CVE-2020-0601 'CurveBall' Exploit Detection

This rule detects files that exploit CVE-2020-0601, a spoofing vulnerability in Windows CryptoAPI (Crypt32.dll). The rule specifically looks for the presence of a particular Object Identifier (OID) for prime explicit curve parameters and a set of known Elliptic Curve Cryptography (ECC) public keys within a Portable Executable (PE) file that also has a digital signature. This combination of indicators is characteristic of the 'CurveBall' exploit, which leverages the vulnerability to spoof code-signing certificates.