rule LINUX_POSSIBLE_RAINBOW_TABLE_ARCHIVE
{
  meta:
    author = "defensive"
    description = "Linux: archive/container likely related to rainbow tables (heuristic)"
    severity = "medium"
    fix_notes = "FP fix: 'reduction' sostituito con 'reduction function' (piu' specifico); LM e NTLM ora fullword per evitare match in parole come 'algorithm'"

  strings:
    $kw1 = "rainbow table" nocase ascii
    $kw2 = "rainbowtable" nocase ascii
    $kw3 = "precomputed" nocase ascii
    $kw4 = "chain length" nocase ascii
    $kw5 = "chain count" nocase ascii
    $kw6 = "reduction function" nocase ascii
    $kw7 = "rtgen" nocase ascii
    $kw8 = "rcrack" nocase ascii
    $kw9 = "ophcrack" nocase ascii

    $h1 = "LM" fullword ascii
    $h2 = "NTLM" fullword ascii
    $h3 = "MD5" ascii
    $h4 = "SHA1" ascii
    $h5 = "SHA-1" ascii
    $h6 = "SHA256" ascii
    $h7 = "SHA-256" ascii

    $zip = { 50 4B 03 04 }
    $rar = { 52 61 72 21 1A 07 }
    $7z  = { 37 7A BC AF 27 1C }

  condition:
    (any of ($zip,$rar,$7z)) and
    (2 of ($kw*)) and
    (1 of ($h*)) and
    filesize > 1MB
}