deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Zeus_Panda
Repository: Neo23x0/signature-base
Detects: Detects ZEUS Panda Malware
Author: Florian Roth (Nextron Systems)
Reference: https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf

Pattern signatures:
$x1 = "SER32.dll" fullword ascii
      $x2 = "/c start \"\" \"%s\"" fullword wide
      $x3 = "del /F \"%s\"" fullword ascii

      $s1 = "bcdfghklmnpqrstvwxz" fullword ascii
      $s2 = "=> -,0;" fullword ascii
      $s3 = "Yahoo! Slurp" fullword ascii
      $s4 = "ZTNHGET ^&" fullword ascii
      $s5 = "MSIE 9" fullword ascii
      $s6 = "%s%08x.%s" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and ( 2 of ($x*) or 4 of them )

Full rule:
rule Zeus_Panda {
   meta:
      description = "Detects ZEUS Panda Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"
      date = "2017-08-04"
      hash1 = "bd956b2e[PII_REDACTED]5b9b92e20f75dbf67ac5f12f9daa194525e1b673c7f83c"
      id = "2786b1e0-37af-5595-a24b-56ef3cb928a7"
   strings:
      $x1 = "SER32.dll" fullword ascii
      $x2 = "/c start \"\" \"%s\"" fullword wide
      $x3 = "del /F \"%s\"" fullword ascii

      $s1 = "bcdfghklmnpqrstvwxz" fullword ascii
      $s2 = "=> -,0;" fullword ascii
      $s3 = "Yahoo! Slurp" fullword ascii
      $s4 = "ZTNHGET ^&" fullword ascii
      $s5 = "MSIE 9" fullword ascii
      $s6 = "%s%08x.%s" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and ( 2 of ($x*) or 4 of them )
}
YARA Detection Rule: VUL_JQuery_FileUpload_CVE_2018_9206
Repository: Neo23x0/signature-base
Detects: Detects JQuery File Upload vulnerability CVE-2018-9206
Author: Florian Roth (Nextron Systems)
Reference: https://www.zdnet.com/article/zero-day-in-popular-jquery-plugin-actively-exploited-for-at-least-three-years/

Pattern signatures:
$s1 = "error_reporting(E_ALL | E_STRICT);" fullword ascii
      $s2 = "require('UploadHandler.php');" fullword ascii
      $s3 = "$upload_handler = new UploadHandler();" fullword ascii

Detection condition:
all of them

Full rule:
rule VUL_JQuery_FileUpload_CVE_2018_9206 {
   meta:
      description = "Detects JQuery File Upload vulnerability CVE-2018-9206"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.zdnet.com/article/zero-day-in-popular-jquery-plugin-actively-exploited-for-at-least-three-years/"
      reference2 = "https://github.com/blueimp/jQuery-File-Upload/commit/aeb47e51c67df8a504b[PII_REDACTED]c1c66b5dc2f"
      reference3 = "https://blogs.akamai.com/sitr/2018/10/having-the-security-rug-pulled-out-from-under-you.html"
      date = "2018-10-19"
      id = "20bac44c-0e5a-5561-9fd8-a71cd2d8590a"
   strings:
      $s1 = "error_reporting(E_ALL | E_STRICT);" fullword ascii
      $s2 = "require('UploadHandler.php');" fullword ascii
      $s3 = "$upload_handler = new UploadHandler();" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: RUAG_Tavdig_Malformed_Executable
Repository: Neo23x0/signature-base
Detects: Detects an embedded executable with a malformed header - known from Tavdig malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/N5MEj0

Detection condition:
uint16(0) == 0x5a4d and /* MZ Header */
    uint32(uint32(0x3C)) == 0x0000AD0B /* malformed PE header > 0x0bad */

Full rule:
rule RUAG_Tavdig_Malformed_Executable {
  meta:
    description = "Detects an embedded executable with a malformed header - known from Tavdig malware"
    author = "Florian Roth (Nextron Systems)"
    reference = "https://goo.gl/N5MEj0"
    score = 60
    id = "da6357d4-0cdb-5f30-9[PII_REDACTED]3cc41"
  condition:
    uint16(0) == 0x5a4d and /* MZ Header */
    uint32(uint32(0x3C)) == 0x0000AD0B /* malformed PE header > 0x0bad */
}
YARA Detection Rule: RUAG_Bot_Config_File
Repository: Neo23x0/signature-base
Detects: Detects a specific config file used by malware in RUAG APT case
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/N5MEj0

Pattern signatures:
$s1 = "[CONFIG]" ascii
    $s2 = "name = " ascii
    $s3 = "exe = cmd.exe" ascii

Detection condition:
uint32(0) == 0x4e4f435b and $s1 at 0 and $s2 and $s3 and filesize < 160

Full rule:
rule RUAG_Bot_Config_File {
  meta:
    description = "Detects a specific config file used by malware in RUAG APT case"
    author = "Florian Roth (Nextron Systems)"
    reference = "https://goo.gl/N5MEj0"
    score = 60
    id = "aa3d5f9e-0b23-5180-9e52-a7d705712747"
  strings:
    $s1 = "[CONFIG]" ascii
    $s2 = "name = " ascii
    $s3 = "exe = cmd.exe" ascii
  condition:
    uint32(0) == 0x4e4f435b and $s1 at 0 and $s2 and $s3 and filesize < 160
}
YARA Detection Rule: RUAG_Cobra_Malware
Repository: Neo23x0/signature-base
Detects: Detects a malware mentioned in the RUAG Case called Carbon/Cobra
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/N5MEj0

Pattern signatures:
$s1 = "\\Cobra\\Release\\Cobra.pdb" ascii

Detection condition:
uint16(0) == 0x5a4d and $s1

Full rule:
rule RUAG_Cobra_Malware {
  meta:
    description = "Detects a malware mentioned in the RUAG Case called Carbon/Cobra"
    author = "Florian Roth (Nextron Systems)"
    reference = "https://goo.gl/N5MEj0"
    score = 60
    id = "dd2d591f-6f56-5c31-9f3c-3aa7d174c9a0"
  strings:
    $s1 = "\\Cobra\\Release\\Cobra.pdb" ascii
  condition:
    uint16(0) == 0x5a4d and $s1
}
YARA Detection Rule: RUAG_Cobra_Config_File
Repository: Neo23x0/signature-base
Detects: Detects a config text file used by malware Cobra in RUAG case
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/N5MEj0

Pattern signatures:
$h1 = "[NAME]" ascii

    $s1 = "object_id=" ascii
    $s2 = "[TIME]" ascii fullword
    $s3 = "lastconnect" ascii
    $s4 = "[CW_LOCAL]" ascii fullword
    $s5 = "system_pipe" ascii
    $s6 = "user_pipe" ascii
    $s7 = "[TRANSPORT]" ascii
    $s8 = "run_task_system" ascii
    $s9 = "[WORKDATA]" ascii
    $s10 = "address1" ascii

Detection condition:
uint32(0) == 0x4d414e5b and $h1 at 0 and 8 of ($s*) and filesize < 5KB

Full rule:
rule RUAG_Cobra_Config_File {
  meta:
    description = "Detects a config text file used by malware Cobra in RUAG case"
    author = "Florian Roth (Nextron Systems)"
    reference = "https://goo.gl/N5MEj0"
    score = 60
    id = "b3899d95-acc9-55ca-9025-edecce755ca6"
  strings:
    $h1 = "[NAME]" ascii

    $s1 = "object_id=" ascii
    $s2 = "[TIME]" ascii fullword
    $s3 = "lastconnect" ascii
    $s4 = "[CW_LOCAL]" ascii fullword
    $s5 = "system_pipe" ascii
    $s6 = "user_pipe" ascii
    $s7 = "[TRANSPORT]" ascii
    $s8 = "run_task_system" ascii
    $s9 = "[WORKDATA]" ascii
    $s10 = "address1" ascii
  condition:
    uint32(0) == 0x4d414e5b and $h1 at 0 and 8 of ($s*) and filesize < 5KB
}
YARA Detection Rule: RUAG_Exfil_Config_File
Repository: Neo23x0/signature-base
Detects: Detects a config text file used in data exfiltration in RUAG case
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/N5MEj0

Pattern signatures:
$h1 = "[TRANSPORT]" ascii

    $s1 = "system_pipe" ascii
    $s2 = "spstatus" ascii
    $s3 = "adaptable" ascii
    $s4 = "post_frag" ascii
    $s5 = "pfsgrowperiod" ascii

Detection condition:
uint32(0) == 0x4152545b and $h1 at 0 and all of ($s*) and filesize < 1KB

Full rule:
rule RUAG_Exfil_Config_File {
  meta:
    description = "Detects a config text file used in data exfiltration in RUAG case"
    author = "Florian Roth (Nextron Systems)"
    reference = "https://goo.gl/N5MEj0"
    score = 60
    id = "7057bc7b-7f8c-5db8-b7f3-f6c33487b122"
  strings:
    $h1 = "[TRANSPORT]" ascii

    $s1 = "system_pipe" ascii
    $s2 = "spstatus" ascii
    $s3 = "adaptable" ascii
    $s4 = "post_frag" ascii
    $s5 = "pfsgrowperiod" ascii
  condition:
    uint32(0) == 0x4152545b and $h1 at 0 and all of ($s*) and filesize < 1KB
}
YARA Detection Rule: MAL_Trickbot_Oct19_1
Repository: Neo23x0/signature-base
Detects: Detects Trickbot malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "Celestor@hotmail.com" fullword ascii
      $s2 = "\\txtPassword" ascii
      $s14 = "Invalid Password, try again!" fullword wide

      $op1 = { 78 c4 40 00 ff ff ff ff b4 47 41 }
      $op2 = { 9b 68 b2 34 46 00 eb 14 8d 55 e4 8d 45 e8 52 50 }

Detection condition:
uint16(0) == 0x5a4d and filesize <= 2000KB and 3 of them

Full rule:
rule MAL_Trickbot_Oct19_1 {
   meta:
      description = "Detects Trickbot malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2019-10-02"
      hash1 = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
      hash2 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
      hash3 = "9d6e4ad7f84d025bbe9f95e74542e7d9f79e054f6dcd7b37296f01e7edd2abae"
      id = "b428cbf9-0796-5a01-9b98-28e1bc6827cc"
   strings:
      $s1 = "Celestor@hotmail.com" fullword ascii
      $s2 = "\\txtPassword" ascii
      $s14 = "Invalid Password, try again!" fullword wide

      $op1 = { 78 c4 40 00 ff ff ff ff b4 47 41 }
      $op2 = { 9b 68 b2 34 46 00 eb 14 8d 55 e4 8d 45 e8 52 50 }
   condition:
      uint16(0) == 0x5a4d and filesize <= 2000KB and 3 of them
}
YARA Detection Rule: MAL_Trickbot_Oct19_2
Repository: Neo23x0/signature-base
Detects: Detects Trickbot malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "C:\\Users\\User\\Desktop\\Encrypt\\Math_Cad\\Release\\Math_Cad.pdb" fullword ascii
      $x2 = "AxedWV3OVTFfnGb" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize <= 2000KB and 1 of them

Full rule:
rule MAL_Trickbot_Oct19_2 {
   meta:
      description = "Detects Trickbot malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2019-10-02"
      hash1 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
      hash2 = "d75561a744e3ed45dfbf25fe7c120bd24c38138ac469fd02e383dd455a540334"
      id = "2ff69a51-d089-53e5-ab19-4fbdf20f90f8"
   strings:
      $x1 = "C:\\Users\\User\\Desktop\\Encrypt\\Math_Cad\\Release\\Math_Cad.pdb" fullword ascii
      $x2 = "AxedWV3OVTFfnGb" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize <= 2000KB and 1 of them
}
YARA Detection Rule: MAL_Trickbot_Oct19_3
Repository: Neo23x0/signature-base
Detects: Detects Trickbot malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "Decrypt Shell Fail" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize <= 2000KB and ( 1 of them or pe.imphash() == "4e3fbfbf1fc23f646cd40a6fe09385a7" )

Full rule:
rule MAL_Trickbot_Oct19_3 {
   meta:
      description = "Detects Trickbot malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2019-10-02"
      hash1 = "25a4ae2a1ce6dbe7da4ba1e2559caa7ed080762cf52dba6c8b[PII_REDACTED]5504"
      hash2 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
      hash3 = "d75561a744e3ed45dfbf25fe7c120bd24c38138ac469fd02e383dd455a540334"
      hash4 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
      hash5 = "e92dd00b092b435420f0996e4f557023fe1436110a11f0f61fbb628b959aac99"
      id = "3428b7e3-def9-5574-bbbb-6ba98c134dec"
   strings:
      $s1 = "Decrypt Shell Fail" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize <= 2000KB and ( 1 of them or pe.imphash() == "4e3fbfbf1fc23f646cd40a6fe09385a7" )
}
YARA Detection Rule: MAL_Trickbot_Oct19_4
Repository: Neo23x0/signature-base
Detects: Detects Trickbot malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "c:\\users\\user\\documents\\visual studio 2005\\projects\\adzxser\\release\\ADZXSER.pdb" fullword ascii
      $x2 = "http://root-hack.org" fullword ascii
      $x3 = "http://hax-studios.net" fullword ascii
      $x4 = "5OCFBBKCAZxWUE#$_SVRR[SQJ" fullword ascii
      $x5 = "G*\\AC:\\Users\\911\\Desktop\\cButtonBar\\cButtonBar\\ButtonBar.vbp" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize <= 2000KB and 1 of them

Full rule:
rule MAL_Trickbot_Oct19_4 {
   meta:
      description = "Detects Trickbot malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2019-10-02"
      hash1 = "25a4ae2a1ce6dbe7da4ba1e2559caa7ed080762cf52dba6c8b[PII_REDACTED]5504"
      hash2 = "e92dd00b092b435420f0996e4f557023fe1436110a11f0f61fbb628b959aac99"
      hash3 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
      hash4 = "9ecc794ec77ce937e8c835d837ca7f0548ef695090543ed83a7adbc07da9f536"
      id = "dcadaa50-52ae-5ded-b40e-149f28092093"
   strings:
      $x1 = "c:\\users\\user\\documents\\visual studio 2005\\projects\\adzxser\\release\\ADZXSER.pdb" fullword ascii
      $x2 = "http://root-hack.org" fullword ascii
      $x3 = "http://hax-studios.net" fullword ascii
      $x4 = "5OCFBBKCAZxWUE#$_SVRR[SQJ" fullword ascii
      $x5 = "G*\\AC:\\Users\\911\\Desktop\\cButtonBar\\cButtonBar\\ButtonBar.vbp" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize <= 2000KB and 1 of them
}
YARA Detection Rule: MAL_Trickbot_Oct19_5
Repository: Neo23x0/signature-base
Detects: Detects Trickbot malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "LoadShellCode" fullword ascii
      $s2 = "pShellCode" fullword ascii
      $s3 = "InitShellCode" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize <= 2000KB and 2 of them

Full rule:
rule MAL_Trickbot_Oct19_5 {
   meta:
      description = "Detects Trickbot malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2019-10-02"
      hash1 = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
      hash2 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
      hash3 = "9ecc794ec77ce937e8c835d837ca7f0548ef695090543ed83a7adbc07da9f536"
      hash4 = "9d6e4ad7f84d025bbe9f95e74542e7d9f79e054f6dcd7b37296f01e7edd2abae"
      id = "b3034f0c-5fd9-58a2-866f-9100e3a56f39"
   strings:
      $s1 = "LoadShellCode" fullword ascii
      $s2 = "pShellCode" fullword ascii
      $s3 = "InitShellCode" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize <= 2000KB and 2 of them
}
YARA Detection Rule: MAL_Trickbot_Oct19_6
Repository: Neo23x0/signature-base
Detects: Detects Trickbot malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "D:\\MyProjects\\spreader\\Release\\ssExecutor_x86.pdb" fullword ascii

      $s1 = "%s\\appdata\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\%s" fullword ascii
      $s2 = "%s\\appdata\\roaming\\%s" fullword ascii
      $s3 = "WINDOWS\\SYSTEM32\\TASKS" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize <= 400KB and ( 1 of ($x*) or 3 of them )

Full rule:
rule MAL_Trickbot_Oct19_6 {
   meta:
      description = "Detects Trickbot malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2019-10-02"
      hash1 = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
      hash2 = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
      id = "5feb8d34-4974-5315-a5f9-79a3fac83d1d"
   strings:
      $x1 = "D:\\MyProjects\\spreader\\Release\\ssExecutor_x86.pdb" fullword ascii

      $s1 = "%s\\appdata\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\%s" fullword ascii
      $s2 = "%s\\appdata\\roaming\\%s" fullword ascii
      $s3 = "WINDOWS\\SYSTEM32\\TASKS" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize <= 400KB and ( 1 of ($x*) or 3 of them )
}
YARA Detection Rule: endor
Repository: Neo23x0/signature-base
Detects: Rule to detect Endor family
Author: Hugo Porcher
Reference: https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf

Pattern signatures:
$u = "user: %s"
        $p = "password: %s"

Detection condition:
ssh_binary and $u and $p in (@u..@u+20)

Full rule:
rule endor {
    meta:
        description = "Rule to detect Endor family"
        author = "Hugo Porcher"
        email  = "hugo.porcher@eset.com"
        reference = "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
        date = "2018-12-05"
        license = "BSD 2-Clause"

    strings:
        $u = "user: %s"
        $p = "password: %s"

    condition:
        ssh_binary and $u and $p in (@u..@u+20)
}
YARA Detection Rule: Invoke_Mimikatz
Repository: Neo23x0/signature-base
Detects: Detects Invoke-Mimikatz String
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz

Pattern signatures:
$x2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm" ascii
      $x3 = "Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii

Detection condition:
1 of them

Full rule:
rule Invoke_Mimikatz {
	meta:
		description = "Detects Invoke-Mimikatz String"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz"
		date = "2016-08-03"
		hash1 = "f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67"
		id = "37de51a6-e1bb-5ee7-9b7f-8fe17b3697b5"
	strings:
		$x2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm" ascii
      $x3 = "Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii
	condition:
      1 of them
}
YARA Detection Rule: MAL_WIPER_Unknown_Jun25
Repository: Neo23x0/signature-base
Detects: Detects unknown disk wiper first spotted in June 2025 and uploaded from Israel
Author: Florian Roth
Reference: https://x.com/cyb3rops/status/[PII_REDACTED]05134975

Pattern signatures:
$x1 = "\\CWipeNew\\Release\\" ascii fullword

      $s1 = "Failed to get disk geometry: " wide fullword
      $s2 = "--- Working on " wide fullword

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 200KB
      and (
         1 of ($x*)
         or all of ($s*)
      )

Full rule:
rule MAL_WIPER_Unknown_Jun25 {
   meta:
      description = "Detects unknown disk wiper first spotted in June 2025 and uploaded from Israel"
      author = "Florian Roth"
      reference = "https://x.com/cyb3rops/status/[PII_REDACTED]05134975"
      date = "2025-06-19"
      score = 75
      hash1 = "12c39f052f030a77c0cd531df86ad3477f46d1287b8b98b625d1dcf89385d721"
   strings:
      $x1 = "\\CWipeNew\\Release\\" ascii fullword

      $s1 = "Failed to get disk geometry: " wide fullword
      $s2 = "--- Working on " wide fullword
   condition:
      uint16(0) == 0x5a4d
      and filesize < 200KB
      and (
         1 of ($x*)
         or all of ($s*)
      )
}
YARA Detection Rule: SUSP_LNX_SH_Disk_Wiper_Script_Jun25
Repository: Neo23x0/signature-base
Detects: Detects unknown disk wiper script for Linux systems
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$s1 = "THIS SCRIPT IS LIVE AND ARMED!" ascii fullword
      $s2 = "FAIR WARNING!" ascii fullword
      $s3 = "lists devices" ascii fullword

Detection condition:
uint16(0) == 0x2123
      and filesize < 2KB
      and all of them

Full rule:
rule SUSP_LNX_SH_Disk_Wiper_Script_Jun25 {
   meta:
      description = "Detects unknown disk wiper script for Linux systems"
      author = "Florian Roth"
      reference = "Internal Research"
      date = "2025-06-19"
      score = 65
      hash1 = "f662f69fc7f4240cd8c00661db9484e76b5d02f903590140b4086fefcf9d9331"
   strings:
      $s1 = "THIS SCRIPT IS LIVE AND ARMED!" ascii fullword
      $s2 = "FAIR WARNING!" ascii fullword
      $s3 = "lists devices" ascii fullword
   condition:
      uint16(0) == 0x2123
      and filesize < 2KB
      and all of them
}
YARA Detection Rule: SUSP_PY_PYInstaller_Swiper_Jun25
Repository: Neo23x0/signature-base
Detects: Detects suspicious Python based executable with similarities to a known disk wiper
Author: Florian Roth
Reference: https://x.com/cyb3rops/status/[PII_REDACTED]05134975

Pattern signatures:
$a1 = "bzlib1.dll" ascii fullword
      $a2 = "VCRUNTIME140_1.dll" wide fullword
      $a3 = "%s%c%s.exe" ascii fullword

      $sc1 = { 73 77 69 70 65 72 00 00 00 } // "swiper\0\0\0"

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 40000KB
      and all of them

Full rule:
rule SUSP_PY_PYInstaller_Swiper_Jun25 {
   meta:
      description = "Detects suspicious Python based executable with similarities to a known disk wiper"
      author = "Florian Roth"
      reference = "https://x.com/cyb3rops/status/[PII_REDACTED]05134975"
      date = "2025-06-19"
      score = 65
      hash1 = "4f669ecbe12e95d51f37be76933de4c2626d20bb01729086ce2efc603c4ffdf3"
   strings:
      $a1 = "bzlib1.dll" ascii fullword
      $a2 = "VCRUNTIME140_1.dll" wide fullword
      $a3 = "%s%c%s.exe" ascii fullword

      $sc1 = { 73 77 69 70 65 72 00 00 00 } // "swiper\0\0\0"
   condition:
      uint16(0) == 0x5a4d
      and filesize < 40000KB
      and all of them
}
YARA Detection Rule: APT_MAL_IR_DruidFly_Wiper_Jun25
Repository: Neo23x0/signature-base
Detects: Detects Wiper used by the Iranian DruidFly group
Author: Florian Roth
Reference: https://x.com/threatintel/status/[PII_REDACTED]32231444

Pattern signatures:
$xc1 = { 2E 62 61 63 6B 75 70 00 2E 63 6F 6E 66 69 67 00   // .backup .config
               2E 64 62 00 00 00 00 00 2E 73 71 6C 69 74 65 00 } // // .db.... .sqlite
      $xc2 = { 00 5C 5C 2E 5C 25 63 3A 00 25 63 3A 5C 00 00 00
               00 4E 54 46 53 00 00 00 00 5C }  // \\.\%c: %c:\0\0\0 NTFS\0\0\0\

      $x1 = "%s:%d:%s(): [+] Overwriting \"%s\" \"..." ascii

      $s1 = "C:\\Windows\\System32\\drivers\\beep.sys" ascii fullword
      $s2 = "\\DosDevices\\sectorio" wide fullword

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 2000KB
      and ( 
         1 of ($x*)
         or 2 of them
      )
      or 3 of them

Full rule:
rule APT_MAL_IR_DruidFly_Wiper_Jun25 {
   meta:
      description = "Detects Wiper used by the Iranian DruidFly group"
      author = "Florian Roth"
      reference = "https://x.com/threatintel/status/[PII_REDACTED]32231444"
      date = "2025-06-21"
      score = 80
      hash1 = "81eb22828306f3197b35fef2035cef2c548f587f[PII_REDACTED][PII_REDACTED]89d7"
   strings:
      $xc1 = { 2E 62 61 63 6B 75 70 00 2E 63 6F 6E 66 69 67 00   // .backup .config
               2E 64 62 00 00 00 00 00 2E 73 71 6C 69 74 65 00 } // // .db.... .sqlite
      $xc2 = { 00 5C 5C 2E 5C 25 63 3A 00 25 63 3A 5C 00 00 00
               00 4E 54 46 53 00 00 00 00 5C }  // \\.\%c: %c:\0\0\0 NTFS\0\0\0\

      $x1 = "%s:%d:%s(): [+] Overwriting \"%s\" \"..." ascii

      $s1 = "C:\\Windows\\System32\\drivers\\beep.sys" ascii fullword
      $s2 = "\\DosDevices\\sectorio" wide fullword
   condition:
      uint16(0) == 0x5a4d
      and filesize < 2000KB
      and ( 
         1 of ($x*)
         or 2 of them
      )
      or 3 of them
}