Lab 23: YARA & Sigma Rule Writing for Threat Hunting¶

rule RuleName {
    meta:
        author = "Your Name"
        description = "What this rule detects"
        date = "2026-03-20"
        reference = "URL or report reference"
        severity = "high"
        tlp = "white"
        hash = "SYNTHETIC_HASH_VALUE"

    strings:
        $text_string = "plaintext to match"
        $hex_pattern = { 4D 5A 90 00 }
        $regex_pattern = /regex[0-9]+pattern/

    condition:
        all of them
}

/*
 * Rule: SYNVIPER_Dropper_Stage1
 * Target: First-stage dropper from SYNTHETIC-VIPER campaign
 * All indicators are SYNTHETIC -- not real malware
 * Author: CyberVault SOC (fictional)
 * Date: 2026-03-20
 */

rule SYNVIPER_Dropper_Stage1 : trojan dropper synthetic {
    meta:
        author = "CyberVault SOC"
        description = "Detects SYNTHETIC-VIPER first-stage dropper"
        date = "2026-03-20"
        version = "1.0"
        reference = "INT-2026-0042 (SYNTHETIC)"
        severity = "critical"
        tlp = "amber"
        mitre_attack = "T1566.001, T1204.002"
        hash = "SYNTHETIC_SHA256_aabbccdd11223344"
        filetype = "PE"
        synthetic = "true"

    strings:
        // Text strings -- exact match
        $loader_name = "SyntheticViperLoader" ascii wide

        // C2 domain -- case insensitive
        $c2_domain = "update.synviper.example.com" nocase

        // Dropped filename
        $drop_name = "svchost_update.exe" nocase

        // Configuration marker
        $config_marker = "SVCONFIG_" ascii

        // Hex pattern -- MZ header (PE file)
        $mz_header = { 4D 5A 90 00 03 00 00 00 }

        // Hex pattern with wildcards -- dropper shellcode stub (SYNTHETIC)
        $shellcode_stub = { E8 00 00 00 00 5? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? }

        // Regex -- base64 config block
        $b64_config = /SVCONFIG_[A-Za-z0-9+\/]{20,}={0,2}/

        // Regex -- User-Agent string pattern
        $ua_pattern = /User-Agent:\s*SynViper\/[0-9]+\.[0-9]+/ nocase

    condition:
        // File must start with MZ header
        $mz_header at 0 and

        // File size constraint: 50KB to 500KB
        filesize > 50KB and filesize < 500KB and

        // Must contain the loader name
        $loader_name and

        // Must contain at least 2 of the network/config indicators
        (2 of ($c2_domain, $drop_name, $config_marker, $b64_config, $ua_pattern))
}

rule TextStringExamples : synthetic {
    meta:
        description = "Demonstrates text string modifiers (SYNTHETIC)"
        author = "CyberVault SOC"
        synthetic = "true"

    strings:
        // Basic ASCII string
        $s1 = "malware_config" ascii

        // Wide string (UTF-16LE, common in Windows)
        $s2 = "malware_config" wide

        // Both ASCII and wide
        $s3 = "malware_config" ascii wide

        // Case insensitive
        $s4 = "Content-Type" nocase

        // Full word only (bounded by non-alphanumeric chars)
        $s5 = "cmd" fullword

        // XOR-encoded string (YARA auto-tests all single-byte XOR keys)
        $s6 = "SyntheticViperPayload" xor

        // XOR with specific key range
        $s7 = "SyntheticViperPayload" xor(0x01-0xff)

        // Base64-encoded string (YARA auto-generates standard + URL-safe variants)
        $s8 = "SyntheticViperPayload" base64

        // Base64 with custom alphabet
        $s9 = "SyntheticViperPayload" base64("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_")

    condition:
        any of them
}

rule HexStringExamples : synthetic {
    meta:
        description = "Demonstrates hex string patterns (SYNTHETIC)"
        author = "CyberVault SOC"
        synthetic = "true"

    strings:
        // Exact byte sequence
        $h1 = { 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 }

        // Wildcards -- ?? matches any byte
        $h2 = { 4D 5A ?? ?? 03 00 ?? 00 }

        // Nibble wildcards -- ?0 matches any byte ending in 0
        $h3 = { 4D 5A ?0 00 }

        // Jumps -- [min-max] bytes between patterns
        $h4 = { E8 00 00 00 00 [4-8] 89 ?? 24 }

        // Alternatives -- (AA|BB|CC)
        $h5 = { 4D 5A ( 90 | 00 | 50 ) 00 }

        // Unbounded jump
        $h6 = { 68 ?? ?? ?? ?? [0-100] FF 15 ?? ?? ?? ?? }

    condition:
        any of them
}

rule RegexExamples : synthetic {
    meta:
        description = "Demonstrates regex patterns (SYNTHETIC)"
        author = "CyberVault SOC"
        synthetic = "true"

    strings:
        // IP address pattern (RFC 5737 ranges)
        $r1 = /192\.0\.2\.\d{1,3}/

        // URL pattern
        $r2 = /https?:\/\/[a-z0-9\-]+\.synviper\.example\.com\/[a-z0-9\/]+/i

        // Base64-encoded command
        $r3 = /[A-Za-z0-9+\/]{40,}={0,2}/

        // Windows path pattern
        $r4 = /[A-Z]:\\(Windows|Users|Temp)\\[^\s]{5,50}\.exe/i

        // Registry key pattern
        $r5 = /HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\[A-Za-z0-9_]+/

    condition:
        any of them
}

rule SYNVIPER_Dropper_Optimized : trojan dropper synthetic {
    meta:
        author = "CyberVault SOC"
        description = "Optimized detection for SYNTHETIC-VIPER dropper"
        date = "2026-03-20"
        version = "2.0"
        synthetic = "true"

    strings:
        $mz = { 4D 5A }
        $loader = "SyntheticViperLoader" ascii wide
        $c2 = "update.synviper.example.com" nocase
        $drop = "svchost_update.exe" nocase
        $config = "SVCONFIG_" ascii

    condition:
        // Fast checks first (filesize, magic bytes)
        filesize > 50KB and filesize < 500KB and
        $mz at 0 and

        // Then string matches (more expensive)
        $loader and

        // Threshold for network indicators
        1 of ($c2, $drop, $config)
}

rule SYNVIPER_MacroDoc : maldoc dropper synthetic {
    meta:
        author = "CyberVault SOC"
        description = "Detects SYNTHETIC-VIPER macro-laden document dropper"
        date = "2026-03-20"
        version = "1.0"
        reference = "INT-2026-0042 (SYNTHETIC)"
        severity = "high"
        mitre_attack = "T1566.001, T1059.001, T1204.002"
        synthetic = "true"

    strings:
        // OLE magic bytes
        $ole_magic = { D0 CF 11 E0 A1 B1 1A E1 }

        // VBA macro indicators
        $vba_autoopen = "AutoOpen" ascii wide nocase
        $vba_shell = "Shell" ascii wide fullword
        $vba_wscript = "WScript" ascii wide nocase
        $vba_createobj = "CreateObject" ascii wide nocase

        // Download URL
        $dl_url = "dl.synviper.example.com" nocase

        // PowerShell invocation (case-insensitive to catch obfuscation)
        $ps_invoke = "powershell" nocase
        $ps_enc = "-EncodedCommand" nocase
        $ps_bypass = "-ExecutionPolicy" nocase

        // Obfuscation indicators
        $obf_concat = "Chr(" ascii wide
        $obf_replace = ".Replace(" ascii wide

    condition:
        // OLE file format
        $ole_magic at 0 and

        // File size constraint
        filesize > 100KB and filesize < 5MB and

        // Must have VBA auto-execution
        $vba_autoopen and

        // Must have at least 1 execution method
        1 of ($vba_shell, $vba_wscript, $vba_createobj) and

        // Must have download URL or PowerShell execution
        ($dl_url or 2 of ($ps_invoke, $ps_enc, $ps_bypass)) and

        // Bonus: obfuscation indicators reduce false positives
        1 of ($obf_concat, $obf_replace)
}

import "pe"
import "math"
import "hash"

rule SYNVIPER_PackedDropper : packed packer synthetic {
    meta:
        author = "CyberVault SOC"
        description = "Detects UPX-packed SYNTHETIC-VIPER dropper via PE anomalies"
        date = "2026-03-20"
        version = "1.0"
        reference = "INT-2026-0042 (SYNTHETIC)"
        severity = "high"
        mitre_attack = "T1027.002"
        synthetic = "true"

    strings:
        // UPX packer signatures (SYNTHETIC context)
        $upx0 = "UPX0" ascii fullword
        $upx1 = "UPX1" ascii fullword
        $upx2 = "UPX!" ascii fullword

        // Anti-analysis strings
        $anti_debug = "IsDebuggerPresent" ascii
        $anti_vm_1 = "VMwareService" ascii nocase
        $anti_vm_2 = "VBoxService" ascii nocase
        $anti_sandbox = "SbieDll" ascii

    condition:
        // Must be a PE file
        uint16(0) == 0x5A4D and

        // PE signature present
        uint32(uint32(0x3C)) == 0x00004550 and

        // File size constraint
        filesize > 30KB and filesize < 2MB and

        // UPX packer indicators
        1 of ($upx*) and

        // PE anomalies indicating packing:
        (
            // 1. High entropy in first section (packed data)
            math.entropy(pe.sections[0].offset, pe.sections[0].raw_data_size) > 7.0 or

            // 2. Section name anomalies (UPX sections)
            pe.sections[0].name == "UPX0" or
            pe.sections[0].name == "UPX1" or

            // 3. Virtual size much larger than raw size (decompression)
            pe.sections[0].virtual_size > pe.sections[0].raw_data_size * 5
        ) and

        // Anti-analysis techniques (optional but high-confidence)
        1 of ($anti_debug, $anti_vm_1, $anti_vm_2, $anti_sandbox)
}

import "pe"

rule SYNVIPER_SuspiciousImports : suspicious imports synthetic {
    meta:
        author = "CyberVault SOC"
        description = "Detects PE files with suspicious API import combinations"
        date = "2026-03-20"
        version = "1.0"
        severity = "medium"
        mitre_attack = "T1055, T1027"
        synthetic = "true"

    condition:
        uint16(0) == 0x5A4D and
        filesize < 5MB and

        // Process injection imports
        (
            pe.imports("kernel32.dll", "VirtualAllocEx") and
            pe.imports("kernel32.dll", "WriteProcessMemory") and
            pe.imports("kernel32.dll", "CreateRemoteThread")
        )
        or
        // Credential theft imports
        (
            pe.imports("advapi32.dll", "OpenProcessToken") and
            pe.imports("advapi32.dll", "LookupPrivilegeValueA") and
            pe.imports("advapi32.dll", "AdjustTokenPrivileges")
        )
        or
        // Keylogging imports
        (
            pe.imports("user32.dll", "SetWindowsHookExA") and
            pe.imports("user32.dll", "GetAsyncKeyState")
        )
        or
        // Network exfiltration imports
        (
            pe.imports("wininet.dll", "InternetOpenA") and
            pe.imports("wininet.dll", "InternetConnectA") and
            pe.imports("wininet.dll", "HttpSendRequestA")
        )
}

import "math"
import "pe"

rule HighEntropy_Executable : packed entropy synthetic {
    meta:
        author = "CyberVault SOC"
        description = "Detects PE files with abnormally high entropy (potential packing)"
        date = "2026-03-20"
        version = "1.0"
        severity = "medium"
        mitre_attack = "T1027.002"
        synthetic = "true"

    condition:
        // Must be a PE file
        uint16(0) == 0x5A4D and

        // Overall file entropy > 7.2 (out of 8.0 maximum)
        // Normal executables: 5.0-6.5
        // Packed/encrypted: 7.0-7.99
        math.entropy(0, filesize) > 7.2 and

        // File size between 10KB and 10MB
        filesize > 10KB and filesize < 10MB
}

rule HighEntropy_Section : packed entropy synthetic {
    meta:
        author = "CyberVault SOC"
        description = "Detects PE with high-entropy sections (common in packed malware)"
        date = "2026-03-20"
        version = "1.0"
        severity = "medium"
        mitre_attack = "T1027.002"
        synthetic = "true"

    condition:
        uint16(0) == 0x5A4D and
        filesize < 10MB and

        // Check if ANY section has entropy above 7.5
        for any section in pe.sections : (
            math.entropy(section.offset, section.raw_data_size) > 7.5 and
            section.raw_data_size > 1024  // Ignore tiny sections
        )
}

import "pe"

rule SYNVIPER_Cryptominer : miner cryptominer synthetic {
    meta:
        author = "CyberVault SOC"
        description = "Detects XMRig-based cryptominer deployed by SYNTHETIC-VIPER"
        date = "2026-03-20"
        version = "1.0"
        reference = "INT-2026-0042 (SYNTHETIC)"
        severity = "high"
        mitre_attack = "T1496"
        synthetic = "true"

    strings:
        // XMRig identification strings
        $xmrig_1 = "xmrig" ascii wide nocase
        $xmrig_2 = "XMRig" ascii wide
        $xmrig_3 = "mining" ascii wide nocase fullword

        // Stratum mining protocol
        $stratum_1 = "stratum+tcp://" ascii nocase
        $stratum_2 = "stratum+ssl://" ascii nocase
        $stratum_3 = "stratum+tls://" ascii nocase

        // Synthetic mining pool (FICTIONAL -- not a real pool)
        $pool_1 = "pool.synmine.example.com" ascii nocase
        $pool_2 = "mine.darkpool.example.com" ascii nocase

        // Mining algorithm identifiers
        $algo_1 = "randomx" ascii nocase
        $algo_2 = "cryptonight" ascii nocase
        $algo_3 = "cn/r" ascii nocase
        $algo_4 = "rx/0" ascii nocase

        // Synthetic wallet address (NOT a real Monero address)
        $wallet = "SYNTHETIC_WALLET_4AdUndXHHZ" ascii

        // Configuration keywords
        $cfg_threads = "\"threads\"" ascii
        $cfg_intensity = "\"intensity\"" ascii
        $cfg_donate = "\"donate-level\"" ascii
        $cfg_coin = "\"coin\"" ascii

        // JSON-RPC mining methods
        $jsonrpc_login = "\"method\":\"login\"" ascii
        $jsonrpc_submit = "\"method\":\"submit\"" ascii
        $jsonrpc_getjob = "\"method\":\"getjob\"" ascii

        // CPU feature detection (miners optimize for CPU)
        $cpu_aes = "aes-ni" ascii nocase
        $cpu_avx = "avx2" ascii nocase
        $cpu_sse = "sse4" ascii nocase

    condition:
        // Can be PE or ELF
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and

        filesize > 500KB and filesize < 20MB and

        // Must have XMRig identifiers
        1 of ($xmrig_*) and

        // Must have mining protocol or pool reference
        (1 of ($stratum_*) or 1 of ($pool_*)) and

        // Must have algorithm reference
        1 of ($algo_*) and

        // Should have configuration or JSON-RPC indicators
        (2 of ($cfg_*) or 1 of ($jsonrpc_*))
}

rule SYNVIPER_PHPWebshell : webshell php backdoor synthetic {
    meta:
        author = "CyberVault SOC"
        description = "Detects PHP webshell variants deployed by SYNTHETIC-VIPER"
        date = "2026-03-20"
        version = "1.0"
        reference = "INT-2026-0042 (SYNTHETIC)"
        severity = "critical"
        mitre_attack = "T1505.003"
        synthetic = "true"

    strings:
        // PHP opening tags
        $php_open_1 = "<?php" ascii nocase
        $php_open_2 = "<?" ascii

        // Dangerous function calls (command execution)
        $exec_1 = "system(" ascii nocase
        $exec_2 = "exec(" ascii nocase
        $exec_3 = "shell_exec(" ascii nocase
        $exec_4 = "passthru(" ascii nocase
        $exec_5 = "popen(" ascii nocase
        $exec_6 = "proc_open(" ascii nocase
        $exec_7 = "pcntl_exec(" ascii nocase
        $exec_8 = "assert(" ascii nocase

        // Code evaluation functions
        $eval_1 = "eval(" ascii nocase
        $eval_2 = "preg_replace" ascii nocase   // with /e modifier
        $eval_3 = "create_function(" ascii nocase
        $eval_4 = "call_user_func(" ascii nocase
        $eval_5 = "call_user_func_array(" ascii nocase

        // Obfuscation indicators
        $obf_1 = "base64_decode(" ascii nocase
        $obf_2 = "gzinflate(" ascii nocase
        $obf_3 = "gzuncompress(" ascii nocase
        $obf_4 = "str_rot13(" ascii nocase
        $obf_5 = "rawurldecode(" ascii nocase
        $obf_6 = "hex2bin(" ascii nocase
        $obf_7 = "chr(" ascii nocase

        // File manipulation
        $file_1 = "file_put_contents(" ascii nocase
        $file_2 = "file_get_contents(" ascii nocase
        $file_3 = "fwrite(" ascii nocase
        $file_4 = "move_uploaded_file(" ascii nocase

        // Network operations
        $net_1 = "fsockopen(" ascii nocase
        $net_2 = "curl_exec(" ascii nocase
        $net_3 = "stream_socket_client(" ascii nocase

        // Authentication bypass indicators
        $auth_1 = "$_POST[" ascii
        $auth_2 = "$_GET[" ascii
        $auth_3 = "$_REQUEST[" ascii
        $auth_4 = "$_COOKIE[" ascii

        // Common webshell signatures
        $sig_1 = "FilesMan" ascii nocase
        $sig_2 = "b374k" ascii nocase
        $sig_3 = "c99shell" ascii nocase
        $sig_4 = "r57shell" ascii nocase
        $sig_5 = "WSO " ascii nocase
        $sig_6 = "webshell" ascii nocase

        // SYNTHETIC-VIPER specific indicators
        $sv_marker = "SYNVIPER_SHELL" ascii
        $sv_auth = "sv_auth_key" ascii nocase
        $sv_c2 = "shell.synviper.example.com" ascii nocase

    condition:
        // Must start with PHP tag
        (1 of ($php_open_*)) and

        // File is small (typical webshell size)
        filesize < 500KB and

        (
            // Pattern 1: eval + obfuscation (classic obfuscated webshell)
            (1 of ($eval_*) and 2 of ($obf_*)) or

            // Pattern 2: Command execution + user input
            (1 of ($exec_*) and 1 of ($auth_*)) or

            // Pattern 3: Known webshell signature
            1 of ($sig_*) or

            // Pattern 4: SYNTHETIC-VIPER specific
            1 of ($sv_*) or

            // Pattern 5: File operations + network + obfuscation
            (1 of ($file_*) and 1 of ($net_*) and 1 of ($obf_*))
        )
}

import "pe"
import "math"

rule SYNVIPER_CobaltStrike_Beacon : apt c2 cobaltstrike synthetic {
    meta:
        author = "CyberVault SOC"
        description = "Detects Cobalt Strike beacon with SYNTHETIC-VIPER malleable C2 profile"
        date = "2026-03-20"
        version = "1.0"
        reference = "INT-2026-0042 (SYNTHETIC)"
        severity = "critical"
        mitre_attack = "T1071.001, T1573.002"
        synthetic = "true"

    strings:
        // Cobalt Strike default strings (commonly present even in customized beacons)
        $cs_1 = "beacon.dll" ascii wide
        $cs_2 = "beacon.x64.dll" ascii wide
        $cs_3 = "%s as %s\\%s: %d" ascii
        $cs_4 = "Started service %s on %s" ascii
        $cs_5 = "%s (admin)" ascii
        $cs_6 = "could not spawn %s: %d" ascii
        $cs_7 = "Could not connect to pipe" ascii
        $cs_8 = "IEX (New-Object Net.Webclient).DownloadString" ascii

        // Named pipe patterns (synthetic)
        $pipe_1 = "\\\\.\\pipe\\MSSE-" ascii
        $pipe_2 = "\\\\.\\pipe\\msagent_" ascii
        $pipe_3 = "\\\\.\\pipe\\synviper_" ascii

        // Configuration block indicators
        // Cobalt Strike config is typically XOR-encoded in .data or .rdata
        $config_magic = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? }

        // Malleable C2 profile indicators (SYNTHETIC)
        $c2_uri_1 = "/api/v2/status" ascii
        $c2_uri_2 = "/cdn/jquery.min.js" ascii
        $c2_uri_3 = "/updates/check" ascii

        // SYNTHETIC-VIPER C2 domains
        $c2_domain_1 = "cdn.synviper.example.com" ascii nocase
        $c2_domain_2 = "api.synviper.example.com" ascii nocase
        $c2_domain_3 = "update.synviper.example.com" ascii nocase

        // Sleep/jitter configuration (decompiled)
        $sleep_pattern = { 68 ?? ?? 00 00 [0-10] 68 ?? 00 00 00 [0-10] E8 }

        // Reflective loader signatures
        $reflective_1 = "ReflectiveLoader" ascii
        $reflective_2 = { 4D 5A 41 52 55 48 89 E5 }  // MZARUH.. (x64 reflective)

        // Process injection indicators
        $inject_1 = "ntdll.dll" ascii wide
        $inject_2 = "NtQueueApcThread" ascii
        $inject_3 = "RtlCreateUserThread" ascii

    condition:
        // PE file
        uint16(0) == 0x5A4D and
        filesize > 10KB and filesize < 5MB and

        (
            // Pattern 1: Classic beacon DLL with config block
            (2 of ($cs_*) and $config_magic) or

            // Pattern 2: Named pipes + C2 URIs
            (1 of ($pipe_*) and 1 of ($c2_uri_*)) or

            // Pattern 3: SYNTHETIC-VIPER specific C2
            (1 of ($c2_domain_*) and (1 of ($cs_*) or 1 of ($reflective_*))) or

            // Pattern 4: Reflective loader + injection + C2
            (1 of ($reflective_*) and 1 of ($inject_*) and 1 of ($c2_uri_*, $c2_domain_*)) or

            // Pattern 5: High confidence -- multiple CS indicators
            4 of ($cs_*)
        )
}

/*
 * SYNTHETIC-VIPER Campaign Rule Set
 * File: synviper_campaign.yar
 *
 * Includes all detection rules for the SYNTHETIC-VIPER threat actor.
 * All indicators are 100% SYNTHETIC.
 *
 * Usage:
 *   yara -r synviper_campaign.yar /path/to/scan/
 */

// Import shared modules
import "pe"
import "math"
import "hash"

// Include individual rule files
include "synviper_dropper_stage1.yar"
// (In production, each rule would be in its own file)

// Master rule -- combines multiple detections for high confidence
rule SYNVIPER_Campaign_Any : apt campaign synthetic {
    meta:
        author = "CyberVault SOC"
        description = "Matches ANY SYNTHETIC-VIPER campaign component"
        date = "2026-03-20"
        version = "1.0"
        severity = "critical"
        synthetic = "true"

    condition:
        SYNVIPER_Dropper_Stage1 or
        SYNVIPER_PackedDropper or
        SYNVIPER_Cryptominer or
        SYNVIPER_PHPWebshell or
        SYNVIPER_CobaltStrike_Beacon
}

import "pe"
import "math"
import "dotnet"

rule SYNVIPER_DotNet_Packed : packed dotnet synthetic {
    meta:
        author = "CyberVault SOC"
        description = "Detects packed .NET assemblies used by SYNTHETIC-VIPER"
        date = "2026-03-20"
        version = "1.0"
        severity = "high"
        mitre_attack = "T1027.002"
        synthetic = "true"

    strings:
        // .NET runtime indicators
        $dotnet_1 = "_CorExeMain" ascii
        $dotnet_2 = "mscoree.dll" ascii nocase
        $dotnet_3 = "#Strings" ascii
        $dotnet_4 = "#GUID" ascii
        $dotnet_5 = "#Blob" ascii

        // Common .NET obfuscator artifacts
        $obf_1 = "ConfuserEx" ascii wide nocase
        $obf_2 = "Dotfuscator" ascii wide nocase
        $obf_3 = "SmartAssembly" ascii wide nocase
        $obf_4 = "Eazfuscator" ascii wide nocase
        $obf_5 = "Babel" ascii wide nocase

        // Suspicious method names (reflection-based execution)
        $reflect_1 = "Assembly.Load" ascii wide
        $reflect_2 = "Invoke(" ascii wide
        $reflect_3 = "GetMethod(" ascii wide
        $reflect_4 = "DynamicInvoke" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        filesize > 20KB and filesize < 3MB and

        // .NET PE file
        pe.imports("mscoree.dll", "_CorExeMain") and

        // High entropy (packed)
        for any section in pe.sections : (
            math.entropy(section.offset, section.raw_data_size) > 7.0 and
            section.raw_data_size > 2048
        ) and

        // .NET metadata present
        2 of ($dotnet_*) and

        // Obfuscation or reflective loading
        (1 of ($obf_*) or 2 of ($reflect_*))
}