LOKI2 is an old backdoor released in Phrack Magazine in 1997. This tool is still somewhat novel even in 2021, providing a shell over the ICMP protocol.

• http://phrack.org/issues/49/6.html
• http://phrack.org/issues/51/6.html

A few years ago, I read an article that highlighted this tool’s use by the Turla group that piqued my interest. Due to this tool running over ICMP, I figured it would be fun to use in attack/defend CTFs because many players focus too much on TCP and UDP, and completely neglect to monitor ICMP traffic.

rule loki2
{
	meta:
		description = "http://phrack.org/issues/51/6.html"

	strings:
		$a = "lokid: inactive client <%d> expired from list [%d]"
		$b = "[SUPER fatal] control should NEVER fall here"

	condition:
		any of them
}

YARA Rules Index