deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EquationGroup_Toolset_Apr17_SetOurAddr
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "USAGE: SetOurAddr <input file> <output file> <protocol> [IP/IPX address]" fullword ascii
      $s2 = "Replaced default IP address (127.0.0.1) with Local IP Address %d.%d.%d.%d" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_SetOurAddr {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "04ccc060d401ddba674371e66e0288ebdbfa7df74b925c5c202109f23fb78504"
      id = "a2dbfa7b-3fb6-56cf-9391-1a3abb08e3cb"
   strings:
      $s1 = "USAGE: SetOurAddr <input file> <output file> <protocol> [IP/IPX address]" fullword ascii
      $s2 = "Replaced default IP address (127.0.0.1) with Local IP Address %d.%d.%d.%d" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_GetAdmin_LSADUMP_ModifyPrivilege_Implant
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "\\system32\\win32k.sys" wide
      $s2 = "hKeAddSystemServiceTable" fullword ascii
      $s3 = "hPsDereferencePrimaryToken" fullword ascii
      $s4 = "CcnFormSyncExFBC" fullword wide
      $s5 = "hPsDereferencePrimaryToken" fullword ascii

      $op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
      $op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
      $op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 80KB and ( 4 of ($s*) or all of ($op*) ) )

Full rule:
rule EquationGroup_Toolset_Apr17_GetAdmin_LSADUMP_ModifyPrivilege_Implant {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "c8b354793ad5a16744cf1d4efdc5fe48d5a0cf0657974eb7145e0088fcf609ff"
      hash2 = "5f06ec411f127f23add9f897dc165eaa68cbe8bb99da8f00a4a360f108bb8741"
      id = "b3fda153-563c-5a5c-9f5c-12d6ef8b3d95"
   strings:
      $s1 = "\\system32\\win32k.sys" wide
      $s2 = "hKeAddSystemServiceTable" fullword ascii
      $s3 = "hPsDereferencePrimaryToken" fullword ascii
      $s4 = "CcnFormSyncExFBC" fullword wide
      $s5 = "hPsDereferencePrimaryToken" fullword ascii

      $op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
      $op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
      $op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 80KB and ( 4 of ($s*) or all of ($op*) ) )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_SendPKTrigger
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "----====**** PORT KNOCK TRIGGER BEGIN ****====----" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_SendPKTrigger {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "2f9c7a[PII_REDACTED]73a61f4d4f08e1bd0a41e3d6ffde212db389365488fa6e26"
      id = "6cbf95eb-323c-53a3-9aca-222626add4dc"
   strings:
      $x1 = "----====**** PORT KNOCK TRIGGER BEGIN ****====----" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_DmGz_Target_2
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "\\\\.\\%ls" fullword ascii

      $op0 = { e8 ce 34 00 00 b8 02 00 00 f0 e9 26 02 00 00 48 }
      $op1 = { 8b 4d 28 e8 02 05 00 00 89 45 34 eb 07 c7 45 34 }
      $op2 = { e8 c2 34 00 00 90 48 8d 8c 24 00 01 00 00 e8 a4 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_DmGz_Target_2 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "55ac29b9a67e0324044dafaba27a7f01ca3d8e4d8e[PII_REDACTED]95abe42aa904"
      id = "426e982c-2380-5801-ba80-ab25ec4c0f74"
   strings:
      $s1 = "\\\\.\\%ls" fullword ascii

      $op0 = { e8 ce 34 00 00 b8 02 00 00 f0 e9 26 02 00 00 48 }
      $op1 = { 8b 4d 28 e8 02 05 00 00 89 45 34 eb 07 c7 45 34 }
      $op2 = { e8 c2 34 00 00 90 48 8d 8c 24 00 01 00 00 e8 a4 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_mstcp32_DXGHLP16_tdip
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "\\Registry\\User\\CurrentUser\\" wide
      $s2 = "\\DosDevices\\%ws" wide
      $s3 = "\\Device\\%ws_%ws" wide
      $s4 = "sys\\mstcp32.dbg" fullword ascii
      $s5 = "%ws%03d%ws%wZ" fullword wide
      $s6 = "TCP/IP driver" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 4 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_mstcp32_DXGHLP16_tdip {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      modified = "2023-01-06"
      hash1 = "26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
      hash2 = "fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
      hash3 = "a5ec4d102d802ada7c5083af53fd9d3c9b5aa83be9de58dbb4fac7876faf6d29"
      id = "5b54e68b-7bf3-59a0-8257-c370a3b9e4db"
   strings:
      $s1 = "\\Registry\\User\\CurrentUser\\" wide
      $s2 = "\\DosDevices\\%ws" wide
      $s3 = "\\Device\\%ws_%ws" wide
      $s4 = "sys\\mstcp32.dbg" fullword ascii
      $s5 = "%ws%03d%ws%wZ" fullword wide
      $s6 = "TCP/IP driver" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 4 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_regprobe
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "Usage: %s targetIP protocolSequence portNo [redirectorIP] [CLSID]" fullword ascii
      $x2 = "key does not exist or pinging w2k system" fullword ascii
      $x3 = "RpcProxy=255.255.255.255:65536" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_regprobe {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "99a42440d4cf1186aad1fd09072bd1265e7c6ebbc8bcafc28340b4fe371767de"
      id = "184618b7-a24c-5a8c-9fb2-a5a07f1a0299"
   strings:
      $x1 = "Usage: %s targetIP protocolSequence portNo [redirectorIP] [CLSID]" fullword ascii
      $x2 = "key does not exist or pinging w2k system" fullword ascii
      $x3 = "RpcProxy=255.255.255.255:65536" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_DoubleFeatureDll_dll_2
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = ".dllfD" fullword ascii
      $s2 = "Khsppxu" fullword ascii
      $s3 = "D$8.exe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_DoubleFeatureDll_dll_2 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "f265defd87094c95c7d3ddf009d115207cd9d4007cf98629e814eda8798906af"
      hash2 = "8d62ca9e6d89f2b835d07deb5e684a576607e4fe3740f77c0570d7b16ebc2985"
      hash3 = "634a80e37e4b32706ad1ea4a2ff414473618a8c42a369880db7cc127c0eb705e"
      id = "f77fd49f-815b-5fb9-a3d7-8721edf79b28"
   strings:
      $s1 = ".dllfD" fullword ascii
      $s2 = "Khsppxu" fullword ascii
      $s3 = "D$8.exe" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_GangsterThief_Implant
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "\\\\.\\%s:" fullword wide
      $s4 = "raw_open CreateFile error" fullword ascii
      $s5 = "-PATHDELETED-" ascii
      $s6 = "(deleted)" fullword wide
      $s8 = "NULLFILENAME" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_GangsterThief_Implant {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "50b269bda5fedcf5a62ee0514c4b14d48d53dd18ac3075dcc80b52d0c2783e06"
      id = "9127f280-135e-5f83-9587-eab3ad84ad69"
   strings:
      $s1 = "\\\\.\\%s:" fullword wide
      $s4 = "raw_open CreateFile error" fullword ascii
      $s5 = "-PATHDELETED-" ascii
      $s6 = "(deleted)" fullword wide
      $s8 = "NULLFILENAME" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_SetCallbackPorts
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "USAGE: %s <input file> <output file> <port1> [port2] [port3] [port4] [port5] [port6]" fullword ascii
      $s2 = "You may enter between 1 and 6 ports to change the defaults." fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_SetCallbackPorts {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "16f66c2593665c2507a78f96c0c2a9583eab0bda13a639e28f550c92f9134ff0"
      id = "3c06fc74-2e75-5348-bb62-30c724de1414"
   strings:
      $s1 = "USAGE: %s <input file> <output file> <port1> [port2] [port3] [port4] [port5] [port6]" fullword ascii
      $s2 = "You may enter between 1 and 6 ports to change the defaults." fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_DiBa_Target_BH_2000
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s2 = "0M1U1Z1p1" fullword ascii /* base64 encoded string '3U5gZu' */
      $s14 = "SPRQWV" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_DiBa_Target_BH_2000 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "0654b4b[PII_REDACTED]390cd091029f08245d690dd90d1120e8feec336d1f9e788"
      id = "b02fa407-e6f1-5c2d-a587-7edb55dbe0a5"
   strings:
      $s2 = "0M1U1Z1p1" fullword ascii /* base64 encoded string '3U5gZu' */
      $s14 = "SPRQWV" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_rc5
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "Usage: %s [d|e] session_key ciphertext" fullword ascii
      $s2 = "where session_key and ciphertext are strings of hex" fullword ascii
      $s3 = "d = decrypt mode, e = encrypt mode" fullword ascii
      $s4 = "Bad mode, should be 'd' or 'e'" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_rc5 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "69e2c68c6ea7be338497863c0c5ab5c77d5f522f0a84ab20fe9c75c7f81318eb"
      id = "854c1726-4ba4-5464-a765-4dd154a1b166"
   strings:
      $s1 = "Usage: %s [d|e] session_key ciphertext" fullword ascii
      $s2 = "where session_key and ciphertext are strings of hex" fullword ascii
      $s3 = "d = decrypt mode, e = encrypt mode" fullword ascii
      $s4 = "Bad mode, should be 'd' or 'e'" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_PC_Level_Generic
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "wshtcpip.WSHGetSocketInformation" fullword ascii
      $s2 = "\\\\.\\%hs" fullword ascii
      $s3 = ".?AVResultIp@Mini_Mcl_Cmd_NetConnections@@" fullword ascii
      $s4 = "Corporation. All rights reserved." fullword wide
      $s5 = { 49 83 3c 24 00 75 02 eb 5d 49 8b 34 24 0f b7 46 }

      $op1 = { 44 24 57 6f c6 44 24 58 6e c6 44 24 59 }
      $op2 = { c6 44 24 56 64 88 5c 24 57 }
      $op3 = { 44 24 6d 4c c6 44 24 6e 6f c6 44 24 6f }

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and ( 2 of ($s*) or all of ($op*) )

Full rule:
rule EquationGroup_Toolset_Apr17_PC_Level_Generic {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "7a6488dd13936e505ec738dcc84b9fec57a5e46aab8aff59b8cfad8f599ea86a"
      hash2 = "0e3cfd48732d0b301925ea3ec6186b62724ec755ed40ed79e7cd6d3df511b8a0"
      hash3 = "d1d6e3903b6b92cc52031c963e2031b5956cadc29cc8b3f2c8f38be20f98a4a7"
      hash4 = "25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c"
      hash5 = "591abd3d7ee214df25ac25682b673f02219da108d[PII_REDACTED]b5167a36a7645"
      hash6 = "6b71db2d2721ac210977a4c6c8cf7f75a8f5b80b9dbcece1bede1aec179ed213"
      hash7 = "7be4c05cecb920f1010fc[PII_REDACTED]ad0d5b3a3a1f2f4b4a9be466a1bd2b76"
      hash8 = "f9cbccdbdf9ffd2ebf1ee84d0ddddd24a61dbe0858ab7f0131bef6c7b9a19131"
      hash9 = "3cf7a01bdf8e73769c80b75ca269b506c33464d81f574ded8bb20caec2d4cd13"
      hash10 = "a87a871fe32c49862ed68fda99d92efd762a33ababcd9b6b2b909f2e01f59c16"
      id = "7ff3d0b0-7a70-561e-9c45-d1f9dbccefe9"
   strings:
      $s1 = "wshtcpip.WSHGetSocketInformation" fullword ascii
      $s2 = "\\\\.\\%hs" fullword ascii
      $s3 = ".?AVResultIp@Mini_Mcl_Cmd_NetConnections@@" fullword ascii
      $s4 = "Corporation. All rights reserved." fullword wide
      $s5 = { 49 83 3c 24 00 75 02 eb 5d 49 8b 34 24 0f b7 46 }

      $op1 = { 44 24 57 6f c6 44 24 58 6e c6 44 24 59 }
      $op2 = { c6 44 24 56 64 88 5c 24 57 }
      $op3 = { 44 24 6d 4c c6 44 24 6e 6f c6 44 24 6f }
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and ( 2 of ($s*) or all of ($op*) )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_PC_Level3_http_exe
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "Copyright (C) Microsoft" fullword wide

      $op1 = { 24 39 65 c6 44 24 3a 6c c6 44 24 3b 65 c6 44 24 }
      $op2 = { 44 24 4e 41 88 5c 24 4f ff }
      $op3 = { 44 24 3f 6e c6 44 24 40 45 c6 44 24 41 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_PC_Level3_http_exe {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "3e855fbea28e012cd19b31f9d76a73a2df0eb03ba1cb5d22aafe9865150b020c"
      id = "9bb4224e-f900-5f5c-8091-088a4b791ada"
   strings:
      $s1 = "Copyright (C) Microsoft" fullword wide

      $op1 = { 24 39 65 c6 44 24 3a 6c c6 44 24 3b 65 c6 44 24 }
      $op2 = { 44 24 4e 41 88 5c 24 4f ff }
      $op3 = { 44 24 3f 6e c6 44 24 40 45 c6 44 24 41 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 400KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_ParseCapture
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "* Encrypted log found.  An encryption key must be provided" fullword ascii
      $x2 = "encryptionkey = e.g., \"00 11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff\"" fullword ascii
      $x3 = "Decrypting with key '%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x'" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 50KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_ParseCapture {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "c732d790088a4db148d3291a92de5a449e409704b12e00c7508d75ccd90a03f2"
      id = "11743260-c5ce-59de-9fcf-0c050eee98ff"
   strings:
      $x1 = "* Encrypted log found.  An encryption key must be provided" fullword ascii
      $x2 = "encryptionkey = e.g., \"00 11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff\"" fullword ascii
      $x3 = "Decrypting with key '%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x'" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 50KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_ActiveDirectory_Target
Repository: Neo23x0/signature-base
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth (Nextron Systems)
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "(&(objectCategory=person)(objectClass=user)(cn=" fullword wide
      $s2 = "(&(objectClass=user)(objectCategory=person)" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_ActiveDirectory_Target {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "33c1b7fdee7c70604be1e7baa9eea231164e62d5d5090ce7f807f43229fe5c36"
      id = "1069cabe-7c09-522f-ad3f-05651490b921"
   strings:
      $s1 = "(&(objectCategory=person)(objectClass=user)(cn=" fullword wide
      $s2 = "(&(objectClass=user)(objectCategory=person)" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}