rule StyleSmuggler_Rust_Backdoor {
    meta:
        author = "Tia N. List"
        date = "2026/09/09"
        status = "experimental"
        description = "Detects the StyleSmuggler Rust-compiled Linux backdoor deployed via CVE-2026-75650 Magento exploitation"
        reference = "https://threat-intelligence.redeyesecurity.com/blog/stylesmuggler-magento-zero-day-cve-2026-75650"
        falsepositives = "Unknown"
    strings:
        $rust1 = "rustc" ascii
        $rust2 = ".cargo" ascii
        $path1 = "/tmp/" ascii
        $path2 = "/var/www/" ascii
        $payload1 = "curl" ascii
        $payload2 = "wget" ascii
        $payload3 = "bash -c" ascii
        $elf = { 7F 45 4C 46 }
    condition:
        $elf at 0 and ($rust1 or $rust2) and ($path1 or $path2) and ($payload1 or $payload2 or $payload3)
}