Skip to content

ekfiddle_rules_format.md

Latest commit

 

History

History
84 lines (53 loc) · 4.02 KB

ekfiddle_rules_format.md

File metadata and controls

84 lines (53 loc) · 4.02 KB
Raw

EKFiddle Rules Format

What are EKFiddle Rules

EKFiddle rules are regex-based detection patterns that scan website content, scripts, iframes, CSS, redirects, and response headers to identify malicious indicators. They detect threats including SocGholish, Parrot TDS, ClickFix payloads, fake browser updates, credit card skimmers, and other malware families.

Rules are applied against downloaded content in memory. The scanner decodes obfuscated JavaScript (hex, unicode, base64, string concatenation) before pattern matching to catch evasion attempts.

Rule Format Schema

Each rule follows a tab-separated format:

[Type] TAB [Severity: Rule Name] TAB [Regex Pattern] TAB [Optional Comment]

Fields:

  • Type: Detection category - IP, URI, SourceCode, Headers, or Hash
  • Severity: Optional prefix High:, Med:, or Low: followed by rule name
  • Regex Pattern: Standard regex pattern (Python re syntax)
  • Comment: Optional reference or description (not always present)

Rule Types:

  • IP - Matches IP addresses in URLs or content
  • URI - Matches URL paths and domains
  • SourceCode - Matches patterns in HTML, JavaScript, CSS content
  • Headers - Matches patterns in HTTP response headers
  • Hash - Matches SHA-256 hash values in response body

Severity Levels:

  • High - High confidence malicious indicators
  • Med - Medium confidence suspicious patterns
  • Low - Low confidence monitoring patterns

Examples

Example 1: Parrot TDS Detection (SourceCode)

SourceCode	High: Parrot TDS (ZQXW)	\bzqx[wx]\s*===\s*undefined\b

Detects Parrot TDS traffic distribution system by matching the characteristic zqxw === undefined check in JavaScript source code. High severity indicates confirmed malicious behavior.

Example 2: Malicious Domain Detection (URI)

URI	High: Balada Injector (ET 20240405)	beatifulllhistory\.com|bestresulttostart\.com|bestselllerservice\.com|clickandanalytics\.com|colorschemeas\.com|listwithstats\.com|dataofpages\.com|decentralappps\.com|flyspecialline\.com|getmygateway\.com|getsmallcount\.com|greenfastline\.com|gybritanalytsesystem\.com|lightsteper\.com|lineferaline\.com|linestoget\.com|playerofsunshine\.com|promsmotion\.com|selectchoise\.com|selectofmychoices\.com|specialcraftbox\.com|specialnewspaper\.com|specialtaskevents\.com|stablelightway\.com|startperfectsolutions\.com|statisticplatform\.com|statisticscripts\.com|statisticsong\.com|stratosbody\.com

Matches known malicious domains associated with Balada injector campaigns. URI type scans URL paths and domains extracted from content.

Example 3: Keitaro TDS Header Detection (Headers)

Headers	High: Keitaro TDS Headers	(?i)(?:KEITARO_|X-KEITARO-|K-REDIRECT|K-TARGET|K-LANDING)

Detects Keitaro TDS traffic distribution system by matching custom HTTP headers. Case-insensitive pattern flags TDS infrastructure indicators in response headers.

Example 4: ClickFix MSIEXEC Payload (SourceCode)

SourceCode	High: ClickFix MSIEXEC URL	msiexec\s*[\/\\]i\s*(https?:\/\/[^\s\"\'\<\>\)\]]+)

Extracts MSIEXEC commands with external URLs, indicating ClickFix social engineering campaigns that trick users into executing malicious installers. Captures the full URL for IOC extraction.

Example 5: Obfuscated JavaScript Detection (SourceCode)

SourceCode	High: Obfuscated malicious JS script	(?:const)\s+_?0x[a-fA-F0-9]+\s*=\s*_?0x[a-fA-F0-9]+(?:\s*,\s*_?0x[a-fA-F0-9]+\s*=\s*_?0x[a-fA-F0-9]+){2,}

Detects hex-encoded variable obfuscation patterns common in malicious JavaScript. Matches multiple consecutive hex variable assignments using the _0x prefix pattern.

Rule File Format

Rules are stored in tab-separated text files (typically CustomRegexes.txt or Regex_Rules.txt). Comments start with # or ##. Empty lines are ignored. The scanner auto-detects rule files in the same directory or accepts a custom path via -r flag.

Rules are processed sequentially. Multiple matches per rule are tracked and reported with context including matched content, source location, and severity level.