deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: lsadump
Repository: Neo23x0/signature-base
Detects: LSA dump programe (bootkey/syskey) - pwdump and others
Author: Benjamin DELPY (gentilkiwi)

Pattern signatures:
$str_sam_inc = "\\Domains\\Account" ascii nocase
      $str_sam_exc = "\\Domains\\Account\\Users\\Names\\" ascii nocase
      $hex_api_call = { (41 b8 | 68) 00 00 00 02 [0-64] (68 | ba) ff 07 0f 00 }
      $str_msv_lsa = { 4c 53 41 53 52 56 2e 44 4c 4c 00 [0-32] 6d 73 76 31 5f 30 2e 64 6c 6c 00 }
      $hex_bkey = { 4b 53 53 4d [20-70] 05 00 01 00 }

      $fp1 = "Sysinternals" ascii
      $fp2 = "Apple Inc." ascii wide
      $fp3 = "Kaspersky Lab" ascii fullword
      $fp4 = "ESET Security" ascii
      $fp5 = "Disaster Recovery Module" wide
      $fp6 = "Bitdefender" wide fullword

Detection condition:
uint16(0) == 0x5a4d and
      (($str_sam_inc and not $str_sam_exc) or $hex_api_call or $str_msv_lsa or $hex_bkey)
      and not 1 of ($fp*)
      and not filename contains "Regdat"
      and not filetype == "EXE"
      and not filepath contains "Dr Watson"
      and not extension == "vbs"

Full rule:
rule lsadump {
   meta:
      description = "LSA dump programe (bootkey/syskey) - pwdump and others"
      author = "Benjamin DELPY (gentilkiwi)"
      score = 80
      nodeepdive = 1
      id = "3bfa8dd8-720d-5326-ac92-0fb96cf21219"
   strings:
      $str_sam_inc = "\\Domains\\Account" ascii nocase
      $str_sam_exc = "\\Domains\\Account\\Users\\Names\\" ascii nocase
      $hex_api_call = { (41 b8 | 68) 00 00 00 02 [0-64] (68 | ba) ff 07 0f 00 }
      $str_msv_lsa = { 4c 53 41 53 52 56 2e 44 4c 4c 00 [0-32] 6d 73 76 31 5f 30 2e 64 6c 6c 00 }
      $hex_bkey = { 4b 53 53 4d [20-70] 05 00 01 00 }

      $fp1 = "Sysinternals" ascii
      $fp2 = "Apple Inc." ascii wide
      $fp3 = "Kaspersky Lab" ascii fullword
      $fp4 = "ESET Security" ascii
      $fp5 = "Disaster Recovery Module" wide
      $fp6 = "Bitdefender" wide fullword
   condition:
      uint16(0) == 0x5a4d and
      (($str_sam_inc and not $str_sam_exc) or $hex_api_call or $str_msv_lsa or $hex_bkey)
      and not 1 of ($fp*)
      and not filename contains "Regdat"
      and not filetype == "EXE"
      and not filepath contains "Dr Watson"
      and not extension == "vbs"
}
YARA Detection Rule: SUSP_ServU_SSH_Error_Pattern_Jul21_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious SSH component exceptions that could be an indicator of exploitation attempts as described in advisory addressing CVE-2021-35211 in ServU services
Author: Florian Roth (Nextron Systems)
Reference: https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211#FAQ

Pattern signatures:
$s1 = "EXCEPTION: C0000005;" ascii
      $s2 = "CSUSSHSocket::ProcessReceive();" ascii

Detection condition:
filename == "DebugSocketlog.txt"
      and all of ($s*)

Full rule:
rule SUSP_ServU_SSH_Error_Pattern_Jul21_1 {
   meta:
      description = "Detects suspicious SSH component exceptions that could be an indicator of exploitation attempts as described in advisory addressing CVE-2021-35211 in ServU services"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211#FAQ"
      date = "2021-07-12"
      score = 60
      id = "1a89f0b0-445c-5867-94cd-f07ba1becad6"
   strings:
      $s1 = "EXCEPTION: C0000005;" ascii
      $s2 = "CSUSSHSocket::ProcessReceive();" ascii
   condition:
      filename == "DebugSocketlog.txt"
      and all of ($s*)
}
YARA Detection Rule: SUSP_ServU_Known_Mal_IP_Jul21_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious IP addresses used in exploitation of ServU services CVE-2021-35211 and reported by Solarwinds
Author: Florian Roth (Nextron Systems)
Reference: https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211#FAQ

Pattern signatures:
$xip1 = "98.176.196.89" ascii fullword
      $xip2 = "68.235.178.32" ascii fullword
      $xip3 = "208.113.35.58" ascii fullword
      $xip4 = "144.34.179.162" ascii fullword
      $xip5 = "97.77.97.58" ascii fullword

Detection condition:
filename == "DebugSocketlog.txt"
      and 1 of them

Full rule:
rule SUSP_ServU_Known_Mal_IP_Jul21_1 {
   meta:
      description = "Detects suspicious IP addresses used in exploitation of ServU services CVE-2021-35211 and reported by Solarwinds"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211#FAQ"
      date = "2021-07-12"
      score = 60
      id = "118272a7-7ec9-568b-99e0-8cfe97f3f64e"
   strings:
      $xip1 = "98.176.196.89" ascii fullword
      $xip2 = "68.235.178.32" ascii fullword
      $xip3 = "208.113.35.58" ascii fullword
      $xip4 = "144.34.179.162" ascii fullword
      $xip5 = "97.77.97.58" ascii fullword
   condition:
      filename == "DebugSocketlog.txt"
      and 1 of them
}
YARA Detection Rule: SUSP_EXPL_Confluence_RCE_CVE_2021_26084_Indicators_Sep21
Repository: Neo23x0/signature-base
Detects: Detects ELF binaries owner by the confluence user but outside usual confluence directories
Author: Florian Roth (Nextron Systems)
Reference: https://attackerkb.com/topics/Eu74wdMbEL/cve-2021-26084-confluence-server-ognl-injection/rapid7-analysis

Detection condition:
uint32be(0) == 0x7f454c46  /* ELF binary */
      and owner == "confluence"
      and not filepath contains "/confluence/"

Full rule:
rule SUSP_EXPL_Confluence_RCE_CVE_2021_26084_Indicators_Sep21 {
   meta:
      description = "Detects ELF binaries owner by the confluence user but outside usual confluence directories"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://attackerkb.com/topics/Eu74wdMbEL/cve-2021-26084-confluence-server-ognl-injection/rapid7-analysis"
      date = "2021-09-01"
      score = 55
      id = "395d37ea-1986-5fdd-b58c-562ae0d8be35"
   condition:
      uint32be(0) == 0x7f454c46  /* ELF binary */
      and owner == "confluence"
      and not filepath contains "/confluence/"
}
YARA Detection Rule: APT_MAL_RU_WIN_Snake_Malware_PeIconSizes_May23_1
Repository: Neo23x0/signature-base
Detects: Detects Comadmin file that houses Snake's kernel driver and the driver's loader
Author: CSA
Reference: https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF

Detection condition:
uint16(0) == 0x5a4d
      and ( 
         filename == "WerFault.exe"
         or filename == "werfault.exe"
      )
      and filepath contains "\\WinSxS\\"
      and for any rsrc in pe.resources: (
         rsrc.type == pe.RESOURCE_TYPE_ICON and rsrc.length == 3240
      ) 
      and for any rsrc i

Full rule:
rule APT_MAL_RU_WIN_Snake_Malware_PeIconSizes_May23_1 {
   meta:
      description = "Detects Comadmin file that houses Snake's kernel driver and the driver's loader"
      author = "CSA"
      reference = "https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
      date = "2023-05-10"
      score = 75
   condition:
      uint16(0) == 0x5a4d
      and ( 
         filename == "WerFault.exe"
         or filename == "werfault.exe"
      )
      and filepath contains "\\WinSxS\\"
      and for any rsrc in pe.resources: (
         rsrc.type == pe.RESOURCE_TYPE_ICON and rsrc.length == 3240
      ) 
      and for any rsrc in pe.resources: (
         rsrc.type == pe.RESOURCE_TYPE_ICON and rsrc.length == 1384 
      ) 
      and for any rsrc in pe.resources: (
         rsrc.type == pe.RESOURCE_TYPE_ICON and rsrc.length == 7336
      )
}
YARA Detection Rule: APT_MAL_RU_Snake_Malware_Queue_File_May23_1
Repository: Neo23x0/signature-base
Detects: Detects Queue files used by Snake malware
Author: Florian Roth
Reference: https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF

Detection condition:
filename matches /(\{[0-9A-Fa-f]{8}\-([0-9A-Fa-f]{4}\-){3}[0-9A-Fa-f]{12}\}\.){2}crmlog/
      /* and filepath contains "\\Registration\\" // not needed - already specific enough */
      // we reduce the range for the entropy calculation to the first 1024 for performance
      // reasons. In a full

Full rule:
rule APT_MAL_RU_Snake_Malware_Queue_File_May23_1 {
   meta:
      description = "Detects Queue files used by Snake malware"
      author = "Florian Roth"
      reference = "https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
      date = "2023-05-10"
      score = 80
      id = "c7ed554e-b55e-5c3f-aa8b-231cb1073f34"
   condition:
      filename matches /(\{[0-9A-Fa-f]{8}\-([0-9A-Fa-f]{4}\-){3}[0-9A-Fa-f]{12}\}\.){2}crmlog/
      /* and filepath contains "\\Registration\\" // not needed - already specific enough */
      // we reduce the range for the entropy calculation to the first 1024 for performance
      // reasons. In a fully encrypted file - as used by Snake - this should already be specific enough
      //and math.entropy(0, filesize) >= 7.0
      and math.entropy(0, 1024) >= 7.0
}
YARA Detection Rule: SUSP_Password_XLS_Unencrypted
Repository: Neo23x0/signature-base
Detects: Detects files named e.g. password.xls, which might contain unportected clear text passwords
Author: Arnim Rupp (https://github.com/ruppde)
Reference: Internal Research

Detection condition:
// match password and the german passwort:
      (
         filename istartswith "passwor" or  /* EN / DE */
         filename istartswith "contrase" or  /* ES */
         filename istartswith "mot de pass" or  /* FR */
         filename istartswith "mot_de_pass" or  /* FR */
         filename istar

Full rule:
rule SUSP_Password_XLS_Unencrypted {
   meta:
      description = "Detects files named e.g. password.xls, which might contain unportected clear text passwords"
      author = "Arnim Rupp (https://github.com/ruppde)"
      reference = "Internal Research"
      date = "2023-10-04"
      score = 60
      id = "41096ef1-dd02-5956-9053-3d7fb1a5092c"
   condition:
      // match password and the german passwort:
      (
         filename istartswith "passwor" or  /* EN / DE */
         filename istartswith "contrase" or  /* ES */
         filename istartswith "mot de pass" or  /* FR */
         filename istartswith "mot_de_pass" or  /* FR */
         filename istartswith "motdepass" or  /* FR */
         filename istartswith "wachtwoord"  /* NL */
      )
      and (
         // no need to check if an xls is password protected, because it's trivial to break
         (
            filename iendswith ".xls"
            and uint32be(0) == 0xd0cf11e0  // xls
         )
         or
         (
            filename iendswith ".xlsx"
            and uint32be(0) == 0x504b0304  // unencrypted xlsx = pkzip
         )
      )
}
YARA Detection Rule: SUSP_Password_XLS_Encrypted
Repository: Neo23x0/signature-base
Detects: Detects files named e.g. password.xlsx, which might contain clear text passwords, but are password protected from MS Office
Author: Arnim Rupp (https://github.com/ruppde)
Reference: Internal Research

Detection condition:
// match password and the german passwort:
      (
         filename istartswith "passwor" or  /* EN / DE */
         filename istartswith "contrase" or  /* ES */
         filename istartswith "mot de pass" or  /* FR */
         filename istartswith "mot_de_pass" or  /* FR */
         filename istar

Full rule:
rule SUSP_Password_XLS_Encrypted {
   meta:
      description = "Detects files named e.g. password.xlsx, which might contain clear text passwords, but are password protected from MS Office"
      author = "Arnim Rupp (https://github.com/ruppde)"
      reference = "Internal Research"
      date = "2023-10-04"
      score = 50
      id = "d3[PII_REDACTED]-524d-9111-8ccb754ab99e"
   condition:
      // match password and the german passwort:
      (
         filename istartswith "passwor" or  /* EN / DE */
         filename istartswith "contrase" or  /* ES */
         filename istartswith "mot de pass" or  /* FR */
         filename istartswith "mot_de_pass" or  /* FR */
         filename istartswith "motdepass" or  /* FR */
         filename istartswith "wachtwoord"  /* NL */
      )
      and filename iendswith ".xlsx"
      and uint32be(0) == 0xd0cf11e0  // encrypted xlsx = CDFV2
}
YARA Detection Rule: SUSP_DLL_SideLoading_Characteristics_Feb26
Repository: Neo23x0/signature-base
Detects: Detects suspicious log.dll used by Bitdefender Submission Wizard and seen being used in LotusBlossom toolkit
Author: Florian Roth
Reference: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

Pattern signatures:
$s1 = "log.dll" fullword ascii

Detection condition:
uint16(0) == 0x5a4d
      and (  // this is what makes it suspicious
         filesize < 300KB
         or filesize > 500KB
      )
      and pe.exports("LogInit")
      and pe.exports("LogWrite")
      and $s1
      and filename == "log.dll"

Full rule:
rule SUSP_DLL_SideLoading_Characteristics_Feb26 {
   meta:
      description = "Detects suspicious log.dll used by Bitdefender Submission Wizard and seen being used in LotusBlossom toolkit"
      author = "Florian Roth"
      reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
      date = "2026-02-03"
      score = 70
      hash1 = "3bdc4c[PII_REDACTED]f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad"
   strings:
      $s1 = "log.dll" fullword ascii
   condition:
      uint16(0) == 0x5a4d
      and (  // this is what makes it suspicious
         filesize < 300KB
         or filesize > 500KB
      )
      and pe.exports("LogInit")
      and pe.exports("LogWrite")
      and $s1
      and filename == "log.dll"
}
YARA Detection Rule: SUSP_Renamed_Bitdefender_Submission_Wizard_Feb26
Repository: Neo23x0/signature-base
Detects: Detects renamed Bitdefender Submission Wizard, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom
Author: X__Junior
Reference: https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

Pattern signatures:
$s1 = "BDSubWiz.exe" wide fullword
      $s2 = "Bitdefender Submission Wizard" wide
      $s3 = "Software\\Bitdefender" wide

Detection condition:
uint16(0) == 0x5a4d
      and all of ($s*)
      and not filename == "BDSubWiz.exe"

Full rule:
rule SUSP_Renamed_Bitdefender_Submission_Wizard_Feb26 {
   meta:
      description = "Detects renamed Bitdefender Submission Wizard, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom"
      author = "X__Junior"
      reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
      date = "2026-02-03"
      score = 65
      hash1 = "2da00de67720f5f13b17e9d985fe70f10f153da60c9ab1086fe58f069a156924"
   strings:
      $s1 = "BDSubWiz.exe" wide fullword
      $s2 = "Bitdefender Submission Wizard" wide
      $s3 = "Software\\Bitdefender" wide
   condition:
      uint16(0) == 0x5a4d
      and all of ($s*)
      and not filename == "BDSubWiz.exe"
}
YARA Detection Rule: SUSP_RAR_NTFS_ADS
Repository: Neo23x0/signature-base
Detects: Detects RAR archive with NTFS alternate data stream
Author: Proofpoint
Reference: https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats

Pattern signatures:
// RAR file format documentation: https://www.rarlab.com/technote.htm
        $rar_magic = {52 61 72 21} // RAR magic bytes (will match on any RAR version, we don't restrict on v5 for now, but on offset 0 which does not have to be the case according to the documentation)
        $ads = {
                 03         // Header Type -> Service Header
                 23         // Header flags
                 [17-20]    // Flags and extra data area
                 00         // Windows
                 03         // Length of name = STM = 3
                 53 54 4d   // STM NTFS alternate data stream
                 [1-2]      // variable int (vint) for size of the stream name -> 1-2 bytes should be enough to take into account
                 07         // Data type = Service data = Service header data array
                 3a         // Start of the ADS name -> start with colon ":"
               }
        $neg = "Zone.Identifier"  // This is the default Windows ADS name, we will g

Detection condition:
$rar_magic at 0 and $ads and not $neg in (@ads[1]..@ads[1]+15)

Full rule:
rule SUSP_RAR_NTFS_ADS {
    meta:
        description = "Detects RAR archive with NTFS alternate data stream"
        author = "Proofpoint"
        category = "hunting"
        score = 70
        date = "2024-12-17"
        reference = "https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats"
        hash1 = "feec47858379c29300d249d1693f68dc085300f493891d1a9d4ea83b8db6e3c3"
        hash2 = "53a653aae[PII_REDACTED]bdb8ccf5eaff947f9121f73b8dcf24858c0447922d0b1"
        id = "ca2b5904-b3d3-53cd-a973-6f30f0831a94"
    strings:
        // RAR file format documentation: https://www.rarlab.com/technote.htm
        $rar_magic = {52 61 72 21} // RAR magic bytes (will match on any RAR version, we don't restrict on v5 for now, but on offset 0 which does not have to be the case according to the documentation)
        $ads = {
                 03         // Header Type -> Service Header
                 23         // Header flags
                 [17-20]    // Flags and extra data area
                 00         // Windows
                 03         // Length of name = STM = 3
                 53 54 4d   // STM NTFS alternate data stream
                 [1-2]      // variable int (vint) for size of the stream name -> 1-2 bytes should be enough to take into account
                 07         // Data type = Service data = Service header data array
                 3a         // Start of the ADS name -> start with colon ":"
               }
        $neg = "Zone.Identifier"  // This is the default Windows ADS name, we will get FPs on that, so we don't want that to be the first ADS name we find
    condition:
        $rar_magic at 0 and $ads and not $neg in (@ads[1]..@ads[1]+15)
}
YARA Detection Rule: APT_MAL_VEILEDSIGNAL_Backdoor_Apr23
Repository: Neo23x0/signature-base
Detects: Detects malicious VEILEDSIGNAL backdoor
Author: X__Junior
Reference: https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

Pattern signatures:
$op1 = {B8 AB AA AA AA F7 E1 8B C1 C1 EA 02 8D 14 52 03 D2 2B C2 8A 84 05 ?? ?? ?? ?? 30 84 0D ?? ?? ?? ??} /* xor decryption*/ 
      $op2 = { 50 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 3C 00 00 00 C7 85 ?? ?? ?? ?? 40 00 00 00 C7 85 ?? ?? ?? ?? 05 00 00 00 FF 15} /* shellexecute*/
      $op3 = { 6A 00 8D 85 ?? ?? ?? ?? 50 6A 04 8D 85 ?? ?? ?? ?? 50 57 FF 15 } /* read file*/

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule APT_MAL_VEILEDSIGNAL_Backdoor_Apr23 {
   meta:
      description = "Detects malicious VEILEDSIGNAL backdoor"
      author = "X__Junior"
      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
      date = "2023-04-20"
      score = 85
      hash1 = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
      id = "74c403ea-3178-58e8-88b3-a51c1d475868"
    strings:
      $op1 = {B8 AB AA AA AA F7 E1 8B C1 C1 EA 02 8D 14 52 03 D2 2B C2 8A 84 05 ?? ?? ?? ?? 30 84 0D ?? ?? ?? ??} /* xor decryption*/ 
      $op2 = { 50 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 3C 00 00 00 C7 85 ?? ?? ?? ?? 40 00 00 00 C7 85 ?? ?? ?? ?? 05 00 00 00 FF 15} /* shellexecute*/
      $op3 = { 6A 00 8D 85 ?? ?? ?? ?? 50 6A 04 8D 85 ?? ?? ?? ?? 50 57 FF 15 } /* read file*/
    condition:
      uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: SUSP_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23
Repository: Neo23x0/signature-base
Detects: Detects marker found in VEILEDSIGNAL backdoor
Author: X__Junior
Reference: https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

Pattern signatures:
$opb1 = { 81 BD ?? ?? ?? ?? 5E DA F3 76} /* marker */
      $opb2 = { C7 85 ?? ?? ?? ?? 74 F2 39 DA 66 C7 85 ?? ?? ?? ?? E5 CF} /* 1st xor key*/
      $opb3 = { C7 85 ?? ?? ?? ?? 74 F2 39 DA B9 00 04 00 00 66 C7 85 ?? ?? ?? ?? E5 CF } /* 2nd xor key*/

Detection condition:
2 of them

Full rule:
rule SUSP_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23 {
   meta:
      description = "Detects marker found in VEILEDSIGNAL backdoor"
      author = "X__Junior"
      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
      date = "2023-04-20"
      modified = "2023-04-21"
      score = 75
      hash1 = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
      id = "8f0d92b6-d9b0-55e3-b2ca-601d095f5279"
   strings:
      $opb1 = { 81 BD ?? ?? ?? ?? 5E DA F3 76} /* marker */
      $opb2 = { C7 85 ?? ?? ?? ?? 74 F2 39 DA 66 C7 85 ?? ?? ?? ?? E5 CF} /* 1st xor key*/
      $opb3 = { C7 85 ?? ?? ?? ?? 74 F2 39 DA B9 00 04 00 00 66 C7 85 ?? ?? ?? ?? E5 CF } /* 2nd xor key*/
   condition:
      2 of them
}
YARA Detection Rule: APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2
Repository: Neo23x0/signature-base
Detects: Detects VEILEDSIGNAL malware
Author: Mandiant
Reference: https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

Pattern signatures:
$sb1 = { C1 E0 05 4D 8? [2] 33 D0 45 69 C0 7D 50 BF 12 8B C2 41 FF C2 C1 E8 07 33 D0 8B C2 C1 E0 16 41 81 C0 87 D6 12 00 }
      $si1 = "CryptBinaryToStringA" fullword
      $si2 = "BCryptGenerateSymmetricKey" fullword
      $si3 = "CreateThread" fullword
      $ss1 = "ChainingModeGCM" wide
      $ss2 = "__tutma" fullword

Detection condition:
(uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them

Full rule:
rule APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2 {
   meta:
      description = "Detects VEILEDSIGNAL malware"
      author = "Mandiant"
      score = 75
      disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
      hash1 = "404b09def6054a281b41d309d809a428"
      reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
      date = "2023-04-20"
      id = "1b96c2f0-1c57-593e-9630-a72d43eb857e"
   strings:
      $sb1 = { C1 E0 05 4D 8? [2] 33 D0 45 69 C0 7D 50 BF 12 8B C2 41 FF C2 C1 E8 07 33 D0 8B C2 C1 E0 16 41 81 C0 87 D6 12 00 }
      $si1 = "CryptBinaryToStringA" fullword
      $si2 = "BCryptGenerateSymmetricKey" fullword
      $si3 = "CreateThread" fullword
      $ss1 = "ChainingModeGCM" wide
      $ss2 = "__tutma" fullword
   condition:
      (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and (uint16(uint32(0x3C)+0x18) == 0x020B) and all of them
}