/*
    Source: research.ohiiho.com/arsenal/damanedz-grabber/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule tool_damanedz_grabber {
    meta:
        description = "DamaneDz Config Grabber — symlink credential harvester"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/damanedz-grabber/"
        status      = "validated"

    strings:
        $damanedz   = "DamaneDz" ascii nocase
        $algeria    = "AlGeria" ascii nocase
        $x00x_dir   = "x00x_configs" ascii
        $x00x_title = "x00x Config" ascii
        $symlink    = "symlink(" ascii
        $htaccess   = ".htaccess" ascii
        $follow     = "FollowSymLinks" ascii
        $satisfy    = "Satisfy Any" ascii

    condition:
        filesize < 20KB
        and (
            ($damanedz or $x00x_dir or $x00x_title or $algeria)
            or ($symlink and $htaccess and ($follow or $satisfy))
        )
}