deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PUA_VULN_Driver_Zemanaltd_Zam_7CB5
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0033002e0030002e0030002e[PII_REDACTED]30 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0033002e0030002e0030002e[PII_REDACTED]30 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them

Full rule:
rule PUA_VULN_Driver_Zemanaltd_Zam_7CB5 {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21"
		date = "2024-08-07"
		score = 40
		id = "4af76d57-3f28-5d80-b72a-796f65942488"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0033002e0030002e0030002e[PII_REDACTED]30 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0033002e0030002e0030002e[PII_REDACTED]30 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_Zemanaltd_Zam_45F4
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]35 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule PUA_VULN_Driver_Zemanaltd_Zam_45F4 {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef"
		date = "2024-08-07"
		score = 40
		id = "56dc2fa5-c19c-5a77-9590-e7a957ccb27f"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]35 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_Zemanaltd_Zam_3C18
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]38 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule PUA_VULN_Driver_Zemanaltd_Zam_3C18 {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b"
		date = "2024-08-07"
		score = 40
		id = "94b7a58c-0092-5d81-985f-330599efe25a"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]38 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_Zemanaltd_Zam_E428
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]34 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule PUA_VULN_Driver_Zemanaltd_Zam_E428 {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f"
		date = "2024-08-07"
		score = 40
		id = "3a87403b-9df1-566b-af2d-e22732584b63"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]34 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_A468
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]50006f[PII_REDACTED]49006f } /* FileDescription HpPortIo */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]200049006e0063002e } /* CompanyName HPInc */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8][PII_REDACTED]50006f[PII_REDACTED]49006f[PII_REDACTED]34002e[PII_REDACTED]73 } /* InternalName HpPortIoxsys */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8][PII_REDACTED]50006f[PII_REDACTED]49006f } /* ProductName HpPortIo */
		$ = { 004f[PII_REDACTED]670069006e0061006c[PII_REDACTED]6c0065006e0061006d0065[1-8][PII_REDACTED]50006f[PII_REDACTED]49006f[PII_REDACTED]34002e[PII_REDACTED]73 } /* OriginalFilename HpPortIoxsys */

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them

Full rule:
rule PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_A468 {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "a4680fabf606d[PII_REDACTED]e81c130ff7ec9467a15e[PII_REDACTED]465f264d3c9"
		date = "2024-08-07"
		score = 40
		id = "ee20509d-fdf5-5c5a-8f49-5392c6f015ad"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8][PII_REDACTED]50006f[PII_REDACTED]49006f } /* FileDescription HpPortIo */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8][PII_REDACTED]200049006e0063002e } /* CompanyName HPInc */
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED]0069006f006e[1-8]0031002e0030002e0030002e0030 } /* FileVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0031002e0030002e0030002e0030 } /* ProductVersion  */
		$ = { 0049006e[PII_REDACTED]72006e0061006c004e0061006d0065[1-8][PII_REDACTED]50006f[PII_REDACTED]49006f[PII_REDACTED]34002e[PII_REDACTED]73 } /* InternalName HpPortIoxsys */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8][PII_REDACTED]50006f[PII_REDACTED]49006f } /* ProductName HpPortIo */
		$ = { 004f[PII_REDACTED]670069006e0061006c[PII_REDACTED]6c0065006e0061006d0065[1-8][PII_REDACTED]50006f[PII_REDACTED]49006f[PII_REDACTED]34002e[PII_REDACTED]73 } /* OriginalFilename HpPortIoxsys */
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_Zemanaltd_Zam_7661
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]39 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule PUA_VULN_Driver_Zemanaltd_Zam_7661 {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a"
		date = "2024-08-07"
		score = 40
		id = "cf60dd6e-f13e-5498-b3e1-b28c4b469f10"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]39 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_Zemanaltd_Zam_9A95
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]37 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule PUA_VULN_Driver_Zemanaltd_Zam_9A95 {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae[PII_REDACTED]e85d0c"
		date = "2024-08-07"
		score = 40
		id = "de7c3f85-1101-58c2-882b-e7e59d95fdd8"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]37 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
YARA Detection Rule: PUA_VULN_Driver_Zemanaltd_Zam_2BBC
Repository: Neo23x0/signature-base
Detects: Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys
Author: Florian Roth
Reference: https://github.com/magicsword-io/LOLDrivers

Pattern signatures:
$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]31 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule PUA_VULN_Driver_Zemanaltd_Zam_2BBC {
	meta:
		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
		author = "Florian Roth"
		reference = "https://github.com/magicsword-io/LOLDrivers"
		hash = "2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1"
		date = "2024-08-07"
		score = 40
		id = "171ebc5a-3e8a-5771-8960-b623f6581759"
	strings:
		$ = {[PII_REDACTED]6c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006e[1-8]005a0041004d } /* FileDescription ZAM */
		$ = { 0043006f006d[PII_REDACTED]6e0079004e0061006d0065[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e } /* CompanyName ZemanaLtd */
		$ = {[PII_REDACTED]6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730069006f006e[1-8]0032002e[PII_REDACTED]2e[PII_REDACTED]31 } /* ProductVersion  */
		$ = {[PII_REDACTED]6f[PII_REDACTED]630074004e0061006d0065[1-8]005a0041004d } /* ProductName ZAM */
		$ = { 004c[PII_REDACTED]61006c0043006f[PII_REDACTED][PII_REDACTED]00680074[1-8]005a0065006d0061006e[PII_REDACTED]4c[PII_REDACTED]2e[PII_REDACTED]6c006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0064002e } /* LegalCopyright ZemanaLtdAllrightsreserved */
	condition:
		uint16(0) == 0x5a4d and filesize < 200KB and all of them
}