deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: AppInitHook
Repository: Neo23x0/signature-base
Detects: AppInitGlobalHooks-Mimikatz - Hide Mimikatz From Process Lists - file AppInitHook.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/Z292v6

Pattern signatures:
$s0 = "\\Release\\AppInitHook.pdb" ascii
      $s1 = "AppInitHook.dll" fullword ascii
      $s2 = "mimikatz.exe" fullword wide
      $s3 = "]X86Instruction->OperandSize >= Operand->Length" fullword wide
      $s4 = "mhook\\disasm-lib\\disasm.c" fullword wide
      $s5 = "mhook\\disasm-lib\\disasm_x86.c" fullword wide
      $s6 = "VoidFunc" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and 4 of them

Full rule:
rule AppInitHook {
   meta:
      description = "AppInitGlobalHooks-Mimikatz - Hide Mimikatz From Process Lists - file AppInitHook.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/Z292v6"
      date = "2015-07-15"
      score = 70
      hash = "e7563e4f2a7e5f04a3486db4cefffba173349911a3c6abd7ae616d3bf08cfd45"
      id = "73[PII_REDACTED]-5cdf-b59c-f4da67d2d2ab"
   strings:
      $s0 = "\\Release\\AppInitHook.pdb" ascii
      $s1 = "AppInitHook.dll" fullword ascii
      $s2 = "mimikatz.exe" fullword wide
      $s3 = "]X86Instruction->OperandSize >= Operand->Length" fullword wide
      $s4 = "mhook\\disasm-lib\\disasm.c" fullword wide
      $s5 = "mhook\\disasm-lib\\disasm_x86.c" fullword wide
      $s6 = "VoidFunc" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and 4 of them
}
YARA Detection Rule: HKTL_Mimikatz_SkeletonKey_in_memory_Aug20_1
Repository: Neo23x0/signature-base
Detects: Detects Mimikatz SkeletonKey in Memory
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/sbousseaden/status/[PII_REDACTED]31600384?s=12

Pattern signatures:
$x1 = { 60 ba 4f ca c7 44 24 34 dc 46 6c 7a c7 44 24 38 
              03 3c 17 81 c7 44 24 3c 94 c0 3d f6 }

Detection condition:
1 of them

Full rule:
rule HKTL_Mimikatz_SkeletonKey_in_memory_Aug20_1 {
   meta:
      description = "Detects Mimikatz SkeletonKey in Memory"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/sbousseaden/status/[PII_REDACTED]31600384?s=12"
      date = "2020-08-09"
      id = "e7c1c512-e944-5d87-ac57-cdc9ab7cf660"
   strings:
      $x1 = { 60 ba 4f ca c7 44 24 34 dc 46 6c 7a c7 44 24 38 
              03 3c 17 81 c7 44 24 3c 94 c0 3d f6 }
   condition:
      1 of them
}
YARA Detection Rule: HKTL_mimikatz_memssp_hookfn
Repository: Neo23x0/signature-base
Detects: Detects Default Mimikatz memssp module in-memory
Author: SBousseaden
Reference: https://github.com/sbousseaden/YaraHunts/blob/master/mimikatz_memssp_hookfn.yara

Pattern signatures:
$xc1 = { 48 81 EC A8 00 00 00 C7 84 24 88 00 00 00 ?? ?? 
               ?? ?? C7 84 24 8C 00 00 00 ?? ?? ?? ?? C7 84 24 
               90 00 00 00 ?? ?? ?? 00 C7 84 24 80 00 00 00 61 
               00 00 00 C7 44 24 40 5B 00 25 00 C7 44 24 44 30 
               00 38 00 C7 44 24 48 78 00 3A 00 C7 44 24 4C 25 
               00 30 00 C7 44 24 50 38 00 78 00 C7 44 24 54 5D 
               00 20 00 C7 44 24 58 25 00 77 00 C7 44 24 5C 5A 
               00 5C 00 C7 44 24 60 25 00 77 00 C7 44 24 64 5A 
               00 09 00 C7 44 24 68 25 00 77 00 C7 44 24 6C 5A 
               00 0A 00 C7 44 24 70 00 00 00 00 48 8D 94 24 80 
               00 00 00 48 8D 8C 24 88 00 00 00 48 B8 A0 7D ?? 
               ?? ?? ?? 00 00 FF D0 } // memssp creds logging function
      // $xc2 = {6D 69 6D 69 C7 84 24 8C 00 00 00 6C 73 61 2E C7 84 24 90 00 00 00 6C 6F 67} -  mimilsa.log

Detection condition:
$xc1 // you can set condition to $xc1 and not $xc2 to detect non lazy memssp users

Full rule:
rule HKTL_mimikatz_memssp_hookfn {
   meta:
      description = "Detects Default Mimikatz memssp module in-memory"
      author = "SBousseaden"
      date = "2020-08-26"
      reference = "https://github.com/sbousseaden/YaraHunts/blob/master/mimikatz_memssp_hookfn.yara"
      score = 70
      id = "89940110-8a5e-5a28-bf64-3b568f8ef1f8"
   strings: 
      $xc1 = { 48 81 EC A8 00 00 00 C7 84 24 88 00 00 00 ?? ?? 
               ?? ?? C7 84 24 8C 00 00 00 ?? ?? ?? ?? C7 84 24 
               90 00 00 00 ?? ?? ?? 00 C7 84 24 80 00 00 00 61 
               00 00 00 C7 44 24 40 5B 00 25 00 C7 44 24 44 30 
               00 38 00 C7 44 24 48 78 00 3A 00 C7 44 24 4C 25 
               00 30 00 C7 44 24 50 38 00 78 00 C7 44 24 54 5D 
               00 20 00 C7 44 24 58 25 00 77 00 C7 44 24 5C 5A 
               00 5C 00 C7 44 24 60 25 00 77 00 C7 44 24 64 5A 
               00 09 00 C7 44 24 68 25 00 77 00 C7 44 24 6C 5A 
               00 0A 00 C7 44 24 70 00 00 00 00 48 8D 94 24 80 
               00 00 00 48 8D 8C 24 88 00 00 00 48 B8 A0 7D ?? 
               ?? ?? ?? 00 00 FF D0 } // memssp creds logging function
      // $xc2 = {6D 69 6D 69 C7 84 24 8C 00 00 00 6C 73 61 2E C7 84 24 90 00 00 00 6C 6F 67} -  mimilsa.log
   condition: 
      $xc1 // you can set condition to $xc1 and not $xc2 to detect non lazy memssp users 
}
YARA Detection Rule: HKTL_mimikatz_icon
Repository: Neo23x0/signature-base
Detects: Detects mimikatz icon in PE file
Author: Arnim Rupp
Reference: https://blog.gentilkiwi.com/mimikatz

Pattern signatures:
$ico = {79 e1 d7 ff 7e e5 db ff 7f e8 dc ff 85 eb dd ff ba ff f1 ff 66 a0 b6 ff 01 38 61 ff 22 50 75 c3}

Detection condition:
uint16(0) == 0x5A4D and
        $ico and
        filesize < 10MB

Full rule:
rule HKTL_mimikatz_icon {
    meta:
        description = "Detects mimikatz icon in PE file"
        license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
        author = "Arnim Rupp"
        reference = "https://blog.gentilkiwi.com/mimikatz"
        date = "2023-02-18"
        score = 60
        hash1 = "61c0810a23580cf492a6ba4f[PII_REDACTED]331e7a4134c968c2d6a05261b2d8a1"
        hash2 = "1c3f584164ef595a[PII_REDACTED]9a11e17e46f9982fdcee020cf5e23bad1a0925"
        hash3 = "c6bb98b24206228a54493274ff9757ce7e0cbb4ab2968af978811cc4a98fde85"
        hash4 = "721d3476cdc655305902d682651fffbe72e54a97cd7e91f44d1a47606bae47ab"
        hash5 = "c0f3523151fa307248b2c64bdaac5f167b19be6fccff9eba92ac363f6d5d2595"
        id = "2a5ea476-a30d-5eac-b57a-3fb49386c046"
    strings:
        $ico = {79 e1 d7 ff 7e e5 db ff 7f e8 dc ff 85 eb dd ff ba ff f1 ff 66 a0 b6 ff 01 38 61 ff 22 50 75 c3}
    condition:
        uint16(0) == 0x5A4D and
        $ico and
        filesize < 10MB
}
YARA Detection Rule: KHRAT_Malware
Repository: Neo23x0/signature-base
Detects: Detects an Imphash of KHRAT malware
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and pe.imphash() == "6a8478ad861f98f8428a042f74de1944"

Full rule:
rule KHRAT_Malware {
   meta:
      description = "Detects an Imphash of KHRAT malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
      date = "2017-08-31"
      hash1 = "53e27fd13f26462a58fa5587ecd244cab4da23aa80cf0ed6eb5ee9f9de2688c1"
      id = "3e6a5aca-9898-5864-8974-ca4adf272893"
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and pe.imphash() == "6a8478ad861f98f8428a042f74de1944"
}
YARA Detection Rule: MAL_KHRAT_script
Repository: Neo23x0/signature-base
Detects: Rule derived from KHRAT script but can match on other malicious scripts as well
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/

Pattern signatures:
$x1 = "CreateObject(\"WScript.Shell\").Run \"schtasks /create /sc MINUTE /tn" ascii
      $x2 = "CreateObject(\"WScript.Shell\").Run \"rundll32.exe javascript:\"\"\\..\\mshtml,RunHTMLApplication" ascii
      $x3 = "<registration progid=\"ff010f\" classid=\"{e934870c-b429-4d0d-acf1-eef338b92c4b}\" >" fullword ascii

Detection condition:
1 of them

Full rule:
rule MAL_KHRAT_script {
   meta:
      description = "Rule derived from KHRAT script but can match on other malicious scripts as well"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
      date = "2017-08-31"
      hash1 = "8c88b4177b59f4cac820b0019bcc7f6d3d50ce4badb689759ab0966780ae32e3"
      id = "fd[PII_REDACTED]-560e-a6b2-129a880026aa"
   strings:
      $x1 = "CreateObject(\"WScript.Shell\").Run \"schtasks /create /sc MINUTE /tn" ascii
      $x2 = "CreateObject(\"WScript.Shell\").Run \"rundll32.exe javascript:\"\"\\..\\mshtml,RunHTMLApplication" ascii
      $x3 = "<registration progid=\"ff010f\" classid=\"{e934870c-b429-4d0d-acf1-eef338b92c4b}\" >" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: MAL_KHRAT_scritplet
Repository: Neo23x0/signature-base
Detects: Rule derived from KHRAT scriptlet
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/

Pattern signatures:
$x1 = "http.open \"POST\", \"http://update.upload-dropbox[.]com/docs/tz/GetProcess.php\",False,\"\",\"\" " fullword ascii
      $x2 = "Process=Process & Chr(32) & Chr(32) & Chr(32) & Obj.Description" fullword ascii

      $s1 = "http.SetRequestHeader \"Content-Type\", \"application/json\" " fullword ascii
      $s2 = "Dim http,WMI,Objs,Process" fullword ascii
      $s3 = "Set Objs=WMI.InstancesOf(\"Win32_Process\")" fullword ascii
      $s4 = "'WScript.Echo http.responseText " fullword ascii

Detection condition:
uint16(0) == 0x3f3c and filesize < 1KB and ( 1 of ($x*) or 4 of them )

Full rule:
rule MAL_KHRAT_scritplet {
   meta:
      description = "Rule derived from KHRAT scriptlet"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
      date = "2017-08-31"
      hash1 = "cdb9104636a6f7c6018fe99bc18fb8b542689a84c23c10e9ea13d5aa275fd40e"
      id = "f72d68a3-0409-5401-b6a1-ca8f188d7409"
   strings:
      $x1 = "http.open \"POST\", \"http://update.upload-dropbox[.]com/docs/tz/GetProcess.php\",False,\"\",\"\" " fullword ascii
      $x2 = "Process=Process & Chr(32) & Chr(32) & Chr(32) & Obj.Description" fullword ascii

      $s1 = "http.SetRequestHeader \"Content-Type\", \"application/json\" " fullword ascii
      $s2 = "Dim http,WMI,Objs,Process" fullword ascii
      $s3 = "Set Objs=WMI.InstancesOf(\"Win32_Process\")" fullword ascii
      $s4 = "'WScript.Echo http.responseText " fullword ascii
   condition:
      uint16(0) == 0x3f3c and filesize < 1KB and ( 1 of ($x*) or 4 of them )
}
YARA Detection Rule: HKTL_EXPL_WIN_PS1_BadSuccessor_May25
Repository: Neo23x0/signature-base
Detects: Detects PowerShell tool called Get-BadSuccessorOUPermissions.ps1 that helps exploit a vulnerability in Active Directory. Lists every principal that can perform a BadSuccessor attack and the OUs where it holds the required permissions.
Author: Florian Roth
Reference: https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory

Pattern signatures:
$x1 = "function Get-BadSuccessorOUPermissions" ascii wide
      $x2 = "\"0feb936f-47b3-49f2-9386-1dedc2c23765\"=\"msDS-DelegatedManagedServiceAccount\"" ascii wide
      $x3 = "CreateChild|GenericAll|WriteDACL|WriteOwner" ascii wide

Detection condition:
filesize < 20MB and 1 of them

Full rule:
rule HKTL_EXPL_WIN_PS1_BadSuccessor_May25 {
   meta:
      description = "Detects PowerShell tool called Get-BadSuccessorOUPermissions.ps1 that helps exploit a vulnerability in Active Directory. Lists every principal that can perform a BadSuccessor attack and the OUs where it holds the required permissions."
      author = "Florian Roth"
      reference = "https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory"
      date = "2025-05-22"
      score = 75
   strings:
      $x1 = "function Get-BadSuccessorOUPermissions" ascii wide
      $x2 = "\"0feb936f-47b3-49f2-9386-1dedc2c23765\"=\"msDS-DelegatedManagedServiceAccount\"" ascii wide
      $x3 = "CreateChild|GenericAll|WriteDACL|WriteOwner" ascii wide
   condition:
      filesize < 20MB and 1 of them
}
YARA Detection Rule: SUSP_EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22_1
Repository: Neo23x0/signature-base
Detects: Detects payload as seen in PoC code to exploit Workspace ONE Access freemarker server-side template injection CVE-2022-22954
Author: Florian Roth
Reference: https://github.com/sherlocksecurity/VMware-CVE-2022-22954

Pattern signatures:
$x2 = "${\"freemarker.template.utility.Execute\"?new()("
      $x3 = "cat /etc/passwd\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
      $x4 = "cat /etc/passwd\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"
      $x5 = "cat /etc/shadow\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
      $x6 = "cat /etc/shadow\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"

      $fpg1 = "All Rights"
      $fpg2 = "<html"
      $fpg3 = "<HTML"
      $fpg4 = "Copyright" ascii wide
      $fpg5 = "License"
      $fpg6 = "<?xml"
      $fpg7 = "Help" fullword
      $fpg8 = "COPYRIGHT" ascii wide fullword
      $fpg9 = "Backup"

      $fp1 = "severity: critical" // nuclei

Detection condition:
1 of ($x*)
      and not 1 of ($fp*)

Full rule:
rule SUSP_EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22_1 {
   meta:
      old_rule_name = "EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22"
      description = "Detects payload as seen in PoC code to exploit Workspace ONE Access freemarker server-side template injection CVE-2022-22954"
      author = "Florian Roth"
      reference = "https://github.com/sherlocksecurity/VMware-CVE-2022-22954"
      reference2 = "https://twitter.com/rwincey/status/[PII_REDACTED]94853891/photo/1"
      date = "2022-04-08"
      modified = "2025-03-29"
      score = 60
   strings:
      $x2 = "${\"freemarker.template.utility.Execute\"?new()("
      $x3 = "cat /etc/passwd\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
      $x4 = "cat /etc/passwd\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"
      $x5 = "cat /etc/shadow\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
      $x6 = "cat /etc/shadow\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"

      $fpg1 = "All Rights"
      $fpg2 = "<html"
      $fpg3 = "<HTML"
      $fpg4 = "Copyright" ascii wide
      $fpg5 = "License"
      $fpg6 = "<?xml"
      $fpg7 = "Help" fullword
      $fpg8 = "COPYRIGHT" ascii wide fullword
      $fpg9 = "Backup"

      $fp1 = "severity: critical" // nuclei
   condition:
      1 of ($x*)
      and not 1 of ($fp*)
}
YARA Detection Rule: LOG_SUSP_EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22_
Repository: Neo23x0/signature-base
Detects: Detects payload as seen in PoC code to exploit Workspace ONE Access freemarker server-side template injection CVE-2022-22954
Author: Florian Roth
Reference: https://github.com/sherlocksecurity/VMware-CVE-2022-22954

Pattern signatures:
$x1 = "66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28" ascii

      $fp2 = "ModSecurity"
      $fp3 = " 302 -"

Detection condition:
1 of ($x*)
      and not 1 of ($fp*)

Full rule:
rule LOG_SUSP_EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22_ {
   meta:
      old_rule_name = "EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22"
      description = "Detects payload as seen in PoC code to exploit Workspace ONE Access freemarker server-side template injection CVE-2022-22954"
      author = "Florian Roth"
      reference = "https://github.com/sherlocksecurity/VMware-CVE-2022-22954"
      reference2 = "https://twitter.com/rwincey/status/[PII_REDACTED]94853891/photo/1"
      date = "2022-04-08"
      modified = "2025-03-29"
      score = 60
   strings:
      $x1 = "66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28" ascii

      $fp2 = "ModSecurity"
      $fp3 = " 302 -"
   condition:
      1 of ($x*)
      and not 1 of ($fp*)
}
YARA Detection Rule: TeleBots_IntercepterNG
Repository: Neo23x0/signature-base
Detects: Detects TeleBots malware - IntercepterNG
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4if3HG

Pattern signatures:
$s1 = "Usage: %s iface_num\\dump [mode] [w] [-gw] [-t1 ip]" fullword ascii
      $s2 = "Target%d found: %s - [%.2X-%.2X-%.2X-%.2X-%.2X-%.2X]" fullword ascii
      $s3 = "3: passwords + files, no arp poison" fullword ascii
      $s4 = "IRC Joining Keyed Channel intercepted" fullword ascii
      $s5 = "-tX - set target ip" fullword ascii
      $s6 = "w - save session to .pcap dump" fullword ascii
      $s7 = "example: %s 1 1 -gw 192.168.1.1 -t1 192.168.1.3 -t2 192.168.1.5" fullword ascii
      $s8 = "ORACLE8 DES Authorization intercepted" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and 1 of them ) or ( 4 of them )

Full rule:
rule TeleBots_IntercepterNG {
   meta:
      description = "Detects TeleBots malware - IntercepterNG"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4if3HG"
      date = "2016-12-14"
      hash1 = "5f9fef7974d37922ac91365588fbe7b544e13abbbde7c262fe30bade7026e118"
      id = "f4d48eb6-8235-534d-a32f-7f2711b96e9d"
   strings:
      $s1 = "Usage: %s iface_num\\dump [mode] [w] [-gw] [-t1 ip]" fullword ascii
      $s2 = "Target%d found: %s - [%.2X-%.2X-%.2X-%.2X-%.2X-%.2X]" fullword ascii
      $s3 = "3: passwords + files, no arp poison" fullword ascii
      $s4 = "IRC Joining Keyed Channel intercepted" fullword ascii
      $s5 = "-tX - set target ip" fullword ascii
      $s6 = "w - save session to .pcap dump" fullword ascii
      $s7 = "example: %s 1 1 -gw 192.168.1.1 -t1 192.168.1.3 -t2 192.168.1.5" fullword ascii
      $s8 = "ORACLE8 DES Authorization intercepted" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 500KB and 1 of them ) or ( 4 of them )
}
YARA Detection Rule: TeleBots_KillDisk_1
Repository: Neo23x0/signature-base
Detects: Detects TeleBots malware - KillDisk
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4if3HG

Pattern signatures:
$s1 = "Plug-And-Play Support Service" fullword wide
      $s2 = " /c \"echo Y|" fullword wide
      $s3 = "-set=06.12.2016#09:30 -est=1410" fullword ascii
      $s4 = "%d.%d.%d#%d:%d" fullword ascii
      $s5 = " /T /C /G " fullword wide
      $s6 = "[-] > %ls" fullword wide
      $s7 = "[+] > %ls" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and 4 of them ) or ( 6 of them )

Full rule:
rule TeleBots_KillDisk_1 {
   meta:
      description = "Detects TeleBots malware - KillDisk"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4if3HG"
      date = "2016-12-14"
      hash1 = "8246f709efa922a485e1ca32d8b0d10dc752618e8b3fce4d3dd58d10e4a6a16d"
      id = "111fc6bc-b790-51b9-81b7-a4716bb0aee9"
   strings:
      $s1 = "Plug-And-Play Support Service" fullword wide
      $s2 = " /c \"echo Y|" fullword wide
      $s3 = "-set=06.12.2016#09:30 -est=1410" fullword ascii
      $s4 = "%d.%d.%d#%d:%d" fullword ascii
      $s5 = " /T /C /G " fullword wide
      $s6 = "[-] > %ls" fullword wide
      $s7 = "[+] > %ls" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 500KB and 4 of them ) or ( 6 of them )
}
YARA Detection Rule: TeleBots_KillDisk_2
Repository: Neo23x0/signature-base
Detects: Detects TeleBots malware - KillDisk
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4if3HG

Pattern signatures:
$s1 = "Plug-And-Play Support Service" fullword wide
      $s2 = " /c \"echo Y|" fullword wide
      $s3 = "%d.%d.%d#%d:%d" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and all of them )

Full rule:
rule TeleBots_KillDisk_2 {
   meta:
      description = "Detects TeleBots malware - KillDisk"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4if3HG"
      date = "2016-12-14"
      hash1 = "26173c9ec8fd1c4f9f18f89683b23267f6f9d116196ed15655e9cb453af2890e"
      id = "7797187f-c94b-5323-ae43-2dc001f0b481"
   strings:
      $s1 = "Plug-And-Play Support Service" fullword wide
      $s2 = " /c \"echo Y|" fullword wide
      $s3 = "%d.%d.%d#%d:%d" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 500KB and all of them )
}
YARA Detection Rule: TeleBots_CredRaptor_Password_Stealer
Repository: Neo23x0/signature-base
Detects: Detects TeleBots malware - CredRaptor Password Stealer
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4if3HG

Pattern signatures:
$s1 = "C:\\Documents and Settings\\Administrator\\Desktop\\GetPAI\\Out\\IE.pdb" fullword ascii
      $s2 = "SELECT encryptedUsername, encryptedPassword, hostname,httpRealm FROM moz_logins" fullword ascii
      $s3 = "SELECT ORIGIN_URL,USERNAME_VALUE,PASSWORD_VALUE FROM LOGINS" fullword ascii
      $s4 = ".\\PAI\\IEforXPpasswords.txt" ascii
      $s5 = "\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
      $s6 = "Opera old version credentials" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and 2 of them ) or ( 4 of them )

Full rule:
rule TeleBots_CredRaptor_Password_Stealer {
   meta:
      description = "Detects TeleBots malware - CredRaptor Password Stealer"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4if3HG"
      date = "2016-12-14"
      modified = "2023-01-06"
      hash1 = "50b990f6555055a265fde98324759dbc74619d6a7c49b9fd786775299bf77d26"
      id = "f594a946-13b4-5179-9029-a0730634d55f"
   strings:
      $s1 = "C:\\Documents and Settings\\Administrator\\Desktop\\GetPAI\\Out\\IE.pdb" fullword ascii
      $s2 = "SELECT encryptedUsername, encryptedPassword, hostname,httpRealm FROM moz_logins" fullword ascii
      $s3 = "SELECT ORIGIN_URL,USERNAME_VALUE,PASSWORD_VALUE FROM LOGINS" fullword ascii
      $s4 = ".\\PAI\\IEforXPpasswords.txt" ascii
      $s5 = "\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
      $s6 = "Opera old version credentials" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 2 of them ) or ( 4 of them )
}