deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: RoyalRoad_code_pattern1
Repository: Neo23x0/signature-base
Detects: Detects RoyalRoad weaponized RTF documents
Author: nao_sec
Reference: https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf

Pattern signatures:
$S1= "48905d006c9c5b[PII_REDACTED]030101030a0a01085a5ab844eb7112ba[PII_REDACTED]"
       $RTF= "{\\rt"

Detection condition:
$RTF at 0 and $S1

Full rule:
rule RoyalRoad_code_pattern1
{
   meta:
      description = "Detects RoyalRoad weaponized RTF documents"
      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
      date = "2020/01/15"
      author = "nao_sec"
      score = 80
      id = "db2fb24c-df99-5622-ac3d-d31c34481984"
   strings:
       $S1= "48905d006c9c5b[PII_REDACTED]030101030a0a01085a5ab844eb7112ba[PII_REDACTED]"
       $RTF= "{\\rt"

   condition:
       $RTF at 0 and $S1
}
YARA Detection Rule: RoyalRoad_code_pattern2
Repository: Neo23x0/signature-base
Detects: Detects RoyalRoad weaponized RTF documents
Author: nao_sec
Reference: https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf

Pattern signatures:
$S1= "[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]65" ascii
        $RTF= "{\\rt"

Detection condition:
$RTF at 0 and $S1

Full rule:
rule RoyalRoad_code_pattern2
{
   meta:
      description = "Detects RoyalRoad weaponized RTF documents"
      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
      date = "2020/01/15"
      author = "nao_sec"
      score = 80
      id = "135024ae-9ecf-5691-95ca-96002e500fd5"
    strings:
        $S1= "[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]65" ascii
        $RTF= "{\\rt"

    condition:
        $RTF at 0 and $S1
}
YARA Detection Rule: RoyalRoad_code_pattern3
Repository: Neo23x0/signature-base
Detects: Detects RoyalRoad weaponized RTF documents
Author: nao_sec
Reference: https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf

Pattern signatures:
$S1="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]eb[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]"
    $RTF= "{\\rt"

Detection condition:
$RTF at 0 and $S1

Full rule:
rule RoyalRoad_code_pattern3
{
   meta:
      description = "Detects RoyalRoad weaponized RTF documents"
      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
      date = "2020/01/15"
      author = "nao_sec"
      score = 80
      id = "7bce2fe6-a921-51ec-8b5f-5d7f55ab3864"
strings:
    $S1="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]eb[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]"
    $RTF= "{\\rt"

condition:
    $RTF at 0 and $S1

}
YARA Detection Rule: RoyalRoad_code_pattern4ab
Repository: Neo23x0/signature-base
Detects: Detects RoyalRoad weaponized RTF documents
Author: nao_sec
Reference: https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf

Pattern signatures:
$S1= "[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]EB[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]6}[PII_REDACTED]61616161" ascii
        $RTF= "{\\rt"

Detection condition:
$RTF at 0 and $S1

Full rule:
rule RoyalRoad_code_pattern4ab
{
   meta:
      description = "Detects RoyalRoad weaponized RTF documents"
      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
      date = "2020/01/15"
      author = "nao_sec"
      score = 80
      id = "b4926888-b576-59f7-932a-03b9326845da"
    strings:
        $S1= "[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]EB[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]6}[PII_REDACTED]61616161" ascii
        $RTF= "{\\rt"

    condition:
        $RTF at 0 and $S1
}
YARA Detection Rule: RoyalRoad_code_pattern4ce
Repository: Neo23x0/signature-base
Detects: Detects RoyalRoad weaponized RTF documents
Author: nao_sec
Reference: https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf

Pattern signatures:
$S1= "584242eb[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]616}1616161" ascii
        $RTF= "{\\rt"

Detection condition:
$RTF at 0 and $S1

Full rule:
rule RoyalRoad_code_pattern4ce
{
   meta:
      description = "Detects RoyalRoad weaponized RTF documents"
      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
      date = "2020/01/15"
      author = "nao_sec"
      score = 80
      id = "c6e8a072-23cd-5f6a-9b4f-57d3e4500d13"
    strings:
        $S1= "584242eb[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]616}1616161" ascii
        $RTF= "{\\rt"

    condition:
        $RTF at 0 and $S1
}
YARA Detection Rule: RoyalRoad_code_pattern4d
Repository: Neo23x0/signature-base
Detects: Detects RoyalRoad weaponized RTF documents
Author: nao_sec
Reference: https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf

Pattern signatures:
$S1= "584242eb[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]616161616}[PII_REDACTED]" ascii
        $RTF= "{\\rt"

Detection condition:
$RTF at 0 and $S1

Full rule:
rule RoyalRoad_code_pattern4d
{
   meta:
      description = "Detects RoyalRoad weaponized RTF documents"
      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
      date = "2020/01/15"
      author = "nao_sec"
      score = 80
      id = "1677dfb4-7611-5bef-87d1-4cec6285791f"
    strings:
        $S1= "584242eb[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]616161616}[PII_REDACTED]" ascii
        $RTF= "{\\rt"

    condition:
        $RTF at 0 and $S1
}
YARA Detection Rule: RoyalRoad_RTF
Repository: Neo23x0/signature-base
Detects: Detects RoyalRoad weaponized RTF documents
Author: nao_sec
Reference: https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf

Pattern signatures:
$S1= "objw2180\\objh300" ascii
        $RTF= "{\\rt"

Detection condition:
$RTF at 0 and $S1

Full rule:
rule RoyalRoad_RTF
{
   meta:
      description = "Detects RoyalRoad weaponized RTF documents"
      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
      date = "2020/01/15"
      author = "nao_sec"
      score = 80
      id = "366ec9c3-e6ad-5198-88d5-15aa84a8358f"
    strings:
        $S1= "objw2180\\objh300" ascii
        $RTF= "{\\rt"

    condition:
        $RTF at 0 and $S1
}
YARA Detection Rule: RoyalRoad_RTF_v7
Repository: Neo23x0/signature-base
Detects: Detects RoyalRoad weaponized RTF documents
Author: nao_sec
Reference: https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf

Pattern signatures:
$v7_1= "{\\object\\objocx{\\objdata" ascii
        $v7_2= "ods0000"  ascii
        $RTF= "{\\rt"

Detection condition:
$RTF at 0 and all of ($v7*)

Full rule:
rule RoyalRoad_RTF_v7
{
   meta:
      description = "Detects RoyalRoad weaponized RTF documents"
      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
      date = "2020/01/15"
      author = "nao_sec"
      score = 60
      id = "9d2af980-a851-533a-b25d-ee52277e319c"
    strings:
        $v7_1= "{\\object\\objocx{\\objdata" ascii
        $v7_2= "ods0000"  ascii
        $RTF= "{\\rt"

    condition:
        $RTF at 0 and all of ($v7*)
}
YARA Detection Rule: RoyalRoad_encode_in_RTF
Repository: Neo23x0/signature-base
Detects: Detects RoyalRoad weaponized RTF documents
Author: nao_sec
Reference: https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf

Pattern signatures:
$enc_hex_1 = "B0747746"
        $enc_hex_2 = "B2A66DFF"
        $enc_hex_3 = "F2A32072"
        $enc_hex_4 = "B2A46EFF"
        $enc_hex_1l = "b0747746"
        $enc_hex_2l = "b2a66Dff"
        $enc_hex_3l = "f2a32072"
        $enc_hex_4l = "b2a46eff"
        $RTF= "{\\rt"

Detection condition:
$RTF at 0 and 1 of ($enc_hex*)

Full rule:
rule RoyalRoad_encode_in_RTF
{
   meta:
      description = "Detects RoyalRoad weaponized RTF documents"
      reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
      date = "2020/01/15"
      author = "nao_sec"
      score = 60
      id = "66614152-8f9b-5e62-b6bd-ba0286e66d4d"
    strings:
        $enc_hex_1 = "B0747746"
        $enc_hex_2 = "B2A66DFF"
        $enc_hex_3 = "F2A32072"
        $enc_hex_4 = "B2A46EFF"
        $enc_hex_1l = "b0747746"
        $enc_hex_2l = "b2a66Dff"
        $enc_hex_3l = "f2a32072"
        $enc_hex_4l = "b2a46eff"
        $RTF= "{\\rt"
    condition:
        $RTF at 0 and 1 of ($enc_hex*)
}
YARA Detection Rule: EquationGroup_emptycriss
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file emptycriss
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "./emptycriss <target IP>" fullword ascii
      $s2 = "Cut and paste the following to the telnet prompt:" fullword ascii
      $s8 = "environ define TTYPROMPT abcdef" fullword ascii

Detection condition:
( filesize < 50KB and 1 of them )

Full rule:
rule EquationGroup_emptycriss {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file emptycriss"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "a698d35a0c4d25fd960bd40c1de1022bb0763b77938bf279e91c9330060b0b91"
      id = "658a0a2c-ea3a-5531-abea-54f0ed786e79"
   strings:
      $s1 = "./emptycriss <target IP>" fullword ascii
      $s2 = "Cut and paste the following to the telnet prompt:" fullword ascii
      $s8 = "environ define TTYPROMPT abcdef" fullword ascii
   condition:
      ( filesize < 50KB and 1 of them )
}
YARA Detection Rule: EquationGroup_scripme
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file scripme
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "running \\\"tcpdump -n -n\\\", on the environment variable \\$INTERFACE, scripted" fullword ascii
      $x2 = "Cannot read $opetc/scripme.override -- are you root?" ascii
      $x3 = "$ENV{EXPLOIT_SCRIPME}" ascii
      $x4 = "$opetc/scripme.override" ascii

Detection condition:
( filesize < 30KB and 1 of them )

Full rule:
rule EquationGroup_scripme {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file scripme"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "a1adf1c1caad96e7b7fd92cbf419c4cfa13214e66497c9e46ec274a487cd098a"
      id = "a2c5cd8b-c104-57d9-9ce2-a0b9a8dd9288"
   strings:
      $x1 = "running \\\"tcpdump -n -n\\\", on the environment variable \\$INTERFACE, scripted" fullword ascii
      $x2 = "Cannot read $opetc/scripme.override -- are you root?" ascii
      $x3 = "$ENV{EXPLOIT_SCRIPME}" ascii
      $x4 = "$opetc/scripme.override" ascii
   condition:
      ( filesize < 30KB and 1 of them )
}
YARA Detection Rule: EquationGroup_cryptTool
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file cryptTool
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "The encryption key is " fullword ascii
      $s2 = "___tempFile2.out" ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 200KB and all of them )

Full rule:
rule EquationGroup_cryptTool {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file cryptTool"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "96947ad30a2ab15ca5ef53ba8969b9d9a89c48a403e8b22dd5698145ac6695d2"
      id = "e1f4e010-9c42-5b8a-8feb-2885b99307fe"
   strings:
      $s1 = "The encryption key is " fullword ascii
      $s2 = "___tempFile2.out" ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 200KB and all of them )
}
YARA Detection Rule: EquationGroup_dumppoppy
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file dumppoppy
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "Unless the -c (clobber) option is used, if two RETR commands of the" fullword ascii
      $x2 = "mywarn(\"End of $destfile determined by \\\"^Connection closed by foreign host\\\"\")" fullword ascii

      $l1 = "End of $destfile determined by \"^Connection closed by foreign host"

Detection condition:
( filesize < 20KB and 1 of them )

Full rule:
rule EquationGroup_dumppoppy {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file dumppoppy"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "4a5c01590063c78d03c092570b3206fde211daaa885caac2ab0d42051d4fc719"
      id = "c316aac3-bdd7-5187-8ae2-0a87c2f2d26f"
   strings:
      $x1 = "Unless the -c (clobber) option is used, if two RETR commands of the" fullword ascii
      $x2 = "mywarn(\"End of $destfile determined by \\\"^Connection closed by foreign host\\\"\")" fullword ascii

      $l1 = "End of $destfile determined by \"^Connection closed by foreign host"
   condition:
      ( filesize < 20KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Auditcleaner
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file Auditcleaner
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "> /var/log/audit/audit.log; rm -f ." ascii
      $x2 = "Pastables to run on target:" ascii
      $x3 = "cp /var/log/audit/audit.log .tmp" ascii

      $l1 = "Here is the first good cron session from" fullword ascii
      $l2 = "No need to clean LOGIN lines." fullword ascii

Detection condition:
( filesize < 300KB and 1 of them )

Full rule:
rule EquationGroup_Auditcleaner {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file Auditcleaner"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "8c172a60fa9e50f0df493bf5baeb7cc311baef327431526c47114335e0097626"
      id = "39ed798a-221d-5a4b-8809-db01d5241418"
   strings:
      $x1 = "> /var/log/audit/audit.log; rm -f ." ascii
      $x2 = "Pastables to run on target:" ascii
      $x3 = "cp /var/log/audit/audit.log .tmp" ascii

      $l1 = "Here is the first good cron session from" fullword ascii
      $l2 = "No need to clean LOGIN lines." fullword ascii
   condition:
      ( filesize < 300KB and 1 of them )
}
YARA Detection Rule: EquationGroup_reverse_shell
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file reverse.shell.script
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "sh >/dev/tcp/" ascii
      $s2 = " <&1 2>&1" fullword ascii

Detection condition:
( filesize < 1KB and all of them )

Full rule:
rule EquationGroup_reverse_shell {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file reverse.shell.script"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "d29aa24e6fb9e3b3d007847e1630635d6c70186a36c4ab95268d28aa12896826"
      id = "0e9b8ff2-2187-5b61-a086-2ad4ff1a3b10"
   strings:
      $s1 = "sh >/dev/tcp/" ascii
      $s2 = " <&1 2>&1" fullword ascii
   condition:
      ( filesize < 1KB and all of them )
}
YARA Detection Rule: EquationGroup_tnmunger
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file tnmunger
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "TEST: mungedport=%6d  pp=%d  unmunged=%6d" fullword ascii
      $s2 = "mungedport=%6d  pp=%d  unmunged=%6d" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 10KB and 1 of them )

Full rule:
rule EquationGroup_tnmunger {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file tnmunger"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "1ab985d84871c54d36ba4d2abd9168c2a468f1ba06994459db06be13ee3ae0d2"
      id = "c95dd24f-ffc9-5e58-aed7-205daa001b8c"
   strings:
      $s1 = "TEST: mungedport=%6d  pp=%d  unmunged=%6d" fullword ascii
      $s2 = "mungedport=%6d  pp=%d  unmunged=%6d" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 10KB and 1 of them )
}
YARA Detection Rule: EquationGroup_ys_ratload
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file ys.ratload.sh
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "echo \"example: ${0} -l 192.168.1.1 -p 22222 -x 9999\"" fullword ascii
      $x2 = "-x [ port to start mini X server on DEFAULT = 12121 ]\"" fullword ascii
      $x3 = "CALLBACK_PORT=32177" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 3KB and 1 of them )

Full rule:
rule EquationGroup_ys_ratload {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file ys.ratload.sh"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "a340e5b5cfd41076bd4d6ad89d7157eeac264db97a9dddaae15d935937f10d75"
      id = "abd120e7-23f8-530e-b21e-c50a2b571332"
   strings:
      $x1 = "echo \"example: ${0} -l 192.168.1.1 -p 22222 -x 9999\"" fullword ascii
      $x2 = "-x [ port to start mini X server on DEFAULT = 12121 ]\"" fullword ascii
      $x3 = "CALLBACK_PORT=32177" fullword ascii
   condition:
      ( uint16(0) == 0x2123 and filesize < 3KB and 1 of them )
}
YARA Detection Rule: EquationGroup_eh_1_1_0
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file eh.1.1.0.0
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x1 = "usage: %s -e -v -i target IP [-c Cert File] [-k Key File]" fullword ascii
      $x2 = "TYPE=licxfer&ftp=%s&source=/var/home/ftp/pub&version=NA&licfile=" ascii
      $x3 = "[-l Log File] [-m save MAC time file(s)] [-p Server Port]" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 100KB and 1 of them )

Full rule:
rule EquationGroup_eh_1_1_0 {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file eh.1.1.0.0"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "0f8dd094516f1be96da5f9addc0f97bcac8f2a348374bd9631aa[PII_REDACTED]28"
      id = "a6f0ec1f-b0e5-5913-970d-9cdadf647c44"
   strings:
      $x1 = "usage: %s -e -v -i target IP [-c Cert File] [-k Key File]" fullword ascii
      $x2 = "TYPE=licxfer&ftp=%s&source=/var/home/ftp/pub&version=NA&licfile=" ascii
      $x3 = "[-l Log File] [-m save MAC time file(s)] [-p Server Port]" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 100KB and 1 of them )
}
YARA Detection Rule: EquationGroup_evolvingstrategy_1_0_1
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file evolvingstrategy.1.0.1.1
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$s1 = "chown root sh; chmod 4777 sh;" fullword ascii
      $s2 = "cp /bin/sh .;chown root sh;" fullword ascii

      $l1 = "echo clean up when elevated:" fullword ascii

      $x1 = "EXE=$DIR/sbin/ey_vrupdate" fullword ascii

Detection condition:
( filesize < 4KB and 1 of them )

Full rule:
rule EquationGroup_evolvingstrategy_1_0_1 {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file evolvingstrategy.1.0.1.1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "fe70e16715992cc86bbef3e71240f55c7d73815b4247d7e866c845b970233c1b"
      id = "465f709b-1791-5b36-836b-7a0c08bb9b88"
   strings:
      $s1 = "chown root sh; chmod 4777 sh;" fullword ascii
      $s2 = "cp /bin/sh .;chown root sh;" fullword ascii

      $l1 = "echo clean up when elevated:" fullword ascii

      $x1 = "EXE=$DIR/sbin/ey_vrupdate" fullword ascii
   condition:
      ( filesize < 4KB and 1 of them )
}
YARA Detection Rule: EquationGroup_toast_v3_2_0
Repository: Neo23x0/signature-base
Detects: Equation Group hack tool leaked by ShadowBrokers- file toast_v3.2.0.1-linux
Author: Florian Roth (Nextron Systems)
Reference: https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1

Pattern signatures:
$x2 = "Del --- Usage: %s -l file -w wtmp -r user" fullword ascii
      $s5 = "Roasting ->%s<- at ->%d:%d<-" ascii
      $s6 = "rbnoil -Roasting ->" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 50KB and 1 of them )

Full rule:
rule EquationGroup_toast_v3_2_0 {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file toast_v3.2.0.1-linux"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "2ce2d16d24069dc29cf1464819a9dc6deed38d1e5ffc86d175b06ddb691b648b"
      id = "776014ae-be94-5d81-bceb-fefb67ee1994"
   strings:
      $x2 = "Del --- Usage: %s -l file -w wtmp -r user" fullword ascii
      $s5 = "Roasting ->%s<- at ->%d:%d<-" ascii
      $s6 = "rbnoil -Roasting ->" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 50KB and 1 of them )
}