import "hash"
import "elf"

rule VoidLink_Implant_Hash_Conosciuti
{
    meta:
        description = "Rileva i sample noti di VoidLink (implant principali)"
        author = "Basato su Check Point Research IOC"
        date = "2026-01"
    condition:
        uint32(0) == 0x7f454c46 and  // È un file ELF Linux
        filesize < 5MB and
        (
            hash.sha256(0, filesize) == "05eac3663d47a29da0d32f67e10d161f831138e10958dcd88b9dc97038948f69" or
            hash.sha256(0, filesize) == "15cb93d38b0a4bd931434a501d8308739326ce482da5158eb657b0af0fa7ba49" or
            hash.sha256(0, filesize) == "6850788b9c76042e0e29a318f65fceb574083ed3ec39a34bc64a1292f4586b41" or
            hash.sha256(0, filesize) == "6dcfe9f66d3aef1efd7007c588a59f69e5cd61b7a8eca1fb89a84b8ccef13a2b" or
            hash.sha256(0, filesize) == "28c4a4df27f7ce8ced69476cc7923cf56625928a7b4530bc7b484eec67fe3943" or
            hash.sha256(0, filesize) == "e990a39e479e0750d2320735444b6c86cc26822d86a40d37d6e163d0fe058896" or
            hash.sha256(0, filesize) == "4c4201cc1278da615bacf48deef461bf26c343f8cbb2d8596788b41829a39f3f"
        )
}

rule VoidLink_Stringhe_Core
{
    meta:
        description = "Trova le stringhe principali di VoidLink"
        author = "Basato su analisi Check Point"
    strings:
        $s1 = "VoidLink" ascii fullword
        $s2 = "VoidStream" ascii fullword   // nome del protocollo C2
    condition:
        uint32(0) == 0x7f454c46 and
        filesize < 5MB and
        any of them
}

rule VoidLink_Plugin_Sospetti
{
    meta:
        description = "Rileva i plugin / moduli di VoidLink (es. _v3.o)"
        author = "Basato su IOC Check Point"
    strings:
        $p1 = "_v3.o" ascii
        $p2 = "ssh_harvester_stealth" ascii
        $p3 = "port_scan_stealth" ascii
        $p4 = "k8s_privesc" ascii
        $p5 = "docker_escape" ascii
        $p6 = "passwd_dump" ascii
        $p7 = "ld_preload" ascii
    condition:
        uint32(0) == 0x7f454c46 and
        filesize < 2MB and
        any of ($p*)
}