deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: NTLM_Dump_Output
Repository: Neo23x0/signature-base
Detects: NTML Hash Dump output file - John/LC format
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "500:AAD3B435B51404EEAAD3B435B51404EE:" ascii
      $s1 = "500:aad3b435b51404eeaad3b435b51404ee:" ascii

Detection condition:
1 of them

Full rule:
rule NTLM_Dump_Output {
   meta:
      description = "NTML Hash Dump output file - John/LC format"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "2015-10-01"
      score = 75
      id = "d17ee473-317b-57d4-8ea8-7c89e8f2b2ed"
   strings:
      $s0 = "500:AAD3B435B51404EEAAD3B435B51404EE:" ascii
      $s1 = "500:aad3b435b51404eeaad3b435b51404ee:" ascii
   condition:
      1 of them
}
YARA Detection Rule: Gsecdump_password_dump_file
Repository: Neo23x0/signature-base
Detects: Detects a gsecdump output file
Author: Florian Roth (Nextron Systems)
Reference: https://t.co/OLIj1yVJ4m

Pattern signatures:
$x1 = "Administrator(current):500:" ascii

Detection condition:
uint32be(0) == 0x41646d69 and filesize < 3000 and $x1 at 0

Full rule:
rule Gsecdump_password_dump_file {
   meta:
      description = "Detects a gsecdump output file"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://t.co/OLIj1yVJ4m"
      date = "2018-03-06"
      score = 65
      id = "c7c8ab61-f728-5eb2-a5e3-b3dd84980870"
   strings:
      $x1 = "Administrator(current):500:" ascii
   condition:
      uint32be(0) == 0x41646d69 and filesize < 3000 and $x1 at 0
}
YARA Detection Rule: SUSP_ZIP_NtdsDIT
Repository: Neo23x0/signature-base
Detects: Detects ntds.dit files in ZIP archives that could be a left over of administrative activity or traces of data exfiltration
Author: Florian Roth (Nextron Systems)
Reference: https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/

Pattern signatures:
$s1 = "ntds.dit" ascii

Detection condition:
uint16(0) == 0x4b50 and
      $s1 in (0..256)

Full rule:
rule SUSP_ZIP_NtdsDIT : T1003_003 {
   meta:
      description = "Detects ntds.dit files in ZIP archives that could be a left over of administrative activity or traces of data exfiltration"
      author = "Florian Roth (Nextron Systems)"
      score = 50
      reference = "https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/"
      date = "2020-08-10"
      id = "131ed73d-bb34-5ff6-b145-f95e4469d7f9"
   strings:
      $s1 = "ntds.dit" ascii 
   condition:
      uint16(0) == 0x4b50 and
      $s1 in (0..256)
}
YARA Detection Rule: ROKRAT_Malware
Repository: Neo23x0/signature-base
Detects: Detects ROKRAT Malware
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2017/04/introducing-rokrat.html

Pattern signatures:
$x1 = "c:\\users\\appdata\\local\\svchost.exe" fullword ascii
      $x2 = "c:\\temp\\episode3.mp4" fullword ascii
      $x3 = "MAC-SIL-TED-FOO-YIM-LAN-WAN-SEC-BIL-TAB" ascii
      $x4 = "c:\\temp\\%d.tmp" ascii fullword

      $s1 = "%s%s%04d%02d%02d%02d%02d%02d.jar" fullword ascii
      $s2 = "\\Aboard\\Acm%c%c%c.exe" ascii

      $a1 = "ython" ascii fullword
      $a2 = "iddler" ascii fullword
      $a3 = "egmon" ascii fullword
      $a6 = "iresha" ascii fullword

Detection condition:
uint16(0) == 0x5a4d and filesize < 25000KB and ( 1 of ($x*) or ( 5 of them ) )

Full rule:
rule ROKRAT_Malware {
   meta:
      description = "Detects ROKRAT Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2017/04/introducing-rokrat.html"
      date = "2017-04-03"
      modified = "2021-09-14"
      hash1 = "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00"
      hash2 = "cd166565ce09ef410c5bba40bad0b49441af6cfb48772e7e4a9de3d646b4851c"
      id = "52e7e144-b704-5254-9a0f-928fbc96f877"
   strings:
      $x1 = "c:\\users\\appdata\\local\\svchost.exe" fullword ascii
      $x2 = "c:\\temp\\episode3.mp4" fullword ascii
      $x3 = "MAC-SIL-TED-FOO-YIM-LAN-WAN-SEC-BIL-TAB" ascii
      $x4 = "c:\\temp\\%d.tmp" ascii fullword

      $s1 = "%s%s%04d%02d%02d%02d%02d%02d.jar" fullword ascii
      $s2 = "\\Aboard\\Acm%c%c%c.exe" ascii

      $a1 = "ython" ascii fullword
      $a2 = "iddler" ascii fullword
      $a3 = "egmon" ascii fullword
      $a6 = "iresha" ascii fullword
   condition:
      uint16(0) == 0x5a4d and filesize < 25000KB and ( 1 of ($x*) or ( 5 of them ) )
}
YARA Detection Rule: ROKRAT_Dropper_Nov17
Repository: Neo23x0/signature-base
Detects: Detects dropper for ROKRAT malware
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html

Detection condition:
uint16(0) == 0x5a4d and filesize < 2500KB and
      pe.imphash() == "c6187b1b5f[PII_REDACTED]457719dd6f39"

Full rule:
rule ROKRAT_Dropper_Nov17 {
   meta:
      description = "Detects dropper for ROKRAT malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
      date = "2017-11-28"
      hash1 = "eb6d25e08b2b32a736b57f8df22db6d03dc82f16da554f4e8bb67120eacb1d14"
      hash2 = "a29b07a6fe5d7ce3147dd7ef1d7d18df16e347f37282c43139d53cce25ae7037"
      id = "4f3156a2-6b1b-5c65-b8fa-84c0b739d703"
   condition:
      uint16(0) == 0x5a4d and filesize < 2500KB and
      pe.imphash() == "c6187b1b5f[PII_REDACTED]457719dd6f39"
}
YARA Detection Rule: Freeenki_Infostealer_Nov17
Repository: Neo23x0/signature-base
Detects: Detects Freenki infostealer malware
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html

Pattern signatures:
$x1 = "base64Encoded=\"TVqQAAMAAAAEAAAA" ascii
      $x2 = "command =outFile &\" sysupdate\"" fullword ascii
      $x3 = "outFile=sysDir&\"\\rundll32.exe\"" fullword ascii

      $s1 = "SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command" fullword wide
      $s2 = "c:\\TEMP\\CrashReports\\" ascii
      $s3 = "objShell.run command, 0, True" fullword ascii
      $s4 = "sysDir = shell.ExpandEnvironmentStrings(\"%windir%\")" fullword ascii
      $s5 = "'Wscript.echo \"Base64 encoded: \" + base64Encoded" fullword ascii
      $s6 = "set shell = WScript.CreateObject(\"WScript.Shell\")" fullword ascii

      $a1 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
      $a2 = "SELECT username_value, password_value, signon_realm FROM logins" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and (
        1 of ($x*) or
        3 of them or
        all of ($a*)
      )

Full rule:
rule Freeenki_Infostealer_Nov17 {
   meta:
      description = "Detects Freenki infostealer malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
      date = "2017-11-28"
      modified = "2023-01-06"
      hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
      id = "01365093-e40a-524a-8a13-217742542f1e"
   strings:
      $x1 = "base64Encoded=\"TVqQAAMAAAAEAAAA" ascii
      $x2 = "command =outFile &\" sysupdate\"" fullword ascii
      $x3 = "outFile=sysDir&\"\\rundll32.exe\"" fullword ascii

      $s1 = "SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command" fullword wide
      $s2 = "c:\\TEMP\\CrashReports\\" ascii
      $s3 = "objShell.run command, 0, True" fullword ascii
      $s4 = "sysDir = shell.ExpandEnvironmentStrings(\"%windir%\")" fullword ascii
      $s5 = "'Wscript.echo \"Base64 encoded: \" + base64Encoded" fullword ascii
      $s6 = "set shell = WScript.CreateObject(\"WScript.Shell\")" fullword ascii

      $a1 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
      $a2 = "SELECT username_value, password_value, signon_realm FROM logins" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and (
        1 of ($x*) or
        3 of them or
        all of ($a*)
      )
}
YARA Detection Rule: Freeenki_Infostealer_Nov17_Export_Sig_Testing
Repository: Neo23x0/signature-base
Detects: Detects Freenki infostealer malware
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and
      pe.exports("getUpdate") and pe.number_of_exports == 1

Full rule:
rule Freeenki_Infostealer_Nov17_Export_Sig_Testing {
   meta:
      description = "Detects Freenki infostealer malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
      date = "2017-11-28"
      hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
      id = "929f9d41-2e71-5a86-b12f-489355bdf88d"
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and
      pe.exports("getUpdate") and pe.number_of_exports == 1
}
YARA Detection Rule: ROKRAT_Nov17_1
Repository: Neo23x0/signature-base
Detects: Detects ROKRAT malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "\\T+M\\Result\\DocPrint.pdb" ascii
      $s2 = "d:\\HighSchool\\version 13\\2ndBD" ascii
      $s3 = "e:\\Happy\\Work\\Source\\version" ascii

      $x1 = "\\appdata\\local\\svchost.exe" ascii
      $x2 = "c:\\temp\\esoftscrap.jpg" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 15000KB and 1 of them )

Full rule:
rule ROKRAT_Nov17_1 {
   meta:
      description = "Detects ROKRAT malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-11-28"
      id = "6bf3653b-1f96-5060-b6fd-82ccc83fad77"
   strings:
      $s1 = "\\T+M\\Result\\DocPrint.pdb" ascii
      $s2 = "d:\\HighSchool\\version 13\\2ndBD" ascii
      $s3 = "e:\\Happy\\Work\\Source\\version" ascii

      $x1 = "\\appdata\\local\\svchost.exe" ascii
      $x2 = "c:\\temp\\esoftscrap.jpg" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 15000KB and 1 of them )
}
YARA Detection Rule: Scarcruft_malware_Feb18_1
Repository: Neo23x0/signature-base
Detects: Detects Scarcruft malware - February 2018
Author: Florian rootpath
Reference: https://twitter.com/craiu/status/[PII_REDACTED]95731458

Pattern signatures:
$x1 = "d:\\HighSchool\\version 13\\2ndBD\\T+M\\" ascii
      $x2 = "cmd.exe /C ping 0.1.1.2" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them

Full rule:
rule Scarcruft_malware_Feb18_1 {
   meta:
      description = "Detects Scarcruft malware - February 2018"
      author = "Florian rootpath"
      reference = "https://twitter.com/craiu/status/[PII_REDACTED]95731458"
      date = "2018-02-03"
      score = 90
      id = "43a87f2a-cf60-5035-8d40-c360a789a1ac"
   strings:
      $x1 = "d:\\HighSchool\\version 13\\2ndBD\\T+M\\" ascii
      $x2 = "cmd.exe /C ping 0.1.1.2" wide
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
}
YARA Detection Rule: MAL_APT_Operation_ShadowHammer_MalSetup
Repository: Neo23x0/signature-base
Detects: Detects a malicious file used by BARIUM group in Operation ShadowHammer
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/operation-shadowhammer/89992/

Pattern signatures:
$x1 = "\\AsusShellCode\\Release" ascii
      $x2 = "\\AsusShellCode\\Debug"

Detection condition:
uint16(0) == 0x5a4d and 1 of them

Full rule:
rule MAL_APT_Operation_ShadowHammer_MalSetup {
   meta:
      description = "Detects a malicious file used by BARIUM group in Operation ShadowHammer"
      date = "2019-03-25"
      author = "Florian Roth (Nextron Systems)"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      score = 80
      hash1 = "ac0711afee5a157d084251f3443a40965fc63c57955e3a241df866cfc7315223"
      hash2 = "9acd43af36f2d38077258cb2ace42d6737b43be499367e90037f[PII_REDACTED]f8"
      hash3 = "bca9583263f92c55ba191140668d8299ef6b760a1e940bddb0a7580ce68fef82"
      hash4 = "c299b6dd210ab5779f3abd9d10544f9cae31cd5c6afc92c0fc16c8f43def7596"
      hash5 = "6aedfef62e7a8ab7b8ab3ff57708a55afa1a2a6765f86d581bc99c738a68fc74"
      hash6 = "cfbec77180bd67cceb2e17e64f8a8beec5e8875f47c41936b67a60093e07fcfd"
      reference = "https://securelist.com/operation-shadowhammer/89992/"
      id = "000f840a-848d-5f82-84bf-70690efbd4de"
   strings:
      $x1 = "\\AsusShellCode\\Release" ascii
      $x2 = "\\AsusShellCode\\Debug"
   condition:
      uint16(0) == 0x5a4d and 1 of them
}
YARA Detection Rule: LOG_EXPL_SUSP_TeamCity_CVE_2023_42793_Oct23_1
Repository: Neo23x0/signature-base
Detects: Detects log entries that could indicate a successful exploitation of CVE-2023-42793 on TeamCity servers
Author: Florian Roth
Reference: https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis

Pattern signatures:
$sa1 = "File edited: "
      $sa2 = "\\TeamCity\\config\\internal.properties by user with id="
      
      $sb1 = "s.buildServer.ACTIVITIES.AUDIT - server_file_change: File "
      $sb2 = "\\TeamCity\\config\\internal.properties was modified by \"user with id"

Detection condition:
all of ($sa*) or all of ($sb*)

Full rule:
rule LOG_EXPL_SUSP_TeamCity_CVE_2023_42793_Oct23_1 {
   meta:
      description = "Detects log entries that could indicate a successful exploitation of CVE-2023-42793 on TeamCity servers"
      author = "Florian Roth"
      reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
      date = "2023-10-02"
      score = 70
      id = "81c04863-72aa-5515-889e-3ef718360cac"
   strings:
      $sa1 = "File edited: "
      $sa2 = "\\TeamCity\\config\\internal.properties by user with id="
      
      $sb1 = "s.buildServer.ACTIVITIES.AUDIT - server_file_change: File "
      $sb2 = "\\TeamCity\\config\\internal.properties was modified by \"user with id"
   condition:
      all of ($sa*) or all of ($sb*)
}
YARA Detection Rule: LOG_EXPL_SUSP_TeamCity_Oct23_1
Repository: Neo23x0/signature-base
Detects: Detects log entries that could indicate a successful exploitation of TeamCity servers
Author: Florian Roth
Reference: https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis

Pattern signatures:
$a1 = "tbrains.buildServer.ACTIVITIES"
      $s1 = "External process is launched by user user with id"
      $s2 = ". Command line: cmd.exe \"/c whoami"

Detection condition:
all of them

Full rule:
rule LOG_EXPL_SUSP_TeamCity_Oct23_1 {
   meta:
      description = "Detects log entries that could indicate a successful exploitation of TeamCity servers"
      author = "Florian Roth"
      reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
      date = "2023-10-02"
      score = 70
      id = "4845b40a-cf77-53ae-b2fa-d1ed861153f2"
   strings:
      $a1 = "tbrains.buildServer.ACTIVITIES"
      $s1 = "External process is launched by user user with id"
      $s2 = ". Command line: cmd.exe \"/c whoami"
   condition:
      all of them
}
YARA Detection Rule: EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1
Repository: Neo23x0/signature-base
Detects: Detects successful ProxyNotShell exploitation attempts in log files (attempt to identify the attack before the official release of detailed information)
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/kljunowsky/CVE-2022-41040-POC

Pattern signatures:
$sr1 = / \/autodiscover\/autodiscover\.json[^\n]{1,300}owershell/ nocase ascii

      $sa1 = " 200 "

      $fp1 = " 444 "
      $fp2 = " 404 "
      $fp2b = " 401 " /* Unauthorized */
      $fp3 = "GET /owa/ &Email=autodiscover/autodiscover.json%3F@test.com&ClientId=" ascii /* Nessus */
      $fp4 = "@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com" ascii /* Nessus */

Detection condition:
$sr1
      and 1 of ($sa*)
      and not 1 of ($fp*)

Full rule:
rule EXPL_Exchange_ProxyNotShell_Patterns_CVE_2022_41040_Oct22_1 : SCRIPT {
   meta:
      description = "Detects successful ProxyNotShell exploitation attempts in log files (attempt to identify the attack before the official release of detailed information)"
      author = "Florian Roth (Nextron Systems)"
      score = 75
      old_rule_name = "EXPL_Exchange_ProxyNoShell_Patterns_CVE_2022_41040_Oct22_1"
      reference = "https://github.com/kljunowsky/CVE-2022-41040-POC"
      date = "2022-10-11"
      modified = "2023-03-15"
      id = "d2812fcd-0a20-5bbd-a9e1-9cca1ed58aa3"
   strings:
      $sr1 = / \/autodiscover\/autodiscover\.json[^\n]{1,300}owershell/ nocase ascii

      $sa1 = " 200 "

      $fp1 = " 444 "
      $fp2 = " 404 "
      $fp2b = " 401 " /* Unauthorized */
      $fp3 = "GET /owa/ &Email=autodiscover/autodiscover.json%3F@test.com&ClientId=" ascii /* Nessus */
      $fp4 = "@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com" ascii /* Nessus */
   condition:
      $sr1
      and 1 of ($sa*)
      and not 1 of ($fp*)
}
YARA Detection Rule: SUSP_LNX_Linux_Malware_Indicators_Aug20_1
Repository: Neo23x0/signature-base
Detects: Detects indicators often found in linux malware samples. Note: This detection is based on common characteristics typically associated with the mentioned threats, must be considered a clue and does not conclusively prove maliciousness.
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "&& chmod +x" ascii
      $s2 = "|base64 -" ascii
      $s3 = " /tmp" ascii
      $s4 = "|curl " ascii
      $s5 = "whoami" ascii fullword

      $fp1 = "WITHOUT ANY WARRANTY" ascii
      $fp2 = "postinst" ascii fullword
      $fp3 = "THIS SOFTWARE IS PROVIDED" ascii fullword
      $fp4 = "Free Software Foundation" ascii fullword
      $fp5 = "Too many sessions open! Use ssh_channel.close() or 'with'!"

Detection condition:
filesize < 400KB and
      3 of ($s*) and not 1 of ($fp*)

Full rule:
rule SUSP_LNX_Linux_Malware_Indicators_Aug20_1 {
   meta:
      description = "Detects indicators often found in linux malware samples. Note: This detection is based on common characteristics typically associated with the mentioned threats, must be considered a clue and does not conclusively prove maliciousness."
      author = "Florian Roth (Nextron Systems)"
      score = 65
      reference = "Internal Research"
      date = "2020-08-03"
      modified = "2026-01-04"
      id = "9a1093a6-0239-5d1c-aa30-1ca725941583"
   strings:
      $s1 = "&& chmod +x" ascii
      $s2 = "|base64 -" ascii
      $s3 = " /tmp" ascii
      $s4 = "|curl " ascii
      $s5 = "whoami" ascii fullword

      $fp1 = "WITHOUT ANY WARRANTY" ascii
      $fp2 = "postinst" ascii fullword
      $fp3 = "THIS SOFTWARE IS PROVIDED" ascii fullword
      $fp4 = "Free Software Foundation" ascii fullword
      $fp5 = "Too many sessions open! Use ssh_channel.close() or 'with'!"
   condition:
      filesize < 400KB and
      3 of ($s*) and not 1 of ($fp*)
}
YARA Detection Rule: mal_lockbit4_rc4_win_feb24
Repository: Neo23x0/signature-base
Detects: Detect the implementation of RC4 Algorithm by Lockbit4.0
Author: 0x0d4y
Reference: https://0x0d4y.blog/lockbit4-0-evasion-tales/

Pattern signatures:
$rc4_alg = { 48 3d 00 01 00 00 74 0c 88 84 04 ?? ?? ?? ?? 48 ff c0 eb ec 29 c9 41 b8 ?? ?? ?? ?? 4c 8d 0d 15 7b 00 00 45 31 d2 48 81 f9 00 01 00 00 74 34 44 8a 9c 0c ?? ?? ?? ?? 45 00 da 89 c8 99 41 f7 f8 46 02 14 0a 41 0f b6 c2 8a 94 04 ?? ?? ?? ?? 88 94 0c ?? ?? ?? ?? 44 88 9c 04 ?? ?? ?? ?? 48 ff c1 eb c3 29 c0 48 8b 0d 14 9e 00 00 31 d2 45 29 c0 48 3d ?? ?? ?? ?? 74 4b 41 ff c0 45 0f b6 c0 46 8a 8c 04 ?? ?? ?? ?? 44 00 ca 44 0f b6 d2 46 8a 9c 14 ?? ?? ?? ?? 46 88 9c 04 ?? ?? ?? ?? 46 88 8c 14 ?? ?? ?? ?? 46 02 8c 04 ?? ?? ?? ?? 45 0f b6 c9 46 8a 8c 0c ?? ?? ?? ?? 44 30 0c 01 48 ff c0 eb ad }

Detection condition:
uint16(0) == 0x5a4d and
        $rc4_alg

Full rule:
rule mal_lockbit4_rc4_win_feb24
{
    meta:
        author = "0x0d4y"
        description = "Detect the implementation of RC4 Algorithm by Lockbit4.0"
        date = "2024-02-13"
        score = 100
        reference = "https://0x0d4y.blog/lockbit4-0-evasion-tales/"
        hash = "062311F136D83F64497FD81297360CD4"
        uuid = "4de48ced-b9fa-4286-aac4-c263ad20d67d"
        license = "CC BY 4.0"
        rule_matching_tlp = "TLP:WHITE"
        rule_sharing_tlp = "TLP:WHITE"
        malpedia_family = "win.lockbit"
    strings:
        $rc4_alg = { 48 3d 00 01 00 00 74 0c 88 84 04 ?? ?? ?? ?? 48 ff c0 eb ec 29 c9 41 b8 ?? ?? ?? ?? 4c 8d 0d 15 7b 00 00 45 31 d2 48 81 f9 00 01 00 00 74 34 44 8a 9c 0c ?? ?? ?? ?? 45 00 da 89 c8 99 41 f7 f8 46 02 14 0a 41 0f b6 c2 8a 94 04 ?? ?? ?? ?? 88 94 0c ?? ?? ?? ?? 44 88 9c 04 ?? ?? ?? ?? 48 ff c1 eb c3 29 c0 48 8b 0d 14 9e 00 00 31 d2 45 29 c0 48 3d ?? ?? ?? ?? 74 4b 41 ff c0 45 0f b6 c0 46 8a 8c 04 ?? ?? ?? ?? 44 00 ca 44 0f b6 d2 46 8a 9c 14 ?? ?? ?? ?? 46 88 9c 04 ?? ?? ?? ?? 46 88 8c 14 ?? ?? ?? ?? 46 02 8c 04 ?? ?? ?? ?? 45 0f b6 c9 46 8a 8c 0c ?? ?? ?? ?? 44 30 0c 01 48 ff c0 eb ad }
        
    condition:
        uint16(0) == 0x5a4d and
        $rc4_alg
}
YARA Detection Rule: Embedded_EXE_Cloaking
Repository: Neo23x0/signature-base
Detects: Detects an embedded executable in a non-executable file
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$noex_png = { 89 50 4E 47 }
                $noex_pdf = { 25 50 44 46 }
                $noex_rtf = { 7B 5C 72 74 66 31 }
                $noex_jpg = { FF D8 FF E0 }
                $noex_gif = { 47 49 46 38 }
                $mz  = { 4D 5A }
                $a1 = "This program cannot be run in DOS mode"
                $a2 = "This program must be run under Win32"

Detection condition:
(
                        ( $noex_png at 0 ) or
                        ( $noex_pdf at 0 ) or
                        ( $noex_rtf at 0 ) or
                        ( $noex_jpg at 0 ) or
                        ( $noex_gif at 0 )
                )
                and
                for any i in (1..

Full rule:
rule Embedded_EXE_Cloaking {
        meta:
                description = "Detects an embedded executable in a non-executable file"
                license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
                date = "2015/02/27"
                score = 65
        strings:
                $noex_png = { 89 50 4E 47 }
                $noex_pdf = { 25 50 44 46 }
                $noex_rtf = { 7B 5C 72 74 66 31 }
                $noex_jpg = { FF D8 FF E0 }
                $noex_gif = { 47 49 46 38 }
                $mz  = { 4D 5A }
                $a1 = "This program cannot be run in DOS mode"
                $a2 = "This program must be run under Win32"
        condition:
                (
                        ( $noex_png at 0 ) or
                        ( $noex_pdf at 0 ) or
                        ( $noex_rtf at 0 ) or
                        ( $noex_jpg at 0 ) or
                        ( $noex_gif at 0 )
                )
                and
                for any i in (1..#mz): ( @a1 < ( @mz[i] + 200 ) or @a2 < ( @mz[i] + 200 ) )
}