65a097fe-6102-446a-9f9c-55dfc3f41101
APT WINNTI Global BFE_Notify_Event_

APT WINNTI Global BFE_Notify_Event_

https://github.com/3vangel1st/Yara/blob/master/APT_WINNTI.yar
1
APT WINNTI Global BFE_Notify_Event_ base

fun fact, the notify events have one extra digit (5,4,6 here) https://github.com/3vangel1st/Yara/blob/master/APT_WINNTI.yar

{
  strings:
    $e1 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii nocase
    $e2 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii nocase
    $e3 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii nocase
    $e4 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
    $e5 = "BFE_Notify_Event_{7D00FA3C-FBDC-4A8D-AEEB-3F55A4890D2A}" nocase
  condition:
    (any of ($e*))
}
0