VQL-Artifact.yaml

1 comments

• lexs201992-gif an hour ago

  sipc-init.yaml detection: selection_sipc_init: CommandLine|contains|all: - 'sipc-virt:core' - 'channel' - 'startup'

      selection_c2_channels:
          CommandLine|contains: 
              - 'chan-4'
              - 'chan-5'
              - 'sprd_iq.ko'
          
      selection_suspicious_procs:
          CommandLine|contains:
              - 'wcn_chr'
              - 'linkturbonative'
              - 'sprd_networkcontrol'
              - 'com.sprd.srmi.Srmiapp'
          
      selection_network_anomaly:
          CommandLine|contains|all:
              - 'tun0'
              - 'fd00:2'
              
      selection_build_host:
          CommandLine|contains: 'sh-16-52.rnd.longcheer.net'
  
      condition: selection_sipc_init and (selection_c2_channels or selection_suspicious_procs or selection_network_anomaly or selection_build_host)