Add initial detection rule

Signed-off-by: Still Hsu <[email protected]>

linking/static/hp-socket/linked-against-hp-socket.yml

@@ -0,0 +1,30 @@
+rule:
+  meta:
+    name: linked against High-Performance Socket (hp-socket)
+    namespace: linking/static/hp-socket
+    authors:
+      - [email protected]
+    scope: file
+    att&ck:
+      - Command and Control::Non-Application Layer Protocol [T1095]
+    references:
+      - https://github.com/ldcsaa/HP-Socket/
+    examples:
+      - ac204bc653d6e49eea093b01ba3eaa60
+  features:
+    - or:
+      - substring: "HP-Socket for Linux v%d.%d.%d [BN:%02d]"
+      - 3 or more:
+        - substring: "global/helper.cpp"
+        - substring: "src/HttpServer.cpp"
+        - substring: "src/TcpServer.cpp"
+        - substring: "src/common/IODispatcher.cpp"
+        - substring: "src/common/Thread.cpp"
+        - substring: "/HP-Socket/Linux/"
+      # in theory the following should be present for Windows version; untested
+      - 3 or more:
+        - substring: "Client Send Fail [SOCK: %d, SEQ: %d]"
+        - substring: "(%Iu) Send OK -->"
+        - substring: "<%s#%d> OP: %d, CODE: %d (DATA: 0x%X, LEN: %d>"
+        - substring: "---------------> Client Worker Thread 0x%08X stoped <---------------"
+        - substring: "<C-CNNID: %Iu> OnSend() event should not return 'HR_ERROR' !!"