/*
   steamlure WebView2 fake Steam client family (CORD t20261028-2, deep unit).
   Candidate rules; test results in TEST.md. Static markers only.
*/
import "pe"

rule steamlure_wv2_bridge_app
{
    meta:
        description = "Fake Steam login window (x64, WebView2) that loads a remote phishing page and exposes a window.steamm JSON bridge (http.request, fs.readText/writeText, shell.open, win.*)"
        family = "steamlure WebView2 lure"
        reference = "https://0xcaecffd.github.io/cord-reports/reports/2026-10-steam-lure/"
        author = "CORD"
        date = "2026-10-29"
        samples = "10 of 10 g2/g3 builds (2026-09-17 .. 2026-10-19)"
    strings:
        // document-created bridge script (UTF-16 literal in .rdata)
        $b1 = "window.steamm" wide
        $b2 = "__steammHooked" wide
        $b3 = "__steamm_ov" wide
        $b4 = "http.request" wide
        // browser switches that turn off SmartScreen / Safe Browsing inside WebView2
        $a1 = "WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS" wide
        $a2 = "msSmartScreenProtection,msEnhancedSecurityMode,msSafeLinksValidation" wide
        $a3 = "--disable-client-side-phishing-detection" wide
        // JSON-RPC method names compared as 64-bit immediates in the dispatcher
        $m1 = "win.drag"
        $m2 = "win.clos"
        $m3 = "win.resi"
        $m4 = "http.req"
        $m5 = "fs.write"
        $m6 = "fs.readT"
        $e1 = "only http(s) allowed"
        $e2 = "unknown method: "
        $w1 = "SteamWindow" wide
        $w2 = "Steam/1.0" wide
    condition:
        uint16(0) == 0x5A4D and pe.is_64bit() and filesize < 3MB and
        (
            (2 of ($b*) and 1 of ($a*)) or
            (4 of ($m*) and 1 of ($e*)) or
            ($a1 and $a2 and $w1 and $w2)
        )
}

rule steamlure_wv2_c2_url
{
    meta:
        description = "WebView2 lure build that embeds a numeric f1shh.at subdomain /client URL (UTF-16)"
        author = "CORD"
        date = "2026-10-29"
    strings:
        $u = /h\x00t\x00t\x00p\x00s\x00:\x00\/\x00\/\x00([0-9]\x00){9,10}\.\x00f\x001\x00s\x00h\x00h\x00\.\x00a\x00t\x00\/\x00c\x00l\x00i\x00/
    condition:
        uint16(0) == 0x5A4D and $u
}

rule steamlure_wv2_steamui_hijacker
{
    meta:
        description = "SteamUI variant (3d2b12f8): replaces steam.exe, re-points steam:// handler, App Paths and shortcuts, serves a local Steam login UI over WebView2 to a relay kit"
        family = "steamlure WebView2 lure (SteamUI hijacker)"
        reference = "https://0xcaecffd.github.io/cord-reports/reports/2026-10-steam-lure/"
        author = "CORD"
        date = "2026-10-29"
    strings:
        $s1 = "steam.orig.exe" wide
        $s2 = "steam.live.exe" wide
        $s3 = "%s\\SteamUI\\steam.exe" wide
        $s4 = "https://steamui.local/*" wide
        $s5 = "Steam Client Service" wide
        $s6 = "Software\\Classes\\steam\\shell\\open\\command" wide
        $s7 = "__steamUiMounted" wide
        $s8 = "SteamClientWnd" wide
        $j1 = "steam-inject-root"
        $j2 = "parseTokenSecret"
        $j3 = "'DyNaM1c'"
        $j4 = "checkConfirmations"
    condition:
        uint16(0) == 0x5A4D and filesize < 5MB and
        (5 of ($s*) or (3 of ($j*) and 2 of ($s*)))
}