rule suspicious_powershell_download {
    meta:
        description = "Detects PowerShell download cradle patterns"
        severity = "high"
        author = "TubaBot"
    strings:
        $s1 = "DownloadString" ascii nocase
        $s2 = "DownloadFile" ascii nocase
        $s3 = "IEX" ascii
        $s4 = "Invoke-Expression" ascii nocase
        $s5 = "Net.WebClient" ascii nocase
        $s6 = "System.Net.WebRequest" ascii nocase
        $s7 = "Start-BitsTransfer" ascii nocase
        $s8 = "curl" ascii nocase
        $s9 = "wget" ascii nocase
    condition:
        filesize < 5MB and
        any of ($s1, $s2, $s5, $s6, $s7) and any of ($s3, $s4)
}

rule suspicious_vbs_exec {
    meta:
        description = "Detects VBS script execution patterns"
        severity = "high"
        author = "TubaBot"
    strings:
        $s1 = "CreateObject" ascii nocase
        $s2 = "WScript.Shell" ascii nocase
        $s3 = "Shell.Application" ascii nocase
        $s4 = "ADODB.Stream" ascii nocase
        $s5 = "Scripting.FileSystemObject" ascii nocase
        $s6 = "Exec" ascii nocase
        $s7 = "Run" ascii nocase
    condition:
        filesize < 2MB and
        any of ($s1, $s2, $s3) and any of ($s4, $s5, $s6, $s7)
}

rule suspicious_batch_persistence {
    meta:
        description = "Detects batch file persistence mechanisms"
        severity = "medium"
        author = "TubaBot"
    strings:
        $s1 = "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii nocase
        $s2 = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii nocase
        $s3 = "schtasks" ascii nocase
        $s4 = "at " ascii nocase
        $s5 = "reg add" ascii nocase
        $s6 = "Startup" ascii nocase
    condition:
        filesize < 1MB and
        any of them
}

rule pe_import_injection {
    meta:
        description = "Detects PE files with process injection API imports"
        severity = "high"
        author = "TubaBot"
    strings:
        $s1 = "VirtualAllocEx" ascii
        $s2 = "WriteProcessMemory" ascii
        $s3 = "CreateRemoteThread" ascii
        $s4 = "NtCreateThreadEx" ascii
        $s5 = "RtlCreateUserThread" ascii
    condition:
        filesize < 50MB and
        2 of them
}

rule pe_import_keylogger {
    meta:
        description = "Detects PE files with keylogger API imports"
        severity = "high"
        author = "TubaBot"
    strings:
        $s1 = "SetWindowsHookEx" ascii
        $s2 = "GetAsyncKeyState" ascii
        $s3 = "GetKeyState" ascii
        $s4 = "MapVirtualKey" ascii
    condition:
        filesize < 50MB and
        2 of them
}

rule embedded_pe {
    meta:
        description = "Detects embedded PE files (possible dropper)"
        severity = "medium"
        author = "TubaBot"
    strings:
        $mz = "MZ" ascii
    condition:
        filesize > 2MB and
        #mz > 1
}

rule suspicious_network_api {
    meta:
        description = "Detects PE files with suspicious network APIs"
        severity = "medium"
        author = "TubaBot"
    strings:
        $s1 = "InternetOpen" ascii
        $s2 = "HttpSendRequest" ascii
        $s3 = "WinHttpSendRequest" ascii
        $s4 = "URLDownloadToFile" ascii
        $s5 = "WSAStartup" ascii
        $s6 = "connect" ascii
    condition:
        filesize < 50MB and
        2 of them
}

rule encrypted_data_blob {
    meta:
        description = "Detects large encrypted data blobs in executables"
        severity = "low"
        author = "TubaBot"
    strings:
        $aes = { 52 53 54 55 56 57 58 59 5A }
    condition:
        filesize > 1MB and
        uint16(0) == 0x5A4D and
        @aes > 0
}