rule ios_coruna_w0 {
    meta:
        description = "Detects Coruna's characteristic XOR string decoding pattern"
        author = "@Nadsec"
        severity = "critical"
        reference = "Coruna iOS/macOS exploit framework"
        source = "https://www.nadsec.online/blog/coruna-technical-analysis"

        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/ios.coruna"
        malpedia_version = "20260319"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $xor_pattern = /\[\d{1,3}(,\s*\d{1,3}){5,}\]\.map\(x\s*=>\s*\{\s*return\s+String\.fromCharCode\(x\s*\^\s*\d{1,3}\);\s*\}\)\.join\(""\)/ ascii

    condition:
        filesize < 500KB and #xor_pattern > 5
}