rule ios_coruna_w3 {
    meta:
        description = "Detects Coruna's gadget function name strings"
        author = "@Nadsec"
        severity = "high"
        source = "https://www.nadsec.online/blog/coruna-technical-analysis"

        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/ios.coruna"
        malpedia_version = "20260319"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $g1 = "enet_allocate_packet_payload_default" ascii
        $g2 = "_autohinter_iterator_begin" ascii
        $g3 = "_autohinter_iterator_end" ascii
        $g4 = "_EdgeInfoCFArrayReleaseCallBack" ascii
        $g5 = "_dlfcn_globallookup" ascii
        $g6 = "xmlHashScanFull" ascii
        $g7 = "CFRunLoopObserverCreateWithHandler" ascii

    condition:
        filesize < 500KB and 3 of them
}