deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_Kaspersky_Duqu2_msi3_32
Repository: Neo23x0/signature-base
Detects: Kaspersky APT Report - Duqu2 Sample
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/7yKyOj

Pattern signatures:
$s0 = "ProcessUserAccounts" fullword ascii /* PEStudio Blacklist: strings */
		$s1 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
		$s4 = "msi3_32.dll" fullword wide
		$s5 = "RunDLL" fullword ascii
		$s6 = "MSI Custom Action v3" fullword wide
		$s7 = "msi3_32" fullword wide
		$s8 = "Operating System" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 9203 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 72KB and all of them

Full rule:
rule APT_Kaspersky_Duqu2_msi3_32 {
	meta:
		description = "Kaspersky APT Report - Duqu2 Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/7yKyOj"
		date = "2015-06-10"
		hash = "53d9ef9e0267f10cc10f78331a9e491b3211046b"
		id = "6cbea2e7-f406-57cf-b9c8-9d84b1480035"
	strings:
		$s0 = "ProcessUserAccounts" fullword ascii /* PEStudio Blacklist: strings */
		$s1 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
		$s4 = "msi3_32.dll" fullword wide
		$s5 = "RunDLL" fullword ascii
		$s6 = "MSI Custom Action v3" fullword wide
		$s7 = "msi3_32" fullword wide
		$s8 = "Operating System" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 9203 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 72KB and all of them
}
YARA Detection Rule: SUSP_EXPL_LIBCUE_CVE_2023_43641_Oct23_1
Repository: Neo23x0/signature-base
Detects: Detects a suspicious .cue file that could be an exploitation attempt of libcue vulnerability CVE-2023-43641
Author: Florian Roth
Reference: https://github.com/github/securitylab/blob/main/SecurityExploits/libcue/track_set_index_CVE-2023-43641/README.md

Pattern signatures:
$a1 = "TRACK "
      $a2 = "FILE "

      $s1 = "INDEX 4294"

Detection condition:
filesize < 100KB and all of them

Full rule:
rule SUSP_EXPL_LIBCUE_CVE_2023_43641_Oct23_1 {
   meta:
      author = "Florian Roth"
      description = "Detects a suspicious .cue file that could be an exploitation attempt of libcue vulnerability CVE-2023-43641"
      reference = "https://github.com/github/securitylab/blob/main/SecurityExploits/libcue/track_set_index_CVE-2023-43641/README.md"
      date = "2023-10-27"
      score = 70
      id = "34fcf80c-adcd-55c0-9fb4-261d20f61fa6"
   strings:
      $a1 = "TRACK "
      $a2 = "FILE "

      $s1 = "INDEX 4294"
   condition:
      filesize < 100KB and all of them
}
YARA Detection Rule: SeDLL_Javascript_Decryptor
Repository: Neo23x0/signature-base
Detects: Detects SeDll - DLL is used for decrypting and executing another JavaScript backdoor such as Orz
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/MZ7dRg

Pattern signatures:
$x1 = "SEDll_Win32.dll" fullword ascii
      $x2 = "regsvr32 /s \"%s\" DR __CIM__" wide

      $s1 = "WScriptW" fullword ascii
      $s2 = "IWScript" fullword ascii
      $s3 = "%s\\%s~%d" fullword wide
      $s4 = "PutBlockToFileWW" fullword ascii
      $s5 = "CheckUpAndDownWW" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 40KB and ( 1 of ($x*) or 4 of them )

Full rule:
rule SeDLL_Javascript_Decryptor {
   meta:
      description = "Detects SeDll - DLL is used for decrypting and executing another JavaScript backdoor such as Orz"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/MZ7dRg"
      date = "2017-10-18"
      modified = "2023-01-07"
      hash1 = "146aa9a0ec013aa5bdba9ea9d29f59d48d43bc17c6a20b74bb8c521dbb5bc6f4"
      id = "8fafd139-0c4f-5c51-af8f-b4917d2d69b0"
   strings:
      $x1 = "SEDll_Win32.dll" fullword ascii
      $x2 = "regsvr32 /s \"%s\" DR __CIM__" wide

      $s1 = "WScriptW" fullword ascii
      $s2 = "IWScript" fullword ascii
      $s3 = "%s\\%s~%d" fullword wide
      $s4 = "PutBlockToFileWW" fullword ascii
      $s5 = "CheckUpAndDownWW" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 40KB and ( 1 of ($x*) or 4 of them )
}
YARA Detection Rule: Leviathan_CobaltStrike_Sample_1
Repository: Neo23x0/signature-base
Detects: Detects Cobalt Strike sample from Leviathan report
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/MZ7dRg

Pattern signatures:
$x1 = "a54c81.dll" fullword ascii
      $x2 = "%d is an x64 process (can't inject x86 content)" fullword ascii
      $x3 = "Failed to impersonate logged on user %d (%u)" fullword ascii

      $s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
      $s2 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
      $s3 = "could not run command (w/ token) because of its length of %d bytes!" fullword ascii
      $s4 = "could not write to process memory: %d" fullword ascii
      $s5 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
      $s6 = "Could not connect to pipe (%s): %d" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 3 of them )

Full rule:
rule Leviathan_CobaltStrike_Sample_1 {
   meta:
      description = "Detects Cobalt Strike sample from Leviathan report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/MZ7dRg"
      date = "2017-10-18"
      hash1 = "5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362"
      id = "e29072d8-b4ea-5e94-8a1c-0a1baec5f423"
   strings:
      $x1 = "a54c81.dll" fullword ascii
      $x2 = "%d is an x64 process (can't inject x86 content)" fullword ascii
      $x3 = "Failed to impersonate logged on user %d (%u)" fullword ascii

      $s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
      $s2 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
      $s3 = "could not run command (w/ token) because of its length of %d bytes!" fullword ascii
      $s4 = "could not write to process memory: %d" fullword ascii
      $s5 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
      $s6 = "Could not connect to pipe (%s): %d" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 600KB and ( 1 of ($x*) or 3 of them )
}
YARA Detection Rule: MockDll_Gen
Repository: Neo23x0/signature-base
Detects: Detects MockDll - regsvr DLL loader
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/MZ7dRg

Pattern signatures:
$x1 = "mock_run_ini_Win32.dll" fullword ascii
      $x2 = "mock_run_ini_x64.dll" fullword ascii

      $s1 = "RealCmd=%s %s" fullword ascii
      $s2 = "MockModule=%s" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 20KB and ( 1 of ($x*) or 2 of them )

Full rule:
rule MockDll_Gen {
   meta:
      description = "Detects MockDll - regsvr DLL loader"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/MZ7dRg"
      date = "2017-10-18"
      hash1 = "bfc5c6817ff2cc4f3cd40f649e10cc9ae1e52139f35fdddbd32cb4d221368922"
      hash2 = "80b931ab1798d7d8a8d63411861cee07e31bb9a68f595f579e11d3817cfc4aca"
      id = "904a0649-27e7-5024-aa6b-ddb23bba6202"
   strings:
      $x1 = "mock_run_ini_Win32.dll" fullword ascii
      $x2 = "mock_run_ini_x64.dll" fullword ascii

      $s1 = "RealCmd=%s %s" fullword ascii
      $s2 = "MockModule=%s" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 20KB and ( 1 of ($x*) or 2 of them )
}
YARA Detection Rule: VBScript_Favicon_File
Repository: Neo23x0/signature-base
Detects: VBScript cloaked as Favicon file used in Leviathan incident
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/MZ7dRg

Pattern signatures:
$x1 = "myxml = '<?xml version=\"\"1.0\"\" encoding=\"\"UTF-8\"\"?>';myxml = myxml +'<root>" ascii
      $x2 = ".Run \"taskkill /im mshta.exe" ascii
      $x3 = "<script language=\"VBScript\">Window.ReSizeTo 0, 0 : Window.moveTo -2000,-2000 :" ascii

      $s1 = ".ExpandEnvironmentStrings(\"%ALLUSERSPROFILE%\") &" ascii
      $s2 = ".ExpandEnvironmentStrings(\"%temp%\") & " ascii

Detection condition:
filesize < 100KB and ( uint16(0) == 0x733c and 1 of ($x*) )
      or ( 3 of them )

Full rule:
rule VBScript_Favicon_File {
   meta:
      description = "VBScript cloaked as Favicon file used in Leviathan incident"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/MZ7dRg"
      date = "2017-10-18"
      modified = "2023-01-06"
      hash1 = "39c952c7e14b6be5a9cb1be3f05eafa22e1115806e927f4e2dc85d609bc0eb36"
      id = "84147d4e-d062-5ba4-8019-6bf4b72c36c6"
   strings:
      $x1 = "myxml = '<?xml version=\"\"1.0\"\" encoding=\"\"UTF-8\"\"?>';myxml = myxml +'<root>" ascii
      $x2 = ".Run \"taskkill /im mshta.exe" ascii
      $x3 = "<script language=\"VBScript\">Window.ReSizeTo 0, 0 : Window.moveTo -2000,-2000 :" ascii

      $s1 = ".ExpandEnvironmentStrings(\"%ALLUSERSPROFILE%\") &" ascii
      $s2 = ".ExpandEnvironmentStrings(\"%temp%\") & " ascii
   condition:
      filesize < 100KB and ( uint16(0) == 0x733c and 1 of ($x*) )
      or ( 3 of them )
}
YARA Detection Rule: MAL_WIPER_IsaacWiper_Mar22_1
Repository: Neo23x0/signature-base
Detects: Detects IsaacWiper malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/

Pattern signatures:
$s1 = "C:\\ProgramData\\log.txt" wide fullword
      $s2 = "Cleaner.dll" ascii fullword
      $s3 = "-- system logical drive: " wide fullword
      $s4 = "-- FAILED" wide fullword

      $op1 = { 8b f1 80 3d b0 66 03 10 00 0f 85 96 00 00 00 33 c0 40 b9 a8 66 03 10 87 01 33 db }
      $op2 = { 8b 40 04 2b c2 c1 f8 02 3b c8 74 34 68 a2 c8 01 10 2b c1 6a 04 }
      $op3 = { 8d 4d f4 ff 75 08 e8 12 ff ff ff 68 88 39 03 10 8d 45 f4 50 e8 2d 1d 00 00 cc }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 700KB and
      (
         pe.imphash() == "a4b162717c197e11b76a4d9bc58ea25d" or
         3 of them
      )

Full rule:
rule MAL_WIPER_IsaacWiper_Mar22_1 {
   meta:
      description = "Detects IsaacWiper malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/"
      date = "2022-03-03"
      score = 85
      hash1 = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
      hash2 = "7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0"
      id = "97d8d8dd-db65-5156-8f97-56c620cf2d56"
   strings:
      $s1 = "C:\\ProgramData\\log.txt" wide fullword
      $s2 = "Cleaner.dll" ascii fullword
      $s3 = "-- system logical drive: " wide fullword
      $s4 = "-- FAILED" wide fullword

      $op1 = { 8b f1 80 3d b0 66 03 10 00 0f 85 96 00 00 00 33 c0 40 b9 a8 66 03 10 87 01 33 db }
      $op2 = { 8b 40 04 2b c2 c1 f8 02 3b c8 74 34 68 a2 c8 01 10 2b c1 6a 04 }
      $op3 = { 8d 4d f4 ff 75 08 e8 12 ff ff ff 68 88 39 03 10 8d 45 f4 50 e8 2d 1d 00 00 cc }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 700KB and
      (
         pe.imphash() == "a4b162717c197e11b76a4d9bc58ea25d" or
         3 of them
      )
}
YARA Detection Rule: EXPL_Citrix_Netscaler_ADC_ForensicArtifacts_CVE_2023_3519_Jul23
Repository: Neo23x0/signature-base
Detects: Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519
Author: Florian Roth
Reference: https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf

Pattern signatures:
$sa1 = "216.41.162.172" ascii fullword

      $sb1 = "/flash/nsconfig/keys" ascii
      $sb2 = "ldapsearch" ascii fullword
      $sb3 = "ns_gui/vpn" ascii
      $sb4 = "LDAPTLS_REQCERT" ascii fullword

Detection condition:
filesize < 10MB and $sa1
      or (
         filepath == "/var/log"
         and filename matches /^(bash|sh)\.log/
         and 1 of ($sb*)
      )

Full rule:
rule EXPL_Citrix_Netscaler_ADC_ForensicArtifacts_CVE_2023_3519_Jul23 {
   meta:
      description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
      author = "Florian Roth"
      reference = "https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf"
      date = "2023-07-18"
      modified = "2023-07-21"
      score = 70
      id = "07d725cc-2cf2-55e5-8[PII_REDACTED]47f13"
   strings:
      $sa1 = "216.41.162.172" ascii fullword

      $sb1 = "/flash/nsconfig/keys" ascii
      $sb2 = "ldapsearch" ascii fullword
      $sb3 = "ns_gui/vpn" ascii
      $sb4 = "LDAPTLS_REQCERT" ascii fullword
   condition:
      filesize < 10MB and $sa1
      or (
         filepath == "/var/log"
         and filename matches /^(bash|sh)\.log/
         and 1 of ($sb*)
      )
}
YARA Detection Rule: EXPL_Citrix_Netscaler_ADC_ForensicArtifacts_CVE_2023_3519_Jul23_2
Repository: Neo23x0/signature-base
Detects: Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519
Author: Florian Roth
Reference: https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf

Pattern signatures:
$s1 = "tar -czvf - /var/tmp/all.txt" ascii fullword
      $s2 = "-out /var/tmp/test.tar.gz" ascii
      $s3 = "/test.tar.gz /netscaler/"

Detection condition:
filesize < 10MB and 1 of them

Full rule:
rule EXPL_Citrix_Netscaler_ADC_ForensicArtifacts_CVE_2023_3519_Jul23_2 {
   meta:
      description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
      author = "Florian Roth"
      reference = "https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf"
      date = "2023-07-21"
      score = 70
      id = "471ce547-0133-5836-b9d1-02c932ecfd1e"
   strings:
      $s1 = "tar -czvf - /var/tmp/all.txt" ascii fullword
      $s2 = "-out /var/tmp/test.tar.gz" ascii
      $s3 = "/test.tar.gz /netscaler/"
   condition:
      filesize < 10MB and 1 of them
}
YARA Detection Rule: EXPL_Citrix_Netscaler_ADC_ForensicArtifacts_CVE_2023_3519_Jul23_3
Repository: Neo23x0/signature-base
Detects: Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519
Author: Florian Roth
Reference: https://www.mandiant.com/resources/blog/citrix-zero-day-espionage

Pattern signatures:
$x1 = "cat /flash/nsconfig/ns.conf >>" ascii
      $x2 = "cat /nsconfig/.F1.key >>" ascii
      $x3 = "openssl base64 -d < /tmp/" ascii
      $x4 = "cp /usr/bin/bash /var/tmp/bash" ascii
      $x5 = "chmod 4775 /var/tmp/bash"
      $x6 = "pwd;pwd;pwd;pwd;pwd;"
      $x7 = "(&(servicePrincipalName=*)(UserAccountControl:1.2.840.113556.1.4.803:=512)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(objectCategory=computer)))"

Detection condition:
filesize < 10MB and 1 of them

Full rule:
rule EXPL_Citrix_Netscaler_ADC_ForensicArtifacts_CVE_2023_3519_Jul23_3 {
   meta:
      description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
      author = "Florian Roth"
      reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
      date = "2023-07-24"
      score = 70
      id = "2f40b423-f1da-5711-ac4f-18de77cd52d0"
   strings:
      $x1 = "cat /flash/nsconfig/ns.conf >>" ascii
      $x2 = "cat /nsconfig/.F1.key >>" ascii
      $x3 = "openssl base64 -d < /tmp/" ascii
      $x4 = "cp /usr/bin/bash /var/tmp/bash" ascii
      $x5 = "chmod 4775 /var/tmp/bash"
      $x6 = "pwd;pwd;pwd;pwd;pwd;"
      $x7 = "(&(servicePrincipalName=*)(UserAccountControl:1.2.840.113556.1.4.803:=512)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(objectCategory=computer)))"
   condition:
      filesize < 10MB and 1 of them
}
YARA Detection Rule: LOG_EXPL_Citrix_Netscaler_ADC_Exploitation_Attempt_CVE_2023_3519_Jul23_1
Repository: Neo23x0/signature-base
Detects: This YARA rule detects forensic artifacts that appear following an attempted exploitation of Citrix NetScaler ADC CVE-2023-3519. The rule identifies an attempt to access the vulnerable function using an overly long URL, a potential sign of attempted exploitation. However, it does not confirm whether such an attempt was successful.
Author: Florian Roth
Reference: https://blog.assetnote.io/2023/07/24/citrix-rce-part-2-cve-2023-3519/

Pattern signatures:
/* overly long URL - all URLLEN values >= 200 */
      $sr1 = /GWTEST FORMS SSO: Parse=0; URLLEN=([2-9][0-9]{2}|[0-9]{4,20}); Event: start=0x/
      $s1 = ", type=1; Target: start=0x"

Detection condition:
all of them

Full rule:
rule LOG_EXPL_Citrix_Netscaler_ADC_Exploitation_Attempt_CVE_2023_3519_Jul23_1 {
   meta:
      description = "This YARA rule detects forensic artifacts that appear following an attempted exploitation of Citrix NetScaler ADC CVE-2023-3519. The rule identifies an attempt to access the vulnerable function using an overly long URL, a potential sign of attempted exploitation. However, it does not confirm whether such an attempt was successful."
      author = "Florian Roth"
      reference = "https://blog.assetnote.io/2023/07/24/citrix-rce-part-2-cve-2023-3519/"
      date = "2023-07-27"
      score = 65
      id = "7dfe4130-d976-5d6d-a05d-ccadefe45406"
   strings:
      /* overly long URL - all URLLEN values >= 200 */
      $sr1 = /GWTEST FORMS SSO: Parse=0; URLLEN=([2-9][0-9]{2}|[0-9]{4,20}); Event: start=0x/
      $s1 = ", type=1; Target: start=0x"
   condition:
      all of them
}
YARA Detection Rule: WEBSHELL_SECRETSAUCE_Jul23_1
Repository: Neo23x0/signature-base
Detects: Detects SECRETSAUCE PHP webshells (found after an exploitation of Citrix NetScaler ADC CVE-2023-3519)
Author: Florian Roth
Reference: https://www.mandiant.com/resources/blog/citrix-zero-day-espionage

Pattern signatures:
$sa1 = "for ($x=0; $x<=1; $x++) {" ascii
      $sa2 = "$_REQUEST[" ascii
      $sa3 = "@eval" ascii

      $sb1 = "public $cmd;" ascii
      $sb2 = "return @eval($a);" ascii
      $sb3 = "$z->run($z->get('openssl_public_decrypt'));"

Detection condition:
filesize < 100KB and (
         all of ($sa*) or
         2 of ($sb*)
      )

Full rule:
rule WEBSHELL_SECRETSAUCE_Jul23_1 {
   meta:
      description = "Detects SECRETSAUCE PHP webshells (found after an exploitation of Citrix NetScaler ADC CVE-2023-3519)"
      author = "Florian Roth"
      reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
      date = "2023-07-24"
      score = 85
      id = "db0542e7-648e-5f60-9838-e07498f58b51"
   strings:
      $sa1 = "for ($x=0; $x<=1; $x++) {" ascii
      $sa2 = "$_REQUEST[" ascii
      $sa3 = "@eval" ascii

      $sb1 = "public $cmd;" ascii
      $sb2 = "return @eval($a);" ascii
      $sb3 = "$z->run($z->get('openssl_public_decrypt'));"
   condition:
      filesize < 100KB and (
         all of ($sa*) or
         2 of ($sb*)
      )
}
YARA Detection Rule: xRAT_1
Repository: Neo23x0/signature-base
Detects: Detects Patchwork malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/Pg3P4W

Pattern signatures:
$x1 = "\" -CHECK & PING -n 2 127.0.0.1 & EXIT" fullword wide
      $x2 = "xClient.Core.Elevation" fullword ascii
      $x3 = ">> Welcome to MAX-Shell :Session created" fullword wide
      $x4 = "xClient.Properties.Resources.resources" fullword ascii
      $x5 = "<description>My UAC Compatible application</description>" fullword ascii

      $s1 = "ping -n 20 localhost > nul" fullword wide
      $s2 = "DownloadAndExecute" fullword ascii
      $s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36" fullword wide
      $s4 = "Client.exe" fullword ascii
      $s5 = "Microsoft -Defender" fullword wide
      $s6 = "Microsoft- Defender" fullword wide
      $s7 = "set_RunHidden" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and (
         1 of ($x*) or
         3 of them
      )

Full rule:
rule xRAT_1 {
   meta:
      description = "Detects Patchwork malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/Pg3P4W"
      date = "2017-12-11"
      hash1 = "92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b"
      hash2 = "f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a"
      id = "170c926a-2020-5269-85b8-6fe9ad28ef76"
   strings:
      $x1 = "\" -CHECK & PING -n 2 127.0.0.1 & EXIT" fullword wide
      $x2 = "xClient.Core.Elevation" fullword ascii
      $x3 = ">> Welcome to MAX-Shell :Session created" fullword wide
      $x4 = "xClient.Properties.Resources.resources" fullword ascii
      $x5 = "<description>My UAC Compatible application</description>" fullword ascii

      $s1 = "ping -n 20 localhost > nul" fullword wide
      $s2 = "DownloadAndExecute" fullword ascii
      $s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36" fullword wide
      $s4 = "Client.exe" fullword ascii
      $s5 = "Microsoft -Defender" fullword wide
      $s6 = "Microsoft- Defender" fullword wide
      $s7 = "set_RunHidden" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and (
         1 of ($x*) or
         3 of them
      )
}
YARA Detection Rule: SUSP_TINY_PE
Repository: Neo23x0/signature-base
Detects: Detects Tiny PE file
Author: Florian Roth (Nextron Systems)
Reference: https://webserver2.tecgraf.puc-rio.br/~ismael/Cursos/YC++/apostilas/win32_xcoff_pe/tyne-example/Tiny%20PE.htm

Pattern signatures:
$header = { 4D 5A 00 00 50 45 00 00 }

Detection condition:
uint16(0) == 0x5a4d and uint16(4) == 0x4550 and filesize <= 20KB and $header at 0

Full rule:
rule SUSP_TINY_PE {
   meta:
      description = "Detects Tiny PE file"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://webserver2.tecgraf.puc-rio.br/~ismael/Cursos/YC++/apostilas/win32_xcoff_pe/tyne-example/Tiny%20PE.htm"
      date = "2019-10-23"
      score = 80
      id = "5081c24e-91d1-5705-9459-f675be4f0e3c"
   strings:
      $header = { 4D 5A 00 00 50 45 00 00 }
   condition:
      uint16(0) == 0x5a4d and uint16(4) == 0x4550 and filesize <= 20KB and $header at 0
}