit.co/"
$c2 = "//storageapi.fleek.co"
$c3 = ".herokuapp.com"
$c4 = ".plesk.page"
$c5 = "ipfs.w3s.link"
$c6 = ".glitch.me"
$c7 = "ipfs.fleek.co"
$c8 = "//aeusercontent.net/mt/"
$c9 = "//www.google.com/url?q="
$c10 = "//ipfs.io/"
$c11 = "translate.goog"
$c12 = "//dweb.link/"
$c14 = "//firebasestorage.googleapis.com"
$c15 = "ipfs-dweb-link.translate.goog/"
$c16 = "//s.id/"
$c17 = "//formspree.io"
$c18 = "//submit-form.com"
$c19 = "//app.form2chat.io"
$c20 = "//t.co/"
$c21 = "//bit.ly/"
$c22 = ".pantheonsite.io/"
$c23 = "//l.ead.me/"
$c24 = "//t.me/"
$c25 = "//tinyl.io/"
$d3 = "t.co/redirect"
$y1 = "This program cannot be run in DOS mode"
$z4 = { 64 65 78 }
$z3 = { 52 61 72 21 }
$z2 = { 50 4B }
$z1 = { 4D 5A }
condition:
1 of ($b*) and 1 of ($c*) and not 1 of ($d*) and not $y1 and not $z1 at 0 and not $z2 at 0 and not $z3 at 0 and not $z4 at 0
}
rule SecuriteInfo_Suspicious_Phishing_2_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$b21 = "login with email" nocase
$b22 = "continue with email password" nocase
$b23 = "verify your account" nocase
$b24 = "<title>Webmail :: Login" nocase
$b25 = "Email authentication is required" nocase
$b26 = "validate your account" nocase
$b27 = "veuillez vous connecter" nocase
$b28 = "votre confirmation est requise" nocase
$b29 = "sign in to download" nocase
$b30 = "sign in using your email" nocase
$b31 = /sign.?in.?using.?your.?email.?address/ nocase
$b32 = /(upgrade|upgrading|increase) your mailbox/ nocase
$b33 = "sign in to your account"
$b34 = "confirm your email"
$b35 = /<title>.{0,15}login.{0,15}<\/title>/ nocase
$b36 = "<title>DHL " nocase
$b37 = "<title>EMS Speed Post" nocase
$b38 = /download.?(scanned|shared).?document/ nocase
$b39 = "account password"
$c1 = "//formsubmit.co/"
$c2 = "//storageapi.fleek.co"
$c3 = ".herokuapp.com"
$c4 = ".plesk.page"
$c5 = "ipfs.w3s.link"
$c6 = ".glitch.me"
$c7 = "ipfs.fleek.co"
$c8 = "//aeusercontent.net/mt/"
$c9 = "//www.google.com/url?q="
$c10 = "//ipfs.io/"
$c11 = "translate.goog"
$c12 = "//dweb.link/"
$c14 = "//firebasestorage.googleapis.com"
$c15 = "ipfs-dweb-link.translate.goog/"
$c16 = "//s.id/"
$c17 = "//formspree.io"
$c18 = "//submit-form.com"
$c19 = "//app.form2chat.io"
$c20 = "//t.co/"
$c21 = "//bit.ly/"
$c22 = ".pantheonsite.io/"
$c23 = "//l.ead.me/"
$c24 = "//t.me/"
$c25 = "//tinyl.io/"
$d3 = "t.co/redirect"
$y1 = "This program cannot be run in DOS mode"
$z4 = { 64 65 78 }
$z3 = { 52 61 72 21 }
$z2 = { 50 4B }
$z1 = { 4D 5A }
condition:
1 of ($b*) and 1 of ($c*) and not 1 of ($d*) and not $y1 and not $z1 at 0 and not $z2 at 0 and not $z3 at 0 and not $z4 at 0
}
rule SecuriteInfo_Suspicious_Phishing_3
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-Path: <www-data\@vm[0-9]{6,8}\.25ssd\.had\.wf/
$b1 = /Message-ID:.{1,50}@protonmail\.com/
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Suspicious_Phishing_4
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-Path: <www-data\@vm[0-9]{6,8}\.25ssd\.had\.wf/
$b1 = /From: .{1,50}paypal/
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Suspicious_PDF_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "%PDF"
$b1 = / \/URI \(https:\/\/[0-9a-zA-Z]{0,16}(plesk\.page|t\.ly|pckd\.me|bit\.ly|is\.gd|ow\.ly|3\.ly|clicky\.me|bl\.ink|buff\.ly|rebrand\.ly|bit\.do|cutt\.ly|shorturl\.at|short\.io|kutt\.it|switchy\.io|urlr\.me|name\.com|han\.gl|bitly\.kr|hoy\.kr|vo\.la|oe\.cd|btfy\.io|url-x\.it|wee\.so|duckdns\.org|\.ydns\.eu|tsurl\.co|vk\.sv|cutt\.us)\//i
$z1 = "https://rebrand.ly/protection-member"
condition:
$a1 at 0 and $b1 and not $z1
}
rule SecuriteInfo_PUA_VBS_Agent_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "CreateObject(\"Scripting.FileSystemObject\")"
$a2 = "RegWrite \"HKEY_CURRENT_USER"
$a3 = "CreateObject(\"Shell.Application\")"
$a4 = "ShellExecute"
condition:
all of ($a*)
}
rule SecuriteInfo_Suspicious_PDF_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "%PDF"
$b1 = "loteria-navidad"
$b2 = "loteria-de-navidad"
$c1 = "@inbox.ru"
$c2 = "@gmail.com"
$c3 = "@gmx.net"
condition:
$a1 at 0 and 1 of ($b*) and 1 of ($c*)
}
rule SecuriteInfo_FakeMail_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-Path: .{1,90}\@wetransfer\.com/
$b1 = /DKIM-Signature: .{1,90}email\.wetransfer\.com;/
$b2 = /Received: .{1,90}email\.wetransfer\.com /
condition:
$a1 and not 1 of ($b*)
}
rule SecuriteInfo_Spam_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "the sum of" nocase
$a2 = "deposited the money" nocase
$a3 = "dear friend" nocase
$a4 = "send the amount" nocase
$a5 = "fund transferred" nocase
$a6 = "to assist me" nocase
$a7 = "overdue payment" nocase
$a8 = "United States Dollars" nocase
$a9 = "balance unclaimed" nocase
$a10 = "seeking your assistance" nocase
$a11 = "unclaimed funds" nocase
$a12 = "beneficiary" nocase
$a13 = "as compensation" nocase
$a14 = "reply immediately" nocase
$a15 = /invest(s|ment|) in your country/ nocase
$a16 = "investment opportunity" nocase
$a17 = "excess of US$" nocase
$a18 = "hearing from you" nocase
$a19 = "financial arrangement" nocase
$a20 = "disclose further potential information" nocase
$a21 = "disclose further information" nocase
$a22 = "represents the interests of" nocase
$a23 = "money has not been claimed" nocase
$a24 = "private banking" nocase
$a25 = "get back to me immediately" nocase
$a26 = /(was|were) involved in a.{0,15} accident/ nocase
$a27 = "dearest beloved" nocase
$a28 = "client who have funds" nocase
$a29 = "reply to me immediately" nocase
$a30 = "respond to me as quickly" nocase
$a31 = "International Outsource" nocase
$a32 = "work with top financial" nocase
$a33 = "i have been diagnosed with" nocase
$a35 = "an offshore account" nocase
$a36 = "huge cash sum of" nocase
$a37 = "deposited funds" nocase
$a38 = "your detailed information" nocase
$a39 = "other charity organizations" nocase
$a40 = "of the funds for your reward" nocase
$a41 = "suffering from prolonged cancer"
$a42 = "husband was killed" nocase
$a43 = "my late husband" nocase
$a44 = "i inherited all" nocase
$a45 = "to donate the sum of" nocase
$a46 = "contact me for more information" nocase
$a47 = "fund is deposited in a bank" nocase
$a48 = "my late client" nocase
$a49 = "recovering the fund" nocase
$a50 = "huge amount was deposited" nocase
$a51 = /seek(ing|) your consent/ nocase
$a52 = "this funds can be paid into your bank" nocase
$a53 = "how we can disseminate the funds" nocase
$a54 = /seek(ing|) your indulgence/ nocase
$a55 = "invest funds in your country" nocase
$a56 = "swift response will be appreciated" nocase
$a57 = "maintain the strictest level of confidentiality" nocase
$a58 = "confidential manner" nocase
$a59 = "your email address was found" nocase
$a60 = "compensation funds" nocase
$a61 = "ATM Visa Card" nocase
$a62 = "with the below contact details" nocase
$a63 = "mutual beneficial transaction" nocase
$a65 = "your earliest response" nocase
$a66 = "i found your email" nocase
condition:
6 of ($a*)
}
rule SecuriteInfo_Spam_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$z1 = "Return-Path: " nocase
$a1 = "full name" nocase
$a2 = "phone" nocase
$a3 = "home address" nocase
$a4 = "valid id" nocase
$a5 = "passport" nocase
$a6 = /driver.{0,5}license/ nocase
$a7 = "contact address" nocase
$a8 = "with your details" nocase
$a9 = "account holder" nocase
$a10 = "bank name" nocase
$a11 = "bank address" nocase
$a12 = "contact cell phone" nocase
$a13 = "current address"
$a14 = "cell number"
$a16 = "fill the below information"
$a17 = "bank account details"
$a18 = "highly confidential"
$a19 = "immediate response"
$a20 = "strictly confidential"
$a21 = "bank account details"
$a22 = "i found your contact" nocase
$a23 = "request your assistance"
$b1 = "unclaimed" nocase
$b2 = "beneficiary" nocase
$b3 = /fund.? / nocase
$b4 = "wire transfer"
$b5 = "not been claimed" nocase
$b6 = "million united states dollars"
$b7 = "into your account"
$b8 = "lord jesus"
$b9 = "escrow account"
$b10 = "overpaid tax"
$b11 = "your designated account"
condition:
5 of ($a*) and 3 of ($b*) and $z1
}
rule SecuriteInfo_Spam_3
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Return-Path: <>" nocase
$a2 = "href=\"https://storage.googleapis.com/"
condition:
all of ($a*)
}
rule SecuriteInfo_Spam_4
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-Path: <.{1,25}@.{1,25}\.jp>/ nocase
$a2 = /X-Spam-Relay-Country:.{1,10}CN/
$a3 = "X-Mailer: Microsoft Outlook Express 6.00.2900.5512"
$a4 = "X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512"
condition:
all of ($a*)
}
rule SecuriteInfo_Spam_5
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "We are Project Financing" nocase
$a2 = "We are China Logistics" nocase
$a3 = "high-precision mold" nocase
condition:
1 of ($a*)
}
rule SecuriteInfo_Spam_SEO_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "we are providing our quality SEO" nocase
condition:
1 of ($a*)
}
rule SecuriteInfo_Spam_8
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Return-Path: <>"
$a2 = "X-Envelope-From: <>"
$a3 = "ct.sendgrid.net"
condition:
3 of ($a*)
}
rule SecuriteInfo_Spam_9
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "@163.com"
$b1 = "CNC machining" nocase
$b2 = "we are providing logistics from china" nocase
$b3 = "CNC machinery" nocase
$b4 = "CNC lathes" nocase
$b5 = "lathe machining" nocase
condition:
$a1 and 1 of ($b*)
}
rule SecuriteInfo_Spam_10
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-Path: .{1,90}\@localhost\.localdomain/
$b1 = /Received: .{1,90}\.googleusercontent\.com/
condition:
$a1 and $b1
}
rule SecuriteInfo_JS_Obfus_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /\+=string\.fromcharcode\(.{1,25}\.charcodeat\(.{1,25}\)\^.{1,25}\.charcodeat\(.{1,25}\%.{1,25}\)\)/ nocase
condition:
1 of ($a*)
}
rule SecuriteInfo_JS_Obfus_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /\+[a-z]{2,10}\+[a-z]{2,10}\+[a-z]{2,10}\+[a-z]{2,10}\+[a-z]{2,10}\+[a-z]{2,10}\+[a-z]{2,10}\+[a-z]{2,10};\ ?[a-z]{4,9}=0;\ ?[a-z]{4,9}\(\d{4}\);\ ?}/
condition:
$a1
}
rule SecuriteInfo_Lnk_Downloader_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$header = { 4C 00 00 00 }
$a1 = "<C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" nocase wide
$b1 = "msiexec.exe" nocase wide
$b2 = "powershell.exe" nocase wide
condition:
$header at 0 and $a1 and 1 of ($b*)
}
rule SecuriteInfo_Lnk_Downloader_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$header = { 4C 00 00 00 }
$a1 = "\\W*\\\\\\\\*2\\\\\\m*h*a*e" nocase wide
$a2 = "\\*i*\\S*3*\\m*ta.e*" nocase wide
$a3 = "\\W*\\S*2\\m*h?a.*" nocase wide
$a4 = "\\?i*\\S*3?\\m*ta.e*" nocase wide
$a5 = "powershell.exe -WindowStyle Hidden curl" nocase wide
$a6 = "ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile(" nocase wide
$a7 = "\\W*\\\\\\*2\\\\\\msh*e" nocase wide
$a8 = "powershell.exe -w hidden iwr -Uri" nocase wide
$a9 = "powershell $r=Invoke-WebRequest -Uri" nocase wide
$a10 = "powershell -command (Invoke-webrequest -URI" nocase wide
$a11 = "powershell.exe -windowstyle hidden -command \"& {Invoke-WebRequest" nocase wide
condition:
$header at 0 and 1 of ($a*)
}
rule SecuriteInfo_Lnk_Powershell_Exec_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$header = { 4C 00 00 00 }
$a1 = "powershell.exe" nocase wide
$a2 = "ExecutionPolicy bypass" nocase wide
$a3 = "windowstyle hidden" nocase wide
$a4 = "cmd /c" nocase wide
$a5 = "-command" nocase wide
condition:
$header at 0 and 4 of ($a*)
}
rule SecuriteInfo_Lnk_Autorun_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$header = { 4C 00 00 00 }
$a1 = "powershell.exe" nocase wide
$a2 = "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" nocase wide
condition:
$header at 0 and all of ($a*)
}
rule SecuriteInfo_Linux_Mirai_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$header = { 7F 45 4C 46 }
$a1 = "linuxshell"
$a2 = "ping ;sh"
$a3 = "applet not found"
$a4 = "ogin"
$a5 = "assword"
condition:
$header at 0 and all of ($a*)
}
rule SecuriteInfo_Linux_Shell_Downloader
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "chmod 7" nocase
$a2 = "chmod +x" nocase
$b1 = /https?:\/\/((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\//
$c1 = "curl" nocase
$c2 = "wget" nocase
$c3 = "fetch" nocase
condition:
(#a1 >= 5 or #a2 >= 5) and $b1 and (#c1 >= 5 or #c2 >= 5 or #c3 >= 5)
}
rule SecuriteInfo_Linux_Shell_Downloader_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "cd /tmp || cd /var/run || cd /mnt || cd /root || cd /" nocase
$b1 = /https?:\/\/((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\//
condition:
$a1 and $b1
}
rule SecuriteInfo_Suspicious_Phishing_5
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /facebook.?<\/title>/
$a2 = "log in or sign up</title>" nocase
$a3 = "<title>action | required" nocase
$a4 = "<title>action required" nocase
$a5 = "your paypal account</title>" nocase
$a6 = "<title>adobe" nocase
$a7 = "<title>sign in"
$a8 = "<title>secure redirect"
$a9 = "<title>facebook" nocase
$a10 = "<title>itau" nocase
$a11 = "<title>bancolombia" nocase
$a12 = "<title>instagram" nocase
$a13 = "<title>yahoo" nocase
$a14 = "<title>welcome to facebook" nocase
$a15 = "<title>log in" nocase
$a16 = "<title>whatsapp" nocase
$a17 = "<title>mail settings" nocase
$a18 = "<title>onedrive" nocase
$a19 = "<title>docusign" nocase
$a20 = "<title id=\"pagetitle\">facebook" nocase
$a21 = "<title>dhl" nocase
$a22 = "<title>banca" nocase
$a23 = "<title>download" nocase
$a24 = "<title>login" nocase
$a25 = "<title>email" nocase
$a26 = "<title>send money" nocase
$a27 = "<title>inicie sesion" nocase
$a28 = "<title>ltaú" nocase
$a29 = "<title>alibaba" nocase
$a30 = "<title>acesse a sua conta" nocase
$a31 = "<title>mobile-sign-in" nocase
$a32 = "<title>google" nocase
$a33 = "<title>dropbox" nocase
$a34 = "<title>leboncoin" nocase
$a35 = "<title>compte ameli" nocase
$b1 = "hosted on free web hosting 000webhost.com" nocase
condition:
1 of ($a*) and $b1
}
rule SecuriteInfo_Suspicious_Phishing_6
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /facebook.?<\/title>/
$a2 = "log in or sign up</title>" nocase
$a3 = "<title>action | required" nocase
$a4 = "<title>action required" nocase
$a5 = "your paypal account</title>" nocase
$a6 = "<title>adobe" nocase
$a7 = "<title>sign in"
$a8 = "<title>secure redirect"
$a9 = "<title>facebook" nocase
$a10 = "<title>office 365 portal" nocase
$a11 = "sign in</title>" nocase
$a12 = "<title>maerskline" nocase
$a13 = "<title>microsoft" nocase
$b1 = /action=.{1,50}\.php\"/
$b2 = /\$\.post\(.{1,50}\.php\"/
$b4 = "action=\"https://submit-form.com" nocase
$b5 = "action=\"https://formspree.io" nocase
$b6 = "confirm your email" nocase
$b7 = "confirm your password" nocase
$b8 = "<form name=\"f1\" id=\"i0281\"" nocase
$b9 = "<form name=\"f1\" id=\"09mi\"" nocase
$b10 = /url:.?https:\/\/submit-form\.com/ nocase
$b11 = /url:.?https:\/\/www\.formbackend\.com/ nocase
$b12 = /\$\.ajax\(\{url:.{1,50}\.php\"/
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Suspicious_Phishing_7
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Return-Path: " nocase
$b1 = "suspendu votre carte CB"
$c1 = "X-Mailer: PHPMailer"
condition:
$a1 and $b1 and $c1
}
rule SecuriteInfo_Phishing_against_securiteinfo
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /From:.{1,90}\@securiteinfo\.com/ nocase
$b1 = "[111.67.192."
$b2 = "[111.67.193."
$b3 = "[111.67.194."
$b4 = "[111.67.195."
$b5 = "[111.67.196."
$b6 = "[111.67.197."
$b7 = "[111.67.198."
$b8 = "[111.67.199."
$b9 = "[111.67.200."
$b10 = "[111.67.201."
$b11 = "[111.67.202."
$b12 = "[111.67.203."
$b13 = "[111.67.204."
$b14 = "[111.67.205."
$b15 = "[111.67.206."
$b16 = "[111.67.207."
$b17 = "[185.167.60."
$b18 = "[185.167.61."
$b19 = "[185.167.62."
$b20 = "[185.167.63."
condition:
$a1 and 1 of ($b*)
}
rule SecuriteInfo_Phishing_against_securiteinfo_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "From: \"retour@chronopost.fr\" <webmaster@securiteinfo.com>" nocase
condition:
1 of ($a*)
}
rule SecuriteInfo_Phishing_against_japan
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-Path:.{1,90}\.jp>/ nocase
$a2 = "From: \"Amazon.co.jp" nocase
$b2 = "X-Spam-Relay-Country: CN"
condition:
1 of ($a*) and $b2
}
rule SecuriteInfo_Phishing_against_japan_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-Path:.{1,90}accounts\.nintendo\.com>/ nocase
$a2 = "X-Spam-Relay-Country: CN"
condition:
$a1 and $a2
}
rule SecuriteInfo_W97M_DownLoader_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "<?xml"
$b1 = "Target=\"https://wrath.me/" nocase
$b2 = "Target=\"http://chilp.it/" nocase
$b3 = "Target=\"https://a.doko.moe/" nocase
$b4 = "Target=\"http://gf.to/" nocase
$b5 = "Target=\"http://paste.c-net.org" nocase
$b6 = "Target=\"http://dokdo.in/" nocase
$b7 = "Target=\"https://a.pomf.cat/" nocase
$b8 = "Target=\"https://i8.ae/" nocase
$b9 = "Target=\"https://kbit.co/" nocase
$b10 = "Target=\"https://khaurl.com/" nocase
$b11 = "Target=\"https://kho.ink/" nocase
$b12 = "Target=\"https://myown.bio/" nocase
$b13 = "Target=\"https://topkale.me/" nocase
$b14 = "Target=\"https://urlty.co/" nocase
$b15 = "Target=\"https://zeep.ly/" nocase
$b16 = "Target=\"http://tyny.to/" nocase
$b17 = "Target=\"http://toss.is/" nocase
$b18 = "Target=\"http://xeis.io/" nocase
condition:
$a1 at 0 and 1 of ($b*)
}
rule SecuriteInfo_PUA_VBS_DownLoader_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "CreateObject(\"MSXML2.ServerXMLHTTP" nocase
$a2 = "Open \"GET\"" nocase
$a3 = "ExecutarGlobal" nocase
$z1 = { 4D 5A }
condition:
$a1 and $a2 and $a3 and not $z1 at 0
}
rule SecuriteInfo_PUA_VBS_DownLoader_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "CreateObject(\"ADODB.Stream" nocase
$a2 = ".Open" nocase
$a3 = ".Write" nocase
$a4 = ".ResponseBody" nocase
$a5 = ".SaveToFile" nocase
$z1 = { 4D 5A }
condition:
$a1 and $a2 and $a3 and $a4 and $a5 and not $z1 at 0
}
rule SecuriteInfo_PUA_VBS_DownLoader_3
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "activexobject(\"scripting.filesystemobject\")" nocase
$a2 = "activexobject(\"wscript.shell\")" nocase
$a3 = "activexobject(\"adodb.stream\")" nocase
$a4 = "writetextfile" nocase
$z1 = { 4D 5A }
condition:
$a1 and $a2 and $a3 and $a4 and not $z1 at 0
}
rule SecuriteInfo_Suspicious_Phishing_Mail_16
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Return-Path: <www-data@"
$b1 = /Message-ID:.{1,90}@notification\.sumup\.com/
condition:
$a1 and $b1
}
rule SecuriteInfo_PhishingKit_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "<title>banco de oro" nocase
$b1 = /xml\.open\("get",".{1,15}\.php/
$b2 = /<form autocomplete="off" loginform="true" class="loginform" name="formmm" id="idd" method="post" action=".{1,15}\.php/
$b3 = /class="gohome" href=".{1,15}\.php/
$b4 = "your account has been restore successfully"
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_sendgrid_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "ct.sendgrid.net/ls/click"
$b1 = "suspicious transaction on your paypal account"
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "<title>fedex"
$b1 = "www.paypal.com/ncp/payment/"
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_3
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "masturabtion"
$b1 = "bitcoin wallet"
$b2 = "bitcoin address"
$b3 = "crypto wallet"
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_4
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "paypal</title>"
$b1 = "src=\"../../"
$c1 = "href=\"websrc.php?cmd=_update-information&account_address="
condition:
1 of ($a*) and 1 of ($b*) and 1 of ($c*)
}
rule SecuriteInfo_Spam_12
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "X-Spam-Relay-Country: CN" nocase
$b1 = "years experience"
$b2 = "stainless steel products"
$b3 = "we can provide"
condition:
$a1 and 3 of ($b*)
}
rule SecuriteInfo_Spam_13
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "moulding services in china"
$b1 = "cnc parts"
$b2 = "metal stamping"
$b3 = "extruding"
$b4 = "vacuum froming"
$b5 = "molding"
$b6 = "toolmaking"
$b7 = "tool design"
condition:
$a1 and 1 of ($b*)
}
rule SecuriteInfo_Phishing_against_japan_3
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "From: PayPay"
$a2 = "Return-Path:"
$a3 = /X-Spam-Relay-Country:.{1,10}CN/
$b1 = /Return-Path:.{1,90}@.{1,90}paypay/ nocase
condition:
$a1 and $a2 and $a3 and not $b1
}
rule SecuriteInfo_Suspicious_Phishing_8
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /\/\/ipfs\.io\/ipfs\/.{59}#.{1,70}@/ nocase
condition:
$a1
}
rule SecuriteInfo_Suspicious_Phishing_9
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "From: Amazon" nocase
$b1 = /X-Spam-Relay-Country:.{1,10}CN/
$c1 = "Received-SPF: None (mailfrom)"
condition:
$a1 and $b1 and $c1
}
rule SecuriteInfo_Suspicious_Mail_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Received-SPF: Permerror (mailfrom)" nocase
$a2 = "Received-SPF: Softfail" nocase
$b1 = "X-Spam-Relay-Country: CN"
condition:
any of ($a*) and $b1
}
rule SecuriteInfo_Phishing_Lidl
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "d=newsletter.lidl.fr;"
$a2 = "i=info@newsletter.lidl.fr;"
$b1 = "From: "
$z1 = /From: .{1,90}lidl.fr/
condition:
2 of ($a*) and $b1 and not $z1
}
rule SecuriteInfo_Phishing_Lidl_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "d=newsletter.lidl.fr;"
$a2 = "i=info@newsletter.lidl.fr;"
$b1 = "From: "
$b2 = "Return-Path: "
$z1 = /From: .{1,90}lidl.fr/
$y1 = /Return-Path: .{1,90}lidl.fr/
condition:
2 of ($a*) and 2 of ($b*) and $z1 and not $y1
}
rule SecuriteInfo_ChinesePhish_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$b1 = "Received-SPF: None"
$b2 = "Received-SPF: Neutral"
$b3 = "Received-SPF: Softfail"
$b4 = "Received-SPF: Permerror"
$b5 = "Received-SPF: Temperror"
$c1 = "envelope-from=paypay" nocase
$c2 = "envelope-from=rakuten" nocase
$c3 = "envelope-from=jcb-" nocase
$c4 = "envelope-from=mercari-" nocase
$c5 = "envelope-from=amazon-" nocase
$c6 = "envelope-from=vpass-"
$c7 = "envelope-from=info-"
$c8 = "envelope-from=ana."
$c9 = "envelope-from=eki-net-"
$c10 = "envelope-from=sagawa-exp."
condition:
1 of ($b*) and 1 of ($c*)
}
rule SecuriteInfo_ChinesePhish_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "X-Spam-Relay-Country: CN"
$b1 = "Received-SPF: None"
$c1 = "Received: from localhost (unknown"
$d1 = "https://www.aeon.co.jp"
$d2 = ".cn/aeonlogin"
condition:
$a1 and $b1 and $c1 and 1 of ($d*)
}
rule SecuriteInfo_ChinesePhish_3
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "X-Spam-Relay-Country: CN"
$b1 = "Received-SPF: None"
$c1 = "Received: from localhost (unknown"
$d1 = "class=3Drandom1" nocase
$d2 = "class=3Drandom2" nocase
$d3 = "class=3Drandom3" nocase
condition:
$a1 and $b1 and $c1 and 2 of ($d*)
}
rule SecuriteInfo_ChinesePhish_4
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "X-Spam-Relay-Country: CN"
$b1 = /Message-ID:.{1,90}@localhost/
$c1 = "Received: from localhost (unknown"
$d1 = "Received-SPF: None"
$d2 = "Received-SPF: Neutral"
condition:
$a1 and $b1 and $c1 and 1 of ($d*)
}
rule SecuriteInfo_ChinesePhish_5
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "X-Spam-Relay-Country: CN"
$b1 = /Message-ID: <.{1,25}@.{1,25}\.jp>/ nocase
$d1 = "Received-SPF: Softfail"
$d2 = "Received-SPF: Permerror"
$d3 = "Received-SPF: None"
$d4 = "Received-SPF: Temperror"
condition:
$a1 and $b1 and 1 of ($d*)
}
rule SecuriteInfo_RussianPhish_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Message-ID:.{1,100}\.sendgrid\.net/
$b1 = "helo=linkinferno.com"
$b2 = "helo=direct-plaza.com"
$b3 = "helo=kasacell.com"
$b4 = /Received: from .{1,20}\.googleusercontent\.com/
$c1 = "d=mail.totalenergies.fr;"
condition:
$a1 and 1 of ($b*) and $c1
}
rule SecuriteInfo_RussianPhish_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-Path:.{1,100}\.ru>/
$b1 = "href=3D\"https://////////"
$b2 = "href=\"https://////////"
condition:
$a1 and 1 of ($b*)
}
rule SecuriteInfo_googleusercontent_Phish_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-Path: .{1,100}\.bc\.googleusercontent\.com/
$b1 = /From: .{1,100}@abritel\.fr/
condition:
$a1 and 1 of ($b*)
}
rule SecuriteInfo_googleusercontent_Phish_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Return-Path:"
$b1 = /Received:\ from.{1,80}\.bc\.googleusercontent\.com/
$c1 = /From:.{1,100}@securiteinfo\.com/
condition:
$a1 and $b1 and $c1
}
rule SecuriteInfo_wetransfer_Phish_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /From: .{1,100}noreply@wetransfer\.com/
$b1 = "Return-Path: <www-data@"
condition:
$a1 and $b1
}
rule SecuriteInfo_ipfs_Phish_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "password"
$b1 = "//ipfs.io/ipfs/"
condition:
$a1 and $b1
}
rule SecuriteInfo_Phish_5
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "un kit d'urgence auto offert" nocase
$b1 = "totalenergies" nocase
$b2 = "vinci" nocase
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_6
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "https://fc67176-cdn.cuenote.jp" nocase
$a2 = "https://www.aeon.co.jp" nocase
$a3 = "From: AEON"
$a4 = /Return-Path:\ .{1,30}Aeon/ nocase
$a5 = /Return-Path:\ .{1,30}Rakuten/ nocase
$a6 = "https://www.jcb.co.jp" nocase
$a7 = /Return-Path:\ .{1,30}Resonabank/ nocase
$a8 = /Return-Path:\ .{1,30}SBI/ nocase
$a9 = /Return-Path:\ .{1,30}Amazon/ nocase
$b1 = /https:\/\/.{1,16}\.cn/ nocase
$b2 = "LmNu"
$c1 = "Return-Path: " nocase
condition:
1 of ($a*) and 1 of ($b*) and $c1
}
rule SecuriteInfo_Phish_7
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-Path:\ .{1,30}mastercard/ nocase
$b1 = /X-mailer:\ Foxmail\ .{1,25}\[cn\]/ nocase
condition:
1 of ($a*) and $b1
}
rule SecuriteInfo_Phish_8
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Received-SPF: Softfail"
$a2 = "Received-SPF: Permerror"
$a3 = "Received-SPF: Temperror"
$b1 = "//4e.fi/" nocase
$b2 = "//is.gd/" nocase
$b3 = "//kutt.it/"
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_9
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /@service\..{1,7}\.cn/ nocase
$b1 = /X-mailer:\ Foxmail\ .{1,25}\[cn\]/ nocase
condition:
$a1 and 1 of ($b*)
}
rule SecuriteInfo_Phish_10
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "BODY_SINGLE_WORD"
$a2 = "XM_RANDOM"
$b1 = "X-Spam-Relay-Country: CN XX"
$c1 = "(NewEsmtp) with SMTP"
condition:
1 of ($a*) and $b1 and $c1
}
rule SecuriteInfo_Phish_11
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "From: AEON"
$a2 = /Return-Path:\ .{1,30}Aeon/ nocase
$a3 = /Return-Path:\ .{1,30}Rakuten/ nocase
$a4 = /Return-Path:\ .{1,30}Resonabank/ nocase
$a5 = /Return-Path:\ .{1,30}SBI/ nocase
$a6 = /Return-Path:\ .{1,30}Amazon/ nocase
$a7 = /Return-Path:\ .{1,30}Sbi/ nocase
$a8 = /Return-Path:\ .{1,30}Apple/ nocase
$b1 = "=?UTF-8?"
$c1 = "Return-Path: " nocase
$d1 = "Received-SPF: Softfail"
$d2 = "Received-SPF: Permerror"
$d3 = "Received-SPF: None"
$d4 = "Received-SPF: Temperror"
condition:
1 of ($a*) and $b1 and $c1 and 1 of ($d*)
}
rule SecuriteInfo_URL_Phish_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /https?:\/\/.{1,16}\.com.{1,16}@.{1,20}\.asia\/\?/ nocase
$a2 = /https?:\/\/.{1,16}\.com.{1,36}@.{1,20}\.asia/ nocase
$a3 = /https?:\/\/.{1,16}\.jp.{1,16}@.{1,20}\.asia/ nocase
condition:
1 of ($a*)
}
rule SecuriteInfo_URL_Phish_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /https?:\/\/.{1,16}\.com.{1,16}@(0x[\da-fA-F]+|\d+)(\.(0x[\da-fA-F]+|\d+)){3}/ nocase
condition:
$a1
}
rule SecuriteInfo_Phish_12
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /From:\ .{1,30}ne-pas-repondre@chorus-pro.gouv.fr/ nocase
$b1 = /X-Received:\ by .{1,30}\.bc\.googleusercontent\.com/ nocase
condition:
$a1 and $b1
}
rule SecuriteInfo_Phish_13
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-Path:\ .{1,30}\.bc\.googleusercontent\.com/ nocase
$a2 = "@communications.paypal.com"
$b1 = "Received-SPF: Softfail"
$b2 = "Received-SPF: Permerror"
$b3 = "Received-SPF: None"
$b4 = "Received-SPF: Temperror"
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_14
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "X-Mailer: iPhone Mail"
$b1 = "https://kutt.it/"
condition:
$a1 and 1 of ($b*)
}
rule SecuriteInfo_Phish_15
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "amende"
$a2 = "infraction"
$a3 = "majoration"
$b1 = "cloudflare-ipfs.com/ipfs/"
$b2 = "//reurl.cc"
$b3 = "//t.ly"
$b4 = "//pckd.me"
$b5 = "//bit.ly"
$b6 = "//is.gd"
$b7 = "//ow.ly"
$b8 = "//3.ly"
$b9 = "//clicky.me"
$b10 = "//bl.ink"
$b11 = "//buff.ly"
$b12 = "//rebrand.ly"
$b13 = "//bit.do"
$b14 = "//cutt.ly"
$b15 = "//shorturl.at"
$b16 = "//short.io"
$b17 = "//kutt.it"
$b18 = "//switchy.io"
$b19 = "//urlr.me"
$b20 = "//name.com"
$b21 = "//han.gl"
$b22 = "//bitly.kr"
$b23 = "//hoy.kr"
$b24 = "//vo.la"
$b25 = "//oe.cd"
$b26 = "//btfy.io"
$b27 = "//url-x.it"
$b28 = "//wee.so"
$b29 = "//tsurl.co"
$b30 = "//cutt.us"
$b31 = "//ipfs.io"
$b32 = "//l.ead.me"
$b33 = "//hm.ru"
$b34 = "//espanolinves.me"
$b35 = "//1drv.ms"
$b36 = "shorturl.ac"
$b37 = "//shrtco.de"
$b38 = "//url.dev"
$b39 = "//rb.gy"
condition:
all of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_16
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "https://www.jabank.jp/"
$b1 = /https:\/\/.{1,12}.cn\/jabank/
condition:
$a1 and 1 of ($b*)
}
rule SecuriteInfo_Phish_17
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /From:.{1,90}@fnac\.fr/
$b1 = /Message-ID:.{1,90}@SNEF\.com/ nocase
condition:
$a1 and $b1
}
rule SecuriteInfo_Phish_18
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Return-Path: <Nocibe"
$b1 = "X-Spam-Relay-Country: RU"
condition:
1 of ($a*) and $b1
}
rule SecuriteInfo_Phish_19
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = { A9 20 32 30 32 35 20 61 64 6F 62 65 }
$b1 = "docsend.com" nocase
condition:
$a1 and $b1
}
rule SecuriteInfo_Phish_20
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Received-SPF: Softfail"
$b1 = "@jxpomup.com"
$b2 = "@amanat.kz"
$b3 = "@marlowe.co.jp"
$b4 = "trendgraphix.com"
$b5 = "@yahoo.co.jp"
$b6 = "@soft4europe-france.com"
condition:
$a1 and 1 of ($b*)
}
rule SecuriteInfo_Phish_21
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Received-SPF: None"
$b1 = "iklltfx.fr"
$b2 = "wbtjrzxc.in"
$b3 = "etihad-rusexport.ru"
$b4 = "@fabg.com"
$b5 = "@ygrr.net"
$b6 = "@rcul.com"
$b7 = "@maindivision.ru"
$b8 = "npf-nuclide.ru"
$b9 = "capricornconstructionco.com"
$b10 = "riverviewschoolalumni.org"
condition:
$a1 and 1 of ($b*)
}
rule SecuriteInfo_Hackedwebsite_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /X-PHP-Originating-Script:\ .{1,15}wp-l0gin\.php/
condition:
1 of ($a*)
}
rule SecuriteInfo_Phish_22
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "envelope-from=www-data@"
$b1 = "//kutt.it/" nocase
$b2 = "//shorturl.at/" nocase
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_23
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /helo=.{4,5}\.com/
$a2 = /helo=.{4,5}\.net/
$b1 = "Received-SPF: None"
$b3 = "Received-SPF: Softfail"
$b4 = "Received-SPF: Permerror"
$b5 = "Received-SPF: Temperror"
$c1 = "X-Spam-Relay-Country: CN"
$c2 = "X-Spam-Relay-Country: SG"
$c3 = "X-Spam-Relay-Country: HK"
$c4 = "X-Spam-Relay-Country: RU"
condition:
1 of ($a*) and 1 of ($b*) and 1 of ($c*)
}
rule SecuriteInfo_SPF_Fail
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /helo=.{1,24}\.jp/
$b3 = "Received-SPF: Softfail"
$c1 = "X-Spam-Relay-Country: CN"
$c2 = "X-Spam-Relay-Country: SG"
$c3 = "X-Spam-Relay-Country: HK"
$c4 = "X-Spam-Relay-Country: RU"
condition:
1 of ($a*) and $b3 and 1 of ($c*)
}
rule SecuriteInfo_Phish_24
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /<a href=".{0,1}">help center<\/a>/
condition:
1 of ($a*)
}
rule SecuriteInfo_Phish_25
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = " ANA All Rights Reserved" nocase
$b1 = /https:\/\/.{1,16}\.cn/
$b2 = "Received-SPF: Softfail"
condition:
$a1 and 1 of ($b*)
}
rule SecuriteInfo_Phish_website_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /data-wf-domain=".{0,32}ndax.{0,32}\.webflow\.io"/
$a2 = /data-wf-domain=".{0,32}sso-.{0,32}\.webflow\.io"/
$a3 = /data-wf-domain=".{0,32}secure-.{0,32}\.webflow\.io"/
$a4 = /data-wf-domain=".{0,32}coinbase.{0,32}\.webflow\.io"/
$a5 = /data-wf-domain=".{0,32}auth.{0,32}\.webflow\.io"/
$a6 = /data-wf-domain=".{0,32}trezor.{0,32}\.webflow\.io"/
$a7 = /data-wf-domain=".{0,32}trzor.{0,32}\.webflow\.io"/
$a8 = /data-wf-domain=".{0,32}itrust.{0,32}\.webflow\.io"/
$a9 = /data-wf-domain=".{0,32}-sso.{0,32}\.webflow\.io"/
$a10 = /data-wf-domain=".{0,32}-block.{0,32}\.webflow\.io"/
$a11 = /data-wf-domain=".{0,32}-trezr.{0,32}\.webflow\.io"/
$a12 = /data-wf-domain=".{0,32}login.{0,32}\.webflow\.io"/
$a13 = /data-wf-domain=".{0,32}logn.{0,32}\.webflow\.io"/
condition:
1 of ($a*)
}
rule SecuriteInfo_PUA_Phish_URLwithmail
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /https:\/\/tinyurl\.com\/.{8}\/#.{1,16}@/
$a2 = /https:\/\/firebasestorage\.googleapis\.com\/.{0,35}\.firebasestorage\.app\/.{0,25}\.html\?.{0,70}#.{1,16}@/
condition:
1 of ($a*)
}
rule SecuriteInfo_Phish_26
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Message-ID:.{1,32}sebastien.serrurier@box.com/
$a2 = /Message-ID:.{1,32}jerome.gervais@box.com/
condition:
any of ($a*)
}
rule SecuriteInfo_Phish_27
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Vinci.{1,6}Autoroutes/ nocase
$a2 = /Kit.{1,6}Emergenza/ nocase
$a3 = /Lidl.{1,6}offre/ nocase
$b1 = /Message-ID:.{1,64}@mail\.gmail\.com/
$b2 = /Message-ID:.{1,64}@3c-app-mailcom-bs/
$b3 = /Message-ID:.{1,64}@cmail19\.com/
condition:
any of ($a*) and any of ($b*)
}
rule SecuriteInfo_Phish_28
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Content-Transfer-Encoding: base64"
$b1 = "X-Spam-Relay-Country: IN"
$c1 = "X-Mailru-Msgtype: letter-"
$d1 = "Received-SPF: None"
$d2 = "Received-SPF: Neutral"
$d3 = "Received-SPF: Softfail"
$d4 = "Received-SPF: Permerror"
condition:
$a1 and $b1 and $c1 and any of ($d*)
}
rule SecuriteInfo_URL_Phish_3
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /tinyurl\.com\/.{1,8}#.{1,12}@/
$a2 = /\.ip-ddns\.com#.{1,12}@/
condition:
any of ($a*)
}
rule SecuriteInfo_HTML_29369
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /\/\/www\.[a-z]{4}\.cn\/\?[a-z]{8}">/
condition:
$a1
}
rule SecuriteInfo_Phish_29
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "//qrco.de/" nocase
$b1 = "chronopost" nocase
$b2 = "amende" nocase
condition:
$a1 and any of ($b*)
}
rule SecuriteInfo_Phish_30
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /\/\/ipfs\.io\/ipfs\/.{46,70}[^A-Za-z0-9._%+\-][A-Za-z0-9]([A-Za-z0-9._%+\-]{0,62}[A-Za-z0-9])?@([A-Za-z0-9]([A-Za-z0-9\-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,24}/ nocase ascii
$a2 = /\.amazonaws\.com\/.{1,70}\.html\#[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+.[A-Za-z]{2,}/ nocase ascii
condition:
any of ($a*)
}
rule SecuriteInfo_Phish_31
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = {3755362f2b62754f534e61524162354b4a424579443539685a33666d79306b684771327177614c6e574f4d6875716e78332b5930696532627243584243526e596964594d31553671506754}
$a2 = "iZRnLNtTBGNxxrNkTuuWbRFL1wrGyQvJduONalTeS99MCxslvIe4nDsTJB8l72wbEyjeS9dMOxZ"
$b1 = "Offre exclusive" nocase ascii
condition:
any of ($a*) and any of ($b*)
}
rule SecuriteInfo_Phish_32
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = ".awsapps.com"
$a2 = "X-Mailer: Amazon WorkMail"
$a3 = "www.bing.com/ck/a"
$a4 = "@storage.wm.amazon.com"
$b1 = "Test_gratuit_disponible" nocase
$b2 = "couvrez_la_diff"
$b3 = "dWl0IGRpc3BvbmlibGUg4oCTIGTDqWNvdXZyZXogbGEgZGlmZsOpcmVuY2Xwn5Go"
condition:
any of ($a*) and any of ($b*)
}
rule SecuriteInfo_Phish_33
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "AMERICAN EXPRESS" nocase
$b1 = ".cn/action/home/request/type=" nocase
condition:
any of ($a*) and any of ($b*)
}
rule SecuriteInfo_Phish_34
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "chorus pro" nocase
$a2 = "chambre des notaires" nocase
$a3 = "www.antai.gouv.fr" nocase
$b1 = "links.truthsocial.com/link/" nocase
condition:
any of ($a*) and any of ($b*)
}
rule SecuriteInfo_Trojan_Mimikatz
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "mimikatz"
$b1 = "delete_defender"
$b2 = "Microsoft? Windows? Operating"
$b3 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
$b4 = "drop_defender"
condition:
$a1 and 2 of ($b*) and uint32(0) == 0x00905A4D
}
rule SecuriteInfo_PUA_Suspicious_JS_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Scripting.FileSystemObject" nocase
$a2 = "winmgmts" nocase
$a3 = "Win32_ProcessStartup" nocase
$a4 = ".run(" nocase
$a5 = "WScript.Shell" nocase
condition:
all of ($a*)
}
rule SecuriteInfo_Suspicious_PDF_3
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "%PDF"
$b1 = "wkhtmltopdf" wide
$c1 = "PayPal BTC Invoic" wide
$c2 = "Geek Squad Invoic" wide
condition:
$a1 at 0 and $b1 and any of ($c*)
}
rule SecuriteInfo_Chinese_Spam_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Received-SPF: Softfail"
$b1 = "client-ip=39.128."
$b2 = "client-ip=39.129"
$b3 = "client-ip=39.130."
$b4 = "client-ip=39.131."
$b5 = "client-ip=39.132."
$b6 = "client-ip=39.133."
$b7 = "client-ip=39.134."
$b8 = "client-ip=39.135."
$b9 = "client-ip=39.136."
$b10 = "client-ip=39.137."
$b11 = "client-ip=39.138."
$b12 = "client-ip=39.139."
$b13 = "client-ip=39.140."
condition:
$a1 and any of ($b*)
}
rule SecuriteInfo_Spam_SEO
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-[pP]ath: .{1,90}\@hotmail\.com/
$a2 = /Return-[pP]ath: .{1,90}\@outlook\.com/
$a3 = /Return-[pP]ath: .{1,90}\@gmail\.com/
$c1 = /From: .{1,90}\@hotmail\.com/
$c2 = /From: .{1,90}\@outlook\.com/
$c3 = /From: .{1,90}\@gmail\.com/
$b1 = "Search Engine Optimization" nocase
$b2 = "SEO"
$b3 = "ranking at the top" nocase
$b4 = "promote your site" nocase
$b5 = "rank on 1st page" nocase
$b6 = "Reply now" nocase
$b7 = "page one of " nocase
$b8 = "first page of " nocase
$b9 = "site not rank on" nocase
$b10 = "error on our site" nocase
$b11 = "rank on Google" nocase
$b12 = "free screenshot" nocase
$b13 = "issues on your website" nocase
$b14 = "websites rank on" nocase
$b15 = " 1st page of " nocase
$b16 = "price list" nocase
$b17 = "Google's first page" nocase
$b18 = "through your website" nocase
$b19 = "reviewed your website" nocase
$b20 = "spotted a few errors" nocase
$b21 = "climb to page 1 on" nocase
$b22 = "send a proposal" nocase
$b23 = "some errors on your website" nocase
$b24 = "send you a screenshot" nocase
$b25 = "share our pricing" nocase
$b26 = "ranking on Google" nocase
$b27 = "1st page of google" nocase
$b28 = "ranking high" nocase
$b29 = "Google rank" nocase
$b30 = "quote and price" nocase
$b31 = "search rank" nocase
condition:
(any of ($a*) or any of ($c*)) and 2 of ($b*)
}
rule SecuriteInfo_Spam_IndianDev
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-path: .{1,90}\@hotmail\.com/
$a2 = /Return-path: .{1,90}\@outlook\.com/
$b1 = "mobile app" nocase
$b2 = "redesign proposal" nocase
$b3 = "revamp their apps" nocase
$b4 = "website design" nocase
$b5 = "technical flaws" nocase
condition:
any of ($a*) and 2 of ($b*)
}
rule SecuriteInfo_Spam_YouWinBullshit
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "you have been selected" nocase
$a2 = "claim your reward" nocase
$a3 = "medicare kit" nocase
$a4 = "winner" nocase
condition:
3 of ($a*)
}
rule SecuriteInfo_Phish_35
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-[pP]ath: .{1,90}\@hotmail\.com/
$a2 = /Return-[pP]ath: .{1,90}\@outlook\.com/
$a3 = /Return-[pP]ath: .{1,90}\@gmail\.com/
$c1 = /From: .{1,90}\@hotmail\.com/
$c2 = /From: .{1,90}\@outlook\.com/
$c3 = /From: .{1,90}\@gmail\.com/
$b1 = "unclaimed estate" nocase
condition:
(any of ($a*) or any of ($c*)) and 1 of ($b*)
}
rule SecuriteInfo_Phish_36
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "images2.imgbox.com/7a/b7/cbhqsbbr_o.png"
$b1 = "//bit.ly/" nocase
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Suspicious_File
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /cdn\.discordapp\.com\/attachments\/.{1,60}\.(docx|xmlx|zip|exe)/
condition:
1 of ($a*)
}
rule SecuriteInfo_Phish_37
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-[pP]ath: .{1,90}\@localhost\.localdomain/
$b1 = "paypal.com/ncp/payment/" nocase
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_38
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "bitstack"
$b1 = ".sr-redir.it.com/" nocase
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Spam_14
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-[pP]ath: <>/
$a2 = "X-Envelope-From: <>"
/* $b1 = "Received-SPF: None" */
$b2 = "Received-SPF: Softfail"
$b3 = "Received-SPF: Permerror"
condition:
all of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Chinese_Spam_2
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /Return-[pP]ath:/
$b1 = "charset=\"iso-2022-jp\""
$c1 = "monex.co.jp" nocase
$c2 = "Monex"
$d1 = /\ helo=.{0,12}\.cn;/ nocase
$e1 = /\ d=.{0,12}\.cn;/ nocase
condition:
$a1 and $b1 and 1 of ($c*) and ($d1 or $e1)
}
rule SecuriteInfo_Spam_HackedWebsite
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /X-PHP-Originating-Script:\ .{0,24}\.php.{0,24}eval\(\)'d\ code\(/
condition:
$a1
}
rule SecuriteInfo_Phish_Multa
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "https://entrypoint.myclickfunnels.com"
$a2 = "stationnement"
$a3 = "contravention"
$a4 = "majoration"
$a5 = "amende"
condition:
all of ($a*)
}
rule SecuriteInfo_PUA_ShellExec
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "ActiveXObject(\"WScript.Shell\")" nocase
$a2 = "cmd.exe" nocase
$a3 = ".Run(" nocase
$a4 = "ActiveXObject(\"ADODB.Stream\")" nocase
condition:
all of ($a*)
}
rule SecuriteInfo_Phish_39
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "récompense" nocase
$a2 = "kit d'urgence" nocase
$a3 = "Sephora" nocase
$a4 = "gagnant" nocase
$a5 = "cadeau" nocase
$a6 = "Decathlon"
$a7 = "Xiaomi"
$a8 = "gagnez" nocase
$b1 = /\/\/(plesk\.page|pckd\.me|bit\.ly|is\.gd|ow\.ly|3\.ly|clicky\.me|bl\.ink|buff\.ly|rebrand\.ly|bit\.do|cutt\.ly|shorturl\.at|short\.io|kutt\.it|switchy\.io|urlr\.me|name\.com|han\.gl|bitly\.kr|hoy\.kr|vo\.la|oe\.cd|btfy\.io|url-x\.it|wee\.so|duckdns\.org|\.ydns\.eu|\.page\.link|tsurl\.co|vk\.sv|cutt\.us|\.app\.link|\/\/rb\.gy)\//i
condition:
2 of ($a*) and $b1
}
rule SecuriteInfo_Phish_40
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "action requise" nocase
$b1 = /\/\/(plesk\.page|pckd\.me|bit\.ly|is\.gd|ow\.ly|3\.ly|clicky\.me|bl\.ink|buff\.ly|rebrand\.ly|bit\.do|cutt\.ly|shorturl\.at|short\.io|kutt\.it|switchy\.io|urlr\.me|name\.com|han\.gl|bitly\.kr|hoy\.kr|vo\.la|oe\.cd|btfy\.io|url-x\.it|wee\.so|duckdns\.org|\.ydns\.eu|\.page\.link|tsurl\.co|vk\.sv|cutt\.us|\.app\.link|\/\/rb\.gy)\//i
condition:
1 of ($a*) and $b1
}
rule SecuriteInfo_Phish_41
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Return-Path: <www-data"
$b1 = "@directmail-gouv-antai.fr"
$b2 = "@ar24.fr"
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_PUA_HackedWebsite_URL
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /<a\ href="https:\/\/.{0,26}\/wp-includes\// nocase
condition:
$a1
}
rule SecuriteInfo_PUA_URL_Redirection
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /https:\/\/www\.joblinkapply\.com\/joblink\/.{0,50}returnurl/
$a2 = /https:\/\/www\.googletagmanager\.com\/debug\/clearcookies\?url=http/
$a3 = /\/\?ads_click=.{0,50}redir=.{0,2}https:\/\/storage\.googleapis\.com\//
condition:
1 of ($a*)
}
rule SecuriteInfo_Powershell_Exec_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a2 = "[System.IO.File]::WriteAllBytes($"
$a3 = "[System.Convert]::FromBase64String($"
$a4 = "Expand-Archive -Path $"
$a5 = "Remove-Item"
$a6 = "Start-Process $"
condition:
all of ($a*)
}
rule SecuriteInfo_PUA_VBS_Download_and_Exec_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$b1 = "WinHttp.WinHttpRequest" nocase
$b2 = "MSXML2.XMLHTTP" nocase
$b3 = "Microsoft.XMLHTTP" nocase
$b4 = "MSXML2.ServerXMLHTTP" nocase
$b5 = "Scripting.FileSystemObject" nocase
$a1 = "GET"
$a2 = "ADODB.Stream" nocase
$d1 = "responseBody" nocase
$d2 = "SaveToFile" nocase
$d3 = "ReadText" nocase
$d4 = "responsetext" nocase
$c1 = "Execute"
$c2 = "Run"
$c3 = "exec" nocase
$c4 = /Shell.?\(/ nocase
$z1 = { 4D 5A }
condition:
all of ($a*) and 1 of ($b*) and 1 of ($c*) and 1 of ($d*) and not $z1 at 0
}
rule SecuriteInfo_PUA_VBS_Encoded_and_Exec_1
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$b1 = "MSXML2.DOMDocument" nocase
$b2 = "Microsoft.XMLDOM" nocase
$a2 = "bin.base64"
$a3 = "ADODB.Stream"
$c1 = "Execute"
$c2 = "Run"
$c3 = "exec" nocase
$c4 = /Shell.?\(/ nocase
$d1 = "responseBody" nocase
$d2 = "SaveToFile" nocase
$d3 = "ReadText" nocase
condition:
all of ($a*) and 1 of ($b*) and 1 of ($c*) and 1 of ($d*)
}
rule SecuriteInfo_Phish_42
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "//ipfs.io/ipfs/ba"
$b1 = "your account"
$b2 = "download link"
$b3 = "incoming messages"
$b4 = "storage is full"
$b5 = "storage limit"
$b6 = "wetransfer"
$b7 = "dropbox account"
$b8 = "you have received"
$b9 = "webmail account"
$b10 = "emails pending"
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_URL_Phish_4
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1=/https:\/\/\/\/\/\/\/\/\/\/\/\/\/.{0,32}\.xn--p1ai\/\/\/\//
$a2=/https:\/\/\/\/\/\/\/\/\/\/\/\/\/.{0,32}\.ru\/\/\/\//
condition:
1 of ($a*)
}
rule SecuriteInfo_Phish_43
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "gagnant" nocase
$a2 = "gagner" nocase
$a3 = /r.?.?compense/ nocase
$a4 = /r.?.?clamer/ nocase
$a5 = /r.?.?clamez/ nocase
$a6 = /f.?.?licitation/ nocase
$a7 = "parksize" nocase
$a8 = "cadeau" nocase
$a9 = "claim-button" nocase
$b1 = "cloudflare-ipfs.com/ipfs/"
$b2 = "//reurl.cc"
$b3 = "//t.ly"
$b4 = "//pckd.me"
$b5 = "//bit.ly"
$b6 = "//is.gd"
$b7 = "//ow.ly"
$b8 = "//3.ly"
$b9 = "//clicky.me"
$b10 = "//bl.ink"
$b11 = "//buff.ly"
$b12 = "//rebrand.ly"
$b13 = "//bit.do"
$b14 = "//cutt.ly"
$b15 = "//shorturl.at"
$b16 = "//short.io"
$b17 = "//kutt.it"
$b18 = "//switchy.io"
$b19 = "//urlr.me"
$b20 = "//name.com"
$b21 = "//han.gl"
$b22 = "//bitly.kr"
$b23 = "//hoy.kr"
$b24 = "//vo.la"
$b25 = "//oe.cd"
$b26 = "//btfy.io"
$b27 = "//url-x.it"
$b28 = "//wee.so"
$b29 = "//tsurl.co"
$b30 = "//cutt.us"
$b31 = "//ipfs.io"
$b32 = "//l.ead.me"
$b33 = "//hm.ru"
$b34 = "//espanolinves.me"
$b35 = "//1drv.ms"
$b36 = "shorturl.ac"
$b37 = "//shrtco.de"
$b38 = "//url.dev"
$b39 = "//rb.gy"
condition:
2 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_44
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Leroy Merlin" nocase
$a2 = "Parkside" nocase
$a3 = "Silvercrest"
$b1 = "trackingservice.monday.com"
$b2 = "//buff.ly"
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_VBS_Exec_4
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "=newactivexobject(\"wscript.shell\")"
$a2 = "\".split(\""
$a3 = "\").join(\"\");"
$a4 = "g(\"\"+"
$a5 = ".run("
condition:
all of ($a*)
}
rule SecuriteInfo_Phish_45
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Leroy Merlin" nocase
$a2 = "Parkside" nocase
$a3 = "Dexter" nocase
$a4 = "vinci autoroute" nocase
$a5 = "enqu=C3=AAte" nocase
$a6 = "Lidl" nocase
$a7 = "MetaMask"
$a8 = "IPTV Service"
$a9 = "Sephora"
$a10 = "Premium IPTV"
$a11 = "Wallet"
$a12 = "Action gratuite" nocase
$b1 = /Return-Path: .{1,20}\@.{0,30}\.firebaseapp\.com>/
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_46
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = ".ipfs.dweb.link"
$b1 = "download document"
$b2 = "pending message"
$b3 = "pending on the server"
$b4 = "confirm account"
$b5 = "verify email"
$b6 = "invoice"
condition:
$a1 and 1 of ($b*)
}
rule SecuriteInfo_Phish_47
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "//vo.la/"
$a2 = "//tinyurl.com/" nocase
$a3 = "//shorter.me/"
$a4 = "//m-url.eu/"
$a5 = "//miniurl.be/"
$a6 = "//tinyl.io/"
$a7 = "//rebrand.ly"
$a8 = "//shorturl.at"
$a9 = "//bityl.co"
$a10 = "//is.gd/"
$b1 = "CNN Broadcast"
$b2 = "Renewal Failed" nocase
$b3 = "CNN Chief Medical"
$b4 = "CNN World"
$b5 = "Health Alerts"
$b6 = "inactive account" nocase
$b7 = "CBS News"
$b8 = "Fox News"
$b9 = "CNN Health"
$b10 = "claim your" nocase
$b11 = "Storage Renewal" nocase
$b12 = "Cloud Drive" nocase
$b13 = "cloud storage" nocase
$b14 = "Action Required" nocase
$b15 = "your account" nocase
$b16 = "google drive" nocase
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_48
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "web.core.windows.net"
$b2 = "reset the password" nocase
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_49
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "//storage.googleapis.com/"
$b1 = "récompense exclusive" nocase
$b2 = "Vinci Autoroutes" nocase
$b3 = "Renew Subscription" nocase
$b4 = "action is required" nocase
$b6 = "storage plan" nocase
$b7 = "Update Billing" nocase
$b8 = "UPS Carbon" nocase
$b9 = "Leroy Merlin" nocase
$y1 = "This program cannot be run in DOS mode"
$z4 = { 64 65 78 }
$z3 = { 52 61 72 21 }
$z2 = { 50 4B }
$z1 = { 4D 5A }
condition:
1 of ($a*) and 1 of ($b*) and not $y1 and not $z1 at 0 and not $z2 at 0 and not $z3 at 0 and not $z4 at 0
}
rule SecuriteInfo_PUA_JS_Fingerprint
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "navigator.platform" nocase
$a2 = "navigator.userAgent" nocase
$a3 = "navigator.languages" nocase
$a4 = "navigator.hardwareConcurrency" nocase
$a5 = "navigator.deviceMemory" nocase
$a6 = "navigator.maxTouchPoints" nocase
$a7 = "navigator.cookieEnabled" nocase
$a8 = "navigator.doNotTrack" nocase
$a9 = "navigator.webdriver" nocase
$a10 = "Intl.DateTimeFormat().resolvedOptions().timeZone" nocase
$a11 = "navigator.pdfViewerEnabled" nocase
$a12 = "Date().getTimezoneOffset()" nocase
$a13 = ".saveData" nocase
condition:
9 of ($a*)
}
rule SecuriteInfo_Phish_50
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = /data-wf-domain=".{0,40}\.webflow\.io/
$b2 = "Kucoin Login" nocase
$b3 = "BitMart account" nocase
$b4 = "Netcoins Login" nocase
$b5 = "Swissborg Account" nocase
$b6 = "Email Address\\ User ID" nocase
$b7 = "Ledger.com/Start®" nocase
condition:
$a1 and 1 of ($b*)
}
rule SecuriteInfo_Phish_51
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$b1 = "ISO-2022-JP" nocase
$b2 = "charset=\"UTF-8\"" nocase
$a1 = /https:\/\/.{0,20}\.com\/.{0,20}\.jp\.net"/
$a2 = /https:\/\/.{0,20}\.com\/.{0,20}\.me"/
$a3 = /https:\/\/.{0,20}\.com\/.{0,20}\.jp"/
$a4 = /https:\/\/.{0,20}\.com\/.{0,20}\.group"/
$a5 = /https:\/\/.{0,20}\.com\/.{0,20}\.online"/
$a6 = /https:\/\/.{0,20}\.com\/.{0,20}\.travel"/
$a7 = /https:\/\/.{0,20}\.com\/.{0,20}\.center"/
$a8 = /https:\/\/.{0,20}\.com\/.{0,20}\.cloud"/
condition:
1 of ($b*) and 1 of ($a*)
}
rule SecuriteInfo_Phish_52
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Received-SPF: None"
$a2 = "Received-SPF: Neutral"
$a3 = "Received-SPF: Softfail"
$a4 = "Received-SPF: Permerror"
$a5 = "Received-SPF: Temperror"
$b1 = "X-Spam-Relay-Country: JP"
$b2 = "X-Spam-Relay-Country: CN"
$c1 = "https://qr.paypay.ne.jp"
condition:
1 of ($a*) and 1 of ($b*) and $c1
}
rule SecuriteInfo_Phish_53
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "Return-Path: <>"
$b1 = "@securiteinfo.com>"
$c1 = ".bc.googleusercontent.com"
condition:
1 of ($a*) and 1 of ($b*) and 1 of ($c*)
}
rule SecuriteInfo_Phish_54
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "agence nationale de traitement automatis des infractions"
$b1 = "/wp-content/"
condition:
1 of ($a*) and 1 of ($b*)
}
rule SecuriteInfo_Phish_55
{
meta:
author = "Arnaud Jacques / Copyright © 2021-2026 SecuriteInfo.com"
strings:
$a1 = "you have received a new document for your review"
$b1 = "-1.amazonaws.com"
$b2 = "-2.amazonaws.com"
condition:
1 of ($a*) and 1 of ($b*)
}