rule elf_ancient_w1 {
    meta:
        description = "Ancient (ANCT) IoT bot ELF: persistence modules (home_persist, cron_deb, android_rc, rc_local), sysd init script and sys.service unit, toybox/busybox download chain. C2 is built at runtime, so the rule keys on the persistence layer."
        author = "KSI Digital"
        date = "2026-10-07"
        reference = "https://github.com/ksi-digital/threat-research/tree/main/ancient-botnet"
        tlp = "clear"
        yarahub_uuid = "89d356dd-326c-4817-9c03-6f0c476fd227"
        yarahub_license = "CC BY 4.0"
        yarahub_rule_matching_tlp = "TLP:WHITE"
        yarahub_rule_sharing_tlp = "TLP:WHITE"
        yarahub_reference_md5 = "48f7e7cbb8fb3d869ea10c167d882780"
        yarahub_reference_link = "https://github.com/ksi-digital/threat-research/tree/main/ancient-botnet"
        malpedia_family = "elf.ancient"

        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.ancient"
        malpedia_version = "20261007"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $p1 = "home_persist" ascii
        $p2 = "cron_deb" ascii
        $p3 = "android_rc" ascii
        $p4 = "rc_local" ascii
        $s1 = "/etc/init.d/sysd" ascii
        $s2 = "# Provides: sysd" ascii
        $s3 = "/etc/profile.d/sys.sh" ascii
        $s4 = "sys-daemon.sh" ascii
        $s5 = "/.config/systemd/user/sys.service" ascii
        $s6 = "Description=System Service" ascii
        $d1 = "(toybox wget -O %s %s || busybox wget -O %s %s" ascii
        $d2 = "cp -f %s %s.new >/dev/null 2>&1 && chmod 777 %s.new" ascii
    condition:
        uint32(0) == 0x464c457f and filesize < 3MB and
        3 of ($p*) and 3 of ($s*) and 1 of ($d*)
}