deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: gen_macro_ShellExecute_action
Repository: Neo23x0/signature-base
Detects: VBA macro technique to call ShellExecute to launch payload
Author: John Lambert @JohnLaTwC
Reference: https://twitter.com/StanHacked/status/[PII_REDACTED]68693762

Pattern signatures:
$com1a = "00A0C91F3880"
        $com1b = "C08AFD90"
        $com2a = "00A0C90A8F39"
        $com2b = "9BA05972"
        $s3 = "ShellExecute" fullword
        $s4 = "GetObject" fullword

Detection condition:
filesize < 1MB
        and (uint32be(0) == 0x41747472 or uint32be(0) == 0x61747472 or uint32be(0) == 0x41545452)  //File start with Attribute
        and all of ($s*)
        and (all of ($com1*) or all of ($com2*))

Full rule:
rule gen_macro_ShellExecute_action
{
	meta:
		description = "VBA macro technique to call ShellExecute to launch payload"
        	note = "This rule only works on VT or systems that perform macro subfile extraction"
        	author = "John Lambert @JohnLaTwC"
        	date = "2019-01-08"
    		reference = "https://twitter.com/StanHacked/status/[PII_REDACTED]68693762"
		hash1 = "0878eec9ecae493659e42c1d87588573c1e6fc30acf7a59e6fdb5296b1c198ef"
		hash2 = "a0963ac15339c9803b4355fd71b68bf6ddedad960d5b3ad40bae[PII_REDACTED]91"
		hash3 = "dd094e44a817604596d1ab06ca6e9597d49ca0a2cbe9239c73ceaad70265ec2a"
		hash4 = "7b9094ea41e89379c7048ef784ef494c4597ea0d31b707dcb9c8495f241f5fb0"
		hash5 = "35d8242726b905882bbfcf2770f84cb6f40552e76bff8fb0082ca10de3d61e54"
		hash6 = "bf9ff20d814bf21d46a22abbd7a8ad[PII_REDACTED]f9adf8d2787df9e3fce3f35d"
		hash7 = "77966004fcbff147f6923b3405ad9ad4e1dda42d0931564d0cdc4c7e1c91106a"
		
		reference_hash8 = "https://twitter.com/ItsReallyNick/status/[PII_REDACTED]98316288"
		hash8 = "c77c8033a1e5f694fa119dd7f78811f[PII_REDACTED]121b9414fc01e7de8770447"

		id = "4ae3d3d9-de4a-5c5c-9a4a-bedc80b576be"
    strings:
        $com1a = "00A0C91F3880"
        $com1b = "C08AFD90"
        $com2a = "00A0C90A8F39"
        $com2b = "9BA05972"
        $s3 = "ShellExecute" fullword
        $s4 = "GetObject" fullword
    condition:
    	filesize < 1MB
        and (uint32be(0) == 0x41747472 or uint32be(0) == 0x61747472 or uint32be(0) == 0x41545452)  //File start with Attribute
        and all of ($s*)
        and (all of ($com1*) or all of ($com2*))
}
YARA Detection Rule: APT_UNC5221_Ivanti_ForensicArtifacts_Jan24_1
Repository: Neo23x0/signature-base
Detects: Detects forensic artifacts found in the Ivanti VPN exploitation campaign by APT UNC5221
Author: Florian Roth
Reference: https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day

Pattern signatures:
$x1 = "system(\"chmod a+x /home/etc/sql/dsserver/sessionserver.sh\");"
      $x2 = "SSH-2.0-OpenSSH_0.3xx."
      $x3 = "sed -i '/retval=$(exec $installer $@)/d' /pkg/do-install"

Detection condition:
filesize < 5MB and 1 of them

Full rule:
rule APT_UNC5221_Ivanti_ForensicArtifacts_Jan24_1 {
   meta:
      description = "Detects forensic artifacts found in the Ivanti VPN exploitation campaign by APT UNC5221"
      author = "Florian Roth"
      reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
      date = "2024-01-11"
      score = 75
      id = "49ba2a96-379d-5a58-979d-45e83fa546e7"
   strings:
      $x1 = "system(\"chmod a+x /home/etc/sql/dsserver/sessionserver.sh\");"
      $x2 = "SSH-2.0-OpenSSH_0.3xx."
      $x3 = "sed -i '/retval=$(exec $installer $@)/d' /pkg/do-install"
   condition:
      filesize < 5MB and 1 of them
}
YARA Detection Rule: M_Hunting_Backdoor_ZIPLINE_1
Repository: Neo23x0/signature-base
Detects: This rule detects unique strings in ZIPLINE, a passive ELF backdoor that waits for incoming TCP connections to receive commands from the threat actor.
Author: Mandiant
Reference: https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day

Pattern signatures:
$s1 = "SSH-2.0-OpenSSH_0.3xx" ascii
    $s2 = "$(exec $installer $@)" ascii
    $t1 = "./installer/do-install" ascii
    $t2 = "./installer/bom_files/" ascii
    $t3 = "/tmp/data/root/etc/ld.so.preload" ascii
    $t4 = "/tmp/data/root/home/etc/manifest/exclusion_list" ascii

Detection condition:
uint32(0) == 0x464c457f and
    filesize < 5MB and
    ((1 of ($s*)) or
    (3 of ($t*)))

Full rule:
rule M_Hunting_Backdoor_ZIPLINE_1 {
  meta:
    author = "Mandiant"
    description = "This rule detects unique strings in ZIPLINE, a passive ELF backdoor that waits for incoming TCP connections to receive commands from the threat actor."
    reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
    date = "2024-01-11"
    score = 75
    id = "753884d6-d4c1-5e94-9d2c-f6ebb7bfaf85"
  strings:
    $s1 = "SSH-2.0-OpenSSH_0.3xx" ascii
    $s2 = "$(exec $installer $@)" ascii
    $t1 = "./installer/do-install" ascii
    $t2 = "./installer/bom_files/" ascii
    $t3 = "/tmp/data/root/etc/ld.so.preload" ascii
    $t4 = "/tmp/data/root/home/etc/manifest/exclusion_list" ascii
  condition:
    uint32(0) == 0x464c457f and
    filesize < 5MB and
    ((1 of ($s*)) or
    (3 of ($t*)))
}
YARA Detection Rule: M_Hunting_Dropper_WIREFIRE_1
Repository: Neo23x0/signature-base
Detects: This rule detects WIREFIRE, a web shell written in Python that exists as trojanized logic to a component of the pulse secure appliance.
Author: Mandiant
Reference: https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day

Pattern signatures:
$s1 = "zlib.decompress(aes.decrypt(base64.b64decode(" ascii
    $s2 = "aes.encrypt(t+('\\x00'*(16-len(t)%16))" ascii
    $s3 = "Handles DELETE request to delete an existing visits data." ascii
    $s4 = "request.data.decode().startswith('GIF'):" ascii
    $s5 = "Utils.api_log_admin" ascii

Detection condition:
filesize < 10KB
    and all of them

Full rule:
rule M_Hunting_Dropper_WIREFIRE_1 {
  meta:
    author = "Mandiant"
    description = "This rule detects WIREFIRE, a web shell written in Python that exists as trojanized logic to a component of the pulse secure appliance."
    md5 = "6de651357a15efd01db4e658249d4981"
    reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
    date = "2024-01-11"
    score = 75
    id = "051244f0-00b1-5a4b-8c81-f4ce6f1aa22a"
  strings:
    $s1 = "zlib.decompress(aes.decrypt(base64.b64decode(" ascii
    $s2 = "aes.encrypt(t+('\\x00'*(16-len(t)%16))" ascii
    $s3 = "Handles DELETE request to delete an existing visits data." ascii
    $s4 = "request.data.decode().startswith('GIF'):" ascii
    $s5 = "Utils.api_log_admin" ascii
  condition:
    filesize < 10KB
    and all of them
}
YARA Detection Rule: M_Hunting_Webshell_LIGHTWIRE_2
Repository: Neo23x0/signature-base
Detects: Detects LIGHTWIRE based on the RC4 decoding and execution 1-liner.
Author: Mandiant (modified by Florian Roth)
Reference: https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day

Pattern signatures:
// rewritten as strings - because a regex is unnecessary
    // $re1 = /eval\{my.{1,20}Crypt::RC4->new\(\".{1,50}->RC4\(decode_base64\(CGI::param\(\'.{1,30};eval\s\$.{1,30}\"Compatibility\scheck:\s\$@\";\}/
    $s1 = "eval{my"
    $s2 = "Crypt::RC4->new(\""
    $s3 = "->RC4(decode_base64(CGI::param('"
    $s4 = ";eval $"
    $s5 = "\"Compatibility check: $@\";}"

Detection condition:
filesize < 10KB
    and all of them

Full rule:
rule M_Hunting_Webshell_LIGHTWIRE_2 {
  meta:
    author = "Mandiant (modified by Florian Roth)"
    description = "Detects LIGHTWIRE based on the RC4 decoding and execution 1-liner."
    md5 = "3d97f55a03ceb4f71671aa2ecf5b24e9"
    reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
    date = "2024-01-11"
    modified = "2024-01-12"
    score = 75
    id = "9451da63-c68e-51e8-b4b1-c3082d46fbf6"
  strings:
    // rewritten as strings - because a regex is unnecessary
    // $re1 = /eval\{my.{1,20}Crypt::RC4->new\(\".{1,50}->RC4\(decode_base64\(CGI::param\(\'.{1,30};eval\s\$.{1,30}\"Compatibility\scheck:\s\$@\";\}/
    $s1 = "eval{my"
    $s2 = "Crypt::RC4->new(\""
    $s3 = "->RC4(decode_base64(CGI::param('"
    $s4 = ";eval $"
    $s5 = "\"Compatibility check: $@\";}"
  condition:
    filesize < 10KB
    and all of them
}
YARA Detection Rule: M_Hunting_Dropper_THINSPOOL_1
Repository: Neo23x0/signature-base
Detects: This rule detects THINSPOOL, a dropper that installs the LIGHTWIRE web shell onto a Pulse Secure system.
Author: Mandiant
Reference: https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day

Pattern signatures:
$s1 = "/tmp/qactg/" ascii
    $s2 = "echo '/home/config/dscommands'" ascii
    $s3 = "echo '/home/perl/DSLogConfig.pm'" ascii
    $s4 = "ADM20447" ascii

Detection condition:
filesize < 10KB
    and all of them

Full rule:
rule M_Hunting_Dropper_THINSPOOL_1 {
  meta:
    author = "Mandiant"
    description = "This rule detects THINSPOOL, a dropper that installs the LIGHTWIRE web shell onto a Pulse Secure system."
    md5 = "677c1aa6e2503b56fe13e1568a814754"
    reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
    date = "2024-01-11"
    score = 75
    id = "dd340f72-0a2c-5b66-9e31-1c0f20cd842f"
  strings:
    $s1 = "/tmp/qactg/" ascii
    $s2 = "echo '/home/config/dscommands'" ascii
    $s3 = "echo '/home/perl/DSLogConfig.pm'" ascii
    $s4 = "ADM20447" ascii
  condition:
    filesize < 10KB
    and all of them
}
YARA Detection Rule: M_Hunting_CredTheft_WARPWIRE_1
Repository: Neo23x0/signature-base
Detects: This rule detects WARPWIRE, a credential stealer written in JavaScript that is embedded into a legitimate Pulse Secure file.
Author: Mandiant
Reference: https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day

Pattern signatures:
$s1 = {76 61 72 20 77 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 75 73 65 72 6e 61 6d 65 2e 76 61 6c 75 65 3b}
    $s2 = {76 61 72 20 73 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 70 61 73 73 77 6f 72 64 2e 76 61 6c 75 65 3b}
    $s3 = {2b 77 64 61 74 61 2b 27 26 27 2b 73 64 61 74 61 3b}
    $s4 = {76 61 72 20 78 68 72 20 3d 20 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74}
    $s5 = "Remember the last selected auth realm for 30 days" ascii

Detection condition:
filesize < 8KB and 
   all of them

Full rule:
rule M_Hunting_CredTheft_WARPWIRE_1 {
  meta:
    author = "Mandiant"
    description = "This rule detects WARPWIRE, a credential stealer written in JavaScript that is embedded into a legitimate Pulse Secure file."
    md5 = "d0c7a334a4d9dcd3c6335ae13bee59ea"
    reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
    date = "2024-01-11"
    score = 75
    id = "9a6a8783-b531-560d-998d-8aa7c90158a8"
  strings:
    $s1 = {76 61 72 20 77 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 75 73 65 72 6e 61 6d 65 2e 76 61 6c 75 65 3b}
    $s2 = {76 61 72 20 73 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 70 61 73 73 77 6f 72 64 2e 76 61 6c 75 65 3b}
    $s3 = {2b 77 64 61 74 61 2b 27 26 27 2b 73 64 61 74 61 3b}
    $s4 = {76 61 72 20 78 68 72 20 3d 20 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74}
    $s5 = "Remember the last selected auth realm for 30 days" ascii
  condition:
   filesize < 8KB and 
   all of them
}
YARA Detection Rule: Duqu1_5_modules
Repository: Neo23x0/signature-base
Detects: Detection for Duqu 1.5 modules
Author: Silas Cutler (havex@chronicle.security)
Reference: https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0

Pattern signatures:
$c1 = "%s(%d)disk(%d)fdisk(%d)"
      $c2 = "\\Device\\Floppy%d" wide
      $c3 = "BrokenAudio" wide
      $m1 = { 81 3F E9 18 4B 7E}
      $m2 = { 81 BC 18 F8 04 00 00 B3 20 EA B4 }

Detection condition:
all of them

Full rule:
rule Duqu1_5_modules {
   meta:
      author = "Silas Cutler (havex@chronicle.security)"
      desc = "Detection for Duqu 1.5 modules"
      hash = "bb3961e2b473c22c3d5939adeb86819eb846ccd07f5736abb5e897918580aace"
      reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
      id = "7239f5e1-c08f-566c-8998-f7dacc2c4a29"
   strings:
      $c1 = "%s(%d)disk(%d)fdisk(%d)"
      $c2 = "\\Device\\Floppy%d" wide
      $c3 = "BrokenAudio" wide
      $m1 = { 81 3F E9 18 4B 7E}
      $m2 = { 81 BC 18 F8 04 00 00 B3 20 EA B4 }
   condition:
      all of them
}
YARA Detection Rule: FourElementSword_Config_File
Repository: Neo23x0/signature-base
Detects: Detects FourElementSword Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/

Pattern signatures:
$s0 = "01,,hccutils.dll,2" fullword ascii
		$s1 = "RegisterDlls=OurDll" fullword ascii
		$s2 = "[OurDll]" fullword ascii
		$s3 = "[DefaultInstall]" fullword ascii /* Goodware String - occured 16 times */
		$s4 = "Signature=\"$Windows NT$\"" fullword ascii /* Goodware String - occured 26 times */

Detection condition:
4 of them

Full rule:
rule FourElementSword_Config_File {
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "f05cd0353817bf6c2cab396181464c31c352d6dea07e2d688def261dd6542b27"
		id = "488a2344-3d8d-5769-aca8-9e14f38f5eb0"
	strings:
		$s0 = "01,,hccutils.dll,2" fullword ascii
		$s1 = "RegisterDlls=OurDll" fullword ascii
		$s2 = "[OurDll]" fullword ascii
		$s3 = "[DefaultInstall]" fullword ascii /* Goodware String - occured 16 times */
		$s4 = "Signature=\"$Windows NT$\"" fullword ascii /* Goodware String - occured 26 times */
	condition:
		4 of them
}
YARA Detection Rule: FourElementSword_T9000
Repository: Neo23x0/signature-base
Detects: Detects FourElementSword Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/

Pattern signatures:
$x1 = "D:\\WORK\\T9000\\" ascii
		$x2 = "%s\\temp\\HHHH.dat" fullword wide

		$s1 = "Elevate.dll" fullword wide
		$s2 = "ResN32.dll" fullword wide
		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword wide
		$s4 = "igfxtray.exe" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and 1 of ($x*) ) or ( all of them )

Full rule:
rule FourElementSword_T9000 {
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
		id = "35ae844e-52e1-5e6f-984d-aa75ebd2f60f"
	strings:
		$x1 = "D:\\WORK\\T9000\\" ascii
		$x2 = "%s\\temp\\HHHH.dat" fullword wide

		$s1 = "Elevate.dll" fullword wide
		$s2 = "ResN32.dll" fullword wide
		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword wide
		$s4 = "igfxtray.exe" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 500KB and 1 of ($x*) ) or ( all of them )
}
YARA Detection Rule: FourElementSword_32DLL
Repository: Neo23x0/signature-base
Detects: Detects FourElementSword Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/

Pattern signatures:
$x1 = "%temp%\\tmp092.tmp" fullword ascii

		$s1 = "\\System32\\ctfmon.exe" ascii
		$s2 = "%SystemRoot%\\System32\\" ascii
		$s3 = "32.dll" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 660KB and $x1 ) or ( all of them )

Full rule:
rule FourElementSword_32DLL {
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "7a200c4df99887991c638fe625d07a4a3fc2bdc[PII_REDACTED]52b3df5c8da79b6"
		id = "fc801364-9f40-50eb-90e1-99f8605014c7"
	strings:
		$x1 = "%temp%\\tmp092.tmp" fullword ascii

		$s1 = "\\System32\\ctfmon.exe" ascii
		$s2 = "%SystemRoot%\\System32\\" ascii
		$s3 = "32.dll" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 660KB and $x1 ) or ( all of them )
}
YARA Detection Rule: FourElementSword_Keyainst_EXE
Repository: Neo23x0/signature-base
Detects: Detects FourElementSword Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/

Pattern signatures:
$x1 = "C:\\ProgramData\\Keyainst.exe" fullword ascii

		$s1 = "ShellExecuteA" fullword ascii /* Goodware String - occured 266 times */
		$s2 = "GetStartupInfoA" fullword ascii /* Goodware String - occured 2573 times */
		$s3 = "SHELL32.dll" fullword ascii /* Goodware String - occured 3233 times */

Detection condition:
( uint16(0) == 0x5a4d and filesize < 48KB and $x1 ) or ( all of them )

Full rule:
rule FourElementSword_Keyainst_EXE {
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "cf717a646a015ee72f965488f8df2dd3c36c4714ccc755c295645fe8d150d082"
		id = "175fe2b0-3c76-5464-9a1a-218a09b25a5a"
	strings:
		$x1 = "C:\\ProgramData\\Keyainst.exe" fullword ascii

		$s1 = "ShellExecuteA" fullword ascii /* Goodware String - occured 266 times */
		$s2 = "GetStartupInfoA" fullword ascii /* Goodware String - occured 2573 times */
		$s3 = "SHELL32.dll" fullword ascii /* Goodware String - occured 3233 times */
	condition:
		( uint16(0) == 0x5a4d and filesize < 48KB and $x1 ) or ( all of them )
}
YARA Detection Rule: FourElementSword_ElevateDLL_2
Repository: Neo23x0/signature-base
Detects: Detects FourElementSword Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/

Pattern signatures:
$s1 = "Elevate.dll" fullword ascii
		$s2 = "GetSomeF" fullword ascii
		$s3 = "GetNativeSystemInfo" fullword ascii /* Goodware String - occured 530 times */

Detection condition:
( uint16(0) == 0x5a4d and filesize < 25KB and $s1 ) or ( all of them )

Full rule:
rule FourElementSword_ElevateDLL_2 {
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "9c23febc49c7b[PII_REDACTED]356d38d5578727ee[PII_REDACTED]83cf555fe7f95"
		id = "06879d75-18a3-5d49-a963-fa4bee379387"
	strings:
		$s1 = "Elevate.dll" fullword ascii
		$s2 = "GetSomeF" fullword ascii
		$s3 = "GetNativeSystemInfo" fullword ascii /* Goodware String - occured 530 times */
	condition:
		( uint16(0) == 0x5a4d and filesize < 25KB and $s1 ) or ( all of them )
}
YARA Detection Rule: FourElementSword_fslapi_dll_gui
Repository: Neo23x0/signature-base
Detects: Detects FourElementSword Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/

Pattern signatures:
$s1 = "fslapi.dll.gui" fullword wide
		$s2 = "ImmGetDefaultIMEWnd" fullword ascii /* Goodware String - occured 64 times */
		$s3 = "RichOX" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 12KB and all of them )

Full rule:
rule FourElementSword_fslapi_dll_gui {
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
		id = "1cc73eaf-7463-5070-97e5-6ea4c7735371"
	strings:
		$s1 = "fslapi.dll.gui" fullword wide
		$s2 = "ImmGetDefaultIMEWnd" fullword ascii /* Goodware String - occured 64 times */
		$s3 = "RichOX" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 12KB and all of them )
}
YARA Detection Rule: FourElementSword_PowerShell_Start
Repository: Neo23x0/signature-base
Detects: Detects FourElementSword Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/

Pattern signatures:
$s0 = "start /min powershell C:\\\\ProgramData\\\\wget.exe" ascii
		$s1 = "start /min powershell C:\\\\ProgramData\\\\iuso.exe" fullword ascii

Detection condition:
1 of them

Full rule:
rule FourElementSword_PowerShell_Start {
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "9b6053e784c5762fdb9931f9064ba6e52c26c2d4b09efd6ff13ca87bbb33c692"
		id = "62affc03-a408-5d8f-99da-58dead8646c5"
	strings:
		$s0 = "start /min powershell C:\\\\ProgramData\\\\wget.exe" ascii
		$s1 = "start /min powershell C:\\\\ProgramData\\\\iuso.exe" fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: FourElementSword_ResN32DLL
Repository: Neo23x0/signature-base
Detects: Detects FourElementSword Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/

Pattern signatures:
$s1 = "\\Release\\BypassUAC.pdb" ascii
		$s2 = "\\ResN32.dll" wide
		$s3 = "Eupdate" fullword wide

Detection condition:
all of them

Full rule:
rule FourElementSword_ResN32DLL {
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		hash = "bf1b00b7430899d33795ef3405142e880ef8dcbda8aab0b19d80875a14ed852f"
		id = "3e1f6d8d-53ea-542f-ba49-39b4c86f3124"
	strings:
		$s1 = "\\Release\\BypassUAC.pdb" ascii
		$s2 = "\\ResN32.dll" wide
		$s3 = "Eupdate" fullword wide
	condition:
		all of them
}
YARA Detection Rule: FourElementSword_ElevateDLL
Repository: Neo23x0/signature-base
Detects: Detects FourElementSword Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/

Pattern signatures:
$x1 = "Elevate.dll" fullword wide
		$x2 = "ResN32.dll" fullword wide

		$s1 = "Kingsoft\\Antivirus" fullword wide
		$s2 = "KasperskyLab\\protected" fullword wide
		$s3 = "Sophos" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and 1 of ($x*) and all of ($s*) )
		or ( all of them )

Full rule:
rule FourElementSword_ElevateDLL {
	meta:
		description = "Detects FourElementSword Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
		date = "2016-04-18"
		super_rule = 1
		hash1 = "3dfc94605daf51ebd7bbccbb3a9049999f8d555db0999a6a7e6265a7e458cab9"
		hash2 = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
		id = "06879d75-18a3-5d49-a963-fa4bee379387"
	strings:
		$x1 = "Elevate.dll" fullword wide
		$x2 = "ResN32.dll" fullword wide

		$s1 = "Kingsoft\\Antivirus" fullword wide
		$s2 = "KasperskyLab\\protected" fullword wide
		$s3 = "Sophos" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 500KB and 1 of ($x*) and all of ($s*) )
		or ( all of them )
}