Turla Kazuar v3 VBScript Loader
Detects the initial VBScript loader used in Turla's Kazuar v3 campaign. The loader script (8RWRLT.vbs) is executed via wscript.exe and creates a folder structure mimicking HP printer drivers at %LOCALAPPDATA%\Programs\HP\Printer\Driver. The script downloads multiple files from a remote C2 server including hpbprndi.exe (a legitimate signed HP driver), hpbprndiLOC.dll (the actual Kazuar loader), and encrypted payload files (jayb.dadk, kgjlj.sil, pkrfsu.ldy). The loader uses WinHttp.WinHttpRequest.5.1 COM object to download files while ignoring SSL certificate errors, and establishes persistence by creating a registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. This rule specifically looks for wscript.exe processes with command lines containing both the HP printer driver path and hpbprndi references, which are strong indicators of the Kazuar v3 loader execution.
Sigma
