YARA Detection Rule: Win32_Exploit_CVE20200601
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Yara rule that detects CVE-2020-0601 exploit.
Author: ReversingLabs

Pattern signatures:
$oid_prime_explicit = {
            06 07 2A 86 48 CE 3D 01 01
        }

        $ecc_public_key_1 = {
            04 47 45 0E 96 FB 7D 5D BF E9 39 D1 21 F8 9F 0B
            B6 D5 7B 1E 92 3A 48 59 1C F0 62 31 2D C0 7A 28
            FE 1A A7 5C B3 B6 CC 97 E7 45 D4 58 FA D1 77 6D
            43 A2 C0 87 65 34 0A 1F 7A DD EB 3C 33 A1 C5 9D
            4D A4 6F 41 95 38 7F C9 1E 84 EB D1 9E 49 92 87
            94 87 0C 3A 85 4A 66 9F 9D 59 93 4D 97 61 06 86
            4A
        }

        $ecc_public_key_2 = {
            04 84 13 C9 D0 BA 6D 41 7B E2 6C D0 EB 55 5F 66
            02 1A 24 F4 5B 89 69 47 E3 B8 C2 7D F1 F2 02 C5
            9F A0 F6 5B D5 8B 06 19 86 4F 53 10 6D 07 24 27
            A1 A0 F8 D5 47 19 61 4C 7D CA 93 27 EA 74 0C EF
            6F 96 09 FE 63 EC 70 5D 36 AD 67 77 AE C9 9D 7C
            55 44 3A A2 63 51 1F F5 E3 62 D4 A9 47 07 3E CC
            20
        }

        $ecc_public_key_3 = {
            04 A7 56 7A 7C 52 DA 64 9B 0E 2D 5C D8 5E AC 92
    

Detection condition:
uint16(0) == 0x5A4D and
        (
            $oid_prime_explicit
        ) and
        (
            any of ($ecc_public_key_*)
        ) and
        (
            pe.number_of_signatures > 0
        )

Full rule:
rule Win32_Exploit_CVE20200601 : tc_detection malicious
{
    meta:

        author              = "ReversingLabs"

        source              = "ReversingLabs"
        status              = "RELEASED"
        sharing             = "TLP:WHITE"
        category            = "EXPLOIT"
        exploit             = "CVE-2020-0601"
        description         = "Yara rule that detects CVE-2020-0601 exploit."

        tc_detection_type   = "Exploit"
        tc_detection_name   = "CVE-2020-0601"
        tc_detection_factor = 5

    strings:

        $oid_prime_explicit = {
            06 07 2A 86 48 CE 3D 01 01
        }

        $ecc_public_key_1 = {
            04 47 45 0E 96 FB 7D 5D BF E9 39 D1 21 F8 9F 0B
            B6 D5 7B 1E 92 3A 48 59 1C F0 62 31 2D C0 7A 28
            FE 1A A7 5C B3 B6 CC 97 E7 45 D4 58 FA D1 77 6D
            43 A2 C0 87 65 34 0A 1F 7A DD EB 3C 33 A1 C5 9D
            4D A4 6F 41 95 38 7F C9 1E 84 EB D1 9E 49 92 87
            94 87 0C 3A 85 4A 66 9F 9D 59 93 4D 97 61 06 86
            4A
        }

        $ecc_public_key_2 = {
            04 84 13 C9 D0 BA 6D 41 7B E2 6C D0 EB 55 5F 66
            02 1A 24 F4 5B 89 69 47 E3 B8 C2 7D F1 F2 02 C5
            9F A0 F6 5B D5 8B 06 19 86 4F 53 10 6D 07 24 27
            A1 A0 F8 D5 47 19 61 4C 7D CA 93 27 EA 74 0C EF
            6F 96 09 FE 63 EC 70 5D 36 AD 67 77 AE C9 9D 7C
            55 44 3A A2 63 51 1F F5 E3 62 D4 A9 47 07 3E CC
            20
        }

        $ecc_public_key_3 = {
            04 A7 56 7A 7C 52 DA 64 9B 0E 2D 5C D8 5E AC 92
            3D FE 01 E6 19 4A 3D 14 03 4B FA 60 27 20 D9 83
            89 69 FA 54 C6 9A 18 5E 55 2A 64 DE 06 F6 8D 4A
            3B AD 10 3C 65 3D 90 88 04 89 E0 30 61 B3 AE 5D
            01 A7 7B DE 7C B2 BE CA 65 61 00 86 AE DA 8F 7B
            D0 89 AD 4D 1D 59 9A 41 B1 BC 47 80 DC 9E 62 C3
            F9
        }

        $ecc_public_key_4 = {
            04 CD 0F 5B 56 82 DF F0 45 1A D6 AD F7 79 F0 1D
            C9 AC 96 D6 9E 4E 9C 1F B