deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_NK_Lazarus_RC4_Loop
Repository: Neo23x0/signature-base
Detects: Detects RC4 loop in Lazarus Group implant
Author: f-secure 
Reference: https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical

Pattern signatures:
$str_rc4_loop = { 41 FE 8? 00 01 00 00 45 0F B6 ?? 00 01 00 00 48 
                        FF C? 43 0F B6 0? ?? 41 00 8? 01 01 00 00 41 0F 
                        B6 ?? 01 01 00 00 }

Detection condition:
int16(0) == 0x5a4d and filesize < 3000KB and $str_rc4_loop

Full rule:
rule APT_NK_Lazarus_RC4_Loop {
   meta: 
      author = "f-secure "
      description = "Detects RC4 loop in Lazarus Group implant" 
      date = "2020-06-10"
      reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
      id = "a9503795-b4b8-505e-a1bf-df64ec8c1c32"
   strings:
      $str_rc4_loop = { 41 FE 8? 00 01 00 00 45 0F B6 ?? 00 01 00 00 48 
                        FF C? 43 0F B6 0? ?? 41 00 8? 01 01 00 00 41 0F 
                        B6 ?? 01 01 00 00 }
   condition:
      int16(0) == 0x5a4d and filesize < 3000KB and $str_rc4_loop
}
YARA Detection Rule: APT_NK_Lazarus_Network_Backdoor_Unpacked
Repository: Neo23x0/signature-base
Detects: Detects unpacked variant of Lazarus Group network backdoor
Author: f-secure
Reference: https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical

Pattern signatures:
$str_netsh_1 = "netsh firewall add portopening TCP %d" ascii wide nocase 
      $str_netsh_2 = "netsh firewall delete portopening TCP %d" ascii wide nocase 
      $str_mask_1 = "cmd.exe /c \"%s >> %s 2>&1\"" ascii wide
      $str_mask_2 = "cmd.exe /c \"%s 2>> %s\"" ascii wide 
      $str_mask_3 = "%s\\%s\\%s" ascii wide
      $str_other_1 = "perflog.dat" ascii wide nocase 
      $str_other_2 = "perflog.evt" ascii wide nocase 
      $str_other_3 = "cbstc.log" ascii wide nocase 
      $str_other_4 = "LdrGetProcedureAddress" ascii 
      $str_other_5 = "NtProtectVirtualMemory" ascii

Detection condition:
int16(0) == 0x5a4d
      and filesize < 3000KB
      and 1 of ($str_netsh*)
      and 1 of ($str_mask*)
      and 1 of ($str_other*)

Full rule:
rule APT_NK_Lazarus_Network_Backdoor_Unpacked {
   meta:
      author = "f-secure"
      description = "Detects unpacked variant of Lazarus Group network backdoor" 
      date = "2020-06-10"      
      reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
      id = "8eda9e74-1a19-5510-82d8-cd2eb324629c"
   strings:
      $str_netsh_1 = "netsh firewall add portopening TCP %d" ascii wide nocase 
      $str_netsh_2 = "netsh firewall delete portopening TCP %d" ascii wide nocase 
      $str_mask_1 = "cmd.exe /c \"%s >> %s 2>&1\"" ascii wide
      $str_mask_2 = "cmd.exe /c \"%s 2>> %s\"" ascii wide 
      $str_mask_3 = "%s\\%s\\%s" ascii wide
      $str_other_1 = "perflog.dat" ascii wide nocase 
      $str_other_2 = "perflog.evt" ascii wide nocase 
      $str_other_3 = "cbstc.log" ascii wide nocase 
      $str_other_4 = "LdrGetProcedureAddress" ascii 
      $str_other_5 = "NtProtectVirtualMemory" ascii
   condition:
      int16(0) == 0x5a4d
      and filesize < 3000KB
      and 1 of ($str_netsh*)
      and 1 of ($str_mask*)
      and 1 of ($str_other*)
}
YARA Detection Rule: HoneyBee_Dropper_MalDoc
Repository: Neo23x0/signature-base
Detects: Detects samples from Operation Honeybee
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/JAHZVL

Pattern signatures:
$x1 = "cmd /c expand %TEMP%\\setup.cab -F:* %SystemRoot%\\System32"
      $x2 = "del /f /q %TEMP%\\setup.cab && cliconfg.exe"

      $s1 = "SELECT * FROM Win32_Processor" fullword ascii
      $s2 = "\"cmd /c `wusa " fullword ascii
      $s3 = "sTempPathP" fullword ascii
      $s4 = "sTempFile" fullword ascii
      $s5 = "GetObjectz" fullword ascii
      $s6 = "\\setup.cab" ascii

Detection condition:
uint16(0) == 0xcfd0 and filesize < 400KB and ( 1 of ($x*) or 4 of them )

Full rule:
rule HoneyBee_Dropper_MalDoc {
   meta:
      description = "Detects samples from Operation Honeybee"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/JAHZVL"
      date = "2018-03-03"
      hash1 = "[PII_REDACTED]2bbf0865e7693fe5a2bbe9b3ba12b3f1a1536ef67915daab78004c"
      hash2 = "0d[PII_REDACTED]339f87be70c2f3fe096500cfcdc95a8dea975fdfc457bd347c44"
      id = "4e8dec29-2c0a-5760-91c9-88f67505a7f1"
   strings:
      $x1 = "cmd /c expand %TEMP%\\setup.cab -F:* %SystemRoot%\\System32"
      $x2 = "del /f /q %TEMP%\\setup.cab && cliconfg.exe"

      $s1 = "SELECT * FROM Win32_Processor" fullword ascii
      $s2 = "\"cmd /c `wusa " fullword ascii
      $s3 = "sTempPathP" fullword ascii
      $s4 = "sTempFile" fullword ascii
      $s5 = "GetObjectz" fullword ascii
      $s6 = "\\setup.cab" ascii
   condition:
      uint16(0) == 0xcfd0 and filesize < 400KB and ( 1 of ($x*) or 4 of them )
}
YARA Detection Rule: OpHoneybee_Malware_1
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Honeybee
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/JAHZVL

Pattern signatures:
$x1 = "cmd /c taskkill /im cliconfg.exe /f /t && del /f /q" fullword ascii
      $x2 = "\\FTPCom_vs10\\Release\\Engine.pdb" ascii
      $x3 = "KXU/yP=B29tLzidqNRuf-SbVInw0oCrmWZk6OpFc7A5GTD1QxaJ3H8h4jMeEsYglv" fullword ascii
      $x4 = "D:\\Task\\MiMul\\" ascii

      $s1 = "[DLL_PROCESS_ATTACH]" fullword ascii
      $s2 = "cmd /c systeminfo >%s" fullword ascii
      $s3 = "post.txt" fullword ascii
      $s4 = "\\temp.ini" ascii
      $s5 = "[GetFTPAccountInfo_10001712]" fullword ascii
      $s6 = "ComSysAppMutex" fullword ascii
      $s7 = "From %s (%02d-%02d %02d-%02d-%02d).txt" fullword ascii
      $s8 = "%s %s %c%s%c" fullword ascii
      $s9 = "TO EVERYONE" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (
        pe.imphash() == "e14b59a79999cc0bc589a4cb5994692a" or
        pe.imphash() == "64400f452e2f60305c341e08f217b02c" or
        1 of ($x*) or
        3 of them
      )

Full rule:
rule OpHoneybee_Malware_1 {
   meta:
      description = "Detects malware from Operation Honeybee"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/JAHZVL"
      date = "2018-03-03"
      hash1 = "d31fe5cfa884e04ee26f323b8d104dcaa91146f5c7c216212fd3053afaade80f"
      hash2 = "fc2bcd38659ae83fd25b4f7091412ae9ba011612fa4dcc3ef665b2cae2a1d74f"
      hash3 = "2c5e5c86ca4fa172341c6bcbaa50984fb168d650ae9a33f2c6e6dccc1d57b369"
      hash4 = "439c305cd408dbb508e153caab29d17021a7430f1dbaec0c90ac750ba2136f5f"
      id = "5f48434e-efe6-5cd8-85e2-eabf528e6c58"
   strings:
      $x1 = "cmd /c taskkill /im cliconfg.exe /f /t && del /f /q" fullword ascii
      $x2 = "\\FTPCom_vs10\\Release\\Engine.pdb" ascii
      $x3 = "KXU/yP=B29tLzidqNRuf-SbVInw0oCrmWZk6OpFc7A5GTD1QxaJ3H8h4jMeEsYglv" fullword ascii
      $x4 = "D:\\Task\\MiMul\\" ascii

      $s1 = "[DLL_PROCESS_ATTACH]" fullword ascii
      $s2 = "cmd /c systeminfo >%s" fullword ascii
      $s3 = "post.txt" fullword ascii
      $s4 = "\\temp.ini" ascii
      $s5 = "[GetFTPAccountInfo_10001712]" fullword ascii
      $s6 = "ComSysAppMutex" fullword ascii
      $s7 = "From %s (%02d-%02d %02d-%02d-%02d).txt" fullword ascii
      $s8 = "%s %s %c%s%c" fullword ascii
      $s9 = "TO EVERYONE" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
        pe.imphash() == "e14b59a79999cc0bc589a4cb5994692a" or
        pe.imphash() == "64400f452e2f60305c341e08f217b02c" or
        1 of ($x*) or
        3 of them
      )
}
YARA Detection Rule: OpHoneybee_MaoCheng_Dropper
Repository: Neo23x0/signature-base
Detects: Detects MaoCheng dropper from Operation Honeybee
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/JAHZVL

Pattern signatures:
$x1 = "\\MaoCheng\\Release\\" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and 1 of them

Full rule:
rule OpHoneybee_MaoCheng_Dropper {
   meta:
      description = "Detects MaoCheng dropper from Operation Honeybee"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/JAHZVL"
      date = "2018-03-03"
      hash1 = "35904f482d37f5ce6034d6042bae207418e450f4"
      id = "b163e08e-3892-55f6-ae3e-30d2ba3f4310"
   strings:
      $x1 = "\\MaoCheng\\Release\\" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 600KB and 1 of them
}
YARA Detection Rule: APT_APT29_Win_FlipFlop_LDR
Repository: Neo23x0/signature-base
Detects: A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload.
Author: threatintel@volexity.com
Reference: https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/

Pattern signatures:
$s1 = "irnjadle"
      $s2 = "BADCFEHGJILKNMPORQTSVUXWZY"
      $s3 = "iMrcsofo taBesC yrtpgoarhpciP orived r1v0."

Detection condition:
all of ($s*)

Full rule:
rule APT_APT29_Win_FlipFlop_LDR : APT29 {
   meta:
      author = "threatintel@volexity.com"
      date = "2021-05-25"
      description = "A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload."
      hash = "ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330"
      reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
      id = "58696a6f-55a9-5212-9372-a539cc327e6b"
   strings:
      $s1 = "irnjadle"
      $s2 = "BADCFEHGJILKNMPORQTSVUXWZY"
      $s3 = "iMrcsofo taBesC yrtpgoarhpciP orived r1v0."
   condition:
      all of ($s*)
}
YARA Detection Rule: APT_APT28_Win_FreshFire
Repository: Neo23x0/signature-base
Detects: The FRESHFIRE malware family. The malware acts as a downloader, pulling down an encrypted snippet of code from a remote source, executing it, and deleting it from the remote server.
Author: threatintel@volexity.com
Reference: https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/

Pattern signatures:
$uniq1 = "UlswcXJJWhtHIHrVqWJJ"
      $uniq2 = "gyibvmt\x00"

      $path1 = "root/time/%d/%s.json"
      $path2 = "C:\\dell.sdr"
      $path3 = "root/data/%d/%s.json"

Detection condition:
(
         pe.number_of_exports == 1 and pe.exports("WaitPrompt")
      ) or
      any of ($uniq*) or
      2 of ($path*)

Full rule:
rule APT_APT28_Win_FreshFire : APT29 {
   meta:
      author = "threatintel@volexity.com"
      date = "2021-05-27"
      description = "The FRESHFIRE malware family. The malware acts as a downloader, pulling down an encrypted snippet of code from a remote source, executing it, and deleting it from the remote server."
      hash = "ad67aaa50fd60d02f1378b4155f69cffa9591eaeb80523489a2355512cc30e8c"
      reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
      id = "050b8e61-139a-5ff5-998a-7de67c9975bf"
   strings:
      $uniq1 = "UlswcXJJWhtHIHrVqWJJ"
      $uniq2 = "gyibvmt\x00"

      $path1 = "root/time/%d/%s.json"
      $path2 = "C:\\dell.sdr"
      $path3 = "root/data/%d/%s.json"
   condition:
      (
         pe.number_of_exports == 1 and pe.exports("WaitPrompt")
      ) or
      any of ($uniq*) or
      2 of ($path*)
}
YARA Detection Rule: APT_APT29_NOBELIUM_JS_EnvyScout_May21_1
Repository: Neo23x0/signature-base
Detects: Detects EnvyScout deobfuscator code as used by NOBELIUM group
Author: Florian Roth (Nextron Systems)
Reference: https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/

Pattern signatures:
$x1 = "[i].charCodeAt(0) ^ 2);}"

Detection condition:
filesize < 5000KB and 1 of them

Full rule:
rule APT_APT29_NOBELIUM_JS_EnvyScout_May21_1 {
   meta:
      description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
      date = "2021-05-29"
      id = "42739aad-a88a-545b-8256-1f727c79c4f8"
   strings:
      $x1 = "[i].charCodeAt(0) ^ 2);}"
   condition:
      filesize < 5000KB and 1 of them
}
YARA Detection Rule: APT_APT29_NOBELIUM_JS_EnvyScout_May21_2
Repository: Neo23x0/signature-base
Detects: Detects EnvyScout deobfuscator code as used by NOBELIUM group
Author: Florian Roth (Nextron Systems)
Reference: https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/

Pattern signatures:
$s1 = "saveAs(blob, " ascii
      $s2 = ".iso\");" ascii
      $s3 = "application/x-cd-image" ascii
      $s4 = ".indexOf(\"Win\")!=-1" ascii

Detection condition:
filesize < 5000KB and all of them

Full rule:
rule APT_APT29_NOBELIUM_JS_EnvyScout_May21_2 {
   meta:
      description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
      date = "2021-05-29"
      id = "d5cf3365-fe24-533a-a678-b5b6d4d99997"
   strings:
      $s1 = "saveAs(blob, " ascii
      $s2 = ".iso\");" ascii
      $s3 = "application/x-cd-image" ascii
      $s4 = ".indexOf(\"Win\")!=-1" ascii
   condition:
      filesize < 5000KB and all of them
}
YARA Detection Rule: APT_APT29_NOBELIUM_LNK_NV_Link_May21_2
Repository: Neo23x0/signature-base
Detects: Detects NV Link as used by NOBELIUM group
Author: Florian Roth (Nextron Systems)
Reference: https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/

Pattern signatures:
$s1 = "RegisterOCX BOOM" ascii wide
      $s2 = "cmd.exe /c start BOOM.exe" ascii wide

Detection condition:
filesize < 5000KB and 1 of them

Full rule:
rule APT_APT29_NOBELIUM_LNK_NV_Link_May21_2 {
   meta:
      description = "Detects NV Link as used by NOBELIUM group"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
      date = "2021-05-29"
      id = "52c2caf9-13df-5614-9c9e-afcd76ec77f9"
   strings:
      $s1 = "RegisterOCX BOOM" ascii wide
      $s2 = "cmd.exe /c start BOOM.exe" ascii wide
   condition:
      filesize < 5000KB and 1 of them
}
YARA Detection Rule: APT_APT29_NOBELIUM_LNK_Samples_May21_1
Repository: Neo23x0/signature-base
Detects: Detects link file characteristics as described in APT29 NOBELIUM report
Author: Florian Roth (Nextron Systems)
Reference: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/

Pattern signatures:
$a1 = "rundll32.exe" wide

      $sa1 = "IMGMountingService.dll" wide
      $sa2 = "MountImgHelper" wide

      $sb1 = "diassvcs.dll" wide
      $sb2 = "InitializeComponent" wide

      $sc1 = "MsDiskMountService.dll" wide 
      $sc2 = "DiskDriveIni" wide

      $sd1 = "GraphicalComponent.dll" wide
      $sd2 = "VisualServiceComponent" wide

      $se1 = "data/mstu.dll,MicrosoftUpdateService" wide

Detection condition:
uint16(0) == 0x004c and
      filesize < 4KB and $a1 and 
      ( all of ($sa*) or all of ($sb*) or all of ($sc*) or all of ($sd*) or all of ($se*) )

Full rule:
rule APT_APT29_NOBELIUM_LNK_Samples_May21_1 {
   meta:
      description = "Detects link file characteristics as described in APT29 NOBELIUM report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
      date = "2021-05-27"
      score = 85
      hash1 = "24caf54e7c3fe308444093f7ac64d6d520c8f44ea4251e09e24931bdb72f5548"
      id = "c807ab5a-f66a-5622-81b1-6e69b6df8446"
   strings:
      $a1 = "rundll32.exe" wide

      $sa1 = "IMGMountingService.dll" wide
      $sa2 = "MountImgHelper" wide

      $sb1 = "diassvcs.dll" wide
      $sb2 = "InitializeComponent" wide

      $sc1 = "MsDiskMountService.dll" wide 
      $sc2 = "DiskDriveIni" wide

      $sd1 = "GraphicalComponent.dll" wide
      $sd2 = "VisualServiceComponent" wide

      $se1 = "data/mstu.dll,MicrosoftUpdateService" wide
   condition:
      uint16(0) == 0x004c and
      filesize < 4KB and $a1 and 
      ( all of ($sa*) or all of ($sb*) or all of ($sc*) or all of ($sd*) or all of ($se*) )
}
YARA Detection Rule: APT_APT29_NOBELIUM_BoomBox_May21_1
Repository: Neo23x0/signature-base
Detects: Detects BoomBox malware as described in APT29 NOBELIUM report
Author: Florian Roth
Reference: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/

Pattern signatures:
// PowerShell tool - e1765eafb68fc6034575f126b014fcad6bb043c2961823b7cef5f711e9e01d1c
      $a1 = "]::FromBase64String($" ascii wide

      $xa1 = "123do3y4r378o5t34onf7t3o573tfo73" ascii wide fullword
      $xa2 = "1233t04p7jn3n4rg" ascii wide fullword

      $s1 = "\\Release\\BOOM.pdb" ascii
      $s2 = "/files/upload" ascii
      $s3 = "/tmp/readme.pdf" ascii fullword
      $s4 = "/new/{0}" ascii fullword
      $s5 = "(&(objectClass=user)(objectCategory=person))"

Detection condition:
( 
         uint16(0) == 0x5a4d 
         or 1 of ($a*) 
      )
      and (
         1 of ($x*)
         or 3 of ($s*)
      )

Full rule:
rule APT_APT29_NOBELIUM_BoomBox_May21_1 {
   meta:
      description = "Detects BoomBox malware as described in APT29 NOBELIUM report"
      author = "Florian Roth"
      reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
      date = "2021-05-27"
      modified = "2025-03-20"
      score = 85
      hash = "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27"
      id = "1a14dcf7-81be-5a74-a530-caf6268d1976"
   strings:
      // PowerShell tool - e1765eafb68fc6034575f126b014fcad6bb043c2961823b7cef5f711e9e01d1c
      $a1 = "]::FromBase64String($" ascii wide

      $xa1 = "123do3y4r378o5t34onf7t3o573tfo73" ascii wide fullword
      $xa2 = "1233t04p7jn3n4rg" ascii wide fullword

      $s1 = "\\Release\\BOOM.pdb" ascii
      $s2 = "/files/upload" ascii
      $s3 = "/tmp/readme.pdf" ascii fullword
      $s4 = "/new/{0}" ascii fullword
      $s5 = "(&(objectClass=user)(objectCategory=person))"
   condition:
      ( 
         uint16(0) == 0x5a4d 
         or 1 of ($a*) 
      )
      and (
         1 of ($x*)
         or 3 of ($s*)
      )
}
YARA Detection Rule: APT_APT29_NOBELIUM_BoomBox_PDF_Masq_May21_1
Repository: Neo23x0/signature-base
Detects: Detects PDF documents as used by BoomBox as described in APT29 NOBELIUM report
Author: Florian Roth (Nextron Systems)
Reference: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/

Pattern signatures:
$ah1 = { 25 50 44 46 2d 31 2e 33 0a 25 } /* PDF Header */
      $af1 = { 0a 25 25 45 4f 46 0a } /* EOF */

      $fp1 = "endobj" ascii
      $fp2 = "endstream" ascii
      $fp3 = { 20 6F 62 6A 0A } /*  obj\x0a */

Detection condition:
$ah1 at 0 and $af1 at (filesize-7) and filesize < 100KB
      and not 1 of ($fp*)
      and math.entropy(16,filesize) > 7

Full rule:
rule APT_APT29_NOBELIUM_BoomBox_PDF_Masq_May21_1 {
   meta:
      description = "Detects PDF documents as used by BoomBox as described in APT29 NOBELIUM report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
      date = "2021-05-27"
      score = 70
      id = "bdfb9600-edda-5c8c-ab23-14fb71c8e647"
   strings:
      $ah1 = { 25 50 44 46 2d 31 2e 33 0a 25 } /* PDF Header */
      $af1 = { 0a 25 25 45 4f 46 0a } /* EOF */

      $fp1 = "endobj" ascii
      $fp2 = "endstream" ascii
      $fp3 = { 20 6F 62 6A 0A } /*  obj\x0a */
   condition:
      $ah1 at 0 and $af1 at (filesize-7) and filesize < 100KB
      and not 1 of ($fp*)
      and math.entropy(16,filesize) > 7
}
YARA Detection Rule: APT_APT29_NOBELIUM_NativeZone_Loader_May21_1
Repository: Neo23x0/signature-base
Detects: Detects NativeZone loader as described in APT29 NOBELIUM report
Author: Florian Roth (Nextron Systems)
Reference: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/

Pattern signatures:
$s1 = "\\SystemCertificates\\Lib\\CertPKIProvider.dll" ascii
      $s2 = "rundll32.exe %s %s" ascii fullword
      $s3 = "eglGetConfigs" ascii fullword

      $op1 = { 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 33 db 89 5d fc }
      $op2 = { 8b 46 18 e9 30 ff ff ff 90 87 2f 00 10 90 2f 00 10 }
      $op3 = { e8 14 dd ff ff 8b f1 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 3000KB and 3 of them or 4 of them

Full rule:
rule APT_APT29_NOBELIUM_NativeZone_Loader_May21_1 {
   meta:
      description = "Detects NativeZone loader as described in APT29 NOBELIUM report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
      date = "2021-05-27"
      score = 85
      hash1 = "136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d"
      id = "02d9257d-f439-5071-96b0-a973b088e329"
   strings:
      $s1 = "\\SystemCertificates\\Lib\\CertPKIProvider.dll" ascii
      $s2 = "rundll32.exe %s %s" ascii fullword
      $s3 = "eglGetConfigs" ascii fullword

      $op1 = { 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 33 db 89 5d fc }
      $op2 = { 8b 46 18 e9 30 ff ff ff 90 87 2f 00 10 90 2f 00 10 }
      $op3 = { e8 14 dd ff ff 8b f1 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 3000KB and 3 of them or 4 of them
}