/*
 * Triaje del componente rdpcIip en el corpus analizado por Lobera.
 * Una coincidencia requiere investigacion. Un resultado negativo no descarta
 * Prometei, componentes empaquetados, otros builds ni cambios de cadenas.
 */
rule Lobera_Prometei_rdpcIip_Triage_202610 : prometei triage
{
    meta:
        author = "Lobera"
        description = "Native rdpcIip artifacts: update archives, WinRM and family markers"
        date = "2026-10-13"
        scope = "Triage; three distinct positive samples; limited benign control corpus"
        sha256_reference = "39b1042a5b02f3925141733c0f78b64f9fae71a37041c6acc9a9a4e70723a0f1"

    strings:
        $archive1 = "x updates1.7z -pxinchao123 -y" ascii
        $archive2 = "x updates2.7z -pxinchao123 -y" ascii
        $wsman = "http://%s:5985/wsman" ascii
        $pdb = "\\walker\\netwalker\\Release\\rdpcIip.pdb" ascii nocase
        $marker = "C:\\windows\\mshlpda32.dll" ascii nocase

    condition:
        uint16(0) == 0x5a4d and
        filesize < 2MB and
        $wsman and
        1 of ($archive*) and
        ($pdb or $marker)
}