suspicious-extensions-rce.yaml

id: suspicious-extensions-rce

info:
  name: Suspicious File Extensions - Potential RCE
  author: Nullenc0de
  severity: medium
  description: Detects files with potentially suspicious extensions that could be used for Remote Code Execution (RCE). Scan your AppData folder.

file:
  - extensions:
      - exe
      - bat
      - cmd
      - ps1
      - vbs
      - wsf
      - hta
      - jar
      - py
      - rb
      - pl

    matchers-condition: or
    matchers:
      - type: regex
        regex:
          - '(?i)(system|exec|eval|shellexec|wscript\.shell|scriptcontrol|msxml2\.xmlhttp|adodb\.stream|powershell)'
        part: body

      - type: regex
        regex:
          - '(?i)(download|http|ftp|socket|net\.webclient|invoke-webrequest)'
        part: body

      - type: regex
        regex:
          - '(?i)(bypass|encodedcommand|-enc|-w hidden|-windowstyle hidden)'
        part: path

      # New matcher for batch file commands
      - type: regex
        regex:
          - '(?i)(call|start|cmd|powershell|wscript|cscript)'
        part: body

    extractors:
      - type: regex
        name: suspicious_file
        regex:
          - '.*\.(exe|bat|cmd|ps1|vbs|wsf|hta|jar|py|rb|pl)$'
        part: path

      - type: regex
        name: suspicious_content
        regex:
          - '(?i)(system|exec|eval|shellexec|wscript\.shell|scriptcontrol|msxml2\.xmlhttp|adodb\.stream|powershell|download|http|ftp|socket|net\.webclient|invoke-webrequest|call|start|cmd)'
        part: body