deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CN_Honker_Alien_command
Repository: Neo23x0/signature-base
Detects: Script from disclosed CN Honker Pentest Toolset - file command.txt
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "for /d %i in (E:\\freehost\\*) do @echo %i" fullword ascii /* PEStudio Blacklist: strings */
        $s1 = "/c \"C:\\windows\\temp\\cscript\" C:\\windows\\temp\\iis.vbs" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
filesize < 8KB and all of them

Full rule:
rule CN_Honker_Alien_command {
    meta:
        description = "Script from disclosed CN Honker Pentest Toolset - file command.txt"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "Disclosed CN Honker Pentest Toolset"
        date = "2015-06-23"
		score = 70
        hash = "5896b74158ef153d426fba76c2324cd9c261c709"
        id = "55dd10c9-f7dc-5ee2-a47d-dab8cc7b60e6"
    strings:
        $s0 = "for /d %i in (E:\\freehost\\*) do @echo %i" fullword ascii /* PEStudio Blacklist: strings */
        $s1 = "/c \"C:\\windows\\temp\\cscript\" C:\\windows\\temp\\iis.vbs" fullword ascii /* PEStudio Blacklist: strings */
    condition:
        filesize < 8KB and all of them
}
YARA Detection Rule: CN_Honker_portRecall_bc
Repository: Neo23x0/signature-base
Detects: Script from disclosed CN Honker Pentest Toolset - file bc.pl
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "print \"[*] Connected to remote host \\n\"; " fullword ascii /* PEStudio Blacklist: strings */
        $s1 = "print \"Usage: $0 [Host] [Port] \\n\\n\";  " fullword ascii /* PEStudio Blacklist: strings */
        $s5 = "print \"[*] Resolving HostName\\n\"; " fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
filesize < 10KB and all of them

Full rule:
rule CN_Honker_portRecall_bc {
    meta:
        description = "Script from disclosed CN Honker Pentest Toolset - file bc.pl"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "Disclosed CN Honker Pentest Toolset"
        date = "2015-06-23"
		score = 70
        hash = "[PII_REDACTED]398afd856b2309c7f579d7d61c3767"
        id = "ea74f260-87e6-5027-b558-628949cae32a"
    strings:
        $s0 = "print \"[*] Connected to remote host \\n\"; " fullword ascii /* PEStudio Blacklist: strings */
        $s1 = "print \"Usage: $0 [Host] [Port] \\n\\n\";  " fullword ascii /* PEStudio Blacklist: strings */
        $s5 = "print \"[*] Resolving HostName\\n\"; " fullword ascii /* PEStudio Blacklist: strings */
    condition:
        filesize < 10KB and all of them
}
YARA Detection Rule: CN_Honker_Tuoku_script_MSSQL_
Repository: Neo23x0/signature-base
Detects: Script from disclosed CN Honker Pentest Toolset - file MSSQL_.asp
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "GetLoginCookie = Request.Cookies(Cookie_Login)" fullword ascii /* PEStudio Blacklist: strings */
        $s2 = "if ShellPath=\"\" Then ShellPath = \"c:\\\\windows\\\\system32\\\\cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
        $s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
filesize < 100KB and all of them

Full rule:
rule CN_Honker_Tuoku_script_MSSQL_ {
    meta:
        description = "Script from disclosed CN Honker Pentest Toolset - file MSSQL_.asp"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "Disclosed CN Honker Pentest Toolset"
        date = "2015-06-23"
		score = 70
        hash = "7097c21f92306983add3b5b29a517204cd6cd819"
        id = "35c4f119-6a57-580a-b5ee-c36af0ccc94a"
    strings:
        $s1 = "GetLoginCookie = Request.Cookies(Cookie_Login)" fullword ascii /* PEStudio Blacklist: strings */
        $s2 = "if ShellPath=\"\" Then ShellPath = \"c:\\\\windows\\\\system32\\\\cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
        $s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii /* PEStudio Blacklist: strings */
    condition:
        filesize < 100KB and all of them
}
YARA Detection Rule: CN_Honker_nc_MOVE
Repository: Neo23x0/signature-base
Detects: Script from disclosed CN Honker Pentest Toolset - file MOVE.txt
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "Destination: http://202.113.20.235/gj/images/2.asp" fullword ascii /* PEStudio Blacklist: strings */
        $s1 = "HOST: 202.113.20.235" fullword ascii /* PEStudio Blacklist: strings */
        $s2 = "MOVE /gj/images/A.txt HTTP/1.1" fullword ascii

Detection condition:
filesize < 1KB and all of them

Full rule:
rule CN_Honker_nc_MOVE {
    meta:
        description = "Script from disclosed CN Honker Pentest Toolset - file MOVE.txt"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "Disclosed CN Honker Pentest Toolset"
        date = "2015-06-23"
		score = 70
        hash = "4195370c103ca467cddc8f2724a8e477635be424"
        id = "115d1ec9-6c4f-587e-977c-cd24ada89ab6"
    strings:
        $s0 = "Destination: http://202.113.20.235/gj/images/2.asp" fullword ascii /* PEStudio Blacklist: strings */
        $s1 = "HOST: 202.113.20.235" fullword ascii /* PEStudio Blacklist: strings */
        $s2 = "MOVE /gj/images/A.txt HTTP/1.1" fullword ascii
    condition:
        filesize < 1KB and all of them
}
YARA Detection Rule: CN_Honker_mssqlpw_scan
Repository: Neo23x0/signature-base
Detects: Script from disclosed CN Honker Pentest Toolset - file mssqlpw scan.txt
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "response.Write(\"I Get it ! Password is <font color=red>\" & str & \"</font><BR>" ascii /* PEStudio Blacklist: strings */
        $s1 = "response.Write \"Done!<br>Process \" & tTime & \" s\"" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
filesize < 6KB and all of them

Full rule:
rule CN_Honker_mssqlpw_scan {
    meta:
        description = "Script from disclosed CN Honker Pentest Toolset - file mssqlpw scan.txt"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        reference = "Disclosed CN Honker Pentest Toolset"
        date = "2015-06-23"
		score = 70
        hash = "e49def9d72bfef09a639ef3f7329083a0b8b151c"
        id = "7dc29d06-e1e7-527f-b9e5-d75f660fd73e"
    strings:
        $s0 = "response.Write(\"I Get it ! Password is <font color=red>\" & str & \"</font><BR>" ascii /* PEStudio Blacklist: strings */
        $s1 = "response.Write \"Done!<br>Process \" & tTime & \" s\"" fullword ascii /* PEStudio Blacklist: strings */
    condition:
        filesize < 6KB and all of them
}
YARA Detection Rule: OSX_backdoor_Bella
Repository: Neo23x0/signature-base
Detects: Bella MacOS/OSX backdoor
Author: John Lambert @JohnLaTwC
Reference: https://twitter.com/JohnLaTwC/status/[PII_REDACTED]82924801

Pattern signatures:
$h1 = "#!/usr/bin/env"

        //prereqs
        $s0 = "subprocess" fullword ascii
        $s1 = "import sys" fullword ascii
        $s2 = "shutil" fullword ascii

        $p0 = "create_bella_helpers" fullword ascii
        $p1 = "is_there_SUID_shell" fullword ascii
        $p2 = "BELLA IS NOW RUNNING" fullword ascii
        $p3 = "SELECT * FROM bella WHERE id" fullword ascii

        $subpart1_a = "inject_payloads" fullword ascii
        $subpart1_b = "check_if_payloads" fullword ascii
        $subpart1_c = "updateDB" fullword ascii

        $subpart2_a = "appleIDPhishHelp" fullword ascii
        $subpart2_b = "appleIDPhish" fullword ascii
        $subpart2_c = "iTunes" fullword ascii

Detection condition:
uint32(0) == 0x752f2123
        and $h1 at 0
        and filesize < 120KB
        and @s0[1] < 100
        and @s1[1] < 100
        and @s2[1] < 100
        and
            1 of ($p*)
            or all of ($subpart1_*)
            or all of ($subpart2_*)

Full rule:
rule OSX_backdoor_Bella {
    meta:
        description = "Bella MacOS/OSX backdoor"
        author = "John Lambert @JohnLaTwC"
        reference = "https://twitter.com/JohnLaTwC/status/[PII_REDACTED]82924801"
        date = "2018-02-23"
        hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"

        id = "d2a994f9-acff-5de4-8f70-453b5d4d7947"
    strings:
        $h1 = "#!/usr/bin/env"

        //prereqs
        $s0 = "subprocess" fullword ascii
        $s1 = "import sys" fullword ascii
        $s2 = "shutil" fullword ascii

        $p0 = "create_bella_helpers" fullword ascii
        $p1 = "is_there_SUID_shell" fullword ascii
        $p2 = "BELLA IS NOW RUNNING" fullword ascii
        $p3 = "SELECT * FROM bella WHERE id" fullword ascii

        $subpart1_a = "inject_payloads" fullword ascii
        $subpart1_b = "check_if_payloads" fullword ascii
        $subpart1_c = "updateDB" fullword ascii

        $subpart2_a = "appleIDPhishHelp" fullword ascii
        $subpart2_b = "appleIDPhish" fullword ascii
        $subpart2_c = "iTunes" fullword ascii
    condition:
        uint32(0) == 0x752f2123
        and $h1 at 0
        and filesize < 120KB
        and @s0[1] < 100
        and @s1[1] < 100
        and @s2[1] < 100
        and
            1 of ($p*)
            or all of ($subpart1_*)
            or all of ($subpart2_*)
}
YARA Detection Rule: apt_RU_Turla_Kazuar_DebugView_peFeatures
Repository: Neo23x0/signature-base
Detects: Turla mimicking SysInternals Tools- peFeatures
Author: JAG-S
Reference: https://www.epicturla.com/blog/sysinturla

Detection condition:
uint16(0) == 0x5a4d
		and
		(
			pe.version_info["LegalCopyright"] == "Test Copyright" 
			and
			(
				(
				pe.version_info["ProductName"] == "Sysinternals DebugView"
				and
				pe.version_info["Description"] == "Sysinternals DebugView"
				)
			or
				(
				pe.version_info["FileVersion"] == "4.8

Full rule:
rule apt_RU_Turla_Kazuar_DebugView_peFeatures
{
	meta:
		description = "Turla mimicking SysInternals Tools- peFeatures"
        reference = "https://www.epicturla.com/blog/sysinturla"
		version = "2.0"
		author = "JAG-S"
        score = 85
		hash1 = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
		hash2 = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"

		id = "0a1675c0-8645-5288-9ef6-e68ffbfe0c3b"
	condition:
		uint16(0) == 0x5a4d
		and
		(
			pe.version_info["LegalCopyright"] == "Test Copyright" 
			and
			(
				(
				pe.version_info["ProductName"] == "Sysinternals DebugView"
				and
				pe.version_info["Description"] == "Sysinternals DebugView"
				)
			or
				(
				pe.version_info["FileVersion"] == "4.80.0.0"
				and
				pe.version_info["Comments"] == "Sysinternals DebugView"
				)
			or
				(
				pe.version_info["OriginalName"] contains "DebugView.exe"
				and
				pe.version_info["InternalName"] contains "DebugView.exe"
				)
			or
				(
				pe.version_info["OriginalName"] == "Agent.exe"
				and
				pe.version_info["InternalName"] == "Agent.exe"
				)
			)
		)
}
YARA Detection Rule: APT_MAL_RU_Turla_Kazuar_May20_1
Repository: Neo23x0/signature-base
Detects: Detects Turla Kazuar malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.epicturla.com/blog/sysinturla

Pattern signatures:
$s1 = "Sysinternals" ascii fullword
	  $s2 = "Test Copyright" wide fullword

      $op1 = { 0d 01 00 08 34 2e 38 30 2e 30 2e 30 00 00 13 01 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 2000KB and
      all of them

Full rule:
rule APT_MAL_RU_Turla_Kazuar_May20_1 {
   meta:
      description = "Detects Turla Kazuar malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.epicturla.com/blog/sysinturla"
      date = "2020-05-28"
      hash1 = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
      hash2 = "1fca5f41211c800830c5f5c3e355d31a05e4c702401a61f11e25387e25eeb7fa"
      hash3 = "2d8151dabf891cf743e67c6f9765ee79884d024b10d265119873b0967a09b20f"
      hash4 = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
      id = "cd0d1fa2-5303-55f8-90a7-4a699ec79230"
   strings:
      $s1 = "Sysinternals" ascii fullword
	  $s2 = "Test Copyright" wide fullword

      $op1 = { 0d 01 00 08 34 2e 38 30 2e 30 2e 30 00 00 13 01 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 2000KB and
      all of them
}
YARA Detection Rule: APT17_Malware_Oct17_1
Repository: Neo23x0/signature-base
Detects: Detects APT17 malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/puVc9q

Pattern signatures:
$s1 = "\\spool\\prtprocs\\w32x86\\localspl.dll" ascii
      $s2 = "\\spool\\prtprocs\\x64\\localspl.dll" ascii
      $s3 = "\\msvcrt.dll" ascii
      $s4 = "\\TSMSISrv.dll" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and all of them )

Full rule:
rule APT17_Malware_Oct17_1 {
   meta:
      description = "Detects APT17 malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/puVc9q"
      date = "2017-10-03"
      hash1 = "dc9b5e8aa6ec86db8af0a7aa897ca61db3e5f3d2e0942e319074db1aaccfdc83"
      id = "457312d8-5bfe-5282-9ace-2f169278569c"
   strings:
      $s1 = "\\spool\\prtprocs\\w32x86\\localspl.dll" ascii
      $s2 = "\\spool\\prtprocs\\x64\\localspl.dll" ascii
      $s3 = "\\msvcrt.dll" ascii
      $s4 = "\\TSMSISrv.dll" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 500KB and all of them )
}
YARA Detection Rule: APT17_Malware_Oct17_2
Repository: Neo23x0/signature-base
Detects: Detects APT17 malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/puVc9q

Pattern signatures:
$x1 = "Cookie: __xsptplus=%s" fullword ascii
      $x2 = "http://services.fiveemotions.co.jp" fullword ascii
      $x3 = "http://%s/ja-JP/2015/%d/%d/%d%d%d%d%d%d%d%d.gif" fullword ascii

      $s1 = "FoxHTTPClient_EXE_x86.exe" fullword ascii
      $s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.3072" ascii
      $s3 = "hWritePipe2 Error:%d" fullword ascii
      $s4 = "Not Support This Function!" fullword ascii
      $s5 = "Global\\PnP_No_Management" fullword ascii
      $s6 = "Content-Type: image/x-png" fullword ascii
      $s7 = "Accept-Language: ja-JP" fullword ascii
      $s8 = "IISCMD Error:%d" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and (
         pe.exports("_foo@0") or
         1 of ($x*) or
         6 of them
      )

Full rule:
rule APT17_Malware_Oct17_2 {
   meta:
      description = "Detects APT17 malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/puVc9q"
      date = "2017-10-03"
      hash1 = "20cd49fd0f244944a8f5ba1d7656af3026e67d170133c1b3546c8b2de38d4f27"
      id = "9f21514a-168b-5158-8322-60fa8499b11a"
   strings:
      $x1 = "Cookie: __xsptplus=%s" fullword ascii
      $x2 = "http://services.fiveemotions.co.jp" fullword ascii
      $x3 = "http://%s/ja-JP/2015/%d/%d/%d%d%d%d%d%d%d%d.gif" fullword ascii

      $s1 = "FoxHTTPClient_EXE_x86.exe" fullword ascii
      $s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.3072" ascii
      $s3 = "hWritePipe2 Error:%d" fullword ascii
      $s4 = "Not Support This Function!" fullword ascii
      $s5 = "Global\\PnP_No_Management" fullword ascii
      $s6 = "Content-Type: image/x-png" fullword ascii
      $s7 = "Accept-Language: ja-JP" fullword ascii
      $s8 = "IISCMD Error:%d" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and (
         pe.exports("_foo@0") or
         1 of ($x*) or
         6 of them
      )
}
YARA Detection Rule: APT17_Unsigned_Symantec_Binary_EFA
Repository: Neo23x0/signature-base
Detects: Detects APT17 malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/puVc9q

Pattern signatures:
$s1 = "Copyright (c) 2007 - 2011 Symantec Corporation" fullword wide
      $s2 = "\\\\.\\SYMEFA" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them and pe.number_of_signatures == 0 )

Full rule:
rule APT17_Unsigned_Symantec_Binary_EFA {
   meta:
      description = "Detects APT17 malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/puVc9q"
      date = "2017-10-03"
      hash1 = "128aca58be325174f0220bd7ca6030e4e206b4378796e82da460055733bb6f4f"
      id = "56eec517-8b00-5cb5-9806-249e50f53b99"
   strings:
      $s1 = "Copyright (c) 2007 - 2011 Symantec Corporation" fullword wide
      $s2 = "\\\\.\\SYMEFA" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them and pe.number_of_signatures == 0 )
}
YARA Detection Rule: APT17_Malware_Oct17_Gen
Repository: Neo23x0/signature-base
Detects: Detects APT17 malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/puVc9q

Pattern signatures:
$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)" fullword ascii
      $x2 = "http://%s/imgres?q=A380&hl=en-US&sa=X&biw=1440&bih=809&tbm=isus&tbnid=aLW4-J8Q1lmYBM" ascii

      $s1 = "hWritePipe2 Error:%d" fullword ascii
      $s2 = "Not Support This Function!" fullword ascii
      $s3 = "Cookie: SESSIONID=%s" fullword ascii
      $s4 = "http://0.0.0.0/1" fullword ascii
      $s5 = "Content-Type: image/x-png" fullword ascii
      $s6 = "Accept-Language: en-US" fullword ascii
      $s7 = "IISCMD Error:%d" fullword ascii
      $s8 = "[IISEND=0x%08X][Recv:] 0x%08X %s" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and (
            pe.imphash() == "414bbd566b700ea021cfae3ad8f4d9b9" or
            1 of ($x*) or
            6 of them
         )
      )

Full rule:
rule APT17_Malware_Oct17_Gen {
   meta:
      description = "Detects APT17 malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/puVc9q"
      date = "2017-10-03"
      hash1 = "0375b4216334c85a4b29441a3d37e61d7797c2e1cb94b14cf6292449fb25c7b2"
      hash2 = "07f93e49c7015b68e2542fc591ad2b4a1bc01349f79d48db67c53938ad4b525d"
      hash3 = "ee362a8161bd[PII_REDACTED]63bf5fa1305abac2ce39b903d63df0d7121ba60550"
      id = "c2156e68-d5b5-5bd7-858c-2d5e90199287"
   strings:
      $x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)" fullword ascii
      $x2 = "http://%s/imgres?q=A380&hl=en-US&sa=X&biw=1440&bih=809&tbm=isus&tbnid=aLW4-J8Q1lmYBM" ascii

      $s1 = "hWritePipe2 Error:%d" fullword ascii
      $s2 = "Not Support This Function!" fullword ascii
      $s3 = "Cookie: SESSIONID=%s" fullword ascii
      $s4 = "http://0.0.0.0/1" fullword ascii
      $s5 = "Content-Type: image/x-png" fullword ascii
      $s6 = "Accept-Language: en-US" fullword ascii
      $s7 = "IISCMD Error:%d" fullword ascii
      $s8 = "[IISEND=0x%08X][Recv:] 0x%08X %s" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and (
            pe.imphash() == "414bbd566b700ea021cfae3ad8f4d9b9" or
            1 of ($x*) or
            6 of them
         )
      )
}
YARA Detection Rule: OilRig_Malware_Campaign_Mal1
Repository: Neo23x0/signature-base
Detects: Detects malware from OilRig Campaign
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/QMRZ8K

Pattern signatures:
$x1 = "DownloadExecute=\"powershell \"\"&{$r=Get-Random;$wc=(new-object System.Net.WebClient);$wc.DownloadFile(" ascii
      $x2 = "-ExecutionPolicy Bypass -File \"&HOME&\"dns.ps1\"" fullword ascii
      $x3 = "CreateObject(\"WScript.Shell\").Run Replace(DownloadExecute,\"-_\",\"bat\")" fullword ascii
      $x4 = "CreateObject(\"WScript.Shell\").Run DnsCmd,0" fullword ascii
      $s1 = "http://winodwsupdates.me" ascii

Detection condition:
( uint16(0) == 0x4f48 and filesize < 4KB and 1 of them ) or ( 2 of them )

Full rule:
rule OilRig_Malware_Campaign_Mal1 {
   meta:
      description = "Detects malware from OilRig Campaign"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/QMRZ8K"
      date = "2016-10-12"
      hash1 = "e17e1978563dc10b73fd54e7727cbbe95cc0b170a4e7bd0ab223e059f6c25fcc"
      id = "c577f0ff-1a33-5d7f-93b2-27df8d414bce"
   strings:
      $x1 = "DownloadExecute=\"powershell \"\"&{$r=Get-Random;$wc=(new-object System.Net.WebClient);$wc.DownloadFile(" ascii
      $x2 = "-ExecutionPolicy Bypass -File \"&HOME&\"dns.ps1\"" fullword ascii
      $x3 = "CreateObject(\"WScript.Shell\").Run Replace(DownloadExecute,\"-_\",\"bat\")" fullword ascii
      $x4 = "CreateObject(\"WScript.Shell\").Run DnsCmd,0" fullword ascii
      $s1 = "http://winodwsupdates.me" ascii
   condition:
      ( uint16(0) == 0x4f48 and filesize < 4KB and 1 of them ) or ( 2 of them )
}
YARA Detection Rule: OilRig_Malware_Campaign_Gen2
Repository: Neo23x0/signature-base
Detects: Detects Oilrig malware samples
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/QMRZ8K

Pattern signatures:
$s1 = "%userprofile%\\AppData\\Local\\Microsoft\\" ascii
      $s2 = "$fdn=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('" fullword ascii
      $s3 = "&{$rn = Get-Random; $id = 'TR" fullword ascii
      $s4 = "') -replace '__',('DNS'+$id) | " fullword ascii
      $s5 = "\\upd.vbs" ascii
      $s6 = "schtasks /create /F /sc minute /mo " fullword ascii
      $s7 = "') -replace '__',('HTP'+$id) | " fullword ascii
      $s8 = "&{$rn = Get-Random -minimum 1 -maximum 10000; $id = 'AZ" fullword ascii
      $s9 = "http://www.israirairlines.com/?mode=page&page=14635&lang=eng<" fullword ascii

Detection condition:
( uint16(0) == 0xcfd0 and filesize < 4000KB and 2 of ($s*) ) or ( 4 of them )

Full rule:
rule OilRig_Malware_Campaign_Gen2 {
   meta:
      description = "Detects Oilrig malware samples"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/QMRZ8K"
      date = "2016-10-12"
      modified = "2023-01-07"
      hash1 = "c6437f57a8f290b5ec46b0933bfa8a328b0cb2c0c7fbeea7f21b770ce0250d3d"
      hash2 = "293522e83aeebf185e653ac279bba202024cedb07abc94683930b74df51ce5cb"
      id = "2ca0aadf-c5a8-5c89-ab1e-0c06d2ab8516"
   strings:
      $s1 = "%userprofile%\\AppData\\Local\\Microsoft\\" ascii
      $s2 = "$fdn=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('" fullword ascii
      $s3 = "&{$rn = Get-Random; $id = 'TR" fullword ascii
      $s4 = "') -replace '__',('DNS'+$id) | " fullword ascii
      $s5 = "\\upd.vbs" ascii
      $s6 = "schtasks /create /F /sc minute /mo " fullword ascii
      $s7 = "') -replace '__',('HTP'+$id) | " fullword ascii
      $s8 = "&{$rn = Get-Random -minimum 1 -maximum 10000; $id = 'AZ" fullword ascii
      $s9 = "http://www.israirairlines.com/?mode=page&page=14635&lang=eng<" fullword ascii
   condition:
      ( uint16(0) == 0xcfd0 and filesize < 4000KB and 2 of ($s*) ) or ( 4 of them )
}