deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: r57shell
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file r57shell.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s11 = " $_POST['cmd']=\"echo \\\"Now script try connect to"

Detection condition:
all of them

Full rule:
rule r57shell {
	meta:
		description = "Webshells Auto-generated - file r57shell.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "[PII_REDACTED]cddf8aee5dec6072ed02b5"
		id = "1f1070e8-e82c-5cae-a64a-cd5028adae97"
	strings:
		$s11 = " $_POST['cmd']=\"echo \\\"Now script try connect to"
	condition:
		all of them
}
YARA Detection Rule: bdcli100
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file bdcli100.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s5 = "unable to connect to "
		$s8 = "backdoor is corrupted on "

Detection condition:
all of them

Full rule:
rule bdcli100 {
	meta:
		description = "Webshells Auto-generated - file bdcli100.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b12163ac53789fb4f62e4f17a8c2e028"
		id = "c74e8822-9556-5596-a130-c6e0120d7103"
	strings:
		$s5 = "unable to connect to "
		$s8 = "backdoor is corrupted on "
	condition:
		all of them
}
YARA Detection Rule: HYTop_DevPack_2005Red
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file 2005Red.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "scrollbar-darkshadow-color:#FF9DBB;"
		$s3 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
		$s9 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"

Detection condition:
all of them

Full rule:
rule HYTop_DevPack_2005Red {
	meta:
		description = "Webshells Auto-generated - file 2005Red.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "d8ccda2214b3f6eabd4502a050eb8fe8"
		id = "963effd9-f31d-5238-9419-b5dd11822e56"
	strings:
		$s0 = "scrollbar-darkshadow-color:#FF9DBB;"
		$s3 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
		$s9 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
	condition:
		all of them
}
YARA Detection Rule: HYTop2006_rar_Folder_2006X2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file 2006X2.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "Powered By "
		$s3 = " \" onClick=\"this.form.sharp.name=this.form.password.value;this.form.action=this."

Detection condition:
all of them

Full rule:
rule HYTop2006_rar_Folder_2006X2 {
	meta:
		description = "Webshells Auto-generated - file 2006X2.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cc5bf9fc56d404ebbc492855393d7620"
		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
	strings:
		$s2 = "Powered By "
		$s3 = " \" onClick=\"this.form.sharp.name=this.form.password.value;this.form.action=this."
	condition:
		all of them
}
YARA Detection Rule: rdrbs084
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file rdrbs084.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Create mapped port. You have to specify domain when using HTTP type."
		$s8 = "<LOCAL PORT> <MAPPING SERVER> <MAPPING SERVER PORT> <TARGET SERVER> <TARGET"

Detection condition:
all of them

Full rule:
rule rdrbs084 {
	meta:
		description = "Webshells Auto-generated - file rdrbs084.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "ed30327b255816bdd7590bf891aa0020"
		id = "97[PII_REDACTED]-5c9f-8cca-d966ce770ada"
	strings:
		$s0 = "Create mapped port. You have to specify domain when using HTTP type."
		$s8 = "<LOCAL PORT> <MAPPING SERVER> <MAPPING SERVER PORT> <TARGET SERVER> <TARGET"
	condition:
		all of them
}
YARA Detection Rule: HYTop_CaseSwitch_2005
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file 2005.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "MSComDlg.CommonDialog"
		$s2 = "CommonDialog1"
		$s3 = "__vbaExceptHandler"
		$s4 = "EVENT_SINK_Release"
		$s5 = "EVENT_SINK_AddRef"
		$s6 = "By Marcos"
		$s7 = "EVENT_SINK_QueryInterface"
		$s8 = "MethCallEngine"

Detection condition:
all of them

Full rule:
rule HYTop_CaseSwitch_2005 {
	meta:
		description = "Webshells Auto-generated - file 2005.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8bf667ee9e21366bc0bd3491cb614f41"
		id = "0f2b8e71-1c11-5efe-bee7-146168aec369"
	strings:
		$s1 = "MSComDlg.CommonDialog"
		$s2 = "CommonDialog1"
		$s3 = "__vbaExceptHandler"
		$s4 = "EVENT_SINK_Release"
		$s5 = "EVENT_SINK_AddRef"
		$s6 = "By Marcos"
		$s7 = "EVENT_SINK_QueryInterface"
		$s8 = "MethCallEngine"
	condition:
		all of them
}
YARA Detection Rule: eBayId_index3
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file index3.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s8 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"You"

Detection condition:
all of them

Full rule:
rule eBayId_index3 {
	meta:
		description = "Webshells Auto-generated - file index3.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "0412b1e37f41ea0d002e4ed11608905f"
		id = "4fc30150-7b44-53c4-888c-faf651495407"
	strings:
		$s8 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"You"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_phvayv
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file phvayv.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "wrap=\"OFF\">XXXX</textarea></font><font face"

Detection condition:
all of them

Full rule:
rule FSO_s_phvayv {
	meta:
		description = "Webshells Auto-generated - file phvayv.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "205ecda66c443083403efb1e5c7f7878"
		id = "07e027a6-01a5-5250-a35e-fbfef1449cfe"
	strings:
		$s2 = "wrap=\"OFF\">XXXX</textarea></font><font face"
	condition:
		all of them
}
YARA Detection Rule: byshell063_ntboot
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file ntboot.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtBoot"
		$s1 = "Failure ... Access is Denied !"
		$s2 = "Dumping Description to Registry..."
		$s3 = "Opening Service .... Failure !"

Detection condition:
all of them

Full rule:
rule byshell063_ntboot {
	meta:
		description = "Webshells Auto-generated - file ntboot.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "99b5f49db6d6d9a9faeffb29fd8e6d8c"
		id = "7d1f39f6-04f1-51ee-b125-c35af8ae4c0c"
	strings:
		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtBoot"
		$s1 = "Failure ... Access is Denied !"
		$s2 = "Dumping Description to Registry..."
		$s3 = "Opening Service .... Failure !"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_casus15_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file casus15.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "copy ( $dosya_gonder"

Detection condition:
all of them

Full rule:
rule FSO_s_casus15_2 {
	meta:
		description = "Webshells Auto-generated - file casus15.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "8d155b4239d922367af5d0a1b89533a3"
		id = "d3f67fe9-a93f-504a-8b14-a815135d562f"
	strings:
		$s0 = "copy ( $dosya_gonder"
	condition:
		all of them
}
YARA Detection Rule: installer
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file installer.cmd
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Restore Old Vanquish"
		$s4 = "ReInstall Vanquish"

Detection condition:
all of them

Full rule:
rule installer {
	meta:
		description = "Webshells Auto-generated - file installer.cmd"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a507919ae701cf7e42fa441d3ad95f8f"
		id = "681d8284-55e5-5316-a0d2-f4f13218df76"
	strings:
		$s0 = "Restore Old Vanquish"
		$s4 = "ReInstall Vanquish"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_remview_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file remview.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "<xmp>$out</"
		$s1 = ".mm(\"Eval PHP code\")."

Detection condition:
all of them

Full rule:
rule FSO_s_remview_2 {
	meta:
		description = "Webshells Auto-generated - file remview.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b4a09911a5b23e00b55abe546ded691c"
		id = "8e0492e8-d683-5c2d-b1ce-6c8344b874af"
	strings:
		$s0 = "<xmp>$out</"
		$s1 = ".mm(\"Eval PHP code\")."
	condition:
		all of them
}
YARA Detection Rule: FeliksPack3___PHP_Shells_r57
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file r57.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']."

Detection condition:
all of them

Full rule:
rule FeliksPack3___PHP_Shells_r57 {
	meta:
		description = "Webshells Auto-generated - file r57.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "903908b77a266b855262cdbce81c3f72"
		id = "14092413-27a4-5b7d-9023-0b53b3d45a12"
	strings:
		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']."
	condition:
		all of them
}
YARA Detection Rule: HYTop2006_rar_Folder_2006X
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file 2006X.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "<input name=\"password\" type=\"password\" id=\"password\""
		$s6 = "name=\"theAction\" type=\"text\" id=\"theAction\""

Detection condition:
all of them

Full rule:
rule HYTop2006_rar_Folder_2006X {
	meta:
		description = "Webshells Auto-generated - file 2006X.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "cf3ee0d869dd36e775dfcaa788db8e4b"
		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
	strings:
		$s1 = "<input name=\"password\" type=\"password\" id=\"password\""
		$s6 = "name=\"theAction\" type=\"text\" id=\"theAction\""
	condition:
		all of them
}
YARA Detection Rule: FSO_s_phvayv_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file phvayv.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "rows=\"24\" cols=\"122\" wrap=\"OFF\">XXXX</textarea></font><font"

Detection condition:
all of them

Full rule:
rule FSO_s_phvayv_2 {
	meta:
		description = "Webshells Auto-generated - file phvayv.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "205ecda66c443083403efb1e5c7f7878"
		id = "8bd52f9b-a232-566d-90ab-4085933cdc65"
	strings:
		$s2 = "rows=\"24\" cols=\"122\" wrap=\"OFF\">XXXX</textarea></font><font"
	condition:
		all of them
}
YARA Detection Rule: elmaliseker
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file elmaliseker.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "javascript:Command('Download'"
		$s5 = "zombie_array=array("

Detection condition:
all of them

Full rule:
rule elmaliseker {
	meta:
		description = "Webshells Auto-generated - file elmaliseker.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "ccf48af0c8c09bbd038e610a49c9862e"
		id = "7ecf3d5c-be91-579e-905b-5f2ad03a0e42"
	strings:
		$s0 = "javascript:Command('Download'"
		$s5 = "zombie_array=array("
	condition:
		all of them
}
YARA Detection Rule: shelltools_g0t_root_resolve
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file resolve.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "3^n6B(Ed3"
		$s1 = "^uldn'Vt(x"
		$s2 = "\\= uPKfp"
		$s3 = "'r.axV<ad"
		$s4 = "p,modoi$=sr("
		$s5 = "DiamondC8S t"
		$s6 = "`lQ9fX<ZvJW"

Detection condition:
all of them

Full rule:
rule shelltools_g0t_root_resolve {
	meta:
		description = "Webshells Auto-generated - file resolve.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "69bf9aa296238610a0e05f99b5540297"
		id = "dcdb9952-63fc-57a7-ae17-ffe8ac4271f1"
	strings:
		$s0 = "3^n6B(Ed3"
		$s1 = "^uldn'Vt(x"
		$s2 = "\\= uPKfp"
		$s3 = "'r.axV<ad"
		$s4 = "p,modoi$=sr("
		$s5 = "DiamondC8S t"
		$s6 = "`lQ9fX<ZvJW"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_RemExp
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file RemExp.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Request.Ser"
		$s5 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f=<%=F"
		$s6 = "<td bgcolor=\"<%=BgColor%>\" align=\"right\"><%=Attributes(SubFolder.Attributes)%></"

Detection condition:
all of them

Full rule:
rule FSO_s_RemExp {
	meta:
		description = "Webshells Auto-generated - file RemExp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b69670ecdbb40012c73686cd22696eeb"
		id = "48a262bf-7f48-5ed9-b043-80e9d563bf21"
	strings:
		$s1 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Request.Ser"
		$s5 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f=<%=F"
		$s6 = "<td bgcolor=\"<%=BgColor%>\" align=\"right\"><%=Attributes(SubFolder.Attributes)%></"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_tool
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file tool.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s7 = "\"\"%windir%\\\\calc.exe\"\")"

Detection condition:
all of them

Full rule:
rule FSO_s_tool {
	meta:
		description = "Webshells Auto-generated - file tool.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3a1e1e889fdd974a130a6a767b42655b"
		id = "ed744aa4-7a35-57d6-89bd-3286a21b50a0"
	strings:
		$s7 = "\"\"%windir%\\\\calc.exe\"\")"
	condition:
		all of them
}
YARA Detection Rule: FeliksPack3___PHP_Shells_2005
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file 2005.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "window.open(\"\"&url&\"?id=edit&path=\"+sfile+\"&op=copy&attrib=\"+attrib+\"&dpath=\"+lp"
		$s3 = "<input name=\"dbname\" type=\"hidden\" id=\"dbname\" value=\"<%=request(\"dbname\")%>\">"

Detection condition:
all of them

Full rule:
rule FeliksPack3___PHP_Shells_2005 {
	meta:
		description = "Webshells Auto-generated - file 2005.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "97f2552c2fafc0b2eb467ee29cc803c8"
		id = "91d278d5-e9ec-5a28-9a54-4549b4f0cd07"
	strings:
		$s0 = "window.open(\"\"&url&\"?id=edit&path=\"+sfile+\"&op=copy&attrib=\"+attrib+\"&dpath=\"+lp"
		$s3 = "<input name=\"dbname\" type=\"hidden\" id=\"dbname\" value=\"<%=request(\"dbname\")%>\">"
	condition:
		all of them
}
YARA Detection Rule: byloader
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file byloader.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtfsChk"
		$s1 = "Failure ... Access is Denied !"
		$s2 = "NTFS Disk Driver Checking Service"
		$s3 = "Dumping Description to Registry..."
		$s4 = "Opening Service .... Failure !"

Detection condition:
all of them

Full rule:
rule byloader {
	meta:
		description = "Webshells Auto-generated - file byloader.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "0f0d6dc26055653f5844ded906ce52df"
		id = "24940e4b-06eb-548d-9e14-1a8f9c864bd3"
	strings:
		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtfsChk"
		$s1 = "Failure ... Access is Denied !"
		$s2 = "NTFS Disk Driver Checking Service"
		$s3 = "Dumping Description to Registry..."
		$s4 = "Opening Service .... Failure !"
	condition:
		all of them
}
YARA Detection Rule: shelltools_g0t_root_Fport
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file Fport.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s4 = "Copyright 2000 by Foundstone, Inc."
		$s5 = "You must have administrator privileges to run fport - exiting..."

Detection condition:
all of them

Full rule:
rule shelltools_g0t_root_Fport {
	meta:
		description = "Webshells Auto-generated - file Fport.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "dbb75488aa2fa22ba6950aead1ef30d5"
		id = "664e7b19-4d0b-5062-97d2-0eb34869024d"
	strings:
		$s4 = "Copyright 2000 by Foundstone, Inc."
		$s5 = "You must have administrator privileges to run fport - exiting..."
	condition:
		all of them
}
YARA Detection Rule: BackDooR__fr_
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file BackDooR (fr).php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s3 = "print(\"<p align=\\\"center\\\"><font size=\\\"5\\\">Exploit include "

Detection condition:
all of them

Full rule:
rule BackDooR__fr_ {
	meta:
		description = "Webshells Auto-generated - file BackDooR (fr).php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "a79cac2cf86e073a832aaf29a664f4be"
		id = "fd0c77e8-18b7-5eb4-8ed4-87ee4c864683"
	strings:
		$s3 = "print(\"<p align=\\\"center\\\"><font size=\\\"5\\\">Exploit include "
	condition:
		all of them
}
YARA Detection Rule: FSO_s_ntdaddy
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file ntdaddy.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "<input type=\"text\" name=\".CMD\" size=\"45\" value=\"<%= szCMD %>\"> <input type=\"s"

Detection condition:
all of them

Full rule:
rule FSO_s_ntdaddy {
	meta:
		description = "Webshells Auto-generated - file ntdaddy.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "f6262f3ad9f73b8d3e7d9ea5ec07a357"
		id = "b6b655b8-7bce-5fa5-97b7-a020a7e53f4f"
	strings:
		$s1 = "<input type=\"text\" name=\".CMD\" size=\"45\" value=\"<%= szCMD %>\"> <input type=\"s"
	condition:
		all of them
}
YARA Detection Rule: nstview_nstview
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file nstview.php
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s4 = "open STDIN,\\\"<&X\\\";open STDOUT,\\\">&X\\\";open STDERR,\\\">&X\\\";exec(\\\"/bin/sh -i\\\");"

Detection condition:
all of them

Full rule:
rule nstview_nstview {
	meta:
		description = "Webshells Auto-generated - file nstview.php"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "3871888a0c1ac[PII_REDACTED]231029a56"
		id = "00df601c-bddb-5da8-bef4-d2122419b5d0"
	strings:
		$s4 = "open STDIN,\\\"<&X\\\";open STDOUT,\\\">&X\\\";open STDERR,\\\">&X\\\";exec(\\\"/bin/sh -i\\\");"
	condition:
		all of them
}
YARA Detection Rule: HYTop_DevPack_upload
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file upload.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "<!-- PageUpload Below -->"

Detection condition:
all of them

Full rule:
rule HYTop_DevPack_upload {
	meta:
		description = "Webshells Auto-generated - file upload.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b09852bda534627949f0259828c967de"
		id = "43054993-b0dd-5d2e-9890-db1f47759be5"
	strings:
		$s0 = "<!-- PageUpload Below -->"
	condition:
		all of them
}
YARA Detection Rule: PasswordReminder
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file PasswordReminder.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s3 = "The encoded password is found at 0x%8.8lx and has a length of %d."

Detection condition:
all of them

Full rule:
rule PasswordReminder {
	meta:
		description = "Webshells Auto-generated - file PasswordReminder.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "ea49d754dc609e8bfa4c0f95d14ef9bf"
		id = "642033ee-4454-5913-8348-4d1579fc0bd8"
	strings:
		$s3 = "The encoded password is found at 0x%8.8lx and has a length of %d."
	condition:
		all of them
}
YARA Detection Rule: Pack_InjectT
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file InjectT.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s3 = "ail To Open Registry"
		$s4 = "32fDssignim"
		$s5 = "vide Internet S"
		$s6 = "d]Software\\M"
		$s7 = "TInject.Dll"

Detection condition:
all of them

Full rule:
rule Pack_InjectT {
	meta:
		description = "Webshells Auto-generated - file InjectT.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "983b74ccd57f6195a0584cdfb27d55e8"
		id = "3a640c22-0cd4-5ab1-9216-c68625d7d505"
	strings:
		$s3 = "ail To Open Registry"
		$s4 = "32fDssignim"
		$s5 = "vide Internet S"
		$s6 = "d]Software\\M"
		$s7 = "TInject.Dll"
	condition:
		all of them
}
YARA Detection Rule: FSO_s_RemExp_2
Repository: Neo23x0/signature-base
Detects: Webshells Auto-generated - file RemExp.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = " Then Response.Write \""
		$s3 = "<a href= \"<%=Request.ServerVariables(\"script_name\")%>"

Detection condition:
all of them

Full rule:
rule FSO_s_RemExp_2 {
	meta:
		description = "Webshells Auto-generated - file RemExp.asp"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		hash = "b69670ecdbb40012c73686cd22696eeb"
		id = "501544d5-fe52-5933-8782-516ffe18f3ff"
	strings:
		$s2 = " Then Response.Write \""
		$s3 = "<a href= \"<%=Request.ServerVariables(\"script_name\")%>"
	condition:
		all of them
}