rule LINUX_MEM_RAINBOW_TOOL_RUNTIME
{
  meta:
    author = "defensive"
    description = "Linux memory: runtime strings indicating rainbow table tool execution"
    severity = "high"
    fix_notes = "FP fix: rimossa $e1='.rt' (troppo breve e generica), condizione ora richiede .rtc o .rti che sono estensioni specifiche dei file rainbow table"

  strings:
    $s1 = "rtgen" nocase ascii
    $s2 = "rcrack" nocase ascii
    $s3 = "rtsort" nocase ascii
    $s4 = "ophcrack" nocase ascii
    $s5 = "load tables" nocase ascii
    $s6 = "table path" nocase ascii
    $s7 = "chain length" nocase ascii
    $s8 = "chain count" nocase ascii
    $s9 = "reduction" nocase ascii

    $h1 = "NTLM" ascii
    $h2 = "LM" ascii
    $h3 = "MD5" ascii
    $h4 = "SHA1" ascii
    $h5 = "SHA-1" ascii

    $e2 = ".rtc" ascii
    $e3 = ".rti" ascii

  condition:
    (1 of ($s1,$s2,$s3,$s4)) and
    (2 of ($s5,$s6,$s7,$s8,$s9)) and
    (1 of ($h*)) and
    (1 of ($e2,$e3))
}