deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PUA_VULN_Renamed_Driver_Lowleveldriver_F941
Repository: Neo23x0/signature-base
Detects: Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GPU-Z.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]004c006f0077002d004c[PII_REDACTED]65006c[PII_REDACTED][PII_REDACTED]00650072 } /* FileDescription LowLevelDriver */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e[PII_REDACTED]2e0030002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e[PII_REDACTED]2e0030002e0030 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]004c006f0077002d004c[PII_REDACTED]65006c[PII_REDACTED][PII_REDACTED]00650072 } /* ProductName LowLevelDriver */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]2d[PII_REDACTED][PII_REDACTED][PII_REDACTED]29002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright CopyrightcAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /GPU-Z/i

Full rule:
rule PUA_VULN_Renamed_Driver_Lowleveldriver_F941 {
	meta:
		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GPU-Z.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "f9418b5e90a235339a4a1a889490faca39cd117a51ba4446daa1011da06c7ecd"
		date = "2024-08-07"
		score = 70
		id = "a5f5a4c6-017e-5826-885e-fe07c07b8218"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]004c006f0077002d004c[PII_REDACTED]65006c[PII_REDACTED][PII_REDACTED]00650072 } /* FileDescription LowLevelDriver */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e[PII_REDACTED]2e0030002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e[PII_REDACTED]2e0030002e0030 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]004c006f0077002d004c[PII_REDACTED]65006c[PII_REDACTED][PII_REDACTED]00650072 } /* ProductName LowLevelDriver */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]0043006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]2d[PII_REDACTED][PII_REDACTED][PII_REDACTED]29002e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright CopyrightcAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them and not filename matches /GPU-Z/i
}
YARA Detection Rule: PUA_VULN_Renamed_Driver_Zemanaltd_Zam_5439
Repository: Neo23x0/signature-base
Detects: Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e00360033 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i and not filename matches /zamguard32/i and not filename matches /zamguard64/i

Full rule:
rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_5439 {
	meta:
		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91"
		hash = "ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd"
		date = "2024-08-07"
		score = 70
		id = "93257633-be48-500d-a5d7-babe1890684d"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e00360033 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them and not filename matches /zam64/i and not filename matches /zamguard32/i and not filename matches /zamguard64/i
}
YARA Detection Rule: PUA_VULN_Renamed_Driver_Zemanaltd_Zam_DE8F
Repository: Neo23x0/signature-base
Detects: Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]34 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /zam64/i and not filename matches /zamguard32/i and not filename matches /zamguard64/i

Full rule:
rule PUA_VULN_Renamed_Driver_Zemanaltd_Zam_DE8F {
	meta:
		description = "Detects renamed vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c"
		date = "2024-08-07"
		score = 70
		id = "94f58292-01c9-5368-86fc-e9c4fd195ac6"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]34 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and all of them and not filename matches /zam64/i and not filename matches /zamguard32/i and not filename matches /zamguard64/i
}
YARA Detection Rule: SUSP_Email_Redirection_Spoofing_Feb25
Repository: Neo23x0/signature-base
Detects: Detects redirect spoofing in embedded URLs. This technique is used by threat actors to obscure the actual destination of a link
Author: Jonathan Peters (cod3nym)
Reference: https://any.run/cybersecurity-blog/cyber-attacks-january-2025/#fake-youtube-links-redirect-users-to-phishing-pages-11298

Pattern signatures:
$sa1 = "Content-Transfer-Encoding:" ascii
      $sa2 = "Subject:" ascii

      $x = ".com%20%20%20%20%20%" ascii

Detection condition:
all of them

Full rule:
rule SUSP_Email_Redirection_Spoofing_Feb25 {
   meta:
      description = "Detects redirect spoofing in embedded URLs. This technique is used by threat actors to obscure the actual destination of a link"
      author = "Jonathan Peters (cod3nym)"
      date = "2025-02-20"
      reference = "https://any.run/cybersecurity-blog/cyber-attacks-january-2025/#fake-youtube-links-redirect-users-to-phishing-pages-11298"
      hash = "9b196220b369c199a7e4d57cb5db18b32eb2565a6f9190929c5c01ac4fa04ac8"
      hash = "c4eb35c1a1c10226bff9bb0c88ca516441208d193b4994eeb292a66e53a2cc04"
      hash = "e3b8ea03a472348814c6ac[PII_REDACTED]6e627a1878ec36e46ce62526e1390935"
      score = 70
      id = "bf3a2b06-4dc5-5f0f-bf1f-2bd6a1cc4a8d"
   strings:
      $sa1 = "Content-Transfer-Encoding:" ascii
      $sa2 = "Subject:" ascii

      $x = ".com%20%20%20%20%20%" ascii
   condition:
      all of them
}
YARA Detection Rule: CHAOS_Payload
Repository: Neo23x0/signature-base
Detects: Detects a CHAOS back connect payload
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/tiagorlampert/CHAOS

Pattern signatures:
$x1 = { 2F 43 48 41 4F 53 00 02 73 79 6E 63 2F 61 74 6F 6D 69 63 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )

Full rule:
rule CHAOS_Payload {
   meta:
      description = "Detects a CHAOS back connect payload"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/tiagorlampert/CHAOS"
      date = "2017-07-15"
      score = 80
      hash1 = "0962fcfcb1b52df148720c2112b036e75755f09279e3ebfce1636739af9b4448"
      hash2 = "5c3553345f824b7b6de09ccb67d834e428b8df17443d98816471ca28f5a11424"
      id = "5057bc68-9bf8-54b4-88a1-d0c0cba62fa0"
   strings:
      $x1 = { 2F 43 48 41 4F 53 00 02 73 79 6E 63 2F 61 74 6F 6D 69 63 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 15000KB and all of them )
}
YARA Detection Rule: FE_Webshell_PL_ATRIUM_1
Repository: Neo23x0/signature-base
Detects: Detects samples mentioned in PulseSecure report
Author: Mandiant
Reference: https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html

Pattern signatures:
$s1 = "CGI::param("
        $s2 = "system("
        $s3 = /if[\x09\x20]{0,32}\(CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)\)\s{0,128}\{[\x09\x20]{0,32}print [\x22\x27]Cache-Control: no-cache\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}print [\x22\x27]Content-type: text\/html\\n\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}my \$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)[\x09\x20]{0,32};\s{0,128}system\([\x22\x27]\$/

Detection condition:
all of them

Full rule:
rule FE_Webshell_PL_ATRIUM_1
{
    meta:
        author = "Mandiant"
        date = "2021-04-16"
        hash = "ca0175d86049fa7c796ea06b413857a3"
        description = "Detects samples mentioned in PulseSecure report"
        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
        id = "b2663343-0bae-5215-a443-866ab8626bff"
    strings:
        $s1 = "CGI::param("
        $s2 = "system("
        $s3 = /if[\x09\x20]{0,32}\(CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)\)\s{0,128}\{[\x09\x20]{0,32}print [\x22\x27]Cache-Control: no-cache\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}print [\x22\x27]Content-type: text\/html\\n\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}my \$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)[\x09\x20]{0,32};\s{0,128}system\([\x22\x27]\$/
    condition:
        all of them
}
YARA Detection Rule: FE_Trojan_SH_ATRIUM_1
Repository: Neo23x0/signature-base
Detects: Detects samples mentioned in PulseSecure report
Author: Mandiant
Reference: https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html

Pattern signatures:
$s1 = "CGI::param("
        $s2 = "Cache-Control: no-cache"
        $s3 = "system("
        $s4 = /sed -i [^\r\n]{1,128}CGI::param\([^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Cache-Control: no-cache[^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Content-type: text\/html[^\r\n]{1,128}my [^\r\n]{1,128}=[\x09\x20]{0,32}CGI::param\([^\r\n]{1,128}system\(/

Detection condition:
all of them

Full rule:
rule FE_Trojan_SH_ATRIUM_1
{
    meta:
        author = "Mandiant"
        date = "2021-04-16"
        hash = "a631b7a8a11e6df3fccb21f4d34dbd8a"
        description = "Detects samples mentioned in PulseSecure report"
        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
        id = "c49441f4-a138-534c-a858-a7462ed865c9"
    strings:
        $s1 = "CGI::param("
        $s2 = "Cache-Control: no-cache"
        $s3 = "system("
        $s4 = /sed -i [^\r\n]{1,128}CGI::param\([^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Cache-Control: no-cache[^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Content-type: text\/html[^\r\n]{1,128}my [^\r\n]{1,128}=[\x09\x20]{0,32}CGI::param\([^\r\n]{1,128}system\(/
    condition:
        all of them
}
YARA Detection Rule: FE_APT_Webshell_PL_HARDPULSE
Repository: Neo23x0/signature-base
Detects: Detects samples mentioned in PulseSecure report
Author: Mandiant
Reference: https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html

Pattern signatures:
$r1 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}unless[\x09\x20]{0,32}\(open\(\$\w{1,64},[\x09\x20]{0,32}\$\w{1,64}\)\)\s{0,128}\{\s{1,128}goto[\x09\x20]{1,32}\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}return[\x09\x20]{1,32}0[\x09\x20]{0,32}\x3b\s{0,128}\}/ 
        $r2 = /open[\x09\x20]{0,32}\(\*\w{1,64}[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>/ 
        $r3 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}print[\x09\x20]{0,32}[\x22\x27]Content-type/ 
        $s1 = "CGI::request_method()" 
        $s2 = "CGI::param(" 
        $s3 = "syswrite(" 
        $s4 = "print $_"

Detection condition:
all of them

Full rule:
rule FE_APT_Webshell_PL_HARDPULSE 
{ 
    meta: 
        author = "Mandiant"  
        date = "2021-04-16"      
        hash = "980cba9e82faf194edb6f3cc20dc73ff"
        description = "Detects samples mentioned in PulseSecure report"
        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
        id = "f9a2922e-6b8e-5f92-a947-3215ee8883ac"
    strings: 
        $r1 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}unless[\x09\x20]{0,32}\(open\(\$\w{1,64},[\x09\x20]{0,32}\$\w{1,64}\)\)\s{0,128}\{\s{1,128}goto[\x09\x20]{1,32}\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}return[\x09\x20]{1,32}0[\x09\x20]{0,32}\x3b\s{0,128}\}/ 
        $r2 = /open[\x09\x20]{0,32}\(\*\w{1,64}[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>/ 
        $r3 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}print[\x09\x20]{0,32}[\x22\x27]Content-type/ 
        $s1 = "CGI::request_method()" 
        $s2 = "CGI::param(" 
        $s3 = "syswrite(" 
        $s4 = "print $_" 
    condition: 
        all of them 
}
YARA Detection Rule: FE_APT_Trojan_Linux32_LOCKPICK_1
Repository: Neo23x0/signature-base
Detects: Detects samples mentioned in PulseSecure report
Author: Mandiant
Reference: https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html

Pattern signatures:
$sb1 = { 83 ?? 63 0F 84 [4] 8B 45 ?? 83 ?? 01 89 ?? 24 89 44 24 04 E8 [4] 85 C0 }
        $sb2 = { 83 [2] 63 74 ?? 89 ?? 24 04 89 ?? 24 E8 [4] 83 [2] 01 85 C0 0F [5] EB 00 8B ?? 04 83 F8 02 7? ?? 83 E8 01 C1 E0 02 83 C0 00 89 44 24 08 8D 83 [4] 89 44 24 04 8B ?? 89 04 24 E8 }

Detection condition:
((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and (@sb1[1] < @sb2[1])

Full rule:
rule FE_APT_Trojan_Linux32_LOCKPICK_1
{
    meta:
        author = "Mandiant"
        date = "2021-04-16"
        hash = "e8bfd3f5a[PII_REDACTED]902bbe1195ee8"
        description = "Detects samples mentioned in PulseSecure report"
        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
        id = "00c09378-25a0-55f1-8d93-7b22d98bd8c2"
    strings:
        $sb1 = { 83 ?? 63 0F 84 [4] 8B 45 ?? 83 ?? 01 89 ?? 24 89 44 24 04 E8 [4] 85 C0 }
        $sb2 = { 83 [2] 63 74 ?? 89 ?? 24 04 89 ?? 24 E8 [4] 83 [2] 01 85 C0 0F [5] EB 00 8B ?? 04 83 F8 02 7? ?? 83 E8 01 C1 E0 02 83 C0 00 89 44 24 08 8D 83 [4] 89 44 24 04 8B ?? 89 04 24 E8 }
    condition:
        ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and (@sb1[1] < @sb2[1])
}
YARA Detection Rule: FE_APT_Trojan_Linux32_PACEMAKER
Repository: Neo23x0/signature-base
Detects: Detects samples mentioned in PulseSecure report
Author: Mandiant
Reference: https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html

Pattern signatures:
$s1 = "\x00/proc/%d/mem\x00" 
        $s2 = "\x00/proc/%s/maps\x00" 
        $s3 = "\x00/proc/%s/cmdline\x00" 
        $sb1 = { C7 44 24 08 10 00 00 00 C7 44 24 04 00 00 00 00 8D 45 E0 89 04 24 E8 [4] 8B 45 F4 83 C0 0B C7 44 24 08 10 00 00 00 89 44 24 04 8D 45 E0 89 04 24 E8 [4] 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] EB } 
        $sb2 = { 8B 95 [4] B8 [4] 8D 8D [4] 89 4C 24 10 8D 8D [4] 89 4C 24 0C 89 54 24 08 89 44 24 04 8D 85 [4] 89 04 24 E8 [4] C7 44 24 08 02 00 00 00 C7 44 24 04 00 00 00 00 8B 45 ?? 89 04 24 E8 [4] 89 45 ?? 8D 85 [4] 89 04 24 E8 [4] 89 44 24 08 8D 85 [4] 89 44 24 04 8B 45 ?? 89 04 24 E8 [4] 8B 45 ?? 89 45 ?? C7 45 ?? 00 00 00 00 [0-16] 83 45 ?? 01 8B 45 ?? 3B 45 0C }

Detection condition:
((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and all of them

Full rule:
rule FE_APT_Trojan_Linux32_PACEMAKER 
{ 
    meta: 
        author = "Mandiant"  
        date = "2021-04-16"   
        hash = "d7881c4de4d57828f7e1cab15687274b"
        description = "Detects samples mentioned in PulseSecure report"
        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
        id = "459e26f1-4ea9-56dd-ad71-0ed2c7499aea"
    strings: 
        $s1 = "\x00/proc/%d/mem\x00" 
        $s2 = "\x00/proc/%s/maps\x00" 
        $s3 = "\x00/proc/%s/cmdline\x00" 
        $sb1 = { C7 44 24 08 10 00 00 00 C7 44 24 04 00 00 00 00 8D 45 E0 89 04 24 E8 [4] 8B 45 F4 83 C0 0B C7 44 24 08 10 00 00 00 89 44 24 04 8D 45 E0 89 04 24 E8 [4] 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] EB } 
        $sb2 = { 8B 95 [4] B8 [4] 8D 8D [4] 89 4C 24 10 8D 8D [4] 89 4C 24 0C 89 54 24 08 89 44 24 04 8D 85 [4] 89 04 24 E8 [4] C7 44 24 08 02 00 00 00 C7 44 24 04 00 00 00 00 8B 45 ?? 89 04 24 E8 [4] 89 45 ?? 8D 85 [4] 89 04 24 E8 [4] 89 44 24 08 8D 85 [4] 89 44 24 04 8B 45 ?? 89 04 24 E8 [4] 8B 45 ?? 89 45 ?? C7 45 ?? 00 00 00 00 [0-16] 83 45 ?? 01 8B 45 ?? 3B 45 0C } 
    condition: 
        ((uint32(0) == 0x464c457f) and (uint8(4) == 1)) and all of them 
}
YARA Detection Rule: FE_APT_Trojan_Linux_PACEMAKER
Repository: Neo23x0/signature-base
Detects: Detects samples mentioned in PulseSecure report
Author: Mandiant
Reference: https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html

Pattern signatures:
$s1 = "\x00Name:%s || Pwd:%s || AuthNum:%s\x0a\x00" 
        $s2 = "\x00/proc/%d/mem\x00" 
        $s3 = "\x00/proc/%s/maps\x00" 
        $s4 = "\x00/proc/%s/cmdline\x00"

Detection condition:
(uint32(0) == 0x464c457f) and all of them

Full rule:
rule FE_APT_Trojan_Linux_PACEMAKER 
{ 
    meta: 
        author = "Mandiant"  
        date = "2021-04-16"     
        hash = "d7881c4de4d57828f7e1cab15687274b"
        description = "Detects samples mentioned in PulseSecure report"
        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
        id = "5a20260a-5389-57da-956c-97063fed5015"
    strings: 
        $s1 = "\x00Name:%s || Pwd:%s || AuthNum:%s\x0a\x00" 
        $s2 = "\x00/proc/%d/mem\x00" 
        $s3 = "\x00/proc/%s/maps\x00" 
        $s4 = "\x00/proc/%s/cmdline\x00" 
    condition: 
        (uint32(0) == 0x464c457f) and all of them 
}
YARA Detection Rule: FE_APT_Webshell_PL_PULSECHECK_1
Repository: Neo23x0/signature-base
Detects: Detects samples mentioned in PulseSecure report
Author: Mandiant
Reference: https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html

Pattern signatures:
$r1 = /while[\x09\x20]{0,32}\(<\w{1,64}>\)[\x09\x20]{0,32}\{\s{1,256}\$\w{1,64}[\x09\x20]{0,32}\.=[\x09\x20]{0,32}\$_;\s{0,256}\}/ 
        $s1 = "use Crypt::RC4;" 
        $s2 = "use MIME::Base64" 
        $s3 = "MIME::Base64::decode(" 
        $s4 = "popen(" 
        $s5 = " .= $_;" 
        $s6 = "print MIME::Base64::encode(RC4(" 
        $s7 = "HTTP_X_"

Detection condition:
$s1 and $s2 and (@s3[1] < @s4[1]) and (@s4[1] < @s5[1]) and (@s5[1] < @s6[1]) and (#s7 > 2) and $r1

Full rule:
rule FE_APT_Webshell_PL_PULSECHECK_1 
{ 
    meta: 
        author = "Mandiant" 
        date = "2021-04-16"  
        sha256 = "a1dcdf62aafc36dd8cf64774dea80d79fb4e24ba2a82adf4d944d9186acd1cc1"
        description = "Detects samples mentioned in PulseSecure report"
        reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
        id = "f375fdd8-567b-569b-85f4-af54a35d2a93"
    strings: 
        $r1 = /while[\x09\x20]{0,32}\(<\w{1,64}>\)[\x09\x20]{0,32}\{\s{1,256}\$\w{1,64}[\x09\x20]{0,32}\.=[\x09\x20]{0,32}\$_;\s{0,256}\}/ 
        $s1 = "use Crypt::RC4;" 
        $s2 = "use MIME::Base64" 
        $s3 = "MIME::Base64::decode(" 
        $s4 = "popen(" 
        $s5 = " .= $_;" 
        $s6 = "print MIME::Base64::encode(RC4(" 
        $s7 = "HTTP_X_" 
    condition: 
        $s1 and $s2 and (@s3[1] < @s4[1]) and (@s4[1] < @s5[1]) and (@s5[1] < @s6[1]) and (#s7 > 2) and $r1 
}