import "pe"

rule JFrog_Artifactory_Rust_Backdoor {
    meta:
        author = "Tia N. List"
        date = "2026-09-12"
        status = "experimental"
        description = "Detects Rust-based backdoor deployed during JFrog Artifactory CVE chain exploitation"
        reference = "https://www.bleepingcomputer.com/"
        falsepositives = "Unknown"

    strings:
        $rust = "GoRust" ascii
        $rust2 = "rust-cargo" ascii nocase
        $artifactory = "artifactory" ascii nocase
        $groovy = "groovy" ascii nocase
        $reverse = "/dev/tcp" ascii
        $reverse2 = "ncat" ascii
        $shell = "/bin/sh" ascii
        $shell2 = "/bin/bash" ascii

    condition:
        uint16(0) == 0x5A4D and
        filesize < 50MB and
        ($rust or $rust2) and
        1 of ($artifactory, $groovy) and
        1 of ($reverse, $reverse2, $shell, $shell2)
}