deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Simple_PHP_BackDooR
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file Simple_PHP_BackDooR.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "<hr>to browse go to http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=[directory he"
		$s6 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fn"
		$s9 = "// a simple php backdoor"

Detection condition:
1 of them

Full rule:
rule Simple_PHP_BackDooR {
	meta:
		description = "Webshells Auto-generated - file Simple_PHP_BackDooR.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "a401132363eecc3a1040774bec9cb24f"
	strings:
		$s0 = "<hr>to browse go to http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=[directory he"
		$s6 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fn"
		$s9 = "// a simple php backdoor"
	condition:
		1 of them
}
YARA Detection Rule: sig_2005Gray
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file 2005Gray.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "SCROLLBAR-FACE-COLOR: #e8e7e7;"
		$s4 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
		$s8 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
		$s9 = "SCROLLBAR-3DLIGHT-COLOR: #cccccc;"

Detection condition:
all of them

Full rule:
rule sig_2005Gray {
	meta:
		description = "Webshells Auto-generated - file 2005Gray.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "75dbe3d3b70a5678225d3e2d78b604cc"
	strings:
		$s0 = "SCROLLBAR-FACE-COLOR: #e8e7e7;"
		$s4 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
		$s8 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
		$s9 = "SCROLLBAR-3DLIGHT-COLOR: #cccccc;"
	condition:
		all of them
}
YARA Detection Rule: DllInjection
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file DllInjection.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "\\BDoor\\DllInjecti"

Detection condition:
all of them

Full rule:
rule DllInjection {
	meta:
		description = "Webshells Auto-generated - file DllInjection.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "a7b92283a5102886ab8aee2bc5c8d718"
	strings:
		$s0 = "\\BDoor\\DllInjecti"
	condition:
		all of them
}
YARA Detection Rule: Mithril_v1_45_Mithril
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file Mithril.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "cress.exe"
		$s7 = "\\Debug\\Mithril."

Detection condition:
all of them

Full rule:
rule Mithril_v1_45_Mithril {
	meta:
		description = "Webshells Auto-generated - file Mithril.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "f1484f882dc381dde6eaa0b80ef64a07"
	strings:
		$s2 = "cress.exe"
		$s7 = "\\Debug\\Mithril."
	condition:
		all of them
}
YARA Detection Rule: hkshell_hkrmv
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file hkrmv.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s5 = "/THUMBPOSITION7"
		$s6 = "\\EvilBlade\\"

Detection condition:
all of them

Full rule:
rule hkshell_hkrmv {
	meta:
		description = "Webshells Auto-generated - file hkrmv.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "bd3a0b7a6b5536f8d96f50956560e9bf"
	strings:
		$s5 = "/THUMBPOSITION7"
		$s6 = "\\EvilBlade\\"
	condition:
		all of them
}
YARA Detection Rule: phpshell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file phpshell.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "echo \"<input size=\\\"100\\\" type=\\\"text\\\" name=\\\"newfile\\\" value=\\\"$inputfile\\\"><b"
		$s2 = "$img[$id] = \"<img height=\\\"16\\\" width=\\\"16\\\" border=\\\"0\\\" src=\\\"$REMOTE_IMAGE_UR"
		$s3 = "$file = str_replace(\"\\\\\", \"/\", str_replace(\"//\", \"/\", str_replace(\"\\\\\\\\\", \"\\\\\", "

Detection condition:
all of them

Full rule:
rule phpshell {
	meta:
		description = "Webshells Auto-generated - file phpshell.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "1dccb1ea9f24ffbd085571c88585517b"
	strings:
		$s1 = "echo \"<input size=\\\"100\\\" type=\\\"text\\\" name=\\\"newfile\\\" value=\\\"$inputfile\\\"><b"
		$s2 = "$img[$id] = \"<img height=\\\"16\\\" width=\\\"16\\\" border=\\\"0\\\" src=\\\"$REMOTE_IMAGE_UR"
		$s3 = "$file = str_replace(\"\\\\\", \"/\", str_replace(\"//\", \"/\", str_replace(\"\\\\\\\\\", \"\\\\\", "
	condition:
		all of them
}
YARA Detection Rule: FSO_s_cmd
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file cmd.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>"
		$s1 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"

Detection condition:
all of them

Full rule:
rule FSO_s_cmd {
	meta:
		description = "Webshells Auto-generated - file cmd.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "cbe8e365d41dd3cd8e462ca434cf385f"
	strings:
		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>"
		$s1 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
	condition:
		all of them
}
YARA Detection Rule: FeliksPack3___PHP_Shells_phpft
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file phpft.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s6 = "PHP Files Thief"
		$s11 = "http://www.4ngel.net"

Detection condition:
all of them

Full rule:
rule FeliksPack3___PHP_Shells_phpft {
	meta:
		description = "Webshells Auto-generated - file phpft.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "60ef80175fcc6a879ca57c54226646b1"
	strings:
		$s6 = "PHP Files Thief"
		$s11 = "http://www.4ngel.net"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_indexer
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file indexer.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s3 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input type=\"r"

Detection condition:
all of them

Full rule:
rule FSO_s_indexer {
	meta:
		description = "Webshells Auto-generated - file indexer.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "135fc50f85228691b401848caef3be9e"
	strings:
		$s3 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input type=\"r"
	condition:
		all of them
}
YARA Detection Rule: r57shell
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file r57shell.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s11 = " $_POST['cmd']=\"echo \\\"Now script try connect to"

Detection condition:
all of them

Full rule:
rule r57shell {
	meta:
		description = "Webshells Auto-generated - file r57shell.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "[PII_REDACTED]cddf8aee5dec6072ed02b5"
	strings:
		$s11 = " $_POST['cmd']=\"echo \\\"Now script try connect to"
	condition:
		all of them
}
YARA Detection Rule: bdcli100
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file bdcli100.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s5 = "unable to connect to "
		$s8 = "backdoor is corrupted on "

Detection condition:
all of them

Full rule:
rule bdcli100 {
	meta:
		description = "Webshells Auto-generated - file bdcli100.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "b12163ac53789fb4f62e4f17a8c2e028"
	strings:
		$s5 = "unable to connect to "
		$s8 = "backdoor is corrupted on "
	condition:
		all of them
}
YARA Detection Rule: HYTop_DevPack_2005Red
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file 2005Red.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "scrollbar-darkshadow-color:#FF9DBB;"
		$s3 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
		$s9 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"

Detection condition:
all of them

Full rule:
rule HYTop_DevPack_2005Red {
	meta:
		description = "Webshells Auto-generated - file 2005Red.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "d8ccda2214b3f6eabd4502a050eb8fe8"
	strings:
		$s0 = "scrollbar-darkshadow-color:#FF9DBB;"
		$s3 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
		$s9 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
	condition:
		all of them
}
YARA Detection Rule: HYTop2006_rar_Folder_2006X2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file 2006X2.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "Powered By "
		$s3 = " \" onClick=\"this.form.sharp.name=this.form.password.value;this.form.action=this."

Detection condition:
all of them

Full rule:
rule HYTop2006_rar_Folder_2006X2 {
	meta:
		description = "Webshells Auto-generated - file 2006X2.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "cc5bf9fc56d404ebbc492855393d7620"
	strings:
		$s2 = "Powered By "
		$s3 = " \" onClick=\"this.form.sharp.name=this.form.password.value;this.form.action=this."
	condition:
		all of them
}
YARA Detection Rule: rdrbs084
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file rdrbs084.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "Create mapped port. You have to specify domain when using HTTP type."
		$s8 = "<LOCAL PORT> <MAPPING SERVER> <MAPPING SERVER PORT> <TARGET SERVER> <TARGET"

Detection condition:
all of them

Full rule:
rule rdrbs084 {
	meta:
		description = "Webshells Auto-generated - file rdrbs084.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "ed30327b255816bdd7590bf891aa0020"
	strings:
		$s0 = "Create mapped port. You have to specify domain when using HTTP type."
		$s8 = "<LOCAL PORT> <MAPPING SERVER> <MAPPING SERVER PORT> <TARGET SERVER> <TARGET"
	condition:
		all of them
}
YARA Detection Rule: HYTop_CaseSwitch_2005
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file 2005.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "MSComDlg.CommonDialog"
		$s2 = "CommonDialog1"
		$s3 = "__vbaExceptHandler"
		$s4 = "EVENT_SINK_Release"
		$s5 = "EVENT_SINK_AddRef"
		$s6 = "By Marcos"
		$s7 = "EVENT_SINK_QueryInterface"
		$s8 = "MethCallEngine"

Detection condition:
all of them

Full rule:
rule HYTop_CaseSwitch_2005 {
	meta:
		description = "Webshells Auto-generated - file 2005.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "8bf667ee9e21366bc0bd3491cb614f41"
	strings:
		$s1 = "MSComDlg.CommonDialog"
		$s2 = "CommonDialog1"
		$s3 = "__vbaExceptHandler"
		$s4 = "EVENT_SINK_Release"
		$s5 = "EVENT_SINK_AddRef"
		$s6 = "By Marcos"
		$s7 = "EVENT_SINK_QueryInterface"
		$s8 = "MethCallEngine"
	condition:
		all of them
}
YARA Detection Rule: eBayId_index3
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file index3.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s8 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"You"

Detection condition:
all of them

Full rule:
rule eBayId_index3 {
	meta:
		description = "Webshells Auto-generated - file index3.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "0412b1e37f41ea0d002e4ed11608905f"
	strings:
		$s8 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"You"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_phvayv
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file phvayv.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "wrap=\"OFF\">XXXX</textarea></font><font face"

Detection condition:
all of them

Full rule:
rule FSO_s_phvayv {
	meta:
		description = "Webshells Auto-generated - file phvayv.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "205ecda66c443083403efb1e5c7f7878"
	strings:
		$s2 = "wrap=\"OFF\">XXXX</textarea></font><font face"
	condition:
		all of them
}
YARA Detection Rule: byshell063_ntboot
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file ntboot.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtBoot"
		$s1 = "Failure ... Access is Denied !"
		$s2 = "Dumping Description to Registry..."
		$s3 = "Opening Service .... Failure !"

Detection condition:
all of them

Full rule:
rule byshell063_ntboot {
	meta:
		description = "Webshells Auto-generated - file ntboot.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "99b5f49db6d6d9a9faeffb29fd8e6d8c"
	strings:
		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtBoot"
		$s1 = "Failure ... Access is Denied !"
		$s2 = "Dumping Description to Registry..."
		$s3 = "Opening Service .... Failure !"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_casus15_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file casus15.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "copy ( $dosya_gonder"

Detection condition:
all of them

Full rule:
rule FSO_s_casus15_2 {
	meta:
		description = "Webshells Auto-generated - file casus15.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "8d155b4239d922367af5d0a1b89533a3"
	strings:
		$s0 = "copy ( $dosya_gonder"
	condition:
		all of them
}
YARA Detection Rule: installer
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file installer.cmd
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "Restore Old Vanquish"
		$s4 = "ReInstall Vanquish"

Detection condition:
all of them

Full rule:
rule installer {
	meta:
		description = "Webshells Auto-generated - file installer.cmd"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "a507919ae701cf7e42fa441d3ad95f8f"
	strings:
		$s0 = "Restore Old Vanquish"
		$s4 = "ReInstall Vanquish"
	condition:
		all of them
}
YARA Detection Rule: uploader
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file uploader.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "move_uploaded_file($userfile, \"entrika.php\"); "

Detection condition:
all of them

Full rule:
rule uploader {
	meta:
		description = "Webshells Auto-generated - file uploader.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "b9a9aab319964351b46bd5fc9d6246a8"
	strings:
		$s0 = "move_uploaded_file($userfile, \"entrika.php\"); "
	condition:
		all of them
}
YARA Detection Rule: FSO_s_remview_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file remview.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "<xmp>$out</"
		$s1 = ".mm(\"Eval PHP code\")."

Detection condition:
all of them

Full rule:
rule FSO_s_remview_2 {
	meta:
		description = "Webshells Auto-generated - file remview.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "b4a09911a5b23e00b55abe546ded691c"
	strings:
		$s0 = "<xmp>$out</"
		$s1 = ".mm(\"Eval PHP code\")."
	condition:
		all of them
}
YARA Detection Rule: FeliksPack3___PHP_Shells_r57
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file r57.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']."

Detection condition:
all of them

Full rule:
rule FeliksPack3___PHP_Shells_r57 {
	meta:
		description = "Webshells Auto-generated - file r57.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "903908b77a266b855262cdbce81c3f72"
	strings:
		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']."
	condition:
		all of them
}
YARA Detection Rule: HYTop2006_rar_Folder_2006X
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file 2006X.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "<input name=\"password\" type=\"password\" id=\"password\""
		$s6 = "name=\"theAction\" type=\"text\" id=\"theAction\""

Detection condition:
all of them

Full rule:
rule HYTop2006_rar_Folder_2006X {
	meta:
		description = "Webshells Auto-generated - file 2006X.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "cf3ee0d869dd36e775dfcaa788db8e4b"
	strings:
		$s1 = "<input name=\"password\" type=\"password\" id=\"password\""
		$s6 = "name=\"theAction\" type=\"text\" id=\"theAction\""
	condition:
		all of them
}
YARA Detection Rule: FSO_s_phvayv_2
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file phvayv.php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s2 = "rows=\"24\" cols=\"122\" wrap=\"OFF\">XXXX</textarea></font><font"

Detection condition:
all of them

Full rule:
rule FSO_s_phvayv_2 {
	meta:
		description = "Webshells Auto-generated - file phvayv.php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "205ecda66c443083403efb1e5c7f7878"
	strings:
		$s2 = "rows=\"24\" cols=\"122\" wrap=\"OFF\">XXXX</textarea></font><font"
	condition:
		all of them
}
YARA Detection Rule: elmaliseker
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file elmaliseker.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "javascript:Command('Download'"
		$s5 = "zombie_array=array("

Detection condition:
all of them

Full rule:
rule elmaliseker {
	meta:
		description = "Webshells Auto-generated - file elmaliseker.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "ccf48af0c8c09bbd038e610a49c9862e"
	strings:
		$s0 = "javascript:Command('Download'"
		$s5 = "zombie_array=array("
	condition:
		all of them
}
YARA Detection Rule: shelltools_g0t_root_resolve
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file resolve.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "3^n6B(Ed3"
		$s1 = "^uldn'Vt(x"
		$s2 = "\\= uPKfp"
		$s3 = "'r.axV<ad"
		$s4 = "p,modoi$=sr("
		$s5 = "DiamondC8S t"
		$s6 = "`lQ9fX<ZvJW"

Detection condition:
all of them

Full rule:
rule shelltools_g0t_root_resolve {
	meta:
		description = "Webshells Auto-generated - file resolve.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "69bf9aa296238610a0e05f99b5540297"
	strings:
		$s0 = "3^n6B(Ed3"
		$s1 = "^uldn'Vt(x"
		$s2 = "\\= uPKfp"
		$s3 = "'r.axV<ad"
		$s4 = "p,modoi$=sr("
		$s5 = "DiamondC8S t"
		$s6 = "`lQ9fX<ZvJW"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_RemExp
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file RemExp.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Request.Ser"
		$s5 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f=<%=F"
		$s6 = "<td bgcolor=\"<%=BgColor%>\" align=\"right\"><%=Attributes(SubFolder.Attributes)%></"

Detection condition:
all of them

Full rule:
rule FSO_s_RemExp {
	meta:
		description = "Webshells Auto-generated - file RemExp.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "b69670ecdbb40012c73686cd22696eeb"
	strings:
		$s1 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Request.Ser"
		$s5 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f=<%=F"
		$s6 = "<td bgcolor=\"<%=BgColor%>\" align=\"right\"><%=Attributes(SubFolder.Attributes)%></"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_tool
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file tool.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s7 = "\"\"%windir%\\\\calc.exe\"\")"

Detection condition:
all of them

Full rule:
rule FSO_s_tool {
	meta:
		description = "Webshells Auto-generated - file tool.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "3a1e1e889fdd974a130a6a767b42655b"
	strings:
		$s7 = "\"\"%windir%\\\\calc.exe\"\")"
	condition:
		all of them
}
YARA Detection Rule: FeliksPack3___PHP_Shells_2005
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file 2005.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "window.open(\"\"&url&\"?id=edit&path=\"+sfile+\"&op=copy&attrib=\"+attrib+\"&dpath=\"+lp"
		$s3 = "<input name=\"dbname\" type=\"hidden\" id=\"dbname\" value=\"<%=request(\"dbname\")%>\">"

Detection condition:
all of them

Full rule:
rule FeliksPack3___PHP_Shells_2005 {
	meta:
		description = "Webshells Auto-generated - file 2005.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "97f2552c2fafc0b2eb467ee29cc803c8"
	strings:
		$s0 = "window.open(\"\"&url&\"?id=edit&path=\"+sfile+\"&op=copy&attrib=\"+attrib+\"&dpath=\"+lp"
		$s3 = "<input name=\"dbname\" type=\"hidden\" id=\"dbname\" value=\"<%=request(\"dbname\")%>\">"
	condition:
		all of them
}
YARA Detection Rule: byloader
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file byloader.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtfsChk"
		$s1 = "Failure ... Access is Denied !"
		$s2 = "NTFS Disk Driver Checking Service"
		$s3 = "Dumping Description to Registry..."
		$s4 = "Opening Service .... Failure !"

Detection condition:
all of them

Full rule:
rule byloader {
	meta:
		description = "Webshells Auto-generated - file byloader.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "0f0d6dc26055653f5844ded906ce52df"
	strings:
		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtfsChk"
		$s1 = "Failure ... Access is Denied !"
		$s2 = "NTFS Disk Driver Checking Service"
		$s3 = "Dumping Description to Registry..."
		$s4 = "Opening Service .... Failure !"
	condition:
		all of them
}
YARA Detection Rule: shelltools_g0t_root_Fport
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file Fport.exe
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s4 = "Copyright 2000 by Foundstone, Inc."
		$s5 = "You must have administrator privileges to run fport - exiting..."

Detection condition:
all of them

Full rule:
rule shelltools_g0t_root_Fport {
	meta:
		description = "Webshells Auto-generated - file Fport.exe"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "dbb75488aa2fa22ba6950aead1ef30d5"
	strings:
		$s4 = "Copyright 2000 by Foundstone, Inc."
		$s5 = "You must have administrator privileges to run fport - exiting..."
	condition:
		all of them
}
YARA Detection Rule: BackDooR__fr_
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file BackDooR (fr).php
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s3 = "print(\"<p align=\\\"center\\\"><font size=\\\"5\\\">Exploit include "

Detection condition:
all of them

Full rule:
rule BackDooR__fr_ {
	meta:
		description = "Webshells Auto-generated - file BackDooR (fr).php"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "a79cac2cf86e073a832aaf29a664f4be"
	strings:
		$s3 = "print(\"<p align=\\\"center\\\"><font size=\\\"5\\\">Exploit include "
	condition:
		all of them
}
YARA Detection Rule: FSO_s_ntdaddy
Repository: Yara-Rules/rules
Detects: Webshells Auto-generated - file ntdaddy.asp
Author: Yara Bulk Rule Generator by Florian Roth

Pattern signatures:
$s1 = "<input type=\"text\" name=\".CMD\" size=\"45\" value=\"<%= szCMD %>\"> <input type=\"s"

Detection condition:
all of them

Full rule:
rule FSO_s_ntdaddy {
	meta:
		description = "Webshells Auto-generated - file ntdaddy.asp"
		author = "Yara Bulk Rule Generator by Florian Roth"
		hash = "f6262f3ad9f73b8d3e7d9ea5ec07a357"
	strings:
		$s1 = "<input type=\"text\" name=\".CMD\" size=\"45\" value=\"<%= szCMD %>\"> <input type=\"s"
	condition:
		all of them
}