This rule finds binaries compiled with gscript, a scriptable dropper.

I first encountered this playing CTFs. It is a very nice tool for offensive operations, allowing an attacker to bundle several payloads into one file. This enables attackers to move quickly and deploy a multitude of c2 channels on victim hosts.

Defending against this in a CTF setting was painful because the attackers were re-deploying all of their persistence a few minutes after it was removed by defenders. This led to many situations where we observed attackers utilizing persistence mechanisms that we thought had been removed.

Encountering this malware led me to some really fun research:

• https://github.com/droberson/gokiller
• https://dmfrsecurity.com/2019/11/01/my-never-ending-quest-to-break-gscript/

The next time I ran into gscript, I was able to intercept the payload, reverse engineer it enough to figure out what was being done and deal with it much more effectively.

rule gscript
{
	meta:
		description = "https://github.com/gen0cide/gscript"

	strings:
		$ = "github.com/gen0cide/gscript"

	condition:
		any of them
}

---

YARA Rules Index