Protestware rule

[sergiomarotco]

check my rule for source code:

rule AntiRussianProtestware { meta: custom_title = "Protestware" custom_level = "High" // High, Medium, Low custom_description = "Potentially contains a political slogan and may also contain a backdoor somewhere" strings: $IoC1 = "Украина" nocase $IoC2 = "нетвойне" nocase $IoC3 = "Support Ukraine" nocase $IoC4 = "Россия" nocase $IoC5 = "Харьков" nocase $IoC6 = "Херсон" nocase $IoC7 = "мариуполь" nocase $IoC8 = "война" nocase $IoC9 = "НетПутину" nocase $IoC10 = "mariupol" nocase $IoC11 = "україна" nocase $IoC12 = "Stop War" nocase $IoC13 = "StopWar" nocase $IoC14 = "Ukraine War" nocase $IoC15 = "UkraineWar" nocase $IoC16 = "stands with ukraine" nocase $IoC17 = "нетвойнесУкраиной" nocase $IoC18 = "Russia" nocase $IoC19 = "Путин" nocase $IoC20 = "Stop The War" nocase $IoC21 = "StopTheWar" nocase $IoC22 = "StopRussianAggression" nocase $IoC23 = "Киев" nocase $IoC24 = "No War" nocase $IoC25 = "NoWarWithUkraine" nocase $IoC26 = "UkraineRussie" nocase $IoC27 = "Stand With Ukraine" nocase $IoC28 = "StandWithUkraine" nocase $IoC29 = "Зеленский" nocase $IoC31 = "RussiaUkraineConflict" nocase $IoC32 = "SaveUkraine" nocase $IoC33 = "StopRussia" nocase $IoC34 = "Сумы" nocase $IoC35 = "UkraineInvasion" nocase $IoC36 = "stopputin" nocase $IoC37 = "СлаваУкраїні" nocase $IoC38 = "UkraineRussiaCrisis" nocase $IoC39 = "Гостомель" nocase $IoC40 = "UkraineConflict" nocase $IoC41 = "FlyAway" nocase $IoC42 = "войска" nocase $IoC43 = "ДНР" nocase $IoC44 = "NoWar" nocase $IoC45 = "Одесса" nocase $IoC46 = "Харків" nocase $IoC47 = "Kiev" nocase $IoC48 = "Ukraina" nocase $IoC49 = "России" nocase $IoC50 = "Херсоне" nocase $IoC51 = "путинубийца" nocase $IoC52 = "протесты" nocase $IoC53 = "Donbass" nocase $IoC54 = "нацизм" nocase $IoC55 = "Одеса" nocase $IoC56 = "геноцид" nocase $IoC57 = "europe" nocase $IoC58 = "фашизм" nocase $IoC59 = "Odesa" nocase $IoC60 = "Odessa" nocase $IoC61 = "ЛНР" nocase $IoC62 = "лукашенко" nocase $IoC63 = "Москва" nocase $IoC64 = "IStandWithUkraine" nocase $IoC65 = "Мелитополь" nocase $IoC66 = "невойне" nocase $IoC67 = "СвоихНеБросаем" nocase $IoC68 = "DonbassTragedy" nocase $IoC69 = "See4Yourself" nocase $IoC70 = "Think4Yourself" nocase $IoC71 = "WeRemember" nocase $IoC72 = "IstandwithRussia" nocase $IoC73 = "Novorossiya" nocase $IoC74 = "РаботайтеБратья" nocase $IoC75 = "Welcome2Crimea" nocase $IoC76 = "Crimea" nocase $IoC77 = "CrimeanSpring" nocase $IoC78 = "IStandWithPutin" nocase $IoC79 = "русскиеидут" nocase $IoC80 = "imwithrussia" nocase $IoC81 = "ProudToBeRussian" nocase $IoC82 = "StopPutinNow" nocase $IoC83 = "SlavaUkraini" nocase $IoC84 = "HelpUkraine" nocase $IoC85 = "invaision" nocase $IoC86 = "РоссияБЕЗпутина" nocase $IoC87 = "PutinIsFalling" nocase $IoC88 = "PutinWarCrimes" nocase $IoC89 = "StopWarInUkraine" nocase $IoC90 = "resist" nocase $IoC91 = "SlavaUkrayini" nocase $IoC92 = "FreeBelarus" nocase $IoC93 = "FKPutin" nocase $IoC94 = "FKLukashenko" nocase $IoC95 = "правдаовойне" nocase $IoC96 = "IStandWithZelenskyy" nocase $IoC97 = "PutinWarCriminal" nocase $IoC98 = "ClosetheSkyoverUkraine" nocase $IoC99 = "AdolfPutin" nocase $IoC100 = "PutinHitler" nocase $IoC101 = "RussiaInvadedUkraine" nocase $IoC102 = "WWII" nocase $IoC103 = "nuclearwar" nocase $IoC104 = "санкции" nocase $IoC105 = "бомбит" nocase $IoC106 = "диверсионные" nocase $IoC107 = "Удары" nocase $IoC108 = "армия" nocase $IoC109 = "пиздец" nocase $IoC110 = "мир" nocase $IoC111 = "мирные" nocase $IoC112 = "Путину" nocase $IoC113 = "Украины" nocase $IoC114 = "Россияне" nocase $IoC115 = "АЭС" nocase $IoC116 = "США" nocase $IoC117 = "НАТО" nocase $IoC118 = "Chernihiv" nocase $IoC119 = "Kherson" nocase $IoC120 = "донецк" nocase $IoC121 = "Луганск" nocase $IoC122 = "DearsForPeace" nocase $IoC123 = "МыНеМолчим" nocase $IoC124 = "newsua" nocase $IoC125 = "newsru" nocase $IoC126 = "НетвойнеУкраиныпротивДонбасса" nocase $IoC127 = "санктпетербург" nocase $IoC128 = "зеленський" nocase $IoC129 = "ДаПобеде" nocase $IoC130 = "SWIFT" nocase $IoC131 = "київ" nocase $IoC132 = "тихийпикет" nocase $IoC134 = "russianinvasion" nocase $IoC135 = "Противійни" nocase $IoC136 = "ПУТИН_ВИНОВЕН" nocase $IoC137 = "донбасс" nocase $IoC138 = "EuroMaidan" nocase $IoC139 = "Ирпень" nocase $IoC140 = "беларусь" nocase $IoC141 = "Maidan" nocase $IoC142 = "МойЛуганск" nocase $IoC143 = "StayWithUkraine" nocase $IoC144 = "Zelenskiy" nocase $IoC145 = "НетБезумию" nocase $IoC146 = "питер" nocase $IoC147 = "CoupdEtat" nocase $IoC148 = "бандеровцы" nocase $IoC149 = "всу" nocase $IoC150 = "Кремль" nocase $IoC151 = "BanRussiafromSwift" nocase $IoC152 = "бомбардировки" nocase $IoC153 = "Лавров" nocase $IoC154 = "Rusya" nocase $IoC155 = "АрмияРоссии" nocase $IoC156 = "SanctionRussiaN" nocase $IoC157 = "российское_вторжение" nocase $IoC158 = "ДавайЗаМир" nocase $IoC159 = "НоваяКаховка" nocase $IoC160 = "Irpin" nocase $IoC161 = "worldwar3" nocase $IoC162 = "Moscow" nocase $IoC163 = "переговоры" nocase $IoC164 = "русские" nocase $IoC165 = "ООН" nocase $IoC166 = "Евросоюз" nocase $IoC167 = "путинхуйло" nocase $IoC168 = "терроризм" nocase $IoC169 = "Минобороны" nocase $IoC170 = "WWIII" nocase $IoC171 = "митинг" nocase $IoC172 = "РусскаяВесна" nocase $IoC173 = "DonbassWar" nocase $IoC174 = "янемолчу" nocase $IoC175 = "РоссияУбивает" nocase $IoC176 = "русскийсолдат" nocase $IoC177 = "времяпомогать" nocase $IoC178 = "Шойгу" nocase $IoC179 = "ЗаПрезидента" nocase $IoC180 = "наДонбассевойна8лет" nocase $IoC181 = "МнеНеСтыдно" nocase $IoC182 = "русскиймир" nocase $IoC183 = "россияукраина" nocase $IoC184 = "ЯМыПутин" nocase $IoC185 = "ЕдинаяРоссия" nocase $IoC186 = "DeadRussianSoldiers" nocase $IoC187 = "ВКСРоссии" nocase $IoC188 = "КремлевскиеСМИ" nocase $IoC189 = "Русскиелюди" nocase $IoC190 = "КризиснаДонбассе" nocase $IoC191 = "денацификация" nocase $IoC192 = "Putler" nocase $IoC193 = "русскийТопот" nocase $IoC194 = "россиявставай" nocase $IoC195 = "hack_russia" nocase $IoC196 = "hacker" nocase $IoC197 = "russia-must-be-stopped" nocase $IoC198 = "DDOS" nocase $IoC199 = "warship" nocase $IoC200 = "NoRussian" nocase $IoC201 = "ban-dera" nocase $IoC202 = "stoppropaganda" nocase $IoC203 = "notowar" nocase $IoC204 = "peacenotwar" nocase $IoC205 = "Слава ВСУ" nocase $IoC206 = "https://imgbox.com/KKG4cOJj" nocase $IoC207 = "SlavaUkraine" nocase $IoC208 = "Slava Ukraine" nocase $IoC209 = "motix.com.ua" nocase $IoC210 = "aggressor" nocase $IoC211 = "fascism" nocase $IoC212 = "IT ARMY of Ukraine" nocase $IoC213 = "number_of_errored_responses" nocase $IoC214 = "itarmyofuraine" nocase $IoC215 = "itarmyofukraine2022" nocase $IoC216 = "itARMYofUkraine2022_INT" nocase $IoC217 = "StandWith" nocase condition: 1 of them }