deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SUSP_Msdt_Artefact_Jun22_2
Repository: Neo23x0/signature-base
Detects: Detects suspicious pattern in msdt diagnostics log (e.g. CVE-2022-30190 / Follina exploitation)
Author: Christian Burkard
Reference: https://twitter.com/nas_bench/status/[PII_REDACTED]94844928

Pattern signatures:
$a1 = "<ScriptError><Data id=\"ScriptName\" name=\"Script\">TS_ProgramCompatibilityWizard.ps1" ascii

      $x1 = "/../../" ascii
      $x2 = "$(Invoke-Expression" ascii
      $x3 = "$(IEX(" ascii nocase

Detection condition:
uint32(0) == 0x6D783F3C /* <?xm */
      and $a1
      and 1 of ($x*)

Full rule:
rule SUSP_Msdt_Artefact_Jun22_2 {
   meta:
      description = "Detects suspicious pattern in msdt diagnostics log (e.g. CVE-2022-30190 / Follina exploitation)"
      author = "Christian Burkard"
      date = "2022-06-01"
      modified = "2022-07-29"
      reference = "https://twitter.com/nas_bench/status/[PII_REDACTED]94844928"
      score = 75
      id = "aa2a4bd7-2094-5652-a088-f58d0c7d3f62"
   strings:
      $a1 = "<ScriptError><Data id=\"ScriptName\" name=\"Script\">TS_ProgramCompatibilityWizard.ps1" ascii

      $x1 = "/../../" ascii
      $x2 = "$(Invoke-Expression" ascii
      $x3 = "$(IEX(" ascii nocase
   condition:
      uint32(0) == 0x6D783F3C /* <?xm */
      and $a1
      and 1 of ($x*)
}
YARA Detection Rule: SUSP_LNK_Follina_Jun22
Repository: Neo23x0/signature-base
Detects: Detects LNK files with suspicious Follina/CVE-2022-30190 strings
Author: Paul Hager
Reference: https://twitter.com/gossithedog/status/[PII_REDACTED]05950727

Pattern signatures:
$sa1 = "msdt.exe" ascii wide
      $sa2 = "msdt " ascii wide
      $sa3 = "ms-msdt:" ascii wide

      $sb = "IT_BrowseForFile=" ascii wide

Detection condition:
filesize < 5KB and
      uint16(0) == 0x004c and uint32(4) == 0x00021401 and
      1 of ($sa*) and $sb

Full rule:
rule SUSP_LNK_Follina_Jun22 {
   meta:
      description = "Detects LNK files with suspicious Follina/CVE-2022-30190 strings"
      author = "Paul Hager"
      date = "2022-06-02"
      reference = "https://twitter.com/gossithedog/status/[PII_REDACTED]05950727"
      score = 75
      id = "d331d584-2ab3-5275-b435-6129c7291417"
   strings:
      $sa1 = "msdt.exe" ascii wide
      $sa2 = "msdt " ascii wide
      $sa3 = "ms-msdt:" ascii wide

      $sb = "IT_BrowseForFile=" ascii wide
   condition:
      filesize < 5KB and
      uint16(0) == 0x004c and uint32(4) == 0x00021401 and
      1 of ($sa*) and $sb
}
YARA Detection Rule: APT_TA18_149A_Joanap_Sample1
Repository: Neo23x0/signature-base
Detects: Detects malware from TA18-149A report by US-CERT
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/alerts/TA18-149A

Pattern signatures:
$x1 = "cmd.exe /q /c net share adnim$" ascii
      $x2 = "\\\\%s\\adnim$\\system32\\%s" fullword ascii
      $s1 = "SMB_Dll.dll" fullword ascii
      $s2 = "%s User or Password is not correct!" fullword ascii
      $s3 = "perfw06.dat" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
         pe.imphash() == "f0087d7b90876a2769f2229c6789fcf3" or
         1 of ($x*) or
         2 of them
      )

Full rule:
rule APT_TA18_149A_Joanap_Sample1 {
   meta:
      description = "Detects malware from TA18-149A report by US-CERT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
      date = "2018-05-30"
      hash1 = "ea46ed5aed900cd9f01156a1cd446cbb3e10191f9f980e9f710ea1c20440c781"
      id = "a3a4f9a6-367d-5d99-bffb-f4ff03fa4a09"
   strings:
      $x1 = "cmd.exe /q /c net share adnim$" ascii
      $x2 = "\\\\%s\\adnim$\\system32\\%s" fullword ascii
      $s1 = "SMB_Dll.dll" fullword ascii
      $s2 = "%s User or Password is not correct!" fullword ascii
      $s3 = "perfw06.dat" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and (
         pe.imphash() == "f0087d7b90876a2769f2229c6789fcf3" or
         1 of ($x*) or
         2 of them
      )
}
YARA Detection Rule: APT_TA18_149A_Joanap_Sample2
Repository: Neo23x0/signature-base
Detects: Detects malware from TA18-149A report by US-CERT
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/alerts/TA18-149A

Pattern signatures:
$s1 = "%SystemRoot%\\system32\\svchost.exe -k Wmmvsvc" fullword ascii
      $s2 = "%SystemRoot%\\system32\\svchost.exe -k SCardPrv" fullword ascii
      $s3 = "%SystemRoot%\\system32\\Wmmvsvc.dll" fullword ascii
      $s4 = "%SystemRoot%\\system32\\scardprv.dll" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and (
         pe.imphash() == "e8cd12071a8e823ebc434c8ee3e23203" or
         2 of them
      )

Full rule:
rule APT_TA18_149A_Joanap_Sample2 {
   meta:
      description = "Detects malware from TA18-149A report by US-CERT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
      date = "2018-05-30"
      hash1 = "077d9e0e12357d27f7f0c336239e961a[PII_REDACTED]f7a3f10268d9439ef67885"
      id = "9f4e6e6c-ee2b-5fa3-bf85-5a1652b38c52"
   strings:
      $s1 = "%SystemRoot%\\system32\\svchost.exe -k Wmmvsvc" fullword ascii
      $s2 = "%SystemRoot%\\system32\\svchost.exe -k SCardPrv" fullword ascii
      $s3 = "%SystemRoot%\\system32\\Wmmvsvc.dll" fullword ascii
      $s4 = "%SystemRoot%\\system32\\scardprv.dll" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 600KB and (
         pe.imphash() == "e8cd12071a8e823ebc434c8ee3e23203" or
         2 of them
      )
}
YARA Detection Rule: APT_TA18_149A_Joanap_Sample3
Repository: Neo23x0/signature-base
Detects: Detects malware from TA18-149A report by US-CERT
Author: Florian Roth (Nextron Systems)
Reference: https://www.us-cert.gov/ncas/alerts/TA18-149A

Pattern signatures:
$s1 = "mssvcdll.dll" fullword ascii
      $s2 = "https://www.google.com/index.html" fullword ascii
      $s3 = "LOGINDLG" fullword wide
      $s4 = "rundll" fullword ascii
      $s5 = "%%s\\%%s%%0%dd.%%s" fullword ascii
      $s6 = "%%s\\%%s%%0%dd" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (
         pe.imphash() == "f6f7b2e00921129d[PII_REDACTED]111cd" or
         3 of them
      )

Full rule:
rule APT_TA18_149A_Joanap_Sample3 {
   meta:
      description = "Detects malware from TA18-149A report by US-CERT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
      date = "2018-05-30"
      hash1 = "a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717"
      id = "1c2551bc-01dd-5b30-a4cc-703a868cde73"
   strings:
      $s1 = "mssvcdll.dll" fullword ascii
      $s2 = "https://www.google.com/index.html" fullword ascii
      $s3 = "LOGINDLG" fullword wide
      $s4 = "rundll" fullword ascii
      $s5 = "%%s\\%%s%%0%dd.%%s" fullword ascii
      $s6 = "%%s\\%%s%%0%dd" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
         pe.imphash() == "f6f7b2e00921129d[PII_REDACTED]111cd" or
         3 of them
      )
}
YARA Detection Rule: Sofacy_Fybis_ELF_Backdoor_Gen1
Repository: Neo23x0/signature-base
Detects: Detects Sofacy Fysbis Linux Backdoor
Author: Florian Roth (Nextron Systems)
Reference: http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/

Pattern signatures:
$x1 = "Your command not writed to pipe" fullword ascii
		$x2 = "Terminal don`t started for executing command" fullword ascii
		$x3 = "Command will have end with \\n" fullword ascii

		$s1 = "WantedBy=multi-user.target' >> /usr/lib/systemd/system/" ascii
		$s2 = "Success execute command or long for waiting executing your command" fullword ascii
		$s3 = "ls /etc | egrep -e\"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release\"" fullword ascii
		$s4 = "rm -f /usr/lib/systemd/system/" ascii
		$s5 = "ExecStart=" fullword ascii
		$s6 = "<table><caption><font size=4 color=red>TABLE EXECUTE FILES</font></caption>" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 500KB and 1 of ($x*) ) or
		( 1 of ($x*) and 3 of ($s*) )

Full rule:
rule Sofacy_Fybis_ELF_Backdoor_Gen1 {
	meta:
		description = "Detects Sofacy Fysbis Linux Backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
		date = "2016-02-13"
		modified = "2023-01-27"
		score = 80
		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
		id = "c6abf33e-9c5b-5e0f-b7f0-a0741bf9cc3a"
	strings:
		$x1 = "Your command not writed to pipe" fullword ascii
		$x2 = "Terminal don`t started for executing command" fullword ascii
		$x3 = "Command will have end with \\n" fullword ascii

		$s1 = "WantedBy=multi-user.target' >> /usr/lib/systemd/system/" ascii
		$s2 = "Success execute command or long for waiting executing your command" fullword ascii
		$s3 = "ls /etc | egrep -e\"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release\"" fullword ascii
		$s4 = "rm -f /usr/lib/systemd/system/" ascii
		$s5 = "ExecStart=" fullword ascii
		$s6 = "<table><caption><font size=4 color=red>TABLE EXECUTE FILES</font></caption>" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 500KB and 1 of ($x*) ) or
		( 1 of ($x*) and 3 of ($s*) )
}
YARA Detection Rule: Sofacy_Fysbis_ELF_Backdoor_Gen2
Repository: Neo23x0/signature-base
Detects: Detects Sofacy Fysbis Linux Backdoor
Author: Florian Roth (Nextron Systems)
Reference: http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/

Pattern signatures:
$s1 = "RemoteShell" ascii
		$s2 = "basic_string::_M_replace_dispatch" fullword ascii
		$s3 = "HttpChannel" ascii

Detection condition:
uint16(0) == 0x457f and filesize < 500KB and all of them

Full rule:
rule Sofacy_Fysbis_ELF_Backdoor_Gen2 {
	meta:
		description = "Detects Sofacy Fysbis Linux Backdoor"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
		date = "2016-02-13"
		score = 80
		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
		hash3 = "fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61"
		id = "d4e3a8bb-b23a-53a4-b5fb-b321a3417b43"
	strings:
		$s1 = "RemoteShell" ascii
		$s2 = "basic_string::_M_replace_dispatch" fullword ascii
		$s3 = "HttpChannel" ascii
	condition:
		uint16(0) == 0x457f and filesize < 500KB and all of them
}
YARA Detection Rule: WEBSHELL_ASPX_DLL_MOVEit_Jun23_1
Repository: Neo23x0/signature-base
Detects: Detects compiled ASPX web shells found being used in MOVEit Transfer exploitation
Author: Florian Roth
Reference: https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/?utm_content=251159938&utm_medium=social&utm_source=twitter&hss_channel=tw-403811306

Pattern signatures:
$x1 = "human2_aspx" ascii fullword
      $x2 = "X-siLock-Comment" wide
      $x3 = "x-siLock-Step1" wide

      $a1 = "MOVEit.DMZ.Core.Data" ascii fullword

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 40KB and (
         1 of ($x*) and $a1
      ) or all of them

Full rule:
rule WEBSHELL_ASPX_DLL_MOVEit_Jun23_1 {
   meta:
      description = "Detects compiled ASPX web shells found being used in MOVEit Transfer exploitation"
      author = "Florian Roth"
      reference = "https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/?utm_content=251159938&utm_medium=social&utm_source=twitter&hss_channel=tw-403811306"
      date = "2023-06-01"
      score = 85
      hash1 = "6cbf38f5f27e6a3eaf32e2ac73ed02898cbb5961566bb445e3c511906e2da1fa"
      id = "47db8602-9a9e-5efc-b8b9-fbc4f3c8d4e9"
   strings:
      $x1 = "human2_aspx" ascii fullword
      $x2 = "X-siLock-Comment" wide
      $x3 = "x-siLock-Step1" wide

      $a1 = "MOVEit.DMZ.Core.Data" ascii fullword
   condition:
      uint16(0) == 0x5a4d and
      filesize < 40KB and (
         1 of ($x*) and $a1
      ) or all of them
}
YARA Detection Rule: WEBSHELL_ASPX_MOVEit_Jun23_1
Repository: Neo23x0/signature-base
Detects: Detects ASPX web shells as being used in MOVEit Transfer exploitation
Author: Florian Roth
Reference: https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/

Pattern signatures:
$s1 = "X-siLock-Comment" ascii fullword   
      $s2 = "]; string x = null;" ascii
      $s3 = ";  if (!String.Equals(pass, " ascii

Detection condition:
filesize < 150KB and 2 of them

Full rule:
rule WEBSHELL_ASPX_MOVEit_Jun23_1 {
   meta:
      description = "Detects ASPX web shells as being used in MOVEit Transfer exploitation"
      author = "Florian Roth"
      reference = "https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/"
      date = "2023-06-01"
      score = 85
      hash1 = "2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5"
      hash2 = "48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a"
      hash3 = "e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e"
      id = "2c789b9c-5ec5-5fd1-84e3-6bf7735a9488"
   strings:
      $s1 = "X-siLock-Comment" ascii fullword   
      $s2 = "]; string x = null;" ascii
      $s3 = ";  if (!String.Equals(pass, " ascii
   condition:
      filesize < 150KB and 2 of them
}
YARA Detection Rule: LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_1
Repository: Neo23x0/signature-base
Detects: Detects a potential compromise indicator found in MOVEit Transfer logs
Author: Florian Roth
Reference: https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response

Pattern signatures:
$x1 = "POST /moveitisapi/moveitisapi.dll action=m2 " ascii
      $x2 = " GET /human2.aspx - 443 " ascii

Detection condition:
1 of them

Full rule:
rule LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_1 {
   meta:
      description = "Detects a potential compromise indicator found in MOVEit Transfer logs"
      author = "Florian Roth"
      reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
      date = "2023-06-01"
      score = 70
      id = "a7c521b8-c654-51dd-9d5b-4ba883feffe3"
   strings:
      $x1 = "POST /moveitisapi/moveitisapi.dll action=m2 " ascii
      $x2 = " GET /human2.aspx - 443 " ascii
   condition:
      1 of them
}
YARA Detection Rule: LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_2
Repository: Neo23x0/signature-base
Detects: Detects a potential compromise indicator found in MOVEit Transfer logs
Author: Florian Roth
Reference: https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response

Pattern signatures:
$a1 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/105.0.5195.102+Safari/537.36" ascii
      $a2 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/105.0.5195.54+Safari/537.36" ascii
      
      $s1 = " POST /moveitisapi/moveitisapi.dll" ascii
      $s2 = " POST /guestaccess.aspx"
      $s3 = " POST /api/v1/folders/"

      $s4 = "/files uploadType=resumable&"
      $s5 = " action=m2 "

Detection condition:
1 of ($a*) and 3 of ($s*)
      or all of ($s*)

Full rule:
rule LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_2 {
   meta:
      description = "Detects a potential compromise indicator found in MOVEit Transfer logs"
      author = "Florian Roth"
      reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
      date = "2023-06-03"
      score = 70
      id = "1527f5e3-071d-5152-9452-9c4472d258f2"
   strings:
      $a1 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/105.0.5195.102+Safari/537.36" ascii
      $a2 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/105.0.5195.54+Safari/537.36" ascii
      
      $s1 = " POST /moveitisapi/moveitisapi.dll" ascii
      $s2 = " POST /guestaccess.aspx"
      $s3 = " POST /api/v1/folders/"

      $s4 = "/files uploadType=resumable&"
      $s5 = " action=m2 "
   condition:
      1 of ($a*) and 3 of ($s*)
      or all of ($s*)
}
YARA Detection Rule: LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_3
Repository: Neo23x0/signature-base
Detects: Detects a potential compromise indicator found in MOVEit DMZ Web API logs
Author: Nasreddine Bencherchali
Reference: https://attackerkb.com/topics/mXmV0YpC3W/cve-2023-34362/rapid7-analysis

Pattern signatures:
$s1 = "TargetInvocationException" ascii
      $s2 = "MOVEit.DMZ.Application.Folders.ResumableUploadFilePartHandler.DeserializeFileUploadStream" ascii

Detection condition:
all of ($s*)

Full rule:
rule LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_3 {
   meta:
      description = "Detects a potential compromise indicator found in MOVEit DMZ Web API logs"
      author = "Nasreddine Bencherchali"
      reference = "https://attackerkb.com/topics/mXmV0YpC3W/cve-2023-34362/rapid7-analysis"
      date = "2023-06-13"
      score = 70
      id = "113a501f-d9ed-51fd-82cd-ccb6f02833bd"
   strings:
      $s1 = "TargetInvocationException" ascii
      $s2 = "MOVEit.DMZ.Application.Folders.ResumableUploadFilePartHandler.DeserializeFileUploadStream" ascii
   condition:
      all of ($s*)
}
YARA Detection Rule: CACTUSTORCH
Repository: Neo23x0/signature-base
Detects: Detects CactusTorch Hacktool
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/mdsecactivebreach/CACTUSTORCH

Pattern signatures:
$x1 = "$payload = shellcode(%options[\"listener\"], \"true\", \"x86\");" fullword ascii
      $x2 = "Copy the base64 encoded payload into the code variable below." fullword ascii
      $x3 = " CACTUSTORCH Payload" ascii
      $x4 = "ms.Write transform.TransformFinalBlock(enc.GetBytes_4(b), 0, length), 0, ((length / 4) * 3)" fullword ascii
      $x5 = "' Author: Vincent Yiu (@vysecurity)" fullword ascii
      $x6 = "Dim binary : binary = \"rundll32.exe\"" fullword ascii

      $a1 = "code = code & \"" ascii
      $a2 = "serialized_obj = serialized_obj & \"" ascii

      $s1 = "binary = \"rundll32.exe\"" fullword ascii
      $s2 = "EL.DataType = \"bin.hex\"" fullword ascii
      $s3 = "Set stm = CreateObject(\"System.IO.MemoryStream\")" fullword ascii
      $s4 = "var binary = \"rundll32.exe\";" fullword ascii
      $s5 = "var serialized_obj = \"" ascii

Detection condition:
( filesize < 800KB and
         (
            1 of ($x*) or
            ( 1 of ($a*) and 1 of ($s*) )
         )
      ) or ( 3 of them )

Full rule:
rule CACTUSTORCH {
   meta:
      description = "Detects CactusTorch Hacktool"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
      date = "2017-07-31"
      hash1 = "314e6d7d863878b6dca46af165e7f08fedd42c054d7dc3828dc80b86a3a9b98c"
      hash2 = "0305aa32d5f8484ca115bb[PII_REDACTED]af7f33ac99594ec1aa3c65644e544aea"
      hash3 = "a52d802e34ac9d7d3539019d284b04ded3b8e197d5e3b38ed61f523c3d68baa7"
      id = "75606b9e-97d5-5b8b-87f5-69b7e415b73c"
   strings:
      $x1 = "$payload = shellcode(%options[\"listener\"], \"true\", \"x86\");" fullword ascii
      $x2 = "Copy the base64 encoded payload into the code variable below." fullword ascii
      $x3 = " CACTUSTORCH Payload" ascii
      $x4 = "ms.Write transform.TransformFinalBlock(enc.GetBytes_4(b), 0, length), 0, ((length / 4) * 3)" fullword ascii
      $x5 = "' Author: Vincent Yiu (@vysecurity)" fullword ascii
      $x6 = "Dim binary : binary = \"rundll32.exe\"" fullword ascii

      $a1 = "code = code & \"" ascii
      $a2 = "serialized_obj = serialized_obj & \"" ascii

      $s1 = "binary = \"rundll32.exe\"" fullword ascii
      $s2 = "EL.DataType = \"bin.hex\"" fullword ascii
      $s3 = "Set stm = CreateObject(\"System.IO.MemoryStream\")" fullword ascii
      $s4 = "var binary = \"rundll32.exe\";" fullword ascii
      $s5 = "var serialized_obj = \"" ascii
   condition:
      ( filesize < 800KB and
         (
            1 of ($x*) or
            ( 1 of ($a*) and 1 of ($s*) )
         )
      ) or ( 3 of them )
}
YARA Detection Rule: CN_Tools_xbat
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file xbat.vbs
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "ws.run \"srss.bat /start\",0 " fullword ascii 
        $s1 = "Set ws = Wscript.CreateObject(\"Wscript.Shell\")" fullword ascii

Detection condition:
uint16(0) == 0x6553 and filesize < 0KB and all of them

Full rule:
rule CN_Tools_xbat {
    meta:
        description = "Chinese Hacktool Set - file xbat.vbs"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://tools.zjqhr.com/"
        date = "2015-06-13"
        hash = "a7005acda381a09803b860f04d4cae3fdb65d594"
        id = "5b2f0d2e-a7fb-5f5a-94a9-28e851c9756e"
    strings:
        $s0 = "ws.run \"srss.bat /start\",0 " fullword ascii 
        $s1 = "Set ws = Wscript.CreateObject(\"Wscript.Shell\")" fullword ascii 
    condition:
        uint16(0) == 0x6553 and filesize < 0KB and all of them
}
YARA Detection Rule: CN_Tools_Temp
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file Temp.war
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "META-INF/context.xml<?xml version=\"1.0\" encoding=\"UTF-8\"?>" fullword ascii 
        $s1 = "browser.jsp" fullword ascii 
        $s3 = "cmd.jsp" fullword ascii
        $s4 = "index.jsp" fullword ascii

Detection condition:
uint16(0) == 0x4b50 and filesize < 203KB and all of them

Full rule:
rule CN_Tools_Temp {
    meta:
        description = "Chinese Hacktool Set - file Temp.war"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://tools.zjqhr.com/"
        date = "2015-06-13"
        hash = "c3327ef63b0ed64c4906e9940ef877c76ebaff58"
        id = "4fbaabd0-fbf2-56a0-94af-9deba1e7cc81"
    strings:
        $s0 = "META-INF/context.xml<?xml version=\"1.0\" encoding=\"UTF-8\"?>" fullword ascii 
        $s1 = "browser.jsp" fullword ascii 
        $s3 = "cmd.jsp" fullword ascii
        $s4 = "index.jsp" fullword ascii
    condition:
        uint16(0) == 0x4b50 and filesize < 203KB and all of them
}
YARA Detection Rule: CN_Tools_srss
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file srss.bat
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "srss.exe -idx 0 -ip"
        $s1 = "-port 21 -logfilter \"_USER ,_P" ascii

Detection condition:
filesize < 100 and all of them

Full rule:
rule CN_Tools_srss {
    meta:
        description = "Chinese Hacktool Set - file srss.bat"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "http://tools.zjqhr.com/"
        date = "2015-06-13"
        hash = "092ab[PII_REDACTED]a247fe80b100fb4df0f9c37a0"
        id = "13191e2e-fbcd-5e0b-af55-cc10f2583c1b"
    strings:
        $s0 = "srss.exe -idx 0 -ip"
        $s1 = "-port 21 -logfilter \"_USER ,_P" ascii 
    condition:
        filesize < 100 and all of them
}